X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=index.php;h=3192029a82158becf5d386200939697494caaa87;hb=82af78b272ab0036eec289eb338934736aabbdc2;hp=818fa680a347009c5596d55fa1472fa4185787a9;hpb=ed5b38ddd249c0e50eec7e06e74c9d1c2e864dab;p=github%2Fshaarli%2FShaarli.git diff --git a/index.php b/index.php index 818fa680..3192029a 100644 --- a/index.php +++ b/index.php @@ -1,5 +1,5 @@ '); // Suffix to encapsulate data in PHP code. // http://server.com/x/shaarli --> /shaarli/ @@ -113,6 +113,53 @@ define('STAY_SIGNED_IN_TOKEN', sha1($GLOBALS['hash'].$_SERVER["REMOTE_ADDR"].$GL autoLocale(); // Sniff browser language and set date format accordingly. header('Content-Type: text/html; charset=utf-8'); // We use UTF-8 for proper international characters handling. +//================================================================================================== +// Checking session state (i.e. is the user still logged in) +//================================================================================================== + +function setup_login_state() { + $userIsLoggedIn = false; // By default, we do not consider the user as logged in; + $loginFailure = false; // If set to true, every attempt to authenticate the user will fail. This indicates that an important condition isn't met. + if ($GLOBALS['config']['OPEN_SHAARLI']) { + $userIsLoggedIn = true; + } + if (!isset($GLOBALS['login'])) { + $userIsLoggedIn = false; // Shaarli is not configured yet. + $loginFailure = true; + } + if (isset($_COOKIE['shaarli_staySignedIn']) && + $_COOKIE['shaarli_staySignedIn']===STAY_SIGNED_IN_TOKEN && + !$loginFailure) + { + fillSessionInfo(); + $userIsLoggedIn = true; + } + // If session does not exist on server side, or IP address has changed, or session has expired, logout. + if (empty($_SESSION['uid']) || + ($GLOBALS['disablesessionprotection']==false && $_SESSION['ip']!=allIPs()) || + time() >= $_SESSION['expires_on']) + { + logout(); + $userIsLoggedIn = false; + $loginFailure = true; + } + if (!empty($_SESSION['longlastingsession'])) { + $_SESSION['expires_on']=time()+$_SESSION['longlastingsession']; // In case of "Stay signed in" checked. + } + else { + $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT; // Standard session expiration date. + } + if (!$loginFailure) { + $userIsLoggedIn = true; + } + + return $userIsLoggedIn; +} +//================================================================================================== +$userIsLoggedIn = setup_login_state(); +//================================================================================================== +//================================================================================================== + // Check PHP version function checkphpversion() { @@ -131,13 +178,14 @@ function checkphpversion() function checkUpdate() { if (!isLoggedIn()) return ''; // Do not check versions for visitors. + if (empty($GLOBALS['config']['ENABLE_UPDATECHECK'])) return ''; // Do not check if the user doesn't want to. // Get latest version number at most once a day. if (!is_file($GLOBALS['config']['UPDATECHECK_FILENAME']) || (filemtime($GLOBALS['config']['UPDATECHECK_FILENAME'])','',str_replace('=$_SESSION['expires_on']) - { - logout(); - return false; - } - if (!empty($_SESSION['longlastingsession'])) $_SESSION['expires_on']=time()+$_SESSION['longlastingsession']; // In case of "Stay signed in" checked. - else $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT; // Standard session expiration date. - - return true; + global $userIsLoggedIn; + return $userIsLoggedIn; } // Force logout. -function logout() { if (isset($_SESSION)) { unset($_SESSION['uid']); unset($_SESSION['ip']); unset($_SESSION['username']); unset($_SESSION['privateonly']); } -setcookie('shaarli_staySignedIn', FALSE, 0, WEB_PATH); +function logout() { + if (isset($_SESSION)) { + unset($_SESSION['uid']); + unset($_SESSION['ip']); + unset($_SESSION['username']); + unset($_SESSION['privateonly']); + } + setcookie('shaarli_staySignedIn', FALSE, 0, WEB_PATH); } @@ -512,7 +554,7 @@ function endsWith($haystack,$needle,$case=true) function linkdate2timestamp($linkdate) { $Y=$M=$D=$h=$m=$s=0; - $r = sscanf($linkdate,'%4d%2d%2d_%2d%2d%2d',$Y,$M,$D,$h,$m,$s); + sscanf($linkdate,'%4d%2d%2d_%2d%2d%2d',$Y,$M,$D,$h,$m,$s); return mktime($h,$m,$s,$M,$D,$Y); } @@ -530,16 +572,6 @@ function linkdate2iso8601($linkdate) return date('c',linkdate2timestamp($linkdate)); // 'c' is for ISO 8601 date format. } -/* Converts a linkdate time (YYYYMMDD_HHMMSS) of an article to a localized date format. - (used to display link date on screen) - The date format is automatically chosen according to locale/languages sniffed from browser headers (see autoLocale()). */ -function linkdate2locale($linkdate) -{ - return utf8_encode(strftime('%c',linkdate2timestamp($linkdate))); // %c is for automatic date format according to locale. - // Note that if you use a locale which is not installed on your webserver, - // the date will not be displayed in the chosen locale, but probably in US notation. -} - // Parse HTTP response headers and return an associative array. function http_parse_headers_shaarli( $headers ) { @@ -1105,7 +1137,7 @@ function showDailyRSS() $l = $LINKSDB[$linkdate]; $l['formatedDescription']=nl2br(keepMultipleSpaces(text2clickable(htmlspecialchars($l['description'])))); $l['thumbnail'] = thumbnail($l['url']); - $l['localdate']=linkdate2locale($l['linkdate']); + $l['timestamp'] = linkdate2timestamp($l['linkdate']); if (startsWith($l['url'],'?')) $l['url']=indexUrl().$l['url']; // make permalink URL absolute $links[$linkdate]=$l; } @@ -1153,7 +1185,7 @@ function showDaily() $linksToDisplay[$key]['taglist']=$taglist; $linksToDisplay[$key]['formatedDescription']=nl2br(keepMultipleSpaces(text2clickable(htmlspecialchars($link['description'])))); $linksToDisplay[$key]['thumbnail'] = thumbnail($link['url']); - $linksToDisplay[$key]['localdate'] = linkdate2locale($link['linkdate']); + $linksToDisplay[$key]['timestamp'] = linkdate2timestamp($link['linkdate']); } /* We need to spread the articles on 3 columns. @@ -1234,7 +1266,6 @@ function renderPage() if ($thumb!='') // Only output links which have a thumbnail. { $link['thumbnail']=$thumb; // Thumbnail HTML code. - $link['permalink']=$permalink; $linksToDisplay[]=$link; // Add to array. } } @@ -1426,6 +1457,7 @@ function renderPage() $GLOBALS['disablejquery']=!empty($_POST['disablejquery']); $GLOBALS['privateLinkByDefault']=!empty($_POST['privateLinkByDefault']); $GLOBALS['config']['ENABLE_RSS_PERMALINKS']= !empty($_POST['enableRssPermalinks']); + $GLOBALS['config']['ENABLE_UPDATECHECK'] = !empty($_POST['updateCheck']); writeConfig(); echo ''; exit; @@ -1453,6 +1485,7 @@ function renderPage() $PAGE = new pageBuilder; $PAGE->assign('linkcount',count($LINKSDB)); $PAGE->assign('token',getToken()); + $PAGE->assign('tags', $LINKSDB->allTags()); $PAGE->renderPage('changetag'); exit; } @@ -1509,7 +1542,7 @@ function renderPage() $tags = trim(preg_replace('/\s\s+/',' ', $_POST['lf_tags'])); // Remove multiple spaces. $linkdate=$_POST['lf_linkdate']; $url = trim($_POST['lf_url']); - if (!startsWith($url,'http:') && !startsWith($url,'https:') && !startsWith($url,'ftp:') && !startsWith($url,'magnet:') && !startsWith($url,'?')) + if (!startsWith($url,'http:') && !startsWith($url,'https:') && !startsWith($url,'ftp:') && !startsWith($url,'magnet:') && !startsWith($url,'?') && !startsWith($url,'javascript:')) $url = 'http://'.$url; $link = array('title'=>trim($_POST['lf_title']),'url'=>$url,'description'=>trim($_POST['lf_description']),'private'=>(isset($_POST['lf_private']) ? 1 : 0), 'linkdate'=>$linkdate,'tags'=>str_replace(',',' ',$tags)); @@ -1522,6 +1555,7 @@ function renderPage() if (isset($_GET['source']) && $_GET['source']=='bookmarklet') { echo ''; exit; } $returnurl = ( isset($_POST['returnurl']) ? $_POST['returnurl'] : '?' ); $returnurl .= '#'.smallHash($linkdate); // Scroll to the link which has been edited. + if (strstr($returnurl, "do=addlink")) { $returnurl = '?'; } //if we come from ?do=addlink, set returnurl to homepage instead header('Location: '.$returnurl); // After saving the link, redirect to the page the user was on. exit; } @@ -1550,7 +1584,37 @@ function renderPage() // If we are called from the bookmarklet, we must close the popup: if (isset($_GET['source']) && $_GET['source']=='bookmarklet') { echo ''; exit; } - header('Location: ?'); // After deleting the link, redirect to the home page. + // Pick where we're going to redirect + // ============================================================= + // Basically, we can't redirect to where we were previously if it was a permalink + // or an edit_link, because it would 404. + // Cases: + // - / : nothing in $_GET, redirect to self + // - /?page : redirect to self + // - /?searchterm : redirect to self (there might be other links) + // - /?searchtags : redirect to self + // - /permalink : redirect to / (the link does not exist anymore) + // - /?edit_link : redirect to / (the link does not exist anymore) + // PHP treats the permalink as a $_GET variable, so we need to check if every condition for self + // redirect is not satisfied, and only then redirect to / + $location = "?"; + // Self redirection + if (count($_GET) == 0 || + isset($_GET['page']) || + isset($_GET['searchterm']) || + isset($_GET['searchtags'])) { + + if (isset($_POST['returnurl'])) { + $location = $_POST['returnurl']; // Handle redirects given by the form + } + + if ($location === "?" && + isset($_SERVER['HTTP_REFERER'])) { // Handle HTTP_REFERER in case we're not coming from the same place. + $location = $_SERVER['HTTP_REFERER']; + } + } + + header('Location: ' . $location); // After deleting the link, redirect to appropriate location exit; } @@ -1565,6 +1629,7 @@ function renderPage() $PAGE->assign('link_is_new',false); $PAGE->assign('token',getToken()); // XSRF protection. $PAGE->assign('http_referer',(isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '')); + $PAGE->assign('tags', $LINKSDB->allTags()); $PAGE->renderPage('editlink'); exit; } @@ -1574,10 +1639,13 @@ function renderPage() { $url=$_GET['post']; - // We remove the annoying parameters added by FeedBurner and GoogleFeedProxy (?utm_source=...) - $i=strpos($url,'&utm_source='); if ($i!==false) $url=substr($url,0,$i); - $i=strpos($url,'?utm_source='); if ($i!==false) $url=substr($url,0,$i); - $i=strpos($url,'#xtor=RSS-'); if ($i!==false) $url=substr($url,0,$i); + + // We remove the annoying parameters added by FeedBurner, GoogleFeedProxy, Facebook... + $annoyingpatterns = array('/[\?&]utm_source=[^&]*/', '/[\?&]utm_campaign=[^&]*/', '/[\?&]utm_medium=[^&]*/', '/#xtor=RSS-[^&]*/', '/[\?&]fb_[^&]*/', '/[\?&]__scoop[^&]*/', '/#tk\.rss_all\?/', '/[\?&]action_ref_map=[^&]*/', '/[\?&]action_type_map=[^&]*/', '/[\?&]action_object_map=[^&]*/'); + foreach($annoyingpatterns as $pattern) + { + $url = preg_replace($pattern, "", $url); + } $link_is_new = false; $link = $LINKSDB->getLinkFromUrl($url); // Check if URL is not already in database (in this case, we will edit the existing link) @@ -1633,6 +1701,7 @@ function renderPage() $PAGE->assign('link_is_new',$link_is_new); $PAGE->assign('token',getToken()); // XSRF protection. $PAGE->assign('http_referer',(isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '')); + $PAGE->assign('tags', $LINKSDB->allTags()); $PAGE->renderPage('editlink'); exit; } @@ -1870,10 +1939,16 @@ function buildLinkList($PAGE,$LINKSDB) $title=$link['title']; $classLi = $i%2!=0 ? '' : 'publicLinkHightLight'; $link['class'] = ($link['private']==0 ? $classLi : 'private'); - $link['localdate']=linkdate2locale($link['linkdate']); + $link['timestamp']=linkdate2timestamp($link['linkdate']); $taglist = explode(' ',$link['tags']); uasort($taglist, 'strcasecmp'); $link['taglist']=$taglist; + + if ($link["url"][0] === '?' && // Check for both signs of a note: starting with ? and 7 chars long. I doubt that you'll post any links that look like this. + strlen($link["url"]) === 7) { + $link["url"] = indexUrl() . $link["url"]; + } + $linkDisp[$keys[$i]] = $link; $i++; } @@ -2044,7 +2119,6 @@ function thumbnail($url,$href=false) return $html; } - // Returns the HTML code to display a thumbnail for a link // for the picture wall (using lazy image loading) // Understands various services (youtube.com...) @@ -2058,11 +2132,8 @@ function lazyThumbnail($url,$href=false) $html=''; - // Lazy image (only loaded by JavaScript when in the viewport). - if (!empty($GLOBALS['disablejquery'])) // (except if jQuery is disabled) - $html.='alert("Shaarli is now configured. Please enter your login/password and start shaaring your links!");document.location=\'?do=login\';'; exit; @@ -2240,45 +2312,6 @@ if (!function_exists('json_encode')) { } } -// Webservices (for use with jQuery/jQueryUI) -// e.g. index.php?ws=tags&term=minecr -function processWS() -{ - if (empty($_GET['ws']) || empty($_GET['term'])) return; - $term = $_GET['term']; - $LINKSDB=new linkdb(isLoggedIn() || $GLOBALS['config']['OPEN_SHAARLI']); // Read links from database (and filter private links if used it not logged in). - header('Content-Type: application/json; charset=utf-8'); - - // Search in tags (case insensitive, cumulative search) - if ($_GET['ws']=='tags') - { - $tags=explode(' ',str_replace(',',' ',$term)); $last = array_pop($tags); // Get the last term ("a b c d" ==> "a b c", "d") - $addtags=''; if ($tags) $addtags=implode(' ',$tags).' '; // We will pre-pend previous tags - $suggested=array(); - /* To speed up things, we store list of tags in session */ - if (empty($_SESSION['tags'])) $_SESSION['tags'] = $LINKSDB->allTags(); - foreach($_SESSION['tags'] as $key=>$value) - { - if (startsWith($key,$last,$case=false) && !in_array($key,$tags)) $suggested[$addtags.$key.' ']=0; - } - echo json_encode(array_keys($suggested)); - exit; - } - - // Search a single tag (case sensitive, single tag search) - if ($_GET['ws']=='singletag') - { - /* To speed up things, we store list of tags in session */ - if (empty($_SESSION['tags'])) $_SESSION['tags'] = $LINKSDB->allTags(); - foreach($_SESSION['tags'] as $key=>$value) - { - if (startsWith($key,$term,$case=true)) $suggested[$key]=0; - } - echo json_encode(array_keys($suggested)); - exit; - } -} - // Re-write configuration file according to globals. // Requires some $GLOBALS to be set (login,hash,salt,title). // If the config file cannot be saved, an error message is displayed and the user is redirected to "Tools" menu. @@ -2294,6 +2327,7 @@ function writeConfig() $config .= '$GLOBALS[\'disablejquery\']='.var_export($GLOBALS['disablejquery'],true).'; '; $config .= '$GLOBALS[\'privateLinkByDefault\']='.var_export($GLOBALS['privateLinkByDefault'],true).'; '; $config .= '$GLOBALS[\'config\'][\'ENABLE_RSS_PERMALINKS\']='.var_export($GLOBALS['config']['ENABLE_RSS_PERMALINKS'], true).'; '; + $config .= '$GLOBALS[\'config\'][\'ENABLE_UPDATECHECK\']='.var_export($GLOBALS['config']['ENABLE_UPDATECHECK'], true).'; '; $config .= ' ?>'; if (!file_put_contents($GLOBALS['config']['CONFIG_FILE'],$config) || strcmp(file_get_contents($GLOBALS['config']['CONFIG_FILE']),$config)!=0) { @@ -2534,7 +2568,6 @@ if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=r if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=atom')) { showATOM(); exit; } if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=dailyrss')) { showDailyRSS(); exit; } if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=daily')) { showDaily(); exit; } -if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'ws=')) { processWS(); exit; } // Webservices (for jQuery/jQueryUI) if (!isset($_SESSION['LINKS_PER_PAGE'])) $_SESSION['LINKS_PER_PAGE']=$GLOBALS['config']['LINKS_PER_PAGE']; renderPage(); ?>