<?php
/**
- * Shaarli v0.6.2 - Shaare your links...
+ * Shaarli v0.6.3 - Shaare your links...
*
* The personal, minimalist, super-fast, no-database Delicious clone.
*
/*
* PHP configuration
*/
-define('shaarli_version', '0.6.2');
+define('shaarli_version', '0.6.3');
// http://server.com/x/shaarli --> /shaarli/
define('WEB_PATH', substr($_SERVER["REQUEST_URI"], 0, 1+strrpos($_SERVER["REQUEST_URI"], '/', 0)));
require_once 'application/HttpUtils.php';
require_once 'application/LinkDB.php';
require_once 'application/LinkFilter.php';
+require_once 'application/LinkUtils.php';
require_once 'application/TimeZone.php';
require_once 'application/Url.php';
require_once 'application/Utils.php';
$userIsLoggedIn = setup_login_state();
-// -----------------------------------------------------------------------------------------------
-// Log to text file
-function logm($message)
-{
- $t = strval(date('Y/m/d_H:i:s')).' - '.$_SERVER["REMOTE_ADDR"].' - '.strval($message)."\n";
- file_put_contents($GLOBALS['config']['LOG_FILE'], $t, FILE_APPEND);
-}
-
// ------------------------------------------------------------------------------------------
// Sniff browser language to display dates in the right format automatically.
// (Note that is may not work on your server if the corresponding local is not installed.)
if ($login==$GLOBALS['login'] && $hash==$GLOBALS['hash'])
{ // Login/password is correct.
fillSessionInfo();
- logm('Login successful');
+ logm($GLOBALS['config']['LOG_FILE'], $_SERVER['REMOTE_ADDR'], 'Login successful');
return True;
}
- logm('Login failed for user '.$login);
+ logm($GLOBALS['config']['LOG_FILE'], $_SERVER['REMOTE_ADDR'], 'Login failed for user '.$login);
return False;
}
if ($gb['FAILURES'][$ip]>($GLOBALS['config']['BAN_AFTER']-1))
{
$gb['BANS'][$ip]=time()+$GLOBALS['config']['BAN_DURATION'];
- logm('IP address banned from login');
+ logm($GLOBALS['config']['LOG_FILE'], $_SERVER['REMOTE_ADDR'], 'IP address banned from login');
}
$GLOBALS['IPBANS'] = $gb;
file_put_contents($GLOBALS['config']['IPBANS_FILENAME'], "<?php\n\$GLOBALS['IPBANS']=".var_export($gb,true).";\n?>");
// User is banned. Check if the ban has expired:
if ($gb['BANS'][$ip]<=time())
{ // Ban expired, user can try to login again.
- logm('Ban lifted.');
+ logm($GLOBALS['config']['LOG_FILE'], $_SERVER['REMOTE_ADDR'], 'Ban lifted.');
unset($gb['FAILURES'][$ip]); unset($gb['BANS'][$ip]);
file_put_contents($GLOBALS['config']['IPBANS_FILENAME'], "<?php\n\$GLOBALS['IPBANS']=".var_export($gb,true).";\n?>");
return true; // Ban has expired, user can login.
session_set_cookie_params(0,$cookiedir,$_SERVER['SERVER_NAME']); // 0 means "When browser closes"
session_regenerate_id(true);
}
-
+
// Optional redirect after login:
if (isset($_GET['post'])) {
$uri = '?post='. urlencode($_GET['post']);
return date('c',linkdate2timestamp($linkdate)); // 'c' is for ISO 8601 date format.
}
-// Extract title from an HTML document.
-// (Returns an empty string if not found.)
-function html_extract_title($html)
-{
- return preg_match('!<title>(.*?)</title>!is', $html, $matches) ? trim(str_replace("\n",' ', $matches[1])) : '' ;
-}
-
// ------------------------------------------------------------------------------------------
// Token management for XSRF protection
// Token should be used in any form which acts on data (create,update,delete,import...).
$this->tpl->assign('versionError', '');
} catch (Exception $exc) {
- logm($exc->getMessage());
+ logm($GLOBALS['config']['LOG_FILE'], $_SERVER['REMOTE_ADDR'], $exc->getMessage());
$this->tpl->assign('newVersion', '');
$this->tpl->assign('versionError', escape($exc->getMessage()));
}
if ($this->tpl===false) $this->initialize(); // Lazy initialization
$this->tpl->draw($page);
}
+
+ /**
+ * Render a 404 page (uses the template : tpl/404.tpl)
+ *
+ * usage : $PAGE->render404('The link was deleted')
+ * @param string $message A messate to display what is not found
+ */
+ public function render404($message='The page you are trying to reach does not exist or has been deleted.') {
+ header($_SERVER['SERVER_PROTOCOL'] . ' 404 Not Found');
+ $this->tpl->assign('error_message', $message);
+ $this->renderPage('404');
+ }
}
// ------------------------------------------------------------------------------------------
// -------- User wants to rename a tag or delete it
if ($targetPage == Router::$PAGE_CHANGETAG)
{
- if (empty($_POST['fromtag']))
- {
- $PAGE->assign('linkcount',count($LINKSDB));
- $PAGE->assign('token',getToken());
+ if (empty($_POST['fromtag']) || (empty($_POST['totag']) && isset($_POST['renametag']))) {
+ $PAGE->assign('linkcount', count($LINKSDB));
+ $PAGE->assign('token', getToken());
$PAGE->assign('tags', $LINKSDB->allTags());
$PAGE->renderPage('changetag');
exit;
}
- if (!tokenOk($_POST['token'])) die('Wrong token.');
+
+ if (!tokenOk($_POST['token'])) {
+ die('Wrong token.');
+ }
// Delete a tag:
- if (!empty($_POST['deletetag']) && !empty($_POST['fromtag']))
- {
+ if (isset($_POST['deletetag']) && !empty($_POST['fromtag'])) {
$needle=trim($_POST['fromtag']);
// True for case-sensitive tag search.
$linksToAlter = $LINKSDB->filter(LinkFilter::$FILTER_TAG, $needle, true);
}
// Rename a tag:
- if (!empty($_POST['renametag']) && !empty($_POST['fromtag']) && !empty($_POST['totag']))
- {
+ if (isset($_POST['renametag']) && !empty($_POST['fromtag']) && !empty($_POST['totag'])) {
$needle=trim($_POST['fromtag']);
// True for case-sensitive tag search.
$linksToAlter = $LINKSDB->filter(LinkFilter::$FILTER_TAG, $needle, true);
// -------- User want to post a new link: Display link edit form.
if (isset($_GET['post'])) {
- $url = cleanup_url($_GET['post']);
+ $url = cleanup_url(escape($_GET['post']));
$link_is_new = false;
// Check if URL is not already in database (in this case, we will edit the existing link)
// If this is an HTTP(S) link, we try go get the page to extract the title (otherwise we will to straight to the edit form.)
if (empty($title) && strpos(get_url_scheme($url), 'http') !== false) {
// Short timeout to keep the application responsive
- list($headers, $data) = get_http_url($url, 4);
- // FIXME: Decode charset according to specified in either 1) HTTP response headers or 2) <head> in html
+ list($headers, $content) = get_http_response($url, 4);
if (strpos($headers[0], '200 OK') !== false) {
- // Look for charset in html header.
- preg_match('#<meta .*charset=.*>#Usi', $data, $meta);
-
- // If found, extract encoding.
- if (!empty($meta[0])) {
- // Get encoding specified in header.
- preg_match('#charset="?(.*)"#si', $meta[0], $enc);
- // If charset not found, use utf-8.
- $html_charset = (!empty($enc[1])) ? strtolower($enc[1]) : 'utf-8';
- }
- else {
- $html_charset = 'utf-8';
- }
-
- // Extract title
- $title = html_extract_title($data);
- if (!empty($title)) {
- // Re-encode title in utf-8 if necessary.
- $title = ($html_charset == 'iso-8859-1') ? utf8_encode($title) : $title;
+ // Retrieve charset.
+ $charset = get_charset($headers, $content);
+ // Extract title.
+ $title = html_extract_title($content);
+ // Re-encode title in utf-8 if necessary.
+ if (! empty($title) && $charset != 'utf-8') {
+ $title = mb_convert_encoding($title, $charset, 'utf-8');
}
}
}
+
if ($url == '') {
$url = '?' . smallHash($linkdate);
$title = 'Note: ';
}
+
$link = array(
'linkdate' => $linkdate,
'title' => $title,
exit;
}
+ // Plugin administration page
+ if ($targetPage == Router::$PAGE_PLUGINSADMIN) {
+ $pluginMeta = $pluginManager->getPluginsMeta();
+
+ // Split plugins into 2 arrays: ordered enabled plugins and disabled.
+ $enabledPlugins = array_filter($pluginMeta, function($v) { return $v['order'] !== false; });
+ // Load parameters.
+ $enabledPlugins = load_plugin_parameter_values($enabledPlugins, $GLOBALS['plugins']);
+ uasort(
+ $enabledPlugins,
+ function($a, $b) { return $a['order'] - $b['order']; }
+ );
+ $disabledPlugins = array_filter($pluginMeta, function($v) { return $v['order'] === false; });
+
+ $PAGE->assign('enabledPlugins', $enabledPlugins);
+ $PAGE->assign('disabledPlugins', $disabledPlugins);
+ $PAGE->renderPage('pluginsadmin');
+ exit;
+ }
+
+ // Plugin administration form action
+ if ($targetPage == Router::$PAGE_SAVE_PLUGINSADMIN) {
+ try {
+ if (isset($_POST['parameters_form'])) {
+ unset($_POST['parameters_form']);
+ foreach ($_POST as $param => $value) {
+ $GLOBALS['plugins'][$param] = escape($value);
+ }
+ }
+ else {
+ $GLOBALS['config']['ENABLED_PLUGINS'] = save_plugin_config($_POST);
+ }
+ writeConfig($GLOBALS, isLoggedIn());
+ }
+ catch (Exception $e) {
+ error_log(
+ 'ERROR while saving plugin configuration:.' . PHP_EOL .
+ $e->getMessage()
+ );
+
+ // TODO: do not handle exceptions/errors in JS.
+ echo '<script>alert("'. $e->getMessage() .'");document.location=\'?do=pluginsadmin\';</script>';
+ exit;
+ }
+ header('Location: ?do='. Router::$PAGE_PLUGINSADMIN);
+ exit;
+ }
+
// -------- Otherwise, simply display search form and links:
showLinkList($PAGE, $LINKSDB);
exit;
$linksToDisplay = $LINKSDB->filter($search_type, $search_crits);
if (count($linksToDisplay) == 0) {
- header($_SERVER['SERVER_PROTOCOL'] . ' 404 Not Found');
- echo '<h1>404 Not found.</h1>Oh crap.
- The link you are trying to reach does not exist or has been deleted.';
- echo '<br>Would you mind <a href="?">clicking here</a>?';
+ $PAGE->render404('The link you are trying to reach does not exist or has been deleted.');
exit;
}
}
else // This is a flickr page (html)
{
// Get the flickr html page.
- list($headers, $data) = get_http_url($url, 20);
+ list($headers, $content) = get_http_response($url, 20);
if (strpos($headers[0], '200 OK') !== false)
{
// flickr now nicely provides the URL of the thumbnail in each flickr page.
- preg_match('!<link rel=\"image_src\" href=\"(.+?)\"!',$data,$matches);
+ preg_match('!<link rel=\"image_src\" href=\"(.+?)\"!', $content, $matches);
if (!empty($matches[1])) $imageurl=$matches[1];
// In albums (and some other pages), the link rel="image_src" is not provided,
// <meta property="og:image" content="http://farm4.staticflickr.com/3398/3239339068_25d13535ff_z.jpg" />
if ($imageurl=='')
{
- preg_match('!<meta property=\"og:image\" content=\"(.+?)\"!',$data,$matches);
+ preg_match('!<meta property=\"og:image\" content=\"(.+?)\"!', $content, $matches);
if (!empty($matches[1])) $imageurl=$matches[1];
}
}
if ($imageurl!='')
{ // Let's download the image.
// Image is 240x120, so 10 seconds to download should be enough.
- list($headers, $data) = get_http_url($imageurl, 10);
+ list($headers, $content) = get_http_response($imageurl, 10);
if (strpos($headers[0], '200 OK') !== false) {
- file_put_contents($GLOBALS['config']['CACHEDIR'].'/'.$thumbname,$data); // Save image to cache.
+ // Save image to cache.
+ file_put_contents($GLOBALS['config']['CACHEDIR'].'/' . $thumbname, $content);
header('Content-Type: image/jpeg');
- echo $data;
+ echo $content;
return;
}
}
// This is more complex: we have to perform a HTTP request, then parse the result.
// Maybe we should deport this to JavaScript ? Example: http://stackoverflow.com/questions/1361149/get-img-thumbnails-from-vimeo/4285098#4285098
$vid = substr(parse_url($url,PHP_URL_PATH),1);
- list($headers, $data) = get_http_url('https://vimeo.com/api/v2/video/'.escape($vid).'.php', 5);
+ list($headers, $content) = get_http_response('https://vimeo.com/api/v2/video/'.escape($vid).'.php', 5);
if (strpos($headers[0], '200 OK') !== false) {
- $t = unserialize($data);
+ $t = unserialize($content);
$imageurl = $t[0]['thumbnail_medium'];
// Then we download the image and serve it to our client.
- list($headers, $data) = get_http_url($imageurl, 10);
+ list($headers, $content) = get_http_response($imageurl, 10);
if (strpos($headers[0], '200 OK') !== false) {
- file_put_contents($GLOBALS['config']['CACHEDIR'].'/'.$thumbname,$data); // Save image to cache.
+ // Save image to cache.
+ file_put_contents($GLOBALS['config']['CACHEDIR'] . '/' . $thumbname, $content);
header('Content-Type: image/jpeg');
- echo $data;
+ echo $content;
return;
}
}
// The thumbnail for TED talks is located in the <link rel="image_src" [...]> tag on that page
// http://www.ted.com/talks/mikko_hypponen_fighting_viruses_defending_the_net.html
// <link rel="image_src" href="http://images.ted.com/images/ted/28bced335898ba54d4441809c5b1112ffaf36781_389x292.jpg" />
- list($headers, $data) = get_http_url($url, 5);
+ list($headers, $content) = get_http_response($url, 5);
if (strpos($headers[0], '200 OK') !== false) {
// Extract the link to the thumbnail
- preg_match('!link rel="image_src" href="(http://images.ted.com/images/ted/.+_\d+x\d+\.jpg)"!',$data,$matches);
+ preg_match('!link rel="image_src" href="(http://images.ted.com/images/ted/.+_\d+x\d+\.jpg)"!', $content, $matches);
if (!empty($matches[1]))
{ // Let's download the image.
$imageurl=$matches[1];
// No control on image size, so wait long enough
- list($headers, $data) = get_http_url($imageurl, 20);
+ list($headers, $content) = get_http_response($imageurl, 20);
if (strpos($headers[0], '200 OK') !== false) {
$filepath=$GLOBALS['config']['CACHEDIR'].'/'.$thumbname;
- file_put_contents($filepath,$data); // Save image to cache.
+ file_put_contents($filepath, $content); // Save image to cache.
if (resizeImage($filepath))
{
header('Content-Type: image/jpeg');
// There is no thumbnail available for xkcd comics, so download the whole image and resize it.
// http://xkcd.com/327/
// <img src="http://imgs.xkcd.com/comics/exploits_of_a_mom.png" title="<BLABLA>" alt="<BLABLA>" />
- list($headers, $data) = get_http_url($url, 5);
+ list($headers, $content) = get_http_response($url, 5);
if (strpos($headers[0], '200 OK') !== false) {
// Extract the link to the thumbnail
- preg_match('!<img src="(http://imgs.xkcd.com/comics/.*)" title="[^s]!',$data,$matches);
+ preg_match('!<img src="(http://imgs.xkcd.com/comics/.*)" title="[^s]!', $content, $matches);
if (!empty($matches[1]))
{ // Let's download the image.
$imageurl=$matches[1];
// No control on image size, so wait long enough
- list($headers, $data) = get_http_url($imageurl, 20);
+ list($headers, $content) = get_http_response($imageurl, 20);
if (strpos($headers[0], '200 OK') !== false) {
$filepath=$GLOBALS['config']['CACHEDIR'].'/'.$thumbname;
- file_put_contents($filepath,$data); // Save image to cache.
+ // Save image to cache.
+ file_put_contents($filepath, $content);
if (resizeImage($filepath))
{
header('Content-Type: image/jpeg');
{
// For all other domains, we try to download the image and make a thumbnail.
// We allow 30 seconds max to download (and downloads are limited to 4 Mb)
- list($headers, $data) = get_http_url($url, 30);
+ list($headers, $content) = get_http_response($url, 30);
if (strpos($headers[0], '200 OK') !== false) {
$filepath=$GLOBALS['config']['CACHEDIR'].'/'.$thumbname;
- file_put_contents($filepath,$data); // Save image to cache.
+ // Save image to cache.
+ file_put_contents($filepath, $content);
if (resizeImage($filepath))
{
header('Content-Type: image/jpeg');