X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=index.php;h=c430a2006ee63cac8ed3b8ea751b113bdbb1c9c1;hb=38bedfbbcdd2a40e9f04f5753e0fd6f4fd513c21;hp=b8ca734f2ee7ae1403b31f7a721d12aa4adb2e8a;hpb=53cc2b93b85a080c6c06bc3633fb454241fc5699;p=github%2Fshaarli%2FShaarli.git diff --git a/index.php b/index.php index b8ca734f..c430a200 100755 --- a/index.php +++ b/index.php @@ -1,10 +1,20 @@ /shaarli/ define('WEB_PATH', substr($_SERVER["REQUEST_URI"], 0, 1+strrpos($_SERVER["REQUEST_URI"], '/', 0))); @@ -59,6 +69,7 @@ if (is_file($GLOBALS['config']['CONFIG_FILE'])) { // Shaarli library require_once 'application/Cache.php'; require_once 'application/CachedPage.php'; +require_once 'application/HttpUtils.php'; require_once 'application/LinkDB.php'; require_once 'application/TimeZone.php'; require_once 'application/Url.php'; @@ -92,16 +103,18 @@ ini_set('session.use_only_cookies', 1); // Prevent PHP form using sessionID in URL if cookies are disabled. ini_set('session.use_trans_sid', false); -// Regenerate session id if invalid or not defined in cookie. -if (isset($_COOKIE['shaarli']) && !is_session_id_valid($_COOKIE['shaarli'])) { - $_COOKIE['shaarli'] = uniqid(); -} session_name('shaarli'); // Start session if needed (Some server auto-start sessions). if (session_id() == '') { session_start(); } +// Regenerate session ID if invalid or not defined in cookie. +if (isset($_COOKIE['shaarli']) && !is_session_id_valid($_COOKIE['shaarli'])) { + session_regenerate_id(true); + $_COOKIE['shaarli'] = session_id(); +} + include "inc/rain.tpl.class.php"; //include Rain TPL raintpl::$tpl_dir = $GLOBALS['config']['RAINTPL_TPL']; // template directory raintpl::$cache_dir = $GLOBALS['config']['RAINTPL_TMP']; // cache directory @@ -128,7 +141,7 @@ header("Pragma: no-cache"); if (!is_writable(realpath(dirname(__FILE__)))) die('
ERROR: Shaarli does not have the right to write in its own directory.
'); // Handling of old config file which do not have the new parameters. -if (empty($GLOBALS['title'])) $GLOBALS['title']='Shared links on '.escape(indexUrl()); +if (empty($GLOBALS['title'])) $GLOBALS['title']='Shared links on '.escape(index_url($_SERVER)); if (empty($GLOBALS['timezone'])) $GLOBALS['timezone']=date_default_timezone_get(); if (empty($GLOBALS['redirector'])) $GLOBALS['redirector']=''; if (empty($GLOBALS['disablesessionprotection'])) $GLOBALS['disablesessionprotection']=false; @@ -207,9 +220,11 @@ function checkUpdate() // Get latest version number at most once a day. if (!is_file($GLOBALS['config']['UPDATECHECK_FILENAME']) || (filemtime($GLOBALS['config']['UPDATECHECK_FILENAME'])','',str_replace('', '', str_replace('publish_update($topic_url); } @@ -453,34 +468,6 @@ if (isset($_POST['login'])) // ------------------------------------------------------------------------------------------ // Misc utility functions: -// Returns the server URL (including port and http/https), without path. -// e.g. "http://myserver.com:8080" -// You can append $_SERVER['SCRIPT_NAME'] to get the current script URL. -function serverUrl() -{ - $https = (!empty($_SERVER['HTTPS']) && (strtolower($_SERVER['HTTPS'])=='on')) || $_SERVER["SERVER_PORT"]=='443'; // HTTPS detection. - $serverport = ($_SERVER["SERVER_PORT"]=='80' || ($https && $_SERVER["SERVER_PORT"]=='443') ? '' : ':'.$_SERVER["SERVER_PORT"]); - return 'http'.($https?'s':'').'://'.$_SERVER['SERVER_NAME'].$serverport; -} - -// Returns the absolute URL of current script, without the query. -// (e.g. http://sebsauvage.net/links/) -function indexUrl() -{ - $scriptname = $_SERVER["SCRIPT_NAME"]; - // If the script is named 'index.php', we remove it (for better looking URLs, - // e.g. http://mysite.com/shaarli/?abcde instead of http://mysite.com/shaarli/index.php?abcde) - if (endswith($scriptname,'index.php')) $scriptname = substr($scriptname,0,strlen($scriptname)-9); - return serverUrl() . $scriptname; -} - -// Returns the absolute URL of current script, WITH the query. -// (e.g. http://sebsauvage.net/links/?toto=titi&spamspamspam=humbug) -function pageUrl() -{ - return indexUrl().(!empty($_SERVER["QUERY_STRING"]) ? '?'.$_SERVER["QUERY_STRING"] : ''); -} - // Convert post_max_size/upload_max_filesize (e.g. '16M') parameters to bytes. function return_bytes($val) { @@ -533,53 +520,6 @@ function linkdate2iso8601($linkdate) return date('c',linkdate2timestamp($linkdate)); // 'c' is for ISO 8601 date format. } -// Parse HTTP response headers and return an associative array. -function http_parse_headers_shaarli( $headers ) -{ - $res=array(); - foreach($headers as $header) - { - $i = strpos($header,': '); - if ($i!==false) - { - $key=substr($header,0,$i); - $value=substr($header,$i+2,strlen($header)-$i-2); - $res[$key]=$value; - } - } - return $res; -} - -/* GET an URL. - Input: $url : URL to get (http://...) - $timeout : Network timeout (will wait this many seconds for an anwser before giving up). - Output: An array. [0] = HTTP status message (e.g. "HTTP/1.1 200 OK") or error message - [1] = associative array containing HTTP response headers (e.g. echo getHTTP($url)[1]['Content-Type']) - [2] = data - Example: list($httpstatus,$headers,$data) = getHTTP('http://sebauvage.net/'); - if (strpos($httpstatus,'200 OK')!==false) - echo 'Data type: '.htmlspecialchars($headers['Content-Type']); - else - echo 'There was an error: '.htmlspecialchars($httpstatus) -*/ -function getHTTP($url,$timeout=30) -{ - try - { - $options = array('http'=>array('method'=>'GET','timeout' => $timeout, 'user_agent' => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:23.0) Gecko/20100101 Firefox/23.0')); // Force network timeout - $context = stream_context_create($options); - $data=file_get_contents($url,false,$context,-1, 4000000); // We download at most 4 Mb from source. - if (!$data) { return array('HTTP Error',array(),''); } - $httpStatus=$http_response_header[0]; // e.g. "HTTP/1.1 200 OK" - $responseHeaders=http_parse_headers_shaarli($http_response_header); - return array($httpStatus,$responseHeaders,$data); - } - catch (Exception $e) // getHTTP *can* fail silently (we don't care if the title cannot be fetched) - { - return array($e->getMessage(),'',''); - } -} - // Extract title from an HTML document. // (Returns an empty string if not found.) function html_extract_title($html) @@ -633,14 +573,14 @@ class pageBuilder { $this->tpl = new RainTPL; $this->tpl->assign('newversion',escape(checkUpdate())); - $this->tpl->assign('feedurl',escape(indexUrl())); + $this->tpl->assign('feedurl',escape(index_url($_SERVER))); $searchcrits=''; // Search criteria if (!empty($_GET['searchtags'])) $searchcrits.='&searchtags='.urlencode($_GET['searchtags']); elseif (!empty($_GET['searchterm'])) $searchcrits.='&searchterm='.urlencode($_GET['searchterm']); $this->tpl->assign('searchcrits',$searchcrits); - $this->tpl->assign('source',indexUrl()); + $this->tpl->assign('source',index_url($_SERVER)); $this->tpl->assign('version',shaarli_version); - $this->tpl->assign('scripturl',indexUrl()); + $this->tpl->assign('scripturl',index_url($_SERVER)); $this->tpl->assign('pagetitle','Shaarli'); $this->tpl->assign('privateonly',!empty($_SESSION['privateonly'])); // Show only private links? if (!empty($GLOBALS['title'])) $this->tpl->assign('pagetitle',$GLOBALS['title']); @@ -681,7 +621,7 @@ function showRSS() $query = $_SERVER["QUERY_STRING"]; $cache = new CachedPage( $GLOBALS['config']['PAGECACHE'], - pageUrl(), + page_url($_SERVER), startsWith($query,'do=rss') && !isLoggedIn() ); $cached = $cache->cachedVersion(); @@ -710,7 +650,7 @@ function showRSS() $nblinksToDisplay = $_GET['nb']=='all' ? count($linksToDisplay) : max($_GET['nb']+0,1) ; } - $pageaddr=escape(indexUrl()); + $pageaddr=escape(index_url($_SERVER)); echo ''; echo ''.$GLOBALS['title'].''.$pageaddr.''; echo 'Shared linksen-en'.$pageaddr.''."\n\n"; @@ -748,7 +688,7 @@ function showRSS() echo ''."\n\n"; $i++; } - echo ''; + echo ''; $cache->cache(ob_get_contents()); ob_end_flush(); @@ -769,7 +709,7 @@ function showATOM() $query = $_SERVER["QUERY_STRING"]; $cache = new CachedPage( $GLOBALS['config']['PAGECACHE'], - pageUrl(), + page_url($_SERVER), startsWith($query,'do=atom') && !isLoggedIn() ); $cached = $cache->cachedVersion(); @@ -798,7 +738,7 @@ function showATOM() $nblinksToDisplay = $_GET['nb']=='all' ? count($linksToDisplay) : max($_GET['nb']+0,1) ; } - $pageaddr=escape(indexUrl()); + $pageaddr=escape(index_url($_SERVER)); $latestDate = ''; $entries=''; $i=0; @@ -836,7 +776,7 @@ function showATOM() $feed=''; $feed.=''.$GLOBALS['title'].''; if (!$GLOBALS['config']['HIDE_TIMESTAMPS'] || isLoggedIn()) $feed.=''.escape($latestDate).''; - $feed.=''; + $feed.=''; if (!empty($GLOBALS['config']['PUBSUBHUB_URL'])) { $feed.=''; @@ -846,7 +786,7 @@ function showATOM() $feed.=''.$pageaddr.''.$pageaddr.''; $feed.=''.$pageaddr.''."\n\n"; // Yes, I know I should use a real IRI (RFC3987), but the site URL will do. $feed.=$entries; - $feed.=''; + $feed.=''; echo $feed; $cache->cache(ob_get_contents()); @@ -863,7 +803,7 @@ function showDailyRSS() { $query = $_SERVER["QUERY_STRING"]; $cache = new CachedPage( $GLOBALS['config']['PAGECACHE'], - pageUrl(), + page_url($_SERVER), startsWith($query,'do=dailyrss') && !isLoggedIn() ); $cached = $cache->cachedVersion(); @@ -908,7 +848,7 @@ function showDailyRSS() { // Build the RSS feed. header('Content-Type: application/rss+xml; charset=utf-8'); - $pageaddr = escape(indexUrl()); + $pageaddr = escape(index_url($_SERVER)); echo ''; echo ''; echo 'Daily - '. $GLOBALS['title'] . ''; @@ -921,7 +861,7 @@ function showDailyRSS() { foreach ($days as $day => $linkdates) { $daydate = linkdate2timestamp($day.'_000000'); // Full text date $rfc822date = linkdate2rfc822($day.'_000000'); - $absurl = escape(indexUrl().'?do=daily&day='.$day); // Absolute URL of the corresponding "Daily" page. + $absurl = escape(index_url($_SERVER).'?do=daily&day='.$day); // Absolute URL of the corresponding "Daily" page. // Build the HTML body of this RSS entry. $html = ''; @@ -935,7 +875,7 @@ function showDailyRSS() { $l['thumbnail'] = thumbnail($l['url']); $l['timestamp'] = linkdate2timestamp($l['linkdate']); if (startsWith($l['url'], '?')) { - $l['url'] = indexUrl() . $l['url']; // make permalink URL absolute + $l['url'] = index_url($_SERVER) . $l['url']; // make permalink URL absolute } $links[$linkdate] = $l; } @@ -951,7 +891,7 @@ function showDailyRSS() { echo $html . PHP_EOL; } - echo ''; + echo ''; $cache->cache(ob_get_contents()); ob_end_flush(); @@ -1243,7 +1183,7 @@ function renderPage() { $PAGE = new pageBuilder; $PAGE->assign('linkcount',count($LINKSDB)); - $PAGE->assign('pageabsaddr',indexUrl()); + $PAGE->assign('pageabsaddr',index_url($_SERVER)); $PAGE->renderPage('tools'); exit; } @@ -1496,12 +1436,11 @@ function renderPage() // -------- User want to post a new link: Display link edit form. if (isset($_GET['post'])) { - $url = new Url($_GET['post']); - $url->cleanup(); + $url = cleanup_url($_GET['post']); $link_is_new = false; // Check if URL is not already in database (in this case, we will edit the existing link) - $link = $LINKSDB->getLinkFromUrl((string)$url); + $link = $LINKSDB->getLinkFromUrl($url); if (!$link) { $link_is_new = true; @@ -1513,10 +1452,11 @@ function renderPage() $tags = (empty($_GET['tags']) ? '' : $_GET['tags'] ); $private = (!empty($_GET['private']) && $_GET['private'] === "1" ? 1 : 0); // If this is an HTTP(S) link, we try go get the page to extract the title (otherwise we will to straight to the edit form.) - if (empty($title) && strpos($url->getScheme(), 'http') !== false) { - list($status,$headers,$data) = getHTTP($url,4); // Short timeout to keep the application responsive. + if (empty($title) && strpos(get_url_scheme($url), 'http') !== false) { + // Short timeout to keep the application responsive + list($headers, $data) = get_http_url($url, 4); // FIXME: Decode charset according to specified in either 1) HTTP response headers or 2) in html - if (strpos($status,'200 OK')!==false) { + if (strpos($headers[0], '200 OK') !== false) { // Look for charset in html header. preg_match('##Usi', $data, $meta); @@ -1546,7 +1486,7 @@ function renderPage() $link = array( 'linkdate' => $linkdate, 'title' => $title, - 'url' => (string)$url, + 'url' => $url, 'description' => $description, 'tags' => $tags, 'private' => $private @@ -1809,7 +1749,7 @@ function buildLinkList($PAGE,$LINKSDB) if ($link["url"][0] === '?' && // Check for both signs of a note: starting with ? and 7 chars long. I doubt that you'll post any links that look like this. strlen($link["url"]) === 7) { - $link["url"] = indexUrl() . $link["url"]; + $link["url"] = index_url($_SERVER) . $link["url"]; } $linkDisp[$keys[$i]] = $link; @@ -1944,7 +1884,7 @@ function computeThumbnail($url,$href=false) if ("/talks/" !== substr($path,0,7)) return array(); // This is not a single video URL. } $sign = hash_hmac('sha256', $url, $GLOBALS['salt']); // We use the salt to sign data (it's random, secret, and specific to each installation) - return array('src'=>indexUrl().'?do=genthumbnail&hmac='.$sign.'&url='.urlencode($url), + return array('src'=>index_url($_SERVER).'?do=genthumbnail&hmac='.$sign.'&url='.urlencode($url), 'href'=>$href,'width'=>'120','style'=>'height:auto;','alt'=>'thumbnail'); } @@ -1955,7 +1895,7 @@ function computeThumbnail($url,$href=false) if ($ext=='jpg' || $ext=='jpeg' || $ext=='png' || $ext=='gif') { $sign = hash_hmac('sha256', $url, $GLOBALS['salt']); // We use the salt to sign data (it's random, secret, and specific to each installation) - return array('src'=>indexUrl().'?do=genthumbnail&hmac='.$sign.'&url='.urlencode($url), + return array('src'=>index_url($_SERVER).'?do=genthumbnail&hmac='.$sign.'&url='.urlencode($url), 'href'=>$href,'width'=>'120','style'=>'height:auto;','alt'=>'thumbnail'); } return array(); // No thumbnail. @@ -2041,11 +1981,11 @@ function install() if (!isset($_SESSION['session_tested'])) { // Step 1 : Try to store data in session and reload page. $_SESSION['session_tested'] = 'Working'; // Try to set a variable in session. - header('Location: '.indexUrl().'?test_session'); // Redirect to check stored data. + header('Location: '.index_url($_SERVER).'?test_session'); // Redirect to check stored data. } if (isset($_GET['test_session'])) { // Step 3: Sessions are OK. Remove test parameter from URL. - header('Location: '.indexUrl()); + header('Location: '.index_url($_SERVER)); } @@ -2062,7 +2002,7 @@ function install() $GLOBALS['login'] = $_POST['setlogin']; $GLOBALS['salt'] = sha1(uniqid('',true).'_'.mt_rand()); // Salt renders rainbow-tables attacks useless. $GLOBALS['hash'] = sha1($_POST['setpassword'].$GLOBALS['login'].$GLOBALS['salt']); - $GLOBALS['title'] = (empty($_POST['title']) ? 'Shared links on '.escape(indexUrl()) : $_POST['title'] ); + $GLOBALS['title'] = (empty($_POST['title']) ? 'Shared links on '.escape(index_url($_SERVER)) : $_POST['title'] ); $GLOBALS['config']['ENABLE_UPDATECHECK'] = !empty($_POST['updateCheck']); try { writeConfig($GLOBALS, isLoggedIn()); @@ -2184,8 +2124,9 @@ function genThumbnail() } else // This is a flickr page (html) { - list($httpstatus,$headers,$data) = getHTTP($url,20); // Get the flickr html page. - if (strpos($httpstatus,'200 OK')!==false) + // Get the flickr html page. + list($headers, $data) = get_http_url($url, 20); + if (strpos($headers[0], '200 OK') !== false) { // flickr now nicely provides the URL of the thumbnail in each flickr page. preg_match('! tag on that page // http://www.ted.com/talks/mikko_hypponen_fighting_viruses_defending_the_net.html // - list($httpstatus,$headers,$data) = getHTTP($url,5); - if (strpos($httpstatus,'200 OK')!==false) - { + list($headers, $data) = get_http_url($url, 5); + if (strpos($headers[0], '200 OK') !== false) { // Extract the link to the thumbnail preg_match('!link rel="image_src" href="(http://images.ted.com/images/ted/.+_\d+x\d+\.jpg)"!',$data,$matches); if (!empty($matches[1])) { // Let's download the image. $imageurl=$matches[1]; - list($httpstatus,$headers,$data) = getHTTP($imageurl,20); // No control on image size, so wait long enough. - if (strpos($httpstatus,'200 OK')!==false) - { + // No control on image size, so wait long enough + list($headers, $data) = get_http_url($imageurl, 20); + if (strpos($headers[0], '200 OK') !== false) { $filepath=$GLOBALS['config']['CACHEDIR'].'/'.$thumbname; file_put_contents($filepath,$data); // Save image to cache. if (resizeImage($filepath)) @@ -2271,17 +2209,16 @@ function genThumbnail() // There is no thumbnail available for xkcd comics, so download the whole image and resize it. // http://xkcd.com/327/ // <BLABLA> - list($httpstatus,$headers,$data) = getHTTP($url,5); - if (strpos($httpstatus,'200 OK')!==false) - { + list($headers, $data) = get_http_url($url, 5); + if (strpos($headers[0], '200 OK') !== false) { // Extract the link to the thumbnail preg_match('!