*/
function nl2br_escaped($html)
{
- return str_replace('>','>',str_replace('<','<',nl2br($html)));
+ return str_replace('>', '>', str_replace('<', '<', nl2br($html)));
}
/**
return $final_referer;
}
+
+/**
+ * Checks the PHP version to ensure Shaarli can run
+ *
+ * @param string $minVersion minimum PHP required version
+ * @param string $curVersion current PHP version (use PHP_VERSION)
+ *
+ * @throws Exception the PHP version is not supported
+ */
+function checkPHPVersion($minVersion, $curVersion)
+{
+ if (version_compare($curVersion, $minVersion) < 0) {
+ throw new Exception(
+ 'Your PHP version is obsolete!'
+ .' Shaarli requires at least PHP '.$minVersion.', and thus cannot run.'
+ .' Your PHP version has known security vulnerabilities and should be'
+ .' updated as soon as possible.'
+ );
+ }
+}
+
+/**
+ * Validate session ID to prevent Full Path Disclosure.
+ *
+ * See #298.
+ * The session ID's format depends on the hash algorithm set in PHP settings
+ *
+ * @param string $sessionId Session ID
+ *
+ * @return true if valid, false otherwise.
+ *
+ * @see http://php.net/manual/en/function.hash-algos.php
+ * @see http://php.net/manual/en/session.configuration.php
+ */
+function is_session_id_valid($sessionId)
+{
+ if (empty($sessionId)) {
+ return false;
+ }
+
+ if (!$sessionId) {
+ return false;
+ }
+
+ if (!preg_match('/^[a-zA-Z0-9,-]{2,128}$/', $sessionId)) {
+ return false;
+ }
+
+ return true;
+}