X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=index.php;h=2de9be0a1824b31dc57fd17d34c7b1f1999afe44;hb=e6faed3477eb3f3c4947faf21b3d52ecb85e6e5e;hp=1dc81843f2c8ed09b55fd2904bdec24ec75727b8;hpb=f39580c6fd171b849cec5832b4912182696341f2;p=github%2Fshaarli%2FShaarli.git
diff --git a/index.php b/index.php
index 1dc81843..2de9be0a 100644
--- a/index.php
+++ b/index.php
@@ -78,6 +78,7 @@ require_once 'application/Updater.php';
use \Shaarli\Languages;
use \Shaarli\ThemeUtils;
use \Shaarli\Config\ConfigManager;
+use \Shaarli\SessionManager;
// Ensure the PHP version is supported
try {
@@ -115,12 +116,18 @@ if (session_id() == '') {
}
// Regenerate session ID if invalid or not defined in cookie.
-if (isset($_COOKIE['shaarli']) && !is_session_id_valid($_COOKIE['shaarli'])) {
+if (isset($_COOKIE['shaarli']) && !SessionManager::checkId($_COOKIE['shaarli'])) {
session_regenerate_id(true);
$_COOKIE['shaarli'] = session_id();
}
$conf = new ConfigManager();
+$sessionManager = new SessionManager($_SESSION, $conf);
+
+// LC_MESSAGES isn't defined without php-intl, in this case use LC_COLLATE locale instead.
+if (! defined('LC_MESSAGES')) {
+ define('LC_MESSAGES', LC_COLLATE);
+}
// Sniff browser language and set date format accordingly.
if (isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])) {
@@ -165,7 +172,7 @@ if (! is_file($conf->getConfigFileExt())) {
}
// Display the installation form if no existing config is found
- install($conf);
+ install($conf, $sessionManager);
}
// a token depending of deployment salt, user password, and the current ip
@@ -381,7 +388,7 @@ if (isset($_POST['login']))
{
if (!ban_canLogin($conf)) die(t('I said: NO. You are banned for the moment. Go away.'));
if (isset($_POST['password'])
- && tokenOk($_POST['token'])
+ && $sessionManager->checkToken($_POST['token'])
&& (check_auth($_POST['login'], $_POST['password'], $conf))
) { // Login/password is OK.
ban_loginOk($conf);
@@ -434,7 +441,7 @@ if (isset($_POST['login']))
else
{
ban_loginFailed($conf);
- $redir = '&username='. $_POST['login'];
+ $redir = '&username='. urlencode($_POST['login']);
if (isset($_GET['post'])) {
$redir .= '&post=' . urlencode($_GET['post']);
foreach (array('description', 'source', 'title', 'tags') as $param) {
@@ -454,32 +461,6 @@ if (isset($_POST['login']))
// Token should be used in any form which acts on data (create,update,delete,import...).
if (!isset($_SESSION['tokens'])) $_SESSION['tokens']=array(); // Token are attached to the session.
-/**
- * Returns a token.
- *
- * @param ConfigManager $conf Configuration Manager instance.
- *
- * @return string token.
- */
-function getToken($conf)
-{
- $rnd = sha1(uniqid('', true) .'_'. mt_rand() . $conf->get('credentials.salt')); // We generate a random string.
- $_SESSION['tokens'][$rnd]=1; // Store it on the server side.
- return $rnd;
-}
-
-// Tells if a token is OK. Using this function will destroy the token.
-// true=token is OK.
-function tokenOk($token)
-{
- if (isset($_SESSION['tokens'][$token]))
- {
- unset($_SESSION['tokens'][$token]); // Token is used: destroy it.
- return true; // Token is OK.
- }
- return false; // Wrong token, or already used.
-}
-
/**
* Daily RSS feed: 1 RSS entry per day giving all the links on that day.
* Gives the last 7 days (which have links).
@@ -550,7 +531,11 @@ function showDailyRSS($conf) {
// We pre-format some fields for proper output.
foreach ($links as &$link) {
- $link['formatedDescription'] = format_description($link['description'], $conf->get('redirector.url'));
+ $link['formatedDescription'] = format_description(
+ $link['description'],
+ $conf->get('redirector.url'),
+ $conf->get('redirector.encode_url')
+ );
$link['thumbnail'] = thumbnail($conf, $link['url']);
$link['timestamp'] = $link['created']->getTimestamp();
if (startsWith($link['url'], '?')) {
@@ -622,7 +607,11 @@ function showDaily($pageBuilder, $LINKSDB, $conf, $pluginManager)
$taglist = explode(' ',$link['tags']);
uasort($taglist, 'strcasecmp');
$linksToDisplay[$key]['taglist']=$taglist;
- $linksToDisplay[$key]['formatedDescription'] = format_description($link['description'], $conf->get('redirector.url'));
+ $linksToDisplay[$key]['formatedDescription'] = format_description(
+ $link['description'],
+ $conf->get('redirector.url'),
+ $conf->get('redirector.encode_url')
+ );
$linksToDisplay[$key]['thumbnail'] = thumbnail($conf, $link['url']);
$linksToDisplay[$key]['timestamp'] = $link['created']->getTimestamp();
}
@@ -687,12 +676,13 @@ function showLinkList($PAGE, $LINKSDB, $conf, $pluginManager) {
/**
* Render HTML page (according to URL parameters and user rights)
*
- * @param ConfigManager $conf Configuration Manager instance.
- * @param PluginManager $pluginManager Plugin Manager instance,
- * @param LinkDB $LINKSDB
- * @param History $history instance
+ * @param ConfigManager $conf Configuration Manager instance.
+ * @param PluginManager $pluginManager Plugin Manager instance,
+ * @param LinkDB $LINKSDB
+ * @param History $history instance
+ * @param SessionManager $sessionManager SessionManager instance
*/
-function renderPage($conf, $pluginManager, $LINKSDB, $history)
+function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager)
{
$updater = new Updater(
read_updates_file($conf->get('resource.updates')),
@@ -713,7 +703,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
die($e->getMessage());
}
- $PAGE = new PageBuilder($conf, $LINKSDB);
+ $PAGE = new PageBuilder($conf, $LINKSDB, $sessionManager->generateToken());
$PAGE->assign('linkcount', count($LINKSDB));
$PAGE->assign('privateLinkcount', count_private($LINKSDB));
$PAGE->assign('plugin_errors', $pluginManager->getErrors());
@@ -1109,13 +1099,13 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
if (!empty($_POST['setpassword']) && !empty($_POST['oldpassword']))
{
- if (!tokenOk($_POST['token'])) die(t('Wrong token.')); // Go away!
+ if (!$sessionManager->checkToken($_POST['token'])) die(t('Wrong token.')); // Go away!
// Make sure old password is correct.
$oldhash = sha1($_POST['oldpassword'].$conf->get('credentials.login').$conf->get('credentials.salt'));
if ($oldhash!= $conf->get('credentials.hash')) {
echo '';
- exit;
+ exit;
}
// Save new password
// Salt renders rainbow-tables attacks useless.
@@ -1149,7 +1139,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
{
if (!empty($_POST['title']) )
{
- if (!tokenOk($_POST['token'])) {
+ if (!$sessionManager->checkToken($_POST['token'])) {
die(t('Wrong token.')); // Go away!
}
$tz = 'UTC';
@@ -1225,7 +1215,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
exit;
}
- if (!tokenOk($_POST['token'])) {
+ if (!$sessionManager->checkToken($_POST['token'])) {
die(t('Wrong token.'));
}
@@ -1255,7 +1245,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
if (isset($_POST['save_edit']))
{
// Go away!
- if (! tokenOk($_POST['token'])) {
+ if (! $sessionManager->checkToken($_POST['token'])) {
die(t('Wrong token.'));
}
@@ -1355,7 +1345,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
// -------- User clicked the "Delete" button when editing a link: Delete link from database.
if ($targetPage == Router::$PAGE_DELETELINK)
{
- if (! tokenOk($_GET['token'])) {
+ if (! $sessionManager->checkToken($_GET['token'])) {
die(t('Wrong token.'));
}
@@ -1440,16 +1430,10 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
// If this is an HTTP(S) link, we try go get the page to extract the title (otherwise we will to straight to the edit form.)
if (empty($title) && strpos(get_url_scheme($url), 'http') !== false) {
// Short timeout to keep the application responsive
- list($headers, $content) = get_http_response($url, 4);
- if (strpos($headers[0], '200 OK') !== false) {
- // Retrieve charset.
- $charset = get_charset($headers, $content);
- // Extract title.
- $title = html_extract_title($content);
- // Re-encode title in utf-8 if necessary.
- if (! empty($title) && strtolower($charset) != 'utf-8') {
- $title = mb_convert_encoding($title, 'utf-8', $charset);
- }
+ // The callback will fill $charset and $title with data from the downloaded page.
+ get_http_response($url, 25, 4194304, get_curl_download_callback($charset, $title));
+ if (! empty($title) && strtolower($charset) != 'utf-8') {
+ $title = mb_convert_encoding($title, 'utf-8', $charset);
}
}
@@ -1572,7 +1556,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
echo '';
exit;
}
- if (! tokenOk($_POST['token'])) {
+ if (! $sessionManager->checkToken($_POST['token'])) {
die('Wrong token.');
}
$status = NetscapeBookmarkUtils::import(
@@ -1639,7 +1623,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
// Get a fresh token
if ($targetPage == Router::$GET_TOKEN) {
header('Content-Type:text/plain');
- echo getToken($conf);
+ echo $sessionManager->generateToken($conf);
exit;
}
@@ -1711,7 +1695,11 @@ function buildLinkList($PAGE,$LINKSDB, $conf, $pluginManager)
while ($i<$end && $iget('redirector.url'));
+ $link['description'] = format_description(
+ $link['description'],
+ $conf->get('redirector.url'),
+ $conf->get('redirector.encode_url')
+ );
$classLi = ($i % 2) != 0 ? '' : 'publicLinkHightLight';
$link['class'] = $link['private'] == 0 ? $classLi : 'private';
$link['timestamp'] = $link['created']->getTimestamp();
@@ -1965,10 +1953,10 @@ function lazyThumbnail($conf, $url,$href=false)
* Installation
* This function should NEVER be called if the file data/config.php exists.
*
- * @param ConfigManager $conf Configuration Manager instance.
+ * @param ConfigManager $conf Configuration Manager instance.
+ * @param SessionManager $sessionManager SessionManager instance
*/
-function install($conf)
-{
+function install($conf, $sessionManager) {
// On free.fr host, make sure the /sessions directory exists, otherwise login will not work.
if (endsWith($_SERVER['HTTP_HOST'],'.free.fr') && !is_dir($_SERVER['DOCUMENT_ROOT'].'/sessions')) mkdir($_SERVER['DOCUMENT_ROOT'].'/sessions',0705);
@@ -2051,7 +2039,7 @@ function install($conf)
exit;
}
- $PAGE = new PageBuilder($conf);
+ $PAGE = new PageBuilder($conf, null, $sessionManager->generateToken());
list($continents, $cities) = generateTimeZoneData(timezone_identifiers_list(), date_default_timezone_get());
$PAGE->assign('continents', $continents);
$PAGE->assign('cities', $cities);
@@ -2328,7 +2316,7 @@ $response = $app->run(true);
if ($response->getStatusCode() == 404 && strpos($_SERVER['REQUEST_URI'], '/api/v1') === false) {
// We use UTF-8 for proper international characters handling.
header('Content-Type: text/html; charset=utf-8');
- renderPage($conf, $pluginManager, $linkDb, $history);
+ renderPage($conf, $pluginManager, $linkDb, $history, $sessionManager);
} else {
$app->respond($response);
}