X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=index.php;h=9cbc92416232147fed94f2a10e60cbf707d90b5c;hb=db45a36a53dbd722e5e891827e49d9e7651f2a5e;hp=91c3f07e8f90ef50efc5efeb480046a172c61874;hpb=91f17fc92a7168e2baf1096910b8f44f3a24a8a2;p=github%2Fshaarli%2FShaarli.git

diff --git a/index.php b/index.php
index 91c3f07e..9cbc9241 100644
--- a/index.php
+++ b/index.php
@@ -101,8 +101,6 @@ if (dirname($_SERVER['SCRIPT_NAME']) != '/') {
 // Set default cookie expiration and path.
 session_set_cookie_params($cookie['lifetime'], $cookiedir, $_SERVER['SERVER_NAME']);
 // Set session parameters on server side.
-// If the user does not access any page within this time, his/her session is considered expired.
-define('INACTIVITY_TIMEOUT', 3600); // in seconds.
 // Use cookies to store session.
 ini_set('session.use_cookies', 1);
 // Force cookies for session (phpsessionID forbidden in URL).
@@ -183,11 +181,12 @@ define('STAY_SIGNED_IN_TOKEN', sha1($conf->get('credentials.hash') . $_SERVER['R
 /**
  * Checking session state (i.e. is the user still logged in)
  *
- * @param ConfigManager $conf The configuration manager.
+ * @param ConfigManager  $conf           Configuration Manager instance.
+ * @param SessionManager $sessionManager SessionManager instance
  *
- * @return bool: true if the user is logged in, false otherwise.
+ * @return bool true if the user is logged in, false otherwise.
  */
-function setup_login_state($conf)
+function setup_login_state($conf, $sessionManager)
 {
     if ($conf->get('security.open_shaarli')) {
         return true;
@@ -202,12 +201,12 @@ function setup_login_state($conf)
         $_COOKIE['shaarli_staySignedIn']===STAY_SIGNED_IN_TOKEN &&
         !$loginFailure)
     {
-        fillSessionInfo($conf);
+        fillSessionInfo($conf, $sessionManager);
         $userIsLoggedIn = true;
     }
     // If session does not exist on server side, or IP address has changed, or session has expired, logout.
     if (empty($_SESSION['uid'])
-        || ($conf->get('security.session_protection_disabled') === false && $_SESSION['ip'] != allIPs())
+        || ($conf->get('security.session_protection_disabled') === false && $_SESSION['ip'] != client_ip_id($_SERVER))
         || time() >= $_SESSION['expires_on'])
     {
         logout();
@@ -216,9 +215,8 @@ function setup_login_state($conf)
     }
     if (!empty($_SESSION['longlastingsession'])) {
         $_SESSION['expires_on']=time()+$_SESSION['longlastingsession']; // In case of "Stay signed in" checked.
-    }
-    else {
-        $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT; // Standard session expiration date.
+    } else {
+        $_SESSION['expires_on'] = time() + $sessionManager::$INACTIVITY_TIMEOUT;
     }
     if (!$loginFailure) {
         $userIsLoggedIn = true;
@@ -226,49 +224,42 @@ function setup_login_state($conf)
 
     return $userIsLoggedIn;
 }
-$userIsLoggedIn = setup_login_state($conf);
+
+$userIsLoggedIn = setup_login_state($conf, $sessionManager);
 
 // ------------------------------------------------------------------------------------------
 // Session management
 
-// Returns the IP address of the client (Used to prevent session cookie hijacking.)
-function allIPs()
-{
-    $ip = $_SERVER['REMOTE_ADDR'];
-    // Then we use more HTTP headers to prevent session hijacking from users behind the same proxy.
-    if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) { $ip=$ip.'_'.$_SERVER['HTTP_X_FORWARDED_FOR']; }
-    if (isset($_SERVER['HTTP_CLIENT_IP'])) { $ip=$ip.'_'.$_SERVER['HTTP_CLIENT_IP']; }
-    return $ip;
-}
-
 /**
- * Load user session.
+ * Load user session
  *
- * @param ConfigManager $conf Configuration Manager instance.
+ * @param ConfigManager  $conf           Configuration Manager instance.
+ * @param SessionManager $sessionManager SessionManager instance
  */
-function fillSessionInfo($conf)
+function fillSessionInfo($conf, $sessionManager)
 {
     $_SESSION['uid'] = sha1(uniqid('',true).'_'.mt_rand()); // Generate unique random number (different than phpsessionid)
-    $_SESSION['ip']=allIPs();                // We store IP address(es) of the client to make sure session is not hijacked.
+    $_SESSION['ip'] = client_ip_id($_SERVER);
     $_SESSION['username']= $conf->get('credentials.login');
-    $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT;  // Set session expiration.
+    $_SESSION['expires_on'] = time() + $sessionManager::$INACTIVITY_TIMEOUT;
 }
 
 /**
  * Check that user/password is correct.
  *
- * @param string        $login    Username
- * @param string        $password User password
- * @param ConfigManager $conf     Configuration Manager instance.
+ * @param string         $login          Username
+ * @param string         $password       User password
+ * @param ConfigManager  $conf           Configuration Manager instance.
+ * @param SessionManager $sessionManager SessionManager instance
  *
  * @return bool: authentication successful or not.
  */
-function check_auth($login, $password, $conf)
+function check_auth($login, $password, $conf, $sessionManager)
 {
     $hash = sha1($password . $login . $conf->get('credentials.salt'));
-    if ($login == $conf->get('credentials.login') && $hash == $conf->get('credentials.hash'))
-    {   // Login/password is correct.
-        fillSessionInfo($conf);
+    if ($login == $conf->get('credentials.login') && $hash == $conf->get('credentials.hash')) {
+        // Login/password is correct.
+        fillSessionInfo($conf, $sessionManager);
         logm($conf->get('resource.log'), $_SERVER['REMOTE_ADDR'], 'Login successful');
         return true;
     }
@@ -297,14 +288,13 @@ function logout() {
 
 // ------------------------------------------------------------------------------------------
 // Process login form: Check if login/password is correct.
-if (isset($_POST['login']))
-{
+if (isset($_POST['login'])) {
     if (! $loginManager->canLogin($_SERVER)) {
         die(t('I said: NO. You are banned for the moment. Go away.'));
     }
     if (isset($_POST['password'])
         && $sessionManager->checkToken($_POST['token'])
-        && (check_auth($_POST['login'], $_POST['password'], $conf))
+        && (check_auth($_POST['login'], $_POST['password'], $conf, $sessionManager))
     ) {
         // Login/password is OK.
         $loginManager->handleSuccessfulLogin($_SERVER);
@@ -573,6 +563,7 @@ function showDaily($pageBuilder, $LINKSDB, $conf, $pluginManager)
         $pageBuilder->assign($key, $value);
     }
 
+    $pageBuilder->assign('pagetitle', t('Daily') .' - '. $conf->get('general.title', 'Shaarli'));
     $pageBuilder->renderPage('daily');
     exit;
 }
@@ -677,6 +668,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
         // add default state of the 'remember me' checkbox
         $PAGE->assign('remember_user_default', $conf->get('privacy.remember_user_default'));
         $PAGE->assign('user_can_login', $loginManager->canLogin($_SERVER));
+        $PAGE->assign('pagetitle', t('Login') .' - '. $conf->get('general.title', 'Shaarli'));
         $PAGE->renderPage('loginform');
         exit;
     }
@@ -717,6 +709,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
             $PAGE->assign($key, $value);
         }
 
+        $PAGE->assign('pagetitle', t('Picture wall') .' - '. $conf->get('general.title', 'Shaarli'));
         $PAGE->renderPage('picwall');
         exit;
     }
@@ -752,8 +745,9 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
             );
         }
 
+        $searchTags = implode(' ', escape($filteringTags));
         $data = array(
-            'search_tags' => implode(' ', escape($filteringTags)),
+            'search_tags' => $searchTags,
             'tags' => $tagList,
         );
         $pluginManager->executeHooks('render_tagcloud', $data, array('loggedin' => isLoggedIn()));
@@ -762,6 +756,8 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
             $PAGE->assign($key, $value);
         }
 
+        $searchTags = ! empty($searchTags) ? $searchTags .' - ' : '';
+        $PAGE->assign('pagetitle', $searchTags. t('Tag cloud') .' - '. $conf->get('general.title', 'Shaarli'));
         $PAGE->renderPage('tag.cloud');
         exit;
     }
@@ -782,8 +778,9 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
             alphabetical_sort($tags, false, true);
         }
 
+        $searchTags = implode(' ', escape($filteringTags));
         $data = [
-            'search_tags' => implode(' ', escape($filteringTags)),
+            'search_tags' => $searchTags,
             'tags' => $tags,
         ];
         $pluginManager->executeHooks('render_taglist', $data, ['loggedin' => isLoggedIn()]);
@@ -792,6 +789,8 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
             $PAGE->assign($key, $value);
         }
 
+        $searchTags = ! empty($searchTags) ? $searchTags .' - ' : '';
+        $PAGE->assign('pagetitle', $searchTags . t('Tag list') .' - '. $conf->get('general.title', 'Shaarli'));
         $PAGE->renderPage('tag.list');
         exit;
     }
@@ -878,7 +877,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
         if (empty($params['searchtags'])) {
             $params['searchtags'] = trim($_GET['addtag']);
         }
-        else if ($addtag) {
+        elseif ($addtag) {
             $params['searchtags'] = trim($params['searchtags']).' '.trim($_GET['addtag']);
         }
 
@@ -944,7 +943,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
             } else {
                 unset($_SESSION['visibility']);
             }
-        } else if ($_GET['visibility'] === 'public') {
+        } elseif ($_GET['visibility'] === 'public') {
             if (empty($_SESSION['visibility']) || $_SESSION['visibility'] !== 'public') {
                 // See only public links
                 $_SESSION['visibility'] = 'public';
@@ -1016,6 +1015,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
             $PAGE->assign($key, $value);
         }
 
+        $PAGE->assign('pagetitle', t('Tools') .' - '. $conf->get('general.title', 'Shaarli'));
         $PAGE->renderPage('tools');
         exit;
     }
@@ -1059,6 +1059,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
         }
         else // show the change password form.
         {
+            $PAGE->assign('pagetitle', t('Change password') .' - '. $conf->get('general.title', 'Shaarli'));
             $PAGE->renderPage('changepassword');
             exit;
         }
@@ -1082,7 +1083,6 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
             $conf->set('general.title', escape($_POST['title']));
             $conf->set('general.header_link', escape($_POST['titleLink']));
             $conf->set('resource.theme', escape($_POST['theme']));
-            $conf->set('redirector.url', escape($_POST['redirector']));
             $conf->set('security.session_protection_disabled', !empty($_POST['disablesessionprotection']));
             $conf->set('privacy.default_private_links', !empty($_POST['privateLinkByDefault']));
             $conf->set('feed.rss_permalinks', !empty($_POST['enableRssPermalinks']));
@@ -1115,7 +1115,6 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
             $PAGE->assign('title', $conf->get('general.title'));
             $PAGE->assign('theme', $conf->get('resource.theme'));
             $PAGE->assign('theme_available', ThemeUtils::getThemes($conf->get('resource.raintpl_tpl')));
-            $PAGE->assign('redirector', $conf->get('redirector.url'));
             list($continents, $cities) = generateTimeZoneData(
                 timezone_identifiers_list(),
                 $conf->get('general.timezone')
@@ -1131,6 +1130,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
             $PAGE->assign('api_secret', $conf->get('api.secret'));
             $PAGE->assign('languages', Languages::getAvailableLanguages());
             $PAGE->assign('language', $conf->get('translation.language'));
+            $PAGE->assign('pagetitle', t('Configure') .' - '. $conf->get('general.title', 'Shaarli'));
             $PAGE->renderPage('configure');
             exit;
         }
@@ -1141,6 +1141,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
     {
         if (empty($_POST['fromtag']) || (empty($_POST['totag']) && isset($_POST['renametag']))) {
             $PAGE->assign('fromtag', ! empty($_GET['fromtag']) ? escape($_GET['fromtag']) : '');
+            $PAGE->assign('pagetitle', t('Manage tags') .' - '. $conf->get('general.title', 'Shaarli'));
             $PAGE->renderPage('changetag');
             exit;
         }
@@ -1167,6 +1168,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
     // -------- User wants to add a link without using the bookmarklet: Show form.
     if ($targetPage == Router::$PAGE_ADDLINK)
     {
+        $PAGE->assign('pagetitle', t('Shaare a new link') .' - '. $conf->get('general.title', 'Shaarli'));
         $PAGE->renderPage('addlink');
         exit;
     }
@@ -1336,6 +1338,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
             $PAGE->assign($key, $value);
         }
 
+        $PAGE->assign('pagetitle', t('Edit') .' '. t('Shaare') .' - '. $conf->get('general.title', 'Shaarli'));
         $PAGE->renderPage('editlink');
         exit;
     }
@@ -1361,7 +1364,12 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
             if (empty($title) && strpos(get_url_scheme($url), 'http') !== false) {
                 // Short timeout to keep the application responsive
                 // The callback will fill $charset and $title with data from the downloaded page.
-                get_http_response($url, 25, 4194304, get_curl_download_callback($charset, $title));
+                get_http_response(
+                    $url,
+                    $conf->get('general.download_timeout', 30),
+                    $conf->get('general.download_max_size', 4194304),
+                    get_curl_download_callback($charset, $title)
+                );
                 if (! empty($title) && strtolower($charset) != 'utf-8') {
                     $title = mb_convert_encoding($title, 'utf-8', $charset);
                 }
@@ -1400,6 +1408,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
             $PAGE->assign($key, $value);
         }
 
+        $PAGE->assign('pagetitle', t('Shaare') .' - '. $conf->get('general.title', 'Shaarli'));
         $PAGE->renderPage('editlink');
         exit;
     }
@@ -1408,6 +1417,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
         // Export links as a Netscape Bookmarks file
 
         if (empty($_GET['selection'])) {
+            $PAGE->assign('pagetitle', t('Export') .' - '. $conf->get('general.title', 'Shaarli'));
             $PAGE->renderPage('export');
             exit;
         }
@@ -1469,6 +1479,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
                     true
                 )
             );
+            $PAGE->assign('pagetitle', t('Import') .' - '. $conf->get('general.title', 'Shaarli'));
             $PAGE->renderPage('import');
             exit;
         }
@@ -1517,6 +1528,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager,
 
         $PAGE->assign('enabledPlugins', $enabledPlugins);
         $PAGE->assign('disabledPlugins', $disabledPlugins);
+        $PAGE->assign('pagetitle', t('Plugin administration') .' - '. $conf->get('general.title', 'Shaarli'));
         $PAGE->renderPage('pluginsadmin');
         exit;
     }
@@ -1680,6 +1692,16 @@ function buildLinkList($PAGE,$LINKSDB, $conf, $pluginManager)
     // If there is only a single link, we change on-the-fly the title of the page.
     if (count($linksToDisplay) == 1) {
         $data['pagetitle'] = $linksToDisplay[$keys[0]]['title'] .' - '. $conf->get('general.title');
+    } elseif (! empty($searchterm) || ! empty($searchtags)) {
+        $data['pagetitle'] = t('Search: ');
+        $data['pagetitle'] .= ! empty($searchterm) ? $searchterm .' ' : '';
+        $bracketWrap = function ($tag) {
+            return '['. $tag .']';
+        };
+        $data['pagetitle'] .= ! empty($searchtags)
+            ? implode(' ', array_map($bracketWrap, preg_split('/\s+/', $searchtags))).' '
+            : '';
+        $data['pagetitle'] .= '- '. $conf->get('general.title');
     }
 
     $pluginManager->executeHooks('render_linklist', $data, array('loggedin' => isLoggedIn()));