index.php

   1 <?php
   2 // Shaarli 0.0.40 beta - Shaare your links...
   3 // The personal, minimalist, super-fast, no-database delicious clone. By sebsauvage.net
   4 // http://sebsauvage.net/wiki/doku.php?id=php:shaarli
   5 // Licence: http://www.opensource.org/licenses/zlib-license.php
   6 // Requires: php 5.1.x  (but autocomplete fields will only work if you have php 5.2.x)
   7 // -----------------------------------------------------------------------------------------------
   8 // Hardcoded parameter (These parameters can be overwritten by creating the file /config/options.php)
   9 $GLOBALS['config']['DATADIR'] = 'data'; // Data subdirectory
  10 $GLOBALS['config']['CONFIG_FILE'] = $GLOBALS['config']['DATADIR'].'/config.php'; // Configuration file (user login/password)
  11 $GLOBALS['config']['DATASTORE'] = $GLOBALS['config']['DATADIR'].'/datastore.php'; // Data storage file.
  12 $GLOBALS['config']['LINKS_PER_PAGE'] = 20; // Default links per page.
  13 $GLOBALS['config']['IPBANS_FILENAME'] = $GLOBALS['config']['DATADIR'].'/ipbans.php'; // File storage for failures and bans.
  14 $GLOBALS['config']['BAN_AFTER'] = 4;        // Ban IP after this many failures.
  15 $GLOBALS['config']['BAN_DURATION'] = 1800;  // Ban duration for IP address after login failures (in seconds) (1800 sec. = 30 minutes)
  16 $GLOBALS['config']['OPEN_SHAARLI'] = false; // If true, anyone can add/edit/delete links without having to login
  17 $GLOBALS['config']['HIDE_TIMESTAMPS'] = false; // If true, the moment when links were saved are not shown to users that are not logged in.
  18 $GLOBALS['config']['ENABLE_THUMBNAILS'] = true; // Enable thumbnails in links.
  19 $GLOBALS['config']['CACHEDIR'] = 'cache'; // Cache directory for thumbnails for SLOW services (like flickr)
  20 $GLOBALS['config']['PAGECACHE'] = 'pagecache'; // Page cache directory.
  21 $GLOBALS['config']['ENABLE_LOCALCACHE'] = true; // Enable Shaarli to store thumbnail in a local cache. Disable to reduce webspace usage.
  22 $GLOBALS['config']['PUBSUBHUB_URL'] = ''; // PubSubHubbub support. Put an empty string to disable, or put your hub url here to enable.
  23 $GLOBALS['config']['UPDATECHECK_FILENAME'] = $GLOBALS['config']['DATADIR'].'/lastupdatecheck.txt'; // For updates check of Shaarli.
  24 $GLOBALS['config']['UPDATECHECK_INTERVAL'] = 86400 ; // Updates check frequency for Shaarli. 86400 seconds=24 hours
  25                                           // Note: You must have publisher.php in the same directory as Shaarli index.php
  26 // -----------------------------------------------------------------------------------------------
  27 // You should not touch below (or at your own risks !)
  28 // Optionnal config file.
  29 if (is_file($GLOBALS['config']['DATADIR'].'/options.php')) require($GLOBALS['config']['DATADIR'].'/options.php');
  30
  31 define('shaarli_version','0.0.40 beta');
  32 define('PHPPREFIX','<?php /* '); // Prefix to encapsulate data in php code.
  33 define('PHPSUFFIX',' */ ?>'); // Suffix to encapsulate data in php code.
  34
  35 // Force cookie path (but do not change lifetime)
  36 $cookie=session_get_cookie_params();
  37 $cookiedir = ''; if(dirname($_SERVER['SCRIPT_NAME'])!='/') $cookiedir=dirname($_SERVER["SCRIPT_NAME"]).'/';
  38 session_set_cookie_params($cookie['lifetime'],$cookiedir); // Set default cookie expiration and path.
  39
  40 // PHP Settings
  41 ini_set('max_input_time','60');  // High execution time in case of problematic imports/exports.
  42 ini_set('memory_limit', '128M');  // Try to set max upload file size and read (May not work on some hosts).
  43 ini_set('post_max_size', '16M');
  44 ini_set('upload_max_filesize', '16M');
  45 checkphpversion();
  46 error_reporting(E_ALL^E_WARNING);  // See all error except warnings.
  47 //error_reporting(-1); // See all errors (for debugging only)
  48
  49 include "inc/rain.tpl.class.php"; //include Rain TPL
  50 raintpl::$tpl_dir = "tpl/"; // template directory
  51 if (!is_dir('tmp')) { mkdir('tmp',0705); chmod('tmp',0705); }
  52 raintpl::$cache_dir = "tmp/"; // cache directory
  53
  54 ob_start();  // Output buffering for the page cache.
  55
  56
  57 // In case stupid admin has left magic_quotes enabled in php.ini:
  58 if (get_magic_quotes_gpc())
  59 {
  60     function stripslashes_deep($value) { $value = is_array($value) ? array_map('stripslashes_deep', $value) : stripslashes($value); return $value; }
  61     $_POST = array_map('stripslashes_deep', $_POST);
  62     $_GET = array_map('stripslashes_deep', $_GET);
  63     $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
  64 }
  65
  66 // Prevent caching on client side or proxy: (yes, it's ugly)
  67 header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
  68 header("Cache-Control: no-store, no-cache, must-revalidate");
  69 header("Cache-Control: post-check=0, pre-check=0", false);
  70 header("Pragma: no-cache");
  71
  72 // Directories creations (Note that your web host may require differents rights than 705.)
  73 if (!is_dir($GLOBALS['config']['DATADIR'])) { mkdir($GLOBALS['config']['DATADIR'],0705); chmod($GLOBALS['config']['DATADIR'],0705); }
  74 if (!is_dir('tmp')) { mkdir('tmp',0705); chmod('tmp',0705); } // For RainTPL temporary files.
  75 if (!is_file($GLOBALS['config']['DATADIR'].'/.htaccess')) { file_put_contents($GLOBALS['config']['DATADIR'].'/.htaccess',"Allow from none\nDeny from all\n"); } // Protect data files.
  76 if ($GLOBALS['config']['ENABLE_LOCALCACHE'])
  77 {
  78     if (!is_dir($GLOBALS['config']['CACHEDIR'])) { mkdir($GLOBALS['config']['CACHEDIR'],0705); chmod($GLOBALS['config']['CACHEDIR'],0705); }
  79     if (!is_file($GLOBALS['config']['CACHEDIR'].'/.htaccess')) { file_put_contents($GLOBALS['config']['CACHEDIR'].'/.htaccess',"Allow from none\nDeny from all\n"); } // Protect data files.
  80 }
  81
  82 // Run config screen if first run:
  83 if (!is_file($GLOBALS['config']['CONFIG_FILE'])) install();
  84
  85 require $GLOBALS['config']['CONFIG_FILE'];  // Read login/password hash into $GLOBALS.
  86
  87 // Handling of old config file which do not have the new parameters.
  88 if (empty($GLOBALS['title'])) $GLOBALS['title']='Shared links on '.htmlspecialchars(indexUrl());
  89 if (empty($GLOBALS['timezone'])) $GLOBALS['timezone']=date_default_timezone_get();
  90 if (empty($GLOBALS['disablesessionprotection'])) $GLOBALS['disablesessionprotection']=false;
  91
  92
  93 autoLocale(); // Sniff browser language and set date format accordingly.
  94 header('Content-Type: text/html; charset=utf-8'); // We use UTF-8 for proper international characters handling.
  95
  96 // Check php version
  97 function checkphpversion()
  98 {
  99     if (version_compare(PHP_VERSION, '5.1.0') < 0)
 100     {
 101         header('Content-Type: text/plain; charset=utf-8');
 102         echo 'Your server supports php '.PHP_VERSION.'. Shaarli requires at least php 5.1.0, and thus cannot run. Sorry.';
 103         exit;
 104     }
 105 }
 106
 107 // Checks if an update is available for Shaarli.
 108 // (at most once a day, and only for registered user.)
 109 // Output: '' = no new version.
 110 //         other= the available version.
 111 function checkUpdate()
 112 {
 113     if (!isLoggedIn()) return ''; // Do not check versions for visitors.
 114
 115     // Get latest version number at most once a day.
 116     if (!is_file($GLOBALS['config']['UPDATECHECK_FILENAME']) || (filemtime($GLOBALS['config']['UPDATECHECK_FILENAME'])<time()-($GLOBALS['config']['UPDATECHECK_INTERVAL'])))
 117     {
 118         $version=shaarli_version;
 119         list($httpstatus,$headers,$data) = getHTTP('http://sebsauvage.net/files/shaarli_version.txt',2);
 120         if (strpos($httpstatus,'200 OK')!==false) $version=$data;
 121         // If failed, nevermind. We don't want to bother the user with that.
 122         file_put_contents($GLOBALS['config']['UPDATECHECK_FILENAME'],$version); // touch file date
 123     }
 124     // Compare versions:
 125     $newestversion=file_get_contents($GLOBALS['config']['UPDATECHECK_FILENAME']);
 126     if (version_compare($newestversion,shaarli_version)==1) return $newestversion;
 127     return '';
 128 }
 129
 130
 131 // -----------------------------------------------------------------------------------------------
 132 // Simple cache system (mainly for the RSS/ATOM feeds).
 133
 134 class pageCache
 135 {
 136     private $url; // Full URL of the page to cache (typically the value returned by pageUrl())
 137     private $shouldBeCached; // boolean: Should this url be cached ?
 138     private $filename; // Name of the cache file for this url
 139
 140     /*
 141          $url = url (typically the value returned by pageUrl())
 142          $shouldBeCached = boolean. If false, the cache will be disabled.
 143     */
 144     public function __construct($url,$shouldBeCached)
 145     {
 146         $this->url = $url;
 147         $this->filename = $GLOBALS['config']['PAGECACHE'].'/'.sha1($url).'.cache';
 148         $this->shouldBeCached = $shouldBeCached;
 149     }
 150
 151     // If the page should be cached and a cached version exists,
 152     // returns the cached version (otherwise, return null).
 153     public function cachedVersion()
 154     {
 155         if (!$this->shouldBeCached) return null;
 156         if (is_file($this->filename)) { return file_get_contents($this->filename); exit; }
 157         return null;
 158     }
 159
 160     // Put a page in the cache.
 161     public function cache($page)
 162     {
 163         if (!$this->shouldBeCached) return;
 164         if (!is_dir($GLOBALS['config']['PAGECACHE'])) { mkdir($GLOBALS['config']['PAGECACHE'],0705); chmod($GLOBALS['config']['PAGECACHE'],0705); }
 165         file_put_contents($this->filename,$page);
 166     }
 167
 168     // Purge the whole cache.
 169     // (call with pageCache::purgeCache())
 170     public static function purgeCache()
 171     {
 172         if (is_dir($GLOBALS['config']['PAGECACHE']))
 173         {
 174             $handler = opendir($GLOBALS['config']['PAGECACHE']);
 175             if ($handler!==false)
 176             {
 177                 while (($filename = readdir($handler))!==false)
 178                 {
 179                     if (endsWith($filename,'.cache')) { unlink($GLOBALS['config']['PAGECACHE'].'/'.$filename); }
 180                 }
 181                 closedir($handler);
 182             }
 183         }
 184     }
 185
 186 }
 187
 188
 189 // -----------------------------------------------------------------------------------------------
 190 // Log to text file
 191 function logm($message)
 192 {
 193     $t = strval(date('Y/m/d_H:i:s')).' - '.$_SERVER["REMOTE_ADDR"].' - '.strval($message)."\n";
 194     file_put_contents($GLOBALS['config']['DATADIR'].'/log.txt',$t,FILE_APPEND);
 195 }
 196
 197 // Same as nl2br(), but escapes < and >
 198 function nl2br_escaped($html)
 199 {
 200     return str_replace('>','&gt;',str_replace('<','&lt;',nl2br($html)));
 201 }
 202
 203 /* Returns the small hash of a string
 204    eg. smallHash('20111006_131924') --> yZH23w
 205    Small hashes:
 206      - are unique (well, as unique as crc32, at last)
 207      - are always 6 characters long.
 208      - only use the following characters: a-z A-Z 0-9 - _ @
 209      - are NOT cryptographically secure (they CAN be forged)
 210    In Shaarli, they are used as a tinyurl-like link to individual entries.
 211 */
 212 function smallHash($text)
 213 {
 214     $t = rtrim(base64_encode(hash('crc32',$text,true)),'=');
 215     $t = str_replace('+','-',$t); // Get rid of characters which need encoding in URLs.
 216     $t = str_replace('/','_',$t);
 217     $t = str_replace('=','@',$t);
 218     return $t;
 219 }
 220
 221 // In a string, converts urls to clickable links.
 222 // Function inspired from http://www.php.net/manual/en/function.preg-replace.php#85722
 223 function text2clickable($url)
 224 {
 225     $redir = empty($GLOBALS['redirector']) ? '' : $GLOBALS['redirector'];
 226     return preg_replace('!(((?:https?|ftp|file)://|apt:|magnet:)\S+[[:alnum:]]/?)!si','<a href="'.$redir.'$1" rel="nofollow">$1</a>',$url);
 227 }
 228
 229 // This function inserts &nbsp; where relevant so that multiple spaces are properly displayed in HTML
 230 // even in the absence of <pre>  (This is used in description to keep text formatting)
 231 function keepMultipleSpaces($text)
 232 {
 233     return str_replace('  ',' &nbsp;',$text);
 234
 235 }
 236 // ------------------------------------------------------------------------------------------
 237 // Sniff browser language to display dates in the right format automatically.
 238 // (Note that is may not work on your server if the corresponding local is not installed.)
 239 function autoLocale()
 240 {
 241     $loc='en_US'; // Default if browser does not send HTTP_ACCEPT_LANGUAGE
 242     if (isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])) // eg. "fr,fr-fr;q=0.8,en;q=0.5,en-us;q=0.3"
 243     {   // (It's a bit crude, but it works very well. Prefered language is always presented first.)
 244         if (preg_match('/([a-z]{2}(-[a-z]{2})?)/i',$_SERVER['HTTP_ACCEPT_LANGUAGE'],$matches)) $loc=$matches[1];
 245     }
 246     setlocale(LC_TIME,$loc);  // LC_TIME = Set local for date/time format only.
 247 }
 248
 249 // ------------------------------------------------------------------------------------------
 250 // PubSubHubbub protocol support (if enabled)  [UNTESTED]
 251 // (Source: http://aldarone.fr/les-flux-rss-shaarli-et-pubsubhubbub/ )
 252 if (!empty($GLOBALS['config']['PUBSUBHUB_URL'])) include './publisher.php';
 253 function pubsubhub()
 254 {
 255     if (!empty($GLOBALS['config']['PUBSUBHUB_URL']))
 256     {
 257        $p = new Publisher($GLOBALS['config']['PUBSUBHUB_URL']);
 258        $topic_url = array (
 259                        indexUrl().'?do=atom',
 260                        indexUrl().'?do=rss'
 261                     );
 262        $p->publish_update($topic_url);
 263     }
 264 }
 265
 266 // ------------------------------------------------------------------------------------------
 267 // Session management
 268 define('INACTIVITY_TIMEOUT',3600); // (in seconds). If the user does not access any page within this time, his/her session is considered expired.
 269 ini_set('session.use_cookies', 1);       // Use cookies to store session.
 270 ini_set('session.use_only_cookies', 1);  // Force cookies for session (phpsessionID forbidden in URL)
 271 ini_set('session.use_trans_sid', false); // Prevent php to use sessionID in URL if cookies are disabled.
 272 session_name('shaarli');
 273 session_start();
 274
 275 // Returns the IP address of the client (Used to prevent session cookie hijacking.)
 276 function allIPs()
 277 {
 278     $ip = $_SERVER["REMOTE_ADDR"];
 279     // Then we use more HTTP headers to prevent session hijacking from users behind the same proxy.
 280     if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) { $ip=$ip.'_'.$_SERVER['HTTP_X_FORWARDED_FOR']; }
 281     if (isset($_SERVER['HTTP_CLIENT_IP'])) { $ip=$ip.'_'.$_SERVER['HTTP_CLIENT_IP']; }
 282     return $ip;
 283 }
 284
 285 // Check that user/password is correct.
 286 function check_auth($login,$password)
 287 {
 288     $hash = sha1($password.$login.$GLOBALS['salt']);
 289     if ($login==$GLOBALS['login'] && $hash==$GLOBALS['hash'])
 290     {   // Login/password is correct.
 291         $_SESSION['uid'] = sha1(uniqid('',true).'_'.mt_rand()); // generate unique random number (different than phpsessionid)
 292         $_SESSION['ip']=allIPs();                // We store IP address(es) of the client to make sure session is not hijacked.
 293         $_SESSION['username']=$login;
 294         $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT;  // Set session expiration.
 295         logm('Login successful');
 296         return True;
 297     }
 298     logm('Login failed for user '.$login);
 299     return False;
 300 }
 301
 302 // Returns true if the user is logged in.
 303 function isLoggedIn()
 304 {
 305     if ($GLOBALS['config']['OPEN_SHAARLI']) return true;
 306
 307     // If session does not exist on server side, or IP address has changed, or session has expired, logout.
 308     if (empty($_SESSION['uid']) || ($GLOBALS['disablesessionprotection']==false && $_SESSION['ip']!=allIPs()) || time()>=$_SESSION['expires_on'])
 309     {
 310         logout();
 311         return false;
 312     }
 313     if (!empty($_SESSION['longlastingsession']))  $_SESSION['expires_on']=time()+$_SESSION['longlastingsession']; // In case of "Stay signed in" checked.
 314     else $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT; // Standard session expiration date.
 315
 316     return true;
 317 }
 318
 319 // Force logout.
 320 function logout() { if (isset($_SESSION)) { unset($_SESSION['uid']); unset($_SESSION['ip']); unset($_SESSION['username']);}  }
 321
 322
 323 // ------------------------------------------------------------------------------------------
 324 // Brute force protection system
 325 // Several consecutive failed logins will ban the IP address for 30 minutes.
 326 if (!is_file($GLOBALS['config']['IPBANS_FILENAME'])) file_put_contents($GLOBALS['config']['IPBANS_FILENAME'], "<?php\n\$GLOBALS['IPBANS']=".var_export(array('FAILURES'=>array(),'BANS'=>array()),true).";\n?>");
 327 include $GLOBALS['config']['IPBANS_FILENAME'];
 328 // Signal a failed login. Will ban the IP if too many failures:
 329 function ban_loginFailed()
 330 {
 331     $ip=$_SERVER["REMOTE_ADDR"]; $gb=$GLOBALS['IPBANS'];
 332     if (!isset($gb['FAILURES'][$ip])) $gb['FAILURES'][$ip]=0;
 333     $gb['FAILURES'][$ip]++;
 334     if ($gb['FAILURES'][$ip]>($GLOBALS['config']['BAN_AFTER']-1))
 335     {
 336         $gb['BANS'][$ip]=time()+$GLOBALS['config']['BAN_DURATION'];
 337         logm('IP address banned from login');
 338     }
 339     $GLOBALS['IPBANS'] = $gb;
 340     file_put_contents($GLOBALS['config']['IPBANS_FILENAME'], "<?php\n\$GLOBALS['IPBANS']=".var_export($gb,true).";\n?>");
 341 }
 342
 343 // Signals a successful login. Resets failed login counter.
 344 function ban_loginOk()
 345 {
 346     $ip=$_SERVER["REMOTE_ADDR"]; $gb=$GLOBALS['IPBANS'];
 347     unset($gb['FAILURES'][$ip]); unset($gb['BANS'][$ip]);
 348     $GLOBALS['IPBANS'] = $gb;
 349     file_put_contents($GLOBALS['config']['IPBANS_FILENAME'], "<?php\n\$GLOBALS['IPBANS']=".var_export($gb,true).";\n?>");
 350 }
 351
 352 // Checks if the user CAN login. If 'true', the user can try to login.
 353 function ban_canLogin()
 354 {
 355     $ip=$_SERVER["REMOTE_ADDR"]; $gb=$GLOBALS['IPBANS'];
 356     if (isset($gb['BANS'][$ip]))
 357     {
 358         // User is banned. Check if the ban has expired:
 359         if ($gb['BANS'][$ip]<=time())
 360         {   // Ban expired, user can try to login again.
 361             logm('Ban lifted.');
 362             unset($gb['FAILURES'][$ip]); unset($gb['BANS'][$ip]);
 363             file_put_contents($GLOBALS['config']['IPBANS_FILENAME'], "<?php\n\$GLOBALS['IPBANS']=".var_export($gb,true).";\n?>");
 364             return true; // Ban has expired, user can login.
 365         }
 366         return false; // User is banned.
 367     }
 368     return true; // User is not banned.
 369 }
 370
 371 // ------------------------------------------------------------------------------------------
 372 // Process login form: Check if login/password is correct.
 373 if (isset($_POST['login']))
 374 {
 375     if (!ban_canLogin()) die('I said: NO. You are banned for the moment. Go away.');
 376     if (isset($_POST['password']) && tokenOk($_POST['token']) && (check_auth($_POST['login'], $_POST['password'])))
 377     {   // Login/password is ok.
 378         ban_loginOk();
 379         // If user wants to keep the session cookie even after the browser closes:
 380         if (!empty($_POST['longlastingsession']))
 381         {
 382             $_SESSION['longlastingsession']=31536000;  // (31536000 seconds = 1 year)
 383             $_SESSION['expires_on']=time()+$_SESSION['longlastingsession'];  // Set session expiration on server-side.
 384
 385             $cookiedir = ''; if(dirname($_SERVER['SCRIPT_NAME'])!='/') $cookiedir=dirname($_SERVER["SCRIPT_NAME"]).'/';
 386             session_set_cookie_params($_SESSION['longlastingsession'],$cookiedir); // Set session cookie expiration on client side
 387             // Note: Never forget the trailing slash on the cookie path !
 388             session_regenerate_id(true);  // Send cookie with new expiration date to browser.
 389         }
 390         else // Standard session expiration (=when browser closes)
 391         {
 392             $cookiedir = ''; if(dirname($_SERVER['SCRIPT_NAME'])!='/') $cookiedir=dirname($_SERVER["SCRIPT_NAME"]).'/';
 393             session_set_cookie_params(0,$cookiedir); // 0 means "When browser closes"
 394             session_regenerate_id(true);
 395         }
 396         // Optional redirect after login:
 397         if (isset($_GET['post'])) { header('Location: ?post='.urlencode($_GET['post']).(!empty($_GET['title'])?'&title='.urlencode($_GET['title']):'').(!empty($_GET['source'])?'&source='.urlencode($_GET['source']):'')); exit; }
 398         if (isset($_POST['returnurl']))
 399         {
 400             if (endsWith($_POST['returnurl'],'?do=login')) { header('Location: ?'); exit; } // Prevent loops over login screen.
 401             header('Location: '.$_POST['returnurl']); exit;
 402         }
 403         header('Location: ?'); exit;
 404     }
 405     else
 406     {
 407         ban_loginFailed();
 408         echo '<script language="JavaScript">alert("Wrong login/password.");document.location=\'?do=login\';</script>'; // Redirect to login screen.
 409         exit;
 410     }
 411 }
 412
 413 // ------------------------------------------------------------------------------------------
 414 // Misc utility functions:
 415
 416 // Returns the server URL (including port and http/https), without path.
 417 // eg. "http://myserver.com:8080"
 418 // You can append $_SERVER['SCRIPT_NAME'] to get the current script URL.
 419 function serverUrl()
 420 {
 421     $https = (!empty($_SERVER['HTTPS']) && (strtolower($_SERVER['HTTPS'])=='on')) || $_SERVER["SERVER_PORT"]=='443'; // HTTPS detection.
 422     $serverport = ($_SERVER["SERVER_PORT"]=='80' || ($https && $_SERVER["SERVER_PORT"]=='443') ? '' : ':'.$_SERVER["SERVER_PORT"]);
 423     return 'http'.($https?'s':'').'://'.$_SERVER["SERVER_NAME"].$serverport;
 424 }
 425
 426 // Returns the absolute URL of current script, without the query.
 427 // (eg. http://sebsauvage.net/links/)
 428 function indexUrl()
 429 {
 430     return serverUrl() . ($_SERVER["SCRIPT_NAME"] == '/index.php' ? '/' : $_SERVER["SCRIPT_NAME"]);
 431 }
 432
 433 // Returns the absolute URL of current script, WITH the query.
 434 // (eg. http://sebsauvage.net/links/?toto=titi&spamspamspam=humbug)
 435 function pageUrl()
 436 {
 437     return indexUrl().(!empty($_SERVER["QUERY_STRING"]) ? '?'.$_SERVER["QUERY_STRING"] : '');
 438 }
 439
 440 // Convert post_max_size/upload_max_filesize (eg.'16M') parameters to bytes.
 441 function return_bytes($val)
 442 {
 443     $val = trim($val); $last=strtolower($val[strlen($val)-1]);
 444     switch($last)
 445     {
 446         case 'g': $val *= 1024;
 447         case 'm': $val *= 1024;
 448         case 'k': $val *= 1024;
 449     }
 450     return $val;
 451 }
 452
 453 // Try to determine max file size for uploads (POST).
 454 // Returns an integer (in bytes)
 455 function getMaxFileSize()
 456 {
 457     $size1 = return_bytes(ini_get('post_max_size'));
 458     $size2 = return_bytes(ini_get('upload_max_filesize'));
 459     // Return the smaller of two:
 460     $maxsize = min($size1,$size2);
 461     // FIXME: Then convert back to readable notations ? (eg. 2M instead of 2000000)
 462     return $maxsize;
 463 }
 464
 465 // Tells if a string start with a substring or not.
 466 function startsWith($haystack,$needle,$case=true)
 467 {
 468     if($case){return (strcmp(substr($haystack, 0, strlen($needle)),$needle)===0);}
 469     return (strcasecmp(substr($haystack, 0, strlen($needle)),$needle)===0);
 470 }
 471
 472 // Tells if a string ends with a substring or not.
 473 function endsWith($haystack,$needle,$case=true)
 474 {
 475     if($case){return (strcmp(substr($haystack, strlen($haystack) - strlen($needle)),$needle)===0);}
 476     return (strcasecmp(substr($haystack, strlen($haystack) - strlen($needle)),$needle)===0);
 477 }
 478
 479 /*  Converts a linkdate time (YYYYMMDD_HHMMSS) of an article to a timestamp (Unix epoch)
 480     (used to build the ADD_DATE attribute in Netscape-bookmarks file)
 481     PS: I could have used strptime(), but it does not exist on Windows. I'm too kind. */
 482 function linkdate2timestamp($linkdate)
 483 {
 484     $Y=$M=$D=$h=$m=$s=0;
 485     $r = sscanf($linkdate,'%4d%2d%2d_%2d%2d%2d',$Y,$M,$D,$h,$m,$s);
 486     return mktime($h,$m,$s,$M,$D,$Y);
 487 }
 488
 489 /*  Converts a linkdate time (YYYYMMDD_HHMMSS) of an article to a RFC822 date.
 490     (used to build the pubDate attribute in RSS feed.)  */
 491 function linkdate2rfc822($linkdate)
 492 {
 493     return date('r',linkdate2timestamp($linkdate)); // 'r' is for RFC822 date format.
 494 }
 495
 496 /*  Converts a linkdate time (YYYYMMDD_HHMMSS) of an article to a ISO 8601 date.
 497     (used to build the updated tags in ATOM feed.)  */
 498 function linkdate2iso8601($linkdate)
 499 {
 500     return date('c',linkdate2timestamp($linkdate)); // 'c' is for ISO 8601 date format.
 501 }
 502
 503 /*  Converts a linkdate time (YYYYMMDD_HHMMSS) of an article to a localized date format.
 504     (used to display link date on screen)
 505     The date format is automatically chosen according to locale/languages sniffed from browser headers (see autoLocale()). */
 506 function linkdate2locale($linkdate)
 507 {
 508     return utf8_encode(strftime('%c',linkdate2timestamp($linkdate))); // %c is for automatic date format according to locale.
 509     // Note that if you use a local which is not installed on your webserver,
 510     // the date will not be displayed in the chosen locale, but probably in US notation.
 511 }
 512
 513 // Parse HTTP response headers and return an associative array.
 514 function http_parse_headers_shaarli( $headers )
 515 {
 516     $res=array();
 517     foreach($headers as $header)
 518     {
 519         $i = strpos($header,': ');
 520         if ($i!==false)
 521         {
 522             $key=substr($header,0,$i);
 523             $value=substr($header,$i+2,strlen($header)-$i-2);
 524             $res[$key]=$value;
 525         }
 526     }
 527     return $res;
 528 }
 529
 530 /* GET an URL.
 531    Input: $url : url to get (http://...)
 532           $timeout : Network timeout (will wait this many seconds for an anwser before giving up).
 533    Output: An array.  [0] = HTTP status message (eg. "HTTP/1.1 200 OK") or error message
 534                       [1] = associative array containing HTTP response headers (eg. echo getHTTP($url)[1]['Content-Type'])
 535                       [2] = data
 536     Example: list($httpstatus,$headers,$data) = getHTTP('http://sebauvage.net/');
 537              if (strpos($httpstatus,'200 OK')!==false)
 538                  echo 'Data type: '.htmlspecialchars($headers['Content-Type']);
 539              else
 540                  echo 'There was an error: '.htmlspecialchars($httpstatus)
 541 */
 542 function getHTTP($url,$timeout=30)
 543 {
 544     try
 545     {
 546         $options = array('http'=>array('method'=>'GET','timeout' => $timeout)); // Force network timeout
 547         $context = stream_context_create($options);
 548         $data=file_get_contents($url,false,$context,-1, 4000000); // We download at most 4 Mb from source.
 549         if (!$data) { return array('HTTP Error',array(),''); }
 550         $httpStatus=$http_response_header[0]; // eg. "HTTP/1.1 200 OK"
 551         $responseHeaders=http_parse_headers_shaarli($http_response_header);
 552         return array($httpStatus,$responseHeaders,$data);
 553     }
 554     catch (Exception $e)  // getHTTP *can* fail silentely (we don't care if the title cannot be fetched)
 555     {
 556         return array($e->getMessage(),'','');
 557     }
 558 }
 559
 560 // Extract title from an HTML document.
 561 // (Returns an empty string if not found.)
 562 function html_extract_title($html)
 563 {
 564   return preg_match('!<title>(.*?)</title>!is', $html, $matches) ? trim(str_replace("\n",' ', $matches[1])) : '' ;
 565 }
 566
 567 // ------------------------------------------------------------------------------------------
 568 // Token management for XSRF protection
 569 // Token should be used in any form which acts on data (create,update,delete,import...).
 570 if (!isset($_SESSION['tokens'])) $_SESSION['tokens']=array();  // Token are attached to the session.
 571
 572 // Returns a token.
 573 function getToken()
 574 {
 575     $rnd = sha1(uniqid('',true).'_'.mt_rand());  // We generate a random string.
 576     $_SESSION['tokens'][$rnd]=1;  // Store it on the server side.
 577     return $rnd;
 578 }
 579
 580 // Tells if a token is ok. Using this function will destroy the token.
 581 // true=token is ok.
 582 function tokenOk($token)
 583 {
 584     if (isset($_SESSION['tokens'][$token]))
 585     {
 586         unset($_SESSION['tokens'][$token]); // Token is used: destroy it.
 587         return true; // Token is ok.
 588     }
 589     return false; // Wrong token, or already used.
 590 }
 591
 592 // ------------------------------------------------------------------------------------------
 593 /* This class is in charge of building the final page.
 594    (This is basically a wrapper around RainTPL which pre-fills some fields.)
 595    p = new pageBuilder;
 596    p.assign('myfield','myvalue');
 597    p.renderPage('mytemplate');
 598
 599 */
 600 class pageBuilder
 601 {
 602     private $tpl; // RainTPL template
 603
 604     function __construct()
 605     {
 606         $this->tpl=false;
 607     }
 608
 609     private function initialize()
 610     {
 611         $this->tpl = new RainTPL;
 612         $this->tpl->assign('newversion',checkUpdate());
 613         $this->tpl->assign('feedurl',htmlspecialchars(indexUrl()));
 614         $searchcrits=''; // Search criteria
 615         if (!empty($_GET['searchtags'])) $searchcrits.='&searchtags='.urlencode($_GET['searchtags']);
 616         elseif (!empty($_GET['searchterm'])) $searchcrits.='&searchterm='.urlencode($_GET['searchterm']);
 617         $this->tpl->assign('searchcrits',$searchcrits);
 618         $this->tpl->assign('source',indexUrl());
 619         $this->tpl->assign('version',shaarli_version);
 620         $this->tpl->assign('scripturl',indexUrl());
 621         $this->tpl->assign('pagetitle','Shaarli');
 622         $this->tpl->assign('privateonly',!empty($_SESSION['privateonly'])); // Show only private links ?
 623         if (!empty($GLOBALS['title'])) $this->tpl->assign('pagetitle',$GLOBALS['title']);
 624         if (!empty($GLOBALS['pagetitle'])) $this->tpl->assign('pagetitle',$GLOBALS['pagetitle']);
 625         $this->tpl->assign('shaarlititle',empty($GLOBALS['title']) ? 'Shaarli': $GLOBALS['title'] );
 626         return;
 627     }
 628
 629     // The following assign() method is basically the same as RainTPL (except that it's lazy)
 630     public function assign($what,$where)
 631     {
 632         if ($this->tpl===false) $this->initialize(); // Lazy initialization
 633         $this->tpl->assign($what,$where);
 634     }
 635
 636     // Render a specific page (using a template).
 637     // eg. pb.renderPage('picwall')
 638     public function renderPage($page)
 639     {
 640         if ($this->tpl===false) $this->initialize(); // Lazy initialization
 641         $this->tpl->draw($page);
 642     }
 643 }
 644
 645 // ------------------------------------------------------------------------------------------
 646 /* Data storage for links.
 647    This object behaves like an associative array.
 648    Example:
 649       $mylinks = new linkdb();
 650       echo $mylinks['20110826_161819']['title'];
 651       foreach($mylinks as $link)
 652          echo $link['title'].' at url '.$link['url'].' ; description:'.$link['description'];
 653
 654    Available keys:
 655        title : Title of the link
 656        url : URL of the link. Can be absolute or relative. Relative URLs are permalinks (eg.'?m-ukcw')
 657        description : description of the entry
 658        private : Is this link private ? 0=no, other value=yes
 659        linkdate : date of the creation of this entry, in the form YYYYMMDD_HHMMSS (eg.'20110914_192317')
 660        tags : tags attached to this entry (separated by spaces)
 661
 662    We implement 3 interfaces:
 663      - ArrayAccess so that this object behaves like an associative array.
 664      - Iterator so that this object can be used in foreach() loops.
 665      - Countable interface so that we can do a count() on this object.
 666 */
 667 class linkdb implements Iterator, Countable, ArrayAccess
 668 {
 669     private $links; // List of links (associative array. Key=linkdate (eg. "20110823_124546"), value= associative array (keys:title,description...)
 670     private $urls;  // List of all recorded URLs (key=url, value=linkdate) for fast reserve search (url-->linkdate)
 671     private $keys;  // List of linkdate keys (for the Iterator interface implementation)
 672     private $position; // Position in the $this->keys array. (for the Iterator interface implementation.)
 673     private $loggedin; // Is the used logged in ? (used to filter private links)
 674
 675     // Constructor:
 676     function __construct($isLoggedIn)
 677     // Input : $isLoggedIn : is the used logged in ?
 678     {
 679         $this->loggedin = $isLoggedIn;
 680         $this->checkdb(); // Make sure data file exists.
 681         $this->readdb();  // Then read it.
 682     }
 683
 684     // ---- Countable interface implementation
 685     public function count() { return count($this->links); }
 686
 687     // ---- ArrayAccess interface implementation
 688     public function offsetSet($offset, $value)
 689     {
 690         if (!$this->loggedin) die('You are not authorized to add a link.');
 691         if (empty($value['linkdate']) || empty($value['url'])) die('Internal Error: A link should always have a linkdate and url.');
 692         if (empty($offset)) die('You must specify a key.');
 693         $this->links[$offset] = $value;
 694         $this->urls[$value['url']]=$offset;
 695     }
 696     public function offsetExists($offset) { return array_key_exists($offset,$this->links); }
 697     public function offsetUnset($offset)
 698     {
 699         if (!$this->loggedin) die('You are not authorized to delete a link.');
 700         $url = $this->links[$offset]['url']; unset($this->urls[$url]);
 701         unset($this->links[$offset]);
 702     }
 703     public function offsetGet($offset) { return isset($this->links[$offset]) ? $this->links[$offset] : null; }
 704
 705     // ---- Iterator interface implementation
 706     function rewind() { $this->keys=array_keys($this->links); rsort($this->keys); $this->position=0; } // Start over for iteration, ordered by date (latest first).
 707     function key() { return $this->keys[$this->position]; } // current key
 708     function current() { return $this->links[$this->keys[$this->position]]; } // current value
 709     function next() { ++$this->position; } // go to next item
 710     function valid() { return isset($this->keys[$this->position]); }    // Check if current position is valid.
 711
 712     // ---- Misc methods
 713     private function checkdb() // Check if db directory and file exists.
 714     {
 715         if (!file_exists($GLOBALS['config']['DATASTORE'])) // Create a dummy database for example.
 716         {
 717              $this->links = array();
 718              $link = array('title'=>'Shaarli - sebsauvage.net','url'=>'http://sebsauvage.net/wiki/doku.php?id=php:shaarli','description'=>'Welcome to Shaarli ! This is a bookmark. To edit or delete me, you must first login.','private'=>0,'linkdate'=>'20110914_190000','tags'=>'opensource software');
 719              $this->links[$link['linkdate']] = $link;
 720              $link = array('title'=>'My secret stuff... - Pastebin.com','url'=>'http://pastebin.com/smCEEeSn','description'=>'SShhhh!!  I\'m a private link only YOU can see. You can delete me too.','private'=>1,'linkdate'=>'20110914_074522','tags'=>'secretstuff');
 721              $this->links[$link['linkdate']] = $link;
 722              file_put_contents($GLOBALS['config']['DATASTORE'], PHPPREFIX.base64_encode(gzdeflate(serialize($this->links))).PHPSUFFIX); // Write database to disk
 723         }
 724     }
 725
 726     // Read database from disk to memory
 727     private function readdb()
 728     {
 729         // Read data
 730         $this->links=(file_exists($GLOBALS['config']['DATASTORE']) ? unserialize(gzinflate(base64_decode(substr(file_get_contents($GLOBALS['config']['DATASTORE']),strlen(PHPPREFIX),-strlen(PHPSUFFIX))))) : array() );
 731         // Note that gzinflate is faster than gzuncompress. See: http://www.php.net/manual/en/function.gzdeflate.php#96439
 732
 733         // If user is not logged in, filter private links.
 734         if (!$this->loggedin)
 735         {
 736             $toremove=array();
 737             foreach($this->links as $link) { if ($link['private']!=0) $toremove[]=$link['linkdate']; }
 738             foreach($toremove as $linkdate) { unset($this->links[$linkdate]); }
 739         }
 740
 741         // Keep the list of the mapping URLs-->linkdate up-to-date.
 742         $this->urls=array();
 743         foreach($this->links as $link) { $this->urls[$link['url']]=$link['linkdate']; }
 744     }
 745
 746     // Save database from memory to disk.
 747     public function savedb()
 748     {
 749         if (!$this->loggedin) die('You are not authorized to change the database.');
 750         file_put_contents($GLOBALS['config']['DATASTORE'], PHPPREFIX.base64_encode(gzdeflate(serialize($this->links))).PHPSUFFIX);
 751         invalidateCaches();
 752     }
 753
 754     // Returns the link for a given URL (if it exists). false it does not exist.
 755     public function getLinkFromUrl($url)
 756     {
 757         if (isset($this->urls[$url])) return $this->links[$this->urls[$url]];
 758         return false;
 759     }
 760
 761     // Case insentitive search among links (in url, title and description). Returns filtered list of links.
 762     // eg. print_r($mydb->filterFulltext('hollandais'));
 763     public function filterFulltext($searchterms)
 764     {
 765         // FIXME: explode(' ',$searchterms) and perform a AND search.
 766         // FIXME: accept double-quotes to search for a string "as is" ?
 767         $filtered=array();
 768         $s = strtolower($searchterms);
 769         foreach($this->links as $l)
 770         {
 771             $found=   (strpos(strtolower($l['title']),$s)!==false)
 772                    || (strpos(strtolower($l['description']),$s)!==false)
 773                    || (strpos(strtolower($l['url']),$s)!==false)
 774                    || (strpos(strtolower($l['tags']),$s)!==false);
 775             if ($found) $filtered[$l['linkdate']] = $l;
 776         }
 777         krsort($filtered);
 778         return $filtered;
 779     }
 780
 781     // Filter by tag.
 782     // You can specify one or more tags (tags can be separated by space or comma).
 783     // eg. print_r($mydb->filterTags('linux programming'));
 784     public function filterTags($tags,$casesensitive=false)
 785     {
 786         $t = str_replace(',',' ',($casesensitive?$tags:strtolower($tags)));
 787         $searchtags=explode(' ',$t);
 788         $filtered=array();
 789         foreach($this->links as $l)
 790         {
 791             $linktags = explode(' ',($casesensitive?$l['tags']:strtolower($l['tags'])));
 792             if (count(array_intersect($linktags,$searchtags)) == count($searchtags))
 793                 $filtered[$l['linkdate']] = $l;
 794         }
 795         krsort($filtered);
 796         return $filtered;
 797     }
 798
 799     // Filter by day. Day must be in the form 'YYYYMMDD' (eg. '20120125')
 800     // Sort order is: older articles first.
 801     // eg. print_r($mydb->filterDay('20120125'));
 802     public function filterDay($day)
 803     {
 804         $filtered=array();
 805         foreach($this->links as $l)
 806         {
 807             if (startsWith($l['linkdate'],$day)) $filtered[$l['linkdate']] = $l;
 808         }
 809         ksort($filtered);
 810         return $filtered;
 811     }
 812     // Filter by smallHash.
 813     // Only 1 article is returned.
 814     public function filterSmallHash($smallHash)
 815     {
 816         $filtered=array();
 817         foreach($this->links as $l)
 818         {
 819             if ($smallHash==smallHash($l['linkdate'])) // Yes, this is ugly and slow
 820             {
 821                 $filtered[$l['linkdate']] = $l;
 822                 return $filtered;
 823             }
 824         }
 825         return $filtered;
 826     }
 827
 828     // Returns the list of all tags
 829     // Output: associative array key=tags, value=0
 830     public function allTags()
 831     {
 832         $tags=array();
 833         foreach($this->links as $link)
 834             foreach(explode(' ',$link['tags']) as $tag)
 835                 if (!empty($tag)) $tags[$tag]=(empty($tags[$tag]) ? 1 : $tags[$tag]+1);
 836         arsort($tags); // Sort tags by usage (most used tag first)
 837         return $tags;
 838     }
 839
 840     // Returns the list of days containing articles (oldest first)
 841     // Output: An array containing days (in format YYYYMMDD).
 842     public function days()
 843     {
 844         $linkdays=array();
 845         foreach(array_keys($this->links) as $day)
 846         {
 847             $linkdays[substr($day,0,8)]=0;
 848         }
 849         $linkdays=array_keys($linkdays);
 850         sort($linkdays);
 851         return $linkdays;
 852     }
 853 }
 854
 855 // ------------------------------------------------------------------------------------------
 856 // Ouput the last 50 links in RSS 2.0 format.
 857 function showRSS()
 858 {
 859     header('Content-Type: application/rss+xml; charset=utf-8');
 860
 861     // $usepermalink : If true, use permalink instead of final link.
 862     // User just has to add 'permalink' in URL parameters. eg. http://mysite.com/shaarli/?do=rss&permalinks
 863     $usepermalinks = isset($_GET['permalinks']);
 864
 865     // Cache system
 866     $query = $_SERVER["QUERY_STRING"];
 867     $cache = new pageCache(pageUrl(),startsWith($query,'do=rss') && !isLoggedIn());
 868     $cached = $cache->cachedVersion(); if (!empty($cached)) { echo $cached; exit; }
 869
 870     // If cached was not found (or not usable), then read the database and build the response:
 871     $LINKSDB=new linkdb(isLoggedIn() || $GLOBALS['config']['OPEN_SHAARLI']);  // Read links from database (and filter private links if used it not logged in).
 872
 873     // Optionnaly filter the results:
 874     $linksToDisplay=array();
 875     if (!empty($_GET['searchterm'])) $linksToDisplay = $LINKSDB->filterFulltext($_GET['searchterm']);
 876     elseif (!empty($_GET['searchtags']))   $linksToDisplay = $LINKSDB->filterTags(trim($_GET['searchtags']));
 877     else $linksToDisplay = $LINKSDB;
 878
 879     $pageaddr=htmlspecialchars(indexUrl());
 880     echo '<?xml version="1.0" encoding="UTF-8"?><rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/">';
 881     echo '<channel><title>'.htmlspecialchars($GLOBALS['title']).'</title><link>'.$pageaddr.'</link>';
 882     echo '<description>Shared links</description><language>en-en</language><copyright>'.$pageaddr.'</copyright>'."\n\n";
 883     if (!empty($GLOBALS['config']['PUBSUBHUB_URL']))
 884     {
 885         echo '<!-- PubSubHubbub Discovery -->';
 886         echo '<link rel="hub" href="'.htmlspecialchars($GLOBALS['config']['PUBSUBHUB_URL']).'" xmlns="http://www.w3.org/2005/Atom" />';
 887         echo '<link rel="self" href="'.htmlspecialchars($pageaddr).'?do=rss" xmlns="http://www.w3.org/2005/Atom" />';
 888         echo '<!-- End Of PubSubHubbub Discovery -->';
 889     }
 890     $i=0;
 891     $keys=array(); foreach($linksToDisplay as $key=>$value) { $keys[]=$key; }  // No, I can't use array_keys().
 892     while ($i<50 && $i<count($keys))
 893     {
 894         $link = $linksToDisplay[$keys[$i]];
 895         $guid = $pageaddr.'?'.smallHash($link['linkdate']);
 896         $rfc822date = linkdate2rfc822($link['linkdate']);
 897         $absurl = htmlspecialchars($link['url']);
 898         if (startsWith($absurl,'?')) $absurl=$pageaddr.$absurl;  // make permalink URL absolute
 899         if ($usepermalinks===true)
 900             echo '<item><title>'.htmlspecialchars($link['title']).'</title><guid>'.$guid.'</guid><link>'.$guid.'</link>';
 901         else
 902             echo '<item><title>'.htmlspecialchars($link['title']).'</title><guid>'.$guid.'</guid><link>'.$absurl.'</link>';
 903         if (!$GLOBALS['config']['HIDE_TIMESTAMPS'] || isLoggedIn()) echo '<pubDate>'.htmlspecialchars($rfc822date)."</pubDate>\n";
 904         if ($link['tags']!='') // Adding tags to each RSS entry (as mentioned in RSS specification)
 905         {
 906             foreach(explode(' ',$link['tags']) as $tag) { echo '<category domain="'.htmlspecialchars($pageaddr).'">'.htmlspecialchars($tag).'</category>'."\n"; }
 907         }
 908
 909         // Add permalink in description
 910         $descriptionlink = '(<a href="'.$guid.'">Permalink</a>)';
 911         // If user wants permalinks first, put the final link in description
 912         if ($usepermalinks===true) $descriptionlink = '(<a href="'.$absurl.'">Link</a>)';
 913         if (strlen($link['description'])>0) $descriptionlink = '<br>'.$descriptionlink;
 914         echo '<description><![CDATA['.nl2br(keepMultipleSpaces(text2clickable(htmlspecialchars($link['description'])))).$descriptionlink.']]></description>'."\n</item>\n";
 915         $i++;
 916     }
 917     echo '</channel></rss>';
 918
 919     $cache->cache(ob_get_contents());
 920     ob_end_flush();
 921     exit;
 922 }
 923
 924 // ------------------------------------------------------------------------------------------
 925 // Ouput the last 50 links in ATOM format.
 926 function showATOM()
 927 {
 928     header('Content-Type: application/atom+xml; charset=utf-8');
 929
 930     // $usepermalink : If true, use permalink instead of final link.
 931     // User just has to add 'permalink' in URL parameters. eg. http://mysite.com/shaarli/?do=atom&permalinks
 932     $usepermalinks = isset($_GET['permalinks']);
 933
 934     // Cache system
 935     $query = $_SERVER["QUERY_STRING"];
 936     $cache = new pageCache(pageUrl(),startsWith($query,'do=atom') && !isLoggedIn());
 937     $cached = $cache->cachedVersion(); if (!empty($cached)) { echo $cached; exit; }
 938     // If cached was not found (or not usable), then read the database and build the response:
 939
 940     $LINKSDB=new linkdb(isLoggedIn() || $GLOBALS['config']['OPEN_SHAARLI']);  // Read links from database (and filter private links if used it not logged in).
 941
 942
 943     // Optionnaly filter the results:
 944     $linksToDisplay=array();
 945     if (!empty($_GET['searchterm'])) $linksToDisplay = $LINKSDB->filterFulltext($_GET['searchterm']);
 946     elseif (!empty($_GET['searchtags']))   $linksToDisplay = $LINKSDB->filterTags(trim($_GET['searchtags']));
 947     else $linksToDisplay = $LINKSDB;
 948
 949     $pageaddr=htmlspecialchars(indexUrl());
 950     $latestDate = '';
 951     $entries='';
 952     $i=0;
 953     $keys=array(); foreach($linksToDisplay as $key=>$value) { $keys[]=$key; }  // No, I can't use array_keys().
 954     while ($i<50 && $i<count($keys))
 955     {
 956         $link = $linksToDisplay[$keys[$i]];
 957         $guid = $pageaddr.'?'.smallHash($link['linkdate']);
 958         $iso8601date = linkdate2iso8601($link['linkdate']);
 959         $latestDate = max($latestDate,$iso8601date);
 960         $absurl = htmlspecialchars($link['url']);
 961         if (startsWith($absurl,'?')) $absurl=$pageaddr.$absurl;  // make permalink URL absolute
 962         $entries.='<entry><title>'.htmlspecialchars($link['title']).'</title>';
 963         if ($usepermalinks===true)
 964             $entries.='<link href="'.$guid.'" /><id>'.$guid.'</id>';
 965         else
 966             $entries.='<link href="'.$absurl.'" /><id>'.$guid.'</id>';
 967         if (!$GLOBALS['config']['HIDE_TIMESTAMPS'] || isLoggedIn()) $entries.='<updated>'.htmlspecialchars($iso8601date).'</updated>';
 968
 969         // Add permalink in description
 970         $descriptionlink = htmlspecialchars('(<a href="'.$guid.'">Permalink</a>)');
 971         // If user wants permalinks first, put the final link in description
 972         if ($usepermalinks===true) $descriptionlink = htmlspecialchars('(<a href="'.$absurl.'">Link</a>)');
 973         if (strlen($link['description'])>0) $descriptionlink = '&lt;br&gt;'.$descriptionlink;
 974
 975         $entries.='<content type="html">'.htmlspecialchars(nl2br(keepMultipleSpaces(text2clickable(htmlspecialchars($link['description']))))).$descriptionlink."</content>\n";
 976         if ($link['tags']!='') // Adding tags to each ATOM entry (as mentioned in ATOM specification)
 977         {
 978             foreach(explode(' ',$link['tags']) as $tag)
 979                 { $entries.='<category scheme="'.htmlspecialchars($pageaddr,ENT_QUOTES).'" term="'.htmlspecialchars($tag,ENT_QUOTES).'" />'."\n"; }
 980         }
 981         $entries.="</entry>\n";
 982         $i++;
 983     }
 984     $feed='<?xml version="1.0" encoding="UTF-8"?><feed xmlns="http://www.w3.org/2005/Atom">';
 985     $feed.='<title>'.htmlspecialchars($GLOBALS['title']).'</title>';
 986     if (!$GLOBALS['config']['HIDE_TIMESTAMPS'] || isLoggedIn()) $feed.='<updated>'.htmlspecialchars($latestDate).'</updated>';
 987     $feed.='<link rel="self" href="'.htmlspecialchars(serverUrl().$_SERVER["REQUEST_URI"]).'" />';
 988     if (!empty($GLOBALS['config']['PUBSUBHUB_URL']))
 989     {
 990         $feed.='<!-- PubSubHubbub Discovery -->';
 991         $feed.='<link rel="hub" href="'.htmlspecialchars($GLOBALS['config']['PUBSUBHUB_URL']).'" />';
 992         $feed.='<!-- End Of PubSubHubbub Discovery -->';
 993     }
 994     $feed.='<author><name>'.htmlspecialchars($pageaddr).'</name><uri>'.htmlspecialchars($pageaddr).'</uri></author>';
 995     $feed.='<id>'.htmlspecialchars($pageaddr).'</id>'."\n\n"; // Yes, I know I should use a real IRI (RFC3987), but the site URL will do.
 996     $feed.=$entries;
 997     $feed.='</feed>';
 998     echo $feed;
 999
1000     $cache->cache(ob_get_contents());
1001     ob_end_flush();
1002     exit;
1003 }
1004
1005 // ------------------------------------------------------------------------------------------
1006 // Daily RSS feed: 1 RSS entry per day giving all the links on that day.
1007 // Gives the last 7 days (which have links).
1008 // This RSS feed cannot be filtered.
1009 function showDailyRSS()
1010 {
1011     // Cache system
1012     $query = $_SERVER["QUERY_STRING"];
1013     $cache = new pageCache(pageUrl(),startsWith($query,'do=dailyrss') && !isLoggedIn());
1014     $cached = $cache->cachedVersion(); if (!empty($cached)) { echo $cached; exit; }
1015     // If cached was not found (or not usable), then read the database and build the response:
1016     $LINKSDB=new linkdb(isLoggedIn() || $GLOBALS['config']['OPEN_SHAARLI']);  // Read links from database (and filter private links if used it not logged in).
1017
1018     /* Some Shaarlies may have very few links, so we need to look
1019        back in time (rsort()) until we have enough days ($nb_of_days).
1020     */
1021     $linkdates=array(); foreach($LINKSDB as $linkdate=>$value) { $linkdates[]=$linkdate; }
1022     rsort($linkdates);
1023     $nb_of_days=7; // We take 7 days.
1024     $today=Date('Ymd');
1025     $days=array();
1026     foreach($linkdates as $linkdate)
1027     {
1028         $day=substr($linkdate,0,8); // Extract day (without time)
1029         if (strcmp($day,$today)<0)
1030         {
1031             if (empty($days[$day])) $days[$day]=array();
1032             $days[$day][]=$linkdate;
1033         }
1034         if (count($days)>$nb_of_days) break; // Have we collected enough days ?
1035     }
1036
1037     // Build the RSS feed.
1038     header('Content-Type: application/rss+xml; charset=utf-8');
1039     $pageaddr=htmlspecialchars(indexUrl());
1040     echo '<?xml version="1.0" encoding="UTF-8"?><rss version="2.0">';
1041     echo '<channel><title>Daily - '.htmlspecialchars($GLOBALS['title']).'</title><link>'.$pageaddr.'</link>';
1042     echo '<description>Daily shared links</description><language>en-en</language><copyright>'.$pageaddr.'</copyright>'."\n";
1043
1044     foreach($days as $day=>$linkdates) // For each day.
1045     {
1046         $daydate = utf8_encode(strftime('%A %d, %B %Y',linkdate2timestamp($day.'_000000'))); // Full text date
1047         $rfc822date = linkdate2rfc822($day.'_000000');
1048         $absurl=htmlspecialchars(indexUrl().'?do=daily&day='.$day);  // Absolute URL of the corresponding "Daily" page.
1049         echo '<item><title>'.htmlspecialchars($GLOBALS['title'].' - '.$daydate).'</title><guid>'.$absurl.'</guid><link>'.$absurl.'</link>';
1050         echo '<pubDate>'.htmlspecialchars($rfc822date)."</pubDate>";
1051
1052         // Build the HTML body of this RSS entry.
1053         $html='';
1054         $href='';
1055         $links=array();
1056         // We pre-format some fields for proper output.
1057         foreach($linkdates as $linkdate)
1058         {
1059             $l = $LINKSDB[$linkdate];
1060             $l['formatedDescription']=nl2br(keepMultipleSpaces(text2clickable(htmlspecialchars($l['description']))));
1061             $l['thumbnail'] = thumbnail($l['url']);
1062             $l['localdate']=linkdate2locale($l['linkdate']);
1063             if (startsWith($l['url'],'?')) $l['url']=indexUrl().$l['url'];  // make permalink URL absolute
1064             $links[$linkdate]=$l;
1065         }
1066         // Then build the HTML for this day:
1067         $tpl = new RainTPL;
1068         $tpl->assign('links',$links);
1069         $html = $tpl->draw('dailyrss',$return_string=true);
1070         echo "\n";
1071         echo '<description><![CDATA['.$html.']]></description>'."\n</item>\n\n";
1072
1073     }
1074     echo '</channel></rss>';
1075
1076     $cache->cache(ob_get_contents());
1077     ob_end_flush();
1078     exit;
1079 }
1080
1081 // "Daily" page.
1082 function showDaily()
1083 {
1084     $LINKSDB=new linkdb(isLoggedIn() || $GLOBALS['config']['OPEN_SHAARLI']);  // Read links from database (and filter private links if used it not logged in).
1085
1086
1087     $day=Date('Ymd',strtotime('-1 day')); // Yesterday, in format YYYYMMDD.
1088     if (isset($_GET['day'])) $day=$_GET['day'];
1089
1090     $days = $LINKSDB->days();
1091     $i = array_search($day,$days);
1092     if ($i==false) { $i=count($days)-1; $day=$days[$i]; }
1093     $previousday='';
1094     $nextday='';
1095     if ($i!==false)
1096     {
1097         if ($i>1) $previousday=$days[$i-1];
1098         if ($i<count($days)-1) $nextday=$days[$i+1];
1099     }
1100
1101     $linksToDisplay=$LINKSDB->filterDay($day);
1102     // We pre-format some fields for proper output.
1103     foreach($linksToDisplay as $key=>$link)
1104     {
1105         $linksToDisplay[$key]['taglist']=explode(' ',$link['tags']);
1106         $linksToDisplay[$key]['formatedDescription']=nl2br(keepMultipleSpaces(text2clickable(htmlspecialchars($link['description']))));
1107         $linksToDisplay[$key]['thumbnail'] = thumbnail($link['url']);
1108     }
1109
1110     /* We need to spread the articles on 3 columns.
1111        I did not want to use a javascript lib like http://masonry.desandro.com/
1112        so I manually spread entries with a simple method: I roughly evaluate the
1113        height of a div according to title and description length.
1114     */
1115     $columns=array(array(),array(),array()); // Entries to display, for each column.
1116     $fill=array(0,0,0);  // Rough estimate of columns fill.
1117     foreach($linksToDisplay as $key=>$link)
1118     {
1119         // Roughly estimate length of entry (by counting characters)
1120         // Title: 30 chars = 1 line. 1 line is 30 pixels height.
1121         // Description: 836 characters gives roughly 342 pixel height.
1122         // This is not perfect, but it's usually ok.
1123         $length=strlen($link['title'])+(342*strlen($link['description']))/836;
1124         if ($link['thumbnail']) $length +=100; // 1 thumbnails roughly takes 100 pixels height.
1125         // Then put in column which is the less filled:
1126         $smallest=min($fill); // find smallest value in array.
1127         $index=array_search($smallest,$fill); // find index of this smallest value.
1128         array_push($columns[$index],$link); // Put entry in this column.
1129         $fill[$index]+=$length;
1130     }
1131     $PAGE = new pageBuilder;
1132     $PAGE->assign('linksToDisplay',$linksToDisplay);
1133     $PAGE->assign('linkcount',count($LINKSDB));
1134     $PAGE->assign('col1',$columns[0]);
1135     $PAGE->assign('col1',$columns[0]);
1136     $PAGE->assign('col2',$columns[1]);
1137     $PAGE->assign('col3',$columns[2]);
1138     $PAGE->assign('day',utf8_encode(strftime('%A %d, %B %Y',linkdate2timestamp($day.'_000000'))));
1139     $PAGE->assign('previousday',$previousday);
1140     $PAGE->assign('nextday',$nextday);
1141     $PAGE->renderPage('daily');
1142     exit;
1143 }
1144
1145
1146 // ------------------------------------------------------------------------------------------
1147 // Render HTML page (according to URL parameters and user rights)
1148 function renderPage()
1149 {
1150     $LINKSDB=new linkdb(isLoggedIn() || $GLOBALS['config']['OPEN_SHAARLI']);  // Read links from database (and filter private links if used it not logged in).
1151
1152     // -------- Display login form.
1153     if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=login'))
1154     {
1155         if ($GLOBALS['config']['OPEN_SHAARLI']) { header('Location: ?'); exit; }  // No need to login for open Shaarli
1156         $token=''; if (ban_canLogin()) $token=getToken(); // Do not waste token generation if not useful.
1157         $PAGE = new pageBuilder;
1158         $PAGE->assign('token',$token);
1159         $PAGE->assign('returnurl',(isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER']:''));
1160         $PAGE->renderPage('loginform');
1161         exit;
1162     }
1163     // -------- User wants to logout.
1164     if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=logout'))
1165     {
1166         invalidateCaches();
1167         logout();
1168         header('Location: ?');
1169         exit;
1170     }
1171
1172     // -------- Picture wall
1173     if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=picwall'))
1174     {
1175         // Optionnaly filter the results:
1176         $links=array();
1177         if (!empty($_GET['searchterm'])) $links = $LINKSDB->filterFulltext($_GET['searchterm']);
1178         elseif (!empty($_GET['searchtags']))   $links = $LINKSDB->filterTags(trim($_GET['searchtags']));
1179         else $links = $LINKSDB;
1180         $body='';
1181         $linksToDisplay=array();
1182
1183         // Get only links which have a thumbnail.
1184         foreach($links as $link)
1185         {
1186             $permalink='?'.htmlspecialchars(smallhash($link['linkdate']),ENT_QUOTES);
1187             $thumb=lazyThumbnail($link['url'],$permalink);
1188             if ($thumb!='') // Only output links which have a thumbnail.
1189             {
1190                 $link['thumbnail']=$thumb; // Thumbnail HTML code.
1191                 $link['permalink']=$permalink;
1192                 $linksToDisplay[]=$link; // Add to array.
1193             }
1194         }
1195         $PAGE = new pageBuilder;
1196         $PAGE->assign('linkcount',count($LINKSDB));
1197         $PAGE->assign('linksToDisplay',$linksToDisplay);
1198         $PAGE->renderPage('picwall');
1199         exit;
1200     }
1201
1202     // -------- Tag cloud
1203     if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=tagcloud'))
1204     {
1205         $tags= $LINKSDB->allTags();
1206         // We sort tags alphabetically, then choose a font size according to count.
1207         // First, find max value.
1208         $maxcount=0; foreach($tags as $key=>$value) $maxcount=max($maxcount,$value);
1209         ksort($tags);
1210         $tagList=array();
1211         foreach($tags as $key=>$value)
1212         {
1213             $tagList[$key] = array('count'=>$value,'size'=>max(40*$value/$maxcount,8));
1214         }
1215         $PAGE = new pageBuilder;
1216         $PAGE->assign('linkcount',count($LINKSDB));
1217         $PAGE->assign('tags',$tagList);
1218         $PAGE->renderPage('tagcloud');
1219         exit;
1220     }
1221
1222     // -------- User clicks on a tag in a link: The tag is added to the list of searched tags (searchtags=...)
1223     if (isset($_GET['addtag']))
1224     {
1225         // Get previous URL (http_referer) and add the tag to the searchtags parameters in query.
1226         if (empty($_SERVER['HTTP_REFERER'])) { header('Location: ?searchtags='.urlencode($_GET['addtag'])); exit; } // In case browser does not send HTTP_REFERER
1227         parse_str(parse_url($_SERVER['HTTP_REFERER'],PHP_URL_QUERY), $params);
1228         $params['searchtags'] = (empty($params['searchtags']) ?  trim($_GET['addtag']) : trim($params['searchtags']).' '.trim($_GET['addtag']));
1229         unset($params['page']); // We also remove page (keeping the same page has no sense, since the results are different)
1230         header('Location: ?'.http_build_query($params));
1231         exit;
1232     }
1233
1234     // -------- User clicks on a tag in result count: Remove the tag from the list of searched tags (searchtags=...)
1235     if (isset($_GET['removetag']))
1236     {
1237         // Get previous URL (http_referer) and remove the tag from the searchtags parameters in query.
1238         if (empty($_SERVER['HTTP_REFERER'])) { header('Location: ?'); exit; } // In case browser does not send HTTP_REFERER
1239         parse_str(parse_url($_SERVER['HTTP_REFERER'],PHP_URL_QUERY), $params);
1240         if (isset($params['searchtags']))
1241         {
1242             $tags = explode(' ',$params['searchtags']);
1243             $tags=array_diff($tags, array($_GET['removetag'])); // Remove value from array $tags.
1244             if (count($tags)==0) unset($params['searchtags']); else $params['searchtags'] = implode(' ',$tags);
1245             unset($params['page']); // We also remove page (keeping the same page has no sense, since the results are different)
1246         }
1247         header('Location: ?'.http_build_query($params));
1248         exit;
1249     }
1250
1251     // -------- User wants to change the number of links per page (linksperpage=...)
1252     if (isset($_GET['linksperpage']))
1253     {
1254         if (is_numeric($_GET['linksperpage'])) { $_SESSION['LINKS_PER_PAGE']=abs(intval($_GET['linksperpage'])); }
1255         header('Location: '.(empty($_SERVER['HTTP_REFERER'])?'?':$_SERVER['HTTP_REFERER']));
1256         exit;
1257     }
1258
1259     // -------- User wants to see only private links (toggle)
1260     if (isset($_GET['privateonly']))
1261     {
1262         if (empty($_SESSION['privateonly']))
1263         {
1264             $_SESSION['privateonly']=1; // See only private links
1265         }
1266         else
1267         {
1268             unset($_SESSION['privateonly']); // See all links
1269         }
1270         header('Location: '.(empty($_SERVER['HTTP_REFERER'])?'?':$_SERVER['HTTP_REFERER']));
1271         exit;
1272     }
1273
1274     // -------- Handle other actions allowed for non-logged in users:
1275     if (!isLoggedIn())
1276     {
1277         // User tries to post new link but is not loggedin:
1278         // Show login screen, then redirect to ?post=...
1279         if (isset($_GET['post']))
1280         {
1281             header('Location: ?do=login&post='.urlencode($_GET['post']).(!empty($_GET['title'])?'&title='.urlencode($_GET['title']):'').(!empty($_GET['source'])?'&source='.urlencode($_GET['source']):'')); // Redirect to login page, then back to post link.
1282             exit;
1283         }
1284         $PAGE = new pageBuilder;
1285         buildLinkList($PAGE,$LINKSDB); // Compute list of links to display
1286         $PAGE->renderPage('linklist');
1287         exit; // Never remove this one ! All operations below are reserved for logged in user.
1288     }
1289
1290     // -------- All other functions are reserved for the registered user:
1291
1292     // -------- Display the Tools menu if requested (import/export/bookmarklet...)
1293     if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=tools'))
1294     {
1295         $PAGE = new pageBuilder;
1296         $PAGE->assign('linkcount',count($LINKSDB));
1297         $PAGE->assign('pageabsaddr',indexUrl());
1298         $PAGE->renderPage('tools');
1299         exit;
1300     }
1301
1302     // -------- User wants to change his/her password.
1303     if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=changepasswd'))
1304     {
1305         if ($GLOBALS['config']['OPEN_SHAARLI']) die('You are not supposed to change a password on an Open Shaarli.');
1306         if (!empty($_POST['setpassword']) && !empty($_POST['oldpassword']))
1307         {
1308             if (!tokenOk($_POST['token'])) die('Wrong token.'); // Go away !
1309
1310             // Make sure old password is correct.
1311             $oldhash = sha1($_POST['oldpassword'].$GLOBALS['login'].$GLOBALS['salt']);
1312             if ($oldhash!=$GLOBALS['hash']) { echo '<script language="JavaScript">alert("The old password is not correct.");document.location=\'?do=changepasswd\';</script>'; exit; }
1313             // Save new password
1314             $GLOBALS['salt'] = sha1(uniqid('',true).'_'.mt_rand()); // Salt renders rainbow-tables attacks useless.
1315             $GLOBALS['hash'] = sha1($_POST['setpassword'].$GLOBALS['login'].$GLOBALS['salt']);
1316             writeConfig();
1317             echo '<script language="JavaScript">alert("Your password has been changed.");document.location=\'?do=tools\';</script>';
1318             exit;
1319         }
1320         else // show the change password form.
1321         {
1322             $PAGE = new pageBuilder;
1323             $PAGE->assign('linkcount',count($LINKSDB));
1324             $PAGE->assign('token',getToken());
1325             $PAGE->renderPage('changepassword');
1326             exit;
1327         }
1328     }
1329
1330     // -------- User wants to change configuration
1331     if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=configure'))
1332     {
1333         if (!empty($_POST['title']) )
1334         {
1335             if (!tokenOk($_POST['token'])) die('Wrong token.'); // Go away !
1336             $tz = 'UTC';
1337             if (!empty($_POST['continent']) && !empty($_POST['city']))
1338                 if (isTZvalid($_POST['continent'],$_POST['city']))
1339                     $tz = $_POST['continent'].'/'.$_POST['city'];
1340             $GLOBALS['timezone'] = $tz;
1341             $GLOBALS['title']=$_POST['title'];
1342             $GLOBALS['redirector']=$_POST['redirector'];
1343             $GLOBALS['disablesessionprotection']=!empty($_POST['disablesessionprotection']);
1344             writeConfig();
1345             echo '<script language="JavaScript">alert("Configuration was saved.");document.location=\'?do=tools\';</script>';
1346             exit;
1347         }
1348         else // Show the configuration form.
1349         {
1350             $PAGE = new pageBuilder;
1351             $PAGE->assign('linkcount',count($LINKSDB));
1352             $PAGE->assign('token',getToken());
1353             $PAGE->assign('title',htmlspecialchars( empty($GLOBALS['title']) ? '' : $GLOBALS['title'] , ENT_QUOTES));
1354             $PAGE->assign('redirector',htmlspecialchars( empty($GLOBALS['redirector']) ? '' : $GLOBALS['redirector'] , ENT_QUOTES));
1355             list($timezone_form,$timezone_js) = templateTZform($GLOBALS['timezone']);
1356             $PAGE->assign('timezone_form',$timezone_form); // FIXME: put entire tz form generation in template ?
1357             $PAGE->assign('timezone_js',$timezone_js);
1358             $PAGE->renderPage('configure');
1359             exit;
1360         }
1361     }
1362
1363     // -------- User wants to rename a tag or delete it
1364     if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=changetag'))
1365     {
1366         if (empty($_POST['fromtag']))
1367         {
1368             $PAGE = new pageBuilder;
1369             $PAGE->assign('linkcount',count($LINKSDB));
1370             $PAGE->assign('token',getToken());
1371             $PAGE->renderPage('changetag');
1372             exit;
1373         }
1374         if (!tokenOk($_POST['token'])) die('Wrong token.');
1375
1376         // Delete a tag:
1377         if (!empty($_POST['deletetag']) && !empty($_POST['fromtag']))
1378         {
1379             $needle=trim($_POST['fromtag']);
1380             $linksToAlter = $LINKSDB->filterTags($needle,true); // true for case-sensitive tag search.
1381             foreach($linksToAlter as $key=>$value)
1382             {
1383                 $tags = explode(' ',trim($value['tags']));
1384                 unset($tags[array_search($needle,$tags)]); // Remove tag.
1385                 $value['tags']=trim(implode(' ',$tags));
1386                 $LINKSDB[$key]=$value;
1387             }
1388             $LINKSDB->savedb(); // save to disk
1389             echo '<script language="JavaScript">alert("Tag was removed from '.count($linksToAlter).' links.");document.location=\'?\';</script>';
1390             exit;
1391         }
1392
1393         // Rename a tag:
1394         if (!empty($_POST['renametag']) && !empty($_POST['fromtag']) && !empty($_POST['totag']))
1395         {
1396             $needle=trim($_POST['fromtag']);
1397             $linksToAlter = $LINKSDB->filterTags($needle,true); // true for case-sensitive tag search.
1398             foreach($linksToAlter as $key=>$value)
1399             {
1400                 $tags = explode(' ',trim($value['tags']));
1401                 $tags[array_search($needle,$tags)] = trim($_POST['totag']); // Remplace tags value.
1402                 $value['tags']=trim(implode(' ',$tags));
1403                 $LINKSDB[$key]=$value;
1404             }
1405             $LINKSDB->savedb(); // save to disk
1406             echo '<script language="JavaScript">alert("Tag was renamed in '.count($linksToAlter).' links.");document.location=\'?searchtags='.urlencode($_POST['totag']).'\';</script>';
1407             exit;
1408         }
1409     }
1410
1411     // -------- User wants to add a link without using the bookmarklet: show form.
1412     if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=addlink'))
1413     {
1414         $PAGE = new pageBuilder;
1415         $PAGE->assign('linkcount',count($LINKSDB));
1416         $PAGE->renderPage('addlink');
1417         exit;
1418     }
1419
1420     // -------- User clicked the "Save" button when editing a link: Save link to database.
1421     if (isset($_POST['save_edit']))
1422     {
1423         if (!tokenOk($_POST['token'])) die('Wrong token.'); // Go away !
1424         $tags = trim(preg_replace('/\s\s+/',' ', $_POST['lf_tags'])); // Remove multiple spaces.
1425         $linkdate=$_POST['lf_linkdate'];
1426         $link = array('title'=>trim($_POST['lf_title']),'url'=>trim($_POST['lf_url']),'description'=>trim($_POST['lf_description']),'private'=>(isset($_POST['lf_private']) ? 1 : 0),
1427                       'linkdate'=>$linkdate,'tags'=>str_replace(',',' ',$tags));
1428         if ($link['title']=='') $link['title']=$link['url']; // If title is empty, use the URL as title.
1429         $LINKSDB[$linkdate] = $link;
1430         $LINKSDB->savedb(); // save to disk
1431         pubsubhub();
1432
1433         // If we are called from the bookmarklet, we must close the popup:
1434         if (isset($_GET['source']) && $_GET['source']=='bookmarklet') { echo '<script language="JavaScript">self.close();</script>'; exit; }
1435         $returnurl = ( isset($_POST['returnurl']) ? $_POST['returnurl'] : '?' );
1436         header('Location: '.$returnurl); // After saving the link, redirect to the page the user was on.
1437         exit;
1438     }
1439
1440     // -------- User clicked the "Cancel" button when editing a link.
1441     if (isset($_POST['cancel_edit']))
1442     {
1443         // If we are called from the bookmarklet, we must close the popup;
1444         if (isset($_GET['source']) && $_GET['source']=='bookmarklet') { echo '<script language="JavaScript">self.close();</script>'; exit; }
1445         $returnurl = ( isset($_POST['returnurl']) ? $_POST['returnurl'] : '?' );
1446         header('Location: '.$returnurl); // After canceling, redirect to the page the user was on.
1447         exit;
1448     }
1449
1450     // -------- User clicked the "Delete" button when editing a link : Delete link from database.
1451     if (isset($_POST['delete_link']))
1452     {
1453         if (!tokenOk($_POST['token'])) die('Wrong token.');
1454         // We do not need to ask for confirmation:
1455         // - confirmation is handled by javascript
1456         // - we are protected from XSRF by the token.
1457         $linkdate=$_POST['lf_linkdate'];
1458         unset($LINKSDB[$linkdate]);
1459         $LINKSDB->savedb(); // save to disk
1460
1461         // If we are called from the bookmarklet, we must close the popup:
1462         if (isset($_GET['source']) && $_GET['source']=='bookmarklet') { echo '<script language="JavaScript">self.close();</script>'; exit; }
1463         $returnurl = ( isset($_POST['returnurl']) ? $_POST['returnurl'] : '?' );
1464         if ($returnurl=='?') { $returnurl = (isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '?'); }
1465         header('Location: '.$returnurl); // After deleting the link, redirect to the page the user was on.
1466         exit;
1467     }
1468
1469     // -------- User clicked the "EDIT" button on a link: Display link edit form.
1470     if (isset($_GET['edit_link']))
1471     {
1472         $link = $LINKSDB[$_GET['edit_link']];  // Read database
1473         if (!$link) { header('Location: ?'); exit; } // Link not found in database.
1474         $PAGE = new pageBuilder;
1475         $PAGE->assign('linkcount',count($LINKSDB));
1476         $PAGE->assign('link',$link);
1477         $PAGE->assign('link_is_new',false);
1478         $PAGE->assign('token',getToken()); // XSRF protection.
1479         $PAGE->assign('http_referer',(isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : ''));
1480         $PAGE->renderPage('editlink');
1481         exit;
1482     }
1483
1484     // -------- User want to post a new link: Display link edit form.
1485     if (isset($_GET['post']))
1486     {
1487         $url=$_GET['post'];
1488
1489         // We remove the annoying parameters added by FeedBurner and GoogleFeedProxy (?utm_source=...)
1490         $i=strpos($url,'&utm_source='); if ($i!==false) $url=substr($url,0,$i);
1491         $i=strpos($url,'?utm_source='); if ($i!==false) $url=substr($url,0,$i);
1492         $i=strpos($url,'#xtor=RSS-'); if ($i!==false) $url=substr($url,0,$i);
1493
1494         $link_is_new = false;
1495         $link = $LINKSDB->getLinkFromUrl($url); // Check if URL is not already in database (in this case, we will edit the existing link)
1496         if (!$link)
1497         {
1498             $link_is_new = true;  // This is a new link
1499             $linkdate = strval(date('Ymd_His'));
1500             $title = (empty($_GET['title']) ? '' : $_GET['title'] ); // Get title if it was provided in URL (by the bookmarklet).
1501             $description=''; $tags=''; $private=0;
1502             if (($url!='') && parse_url($url,PHP_URL_SCHEME)=='') $url = 'http://'.$url;
1503             // If this is an HTTP link, we try go get the page to extact the title (otherwise we will to straight to the edit form.)
1504             if (empty($title) && parse_url($url,PHP_URL_SCHEME)=='http')
1505             {
1506                 list($status,$headers,$data) = getHTTP($url,4); // Short timeout to keep the application responsive.
1507                 // FIXME: Decode charset according to specified in either 1) HTTP response headers or 2) <head> in html
1508                 if (strpos($status,'200 OK')!==false) $title=html_entity_decode(html_extract_title($data),ENT_QUOTES,'UTF-8');
1509
1510             }
1511             if ($url=='') $url='?'.smallHash($linkdate); // In case of empty URL, this is just a text (with a link that point to itself)
1512             $link = array('linkdate'=>$linkdate,'title'=>$title,'url'=>$url,'description'=>$description,'tags'=>$tags,'private'=>0);
1513         }
1514
1515         $PAGE = new pageBuilder;
1516         $PAGE->assign('linkcount',count($LINKSDB));
1517         $PAGE->assign('link',$link);
1518         $PAGE->assign('link_is_new',$link_is_new);
1519         $PAGE->assign('token',getToken()); // XSRF protection.
1520         $PAGE->assign('http_referer',(isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : ''));
1521         $PAGE->renderPage('editlink');
1522         exit;
1523     }
1524
1525     // -------- Export as Netscape Bookmarks HTML file.
1526     if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=export'))
1527     {
1528         if (empty($_GET['what']))
1529         {
1530             $PAGE = new pageBuilder;
1531             $PAGE->assign('linkcount',count($LINKSDB));
1532             $PAGE->renderPage('export');
1533             exit;
1534         }
1535         $exportWhat=$_GET['what'];
1536         if (!array_intersect(array('all','public','private'),array($exportWhat))) die('What are you trying to export ???');
1537
1538         header('Content-Type: text/html; charset=utf-8');
1539         header('Content-disposition: attachment; filename=bookmarks_'.$exportWhat.'_'.strval(date('Ymd_His')).'.html');
1540         $currentdate=date('Y/m/d H:i:s');
1541         echo <<<HTML
1542 <!DOCTYPE NETSCAPE-Bookmark-file-1>
1543 <!-- This is an automatically generated file.
1544      It will be read and overwritten.
1545      DO NOT EDIT! -->
1546 <!-- Shaarli {$exportWhat} bookmarks export on {$currentdate} -->
1547 <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8">
1548 <TITLE>Bookmarks</TITLE>
1549 <H1>Bookmarks</H1>
1550 HTML;
1551         foreach($LINKSDB as $link)
1552         {
1553             if ($exportWhat=='all' ||
1554                ($exportWhat=='private' && $link['private']!=0) ||
1555                ($exportWhat=='public' && $link['private']==0))
1556             {
1557                 echo '<DT><A HREF="'.htmlspecialchars($link['url']).'" ADD_DATE="'.linkdate2timestamp($link['linkdate']).'" PRIVATE="'.$link['private'].'"';
1558                 if ($link['tags']!='') echo ' TAGS="'.htmlspecialchars(str_replace(' ',',',$link['tags'])).'"';
1559                 echo '>'.htmlspecialchars($link['title'])."</A>\n";
1560                 if ($link['description']!='') echo '<DD>'.htmlspecialchars($link['description'])."\n";
1561             }
1562         }
1563                 exit;
1564     }
1565
1566     // -------- User is uploading a file for import
1567     if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=upload'))
1568     {
1569         // If file is too big, some form field may be missing.
1570         if (!isset($_POST['token']) || (!isset($_FILES)) || (isset($_FILES['filetoupload']['size']) && $_FILES['filetoupload']['size']==0))
1571         {
1572             $returnurl = ( empty($_SERVER['HTTP_REFERER']) ? '?' : $_SERVER['HTTP_REFERER'] );
1573             echo '<script language="JavaScript">alert("The file you are trying to upload is probably bigger than what this webserver can accept ('.getMaxFileSize().' bytes). Please upload in smaller chunks.");document.location=\''.htmlspecialchars($returnurl).'\';</script>';
1574             exit;
1575         }
1576         if (!tokenOk($_POST['token'])) die('Wrong token.');
1577         importFile();
1578         exit;
1579     }
1580
1581     // -------- Show upload/import dialog:
1582     if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=import'))
1583     {
1584         $PAGE = new pageBuilder;
1585         $PAGE->assign('linkcount',count($LINKSDB));
1586         $PAGE->assign('token',getToken());
1587         $PAGE->assign('maxfilesize',getMaxFileSize());
1588         $PAGE->renderPage('import');
1589         exit;
1590     }
1591
1592     // -------- Otherwise, simply display search form and links:
1593     $PAGE = new pageBuilder;
1594     $PAGE->assign('linkcount',count($LINKSDB));
1595     buildLinkList($PAGE,$LINKSDB); // Compute list of links to display
1596     $PAGE->renderPage('linklist');
1597     exit;
1598 }
1599
1600 // -----------------------------------------------------------------------------------------------
1601 // Process the import file form.
1602 function importFile()
1603 {
1604     if (!(isLoggedIn() || $GLOBALS['config']['OPEN_SHAARLI'])) { die('Not allowed.'); }
1605     $LINKSDB=new linkdb(isLoggedIn() || $GLOBALS['config']['OPEN_SHAARLI']);  // Read links from database (and filter private links if used it not logged in).
1606     $filename=$_FILES['filetoupload']['name'];
1607     $filesize=$_FILES['filetoupload']['size'];
1608     $data=file_get_contents($_FILES['filetoupload']['tmp_name']);
1609     $private = (empty($_POST['private']) ? 0 : 1); // Should the links be imported as private ?
1610     $overwrite = !empty($_POST['overwrite']) ; // Should the imported links overwrite existing ones ?
1611     $import_count=0;
1612
1613     // Sniff file type:
1614     $type='unknown';
1615     if (startsWith($data,'<!DOCTYPE NETSCAPE-Bookmark-file-1>')) $type='netscape'; // Netscape bookmark file (aka Firefox).
1616
1617     // Then import the bookmarks.
1618     if ($type=='netscape')
1619     {
1620         // This is a standard Netscape-style bookmark file.
1621         // This format is supported by all browsers (except IE, of course), also delicious, diigo and others.
1622         foreach(explode('<DT>',$data) as $html) // explode is very fast
1623         {
1624             $link = array('linkdate'=>'','title'=>'','url'=>'','description'=>'','tags'=>'','private'=>0);
1625             $d = explode('<DD>',$html);
1626             if (startswith($d[0],'<A '))
1627             {
1628                 $link['description'] = (isset($d[1]) ? html_entity_decode(trim($d[1]),ENT_QUOTES,'UTF-8') : '');  // Get description (optional)
1629                 preg_match('!<A .*?>(.*?)</A>!i',$d[0],$matches); $link['title'] = (isset($matches[1]) ? trim($matches[1]) : '');  // Get title
1630                 $link['title'] = html_entity_decode($link['title'],ENT_QUOTES,'UTF-8');
1631                 preg_match_all('! ([A-Z_]+)=\"(.*?)"!i',$html,$matches,PREG_SET_ORDER);  // Get all other attributes
1632                 $raw_add_date=0;
1633                 foreach($matches as $m)
1634                 {
1635                     $attr=$m[1]; $value=$m[2];
1636                     if ($attr=='HREF') $link['url']=html_entity_decode($value,ENT_QUOTES,'UTF-8');
1637                     elseif ($attr=='ADD_DATE') $raw_add_date=intval($value);
1638                     elseif ($attr=='PRIVATE') $link['private']=($value=='0'?0:1);
1639                     elseif ($attr=='TAGS') $link['tags']=html_entity_decode(str_replace(',',' ',$value),ENT_QUOTES,'UTF-8');
1640                 }
1641                 if ($link['url']!='')
1642                 {
1643                     if ($private==1) $link['private']=1;
1644                     $dblink = $LINKSDB->getLinkFromUrl($link['url']); // See if the link is already in database.
1645                     if ($dblink==false)
1646                     {  // Link not in database, let's import it...
1647                        if (empty($raw_add_date)) $raw_add_date=time(); // In case of shitty bookmark file with no ADD_DATE
1648
1649                        // Make sure date/time is not already used by another link.
1650                        // (Some bookmark files have several different links with the same ADD_DATE)
1651                        // We increment date by 1 second until we find a date which is not used in db.
1652                        // (so that links that have the same date/time are more or less kept grouped by date, but do not conflict.)
1653                        while (!empty($LINKSDB[date('Ymd_His',$raw_add_date)])) { $raw_add_date++; }// Yes, I know it's ugly.
1654                        $link['linkdate']=date('Ymd_His',$raw_add_date);
1655                        $LINKSDB[$link['linkdate']] = $link;
1656                        $import_count++;
1657                     }
1658                     else // link already present in database.
1659                     {
1660                         if ($overwrite)
1661                         {   // If overwrite is required, we import link data, except date/time.
1662                             $link['linkdate']=$dblink['linkdate'];
1663                             $LINKSDB[$link['linkdate']] = $link;
1664                             $import_count++;
1665                         }
1666                     }
1667
1668                 }
1669             }
1670         }
1671         $LINKSDB->savedb();
1672
1673         echo '<script language="JavaScript">alert("File '.$filename.' ('.$filesize.' bytes) was successfully processed: '.$import_count.' links imported.");document.location=\'?\';</script>';
1674     }
1675     else
1676     {
1677         echo '<script language="JavaScript">alert("File '.$filename.' ('.$filesize.' bytes) has an unknown file format. Nothing was imported.");document.location=\'?\';</script>';
1678     }
1679 }
1680
1681 // -----------------------------------------------------------------------------------------------
1682 // Template for the list of links (<div id="linklist">)
1683 // This function fills all the necessary fields in the $PAGE for the template 'linklist.html'
1684 function buildLinkList($PAGE,$LINKSDB)
1685 {
1686     // ---- Filter link database according to parameters
1687     $linksToDisplay=array();
1688     $search_type='';
1689     $search_crits='';
1690     if (isset($_GET['searchterm'])) // Fulltext search
1691     {
1692         $linksToDisplay = $LINKSDB->filterFulltext(trim($_GET['searchterm']));
1693         $search_crits=htmlspecialchars(trim($_GET['searchterm']));
1694         $search_type='fulltext';
1695     }
1696     elseif (isset($_GET['searchtags'])) // Search by tag
1697     {
1698         $linksToDisplay = $LINKSDB->filterTags(trim($_GET['searchtags']));
1699         $search_crits=explode(' ',trim($_GET['searchtags']));
1700         $search_type='tags';
1701     }
1702     elseif (isset($_SERVER['QUERY_STRING']) && preg_match('/[a-zA-Z0-9-_@]{6}(&.+?)?/',$_SERVER['QUERY_STRING'])) // Detect smallHashes in URL
1703     {
1704         $linksToDisplay = $LINKSDB->filterSmallHash(substr(trim($_SERVER["QUERY_STRING"], '/'),0,6));
1705         if (count($linksToDisplay)==0)
1706         {
1707             header($_SERVER["SERVER_PROTOCOL"]." 404 Not Found");
1708             echo '<h1>404 Not found.</h1>Oh crap. The link you are trying to reach does not exist or has been deleted.';
1709             echo '<br>You would mind <a href="?">clicking here</a> ?';
1710             exit;
1711         }
1712         $search_type='permalink';
1713     }
1714     else
1715         $linksToDisplay = $LINKSDB;  // otherwise, display without filtering.
1716
1717     // Option: Show only private links
1718     if (!empty($_SESSION['privateonly']))
1719     {
1720         $tmp = array();
1721         foreach($linksToDisplay as $linkdate=>$link)
1722         {
1723             if ($link['private']!=0) $tmp[$linkdate]=$link;
1724         }
1725         $linksToDisplay=$tmp;
1726     }
1727
1728     // ---- Handle paging.
1729     /* Can someone explain to me why you get the following error when using array_keys() on an object which implements the interface ArrayAccess ???
1730        "Warning: array_keys() expects parameter 1 to be array, object given in ... "
1731        If my class implements ArrayAccess, why won't array_keys() accept it ?  ( $keys=array_keys($linksToDisplay); )
1732     */
1733     $keys=array(); foreach($linksToDisplay as $key=>$value) { $keys[]=$key; } // Stupid and ugly. Thanks php.
1734
1735     // If there is only a single link, we change on-the-fly the title of the page.
1736     if (count($linksToDisplay)==1) $GLOBALS['pagetitle'] = $linksToDisplay[$keys[0]]['title'].' - '.$GLOBALS['title'];
1737
1738     // Select articles according to paging.
1739     $pagecount = ceil(count($keys)/$_SESSION['LINKS_PER_PAGE']);
1740     $pagecount = ($pagecount==0 ? 1 : $pagecount);
1741     $page=( empty($_GET['page']) ? 1 : intval($_GET['page']));
1742     $page = ( $page<1 ? 1 : $page );
1743     $page = ( $page>$pagecount ? $pagecount : $page );
1744     $i = ($page-1)*$_SESSION['LINKS_PER_PAGE']; // Start index.
1745     $end = $i+$_SESSION['LINKS_PER_PAGE'];
1746     $linkDisp=array(); // Links to display
1747     while ($i<$end && $i<count($keys))
1748     {
1749         $link = $linksToDisplay[$keys[$i]];
1750         $link['description']=nl2br(keepMultipleSpaces(text2clickable(htmlspecialchars($link['description']))));
1751         $title=$link['title'];
1752         $classLi =  $i%2!=0 ? '' : 'publicLinkHightLight';
1753         $link['class'] = ($link['private']==0 ? $classLi : 'private');
1754         $link['localdate']=linkdate2locale($link['linkdate']);
1755         $link['taglist']=explode(' ',$link['tags']);
1756         $linkDisp[$keys[$i]] = $link;
1757         $i++;
1758     }
1759
1760     // Compute paging navigation
1761     $searchterm= ( empty($_GET['searchterm']) ? '' : '&searchterm='.$_GET['searchterm'] );
1762     $searchtags= ( empty($_GET['searchtags']) ? '' : '&searchtags='.$_GET['searchtags'] );
1763     $paging='';
1764     $previous_page_url=''; if ($i!=count($keys)) $previous_page_url='?page='.($page+1).$searchterm.$searchtags;
1765     $next_page_url='';if ($page>1) $next_page_url='?page='.($page-1).$searchterm.$searchtags;
1766
1767     $token = ''; if (isLoggedIn()) $token=getToken();
1768
1769     // Fill all template fields.
1770     $PAGE->assign('linkcount',count($LINKSDB));
1771     $PAGE->assign('previous_page_url',$previous_page_url);
1772     $PAGE->assign('next_page_url',$next_page_url);
1773     $PAGE->assign('page_current',$page);
1774     $PAGE->assign('page_max',$pagecount);
1775     $PAGE->assign('result_count',count($linksToDisplay));
1776     $PAGE->assign('search_type',$search_type);
1777     $PAGE->assign('search_crits',$search_crits);
1778     $PAGE->assign('redirector',empty($GLOBALS['redirector']) ? '' : $GLOBALS['redirector']); // optional redirector URL
1779     $PAGE->assign('token',$token);
1780     $PAGE->assign('links',$linkDisp);
1781     return;
1782 }
1783
1784 // Compute the thumbnail for a link.
1785 //
1786 // with a link to the original URL.
1787 // Understands various services (youtube.com...)
1788 // Input: $url = url for which the thumbnail must be found.
1789 //        $href = if provided, this URL will be followed instead of $url
1790 // Returns an associative array with thumbnail attributes (src,href,width,height,style,alt)
1791 // Some of them may be missing.
1792 // Return an empty array if no thumbnail available.
1793 function computeThumbnail($url,$href=false)
1794 {
1795     if (!$GLOBALS['config']['ENABLE_THUMBNAILS']) return array();
1796     if ($href==false) $href=$url;
1797
1798     // For most hosts, the URL of the thumbnail can be easily deduced from the URL of the link.
1799     // (eg. http://www.youtube.com/watch?v=spVypYk4kto --->  http://img.youtube.com/vi/spVypYk4kto/default.jpg )
1800     //                                     ^^^^^^^^^^^                                 ^^^^^^^^^^^
1801     $domain = parse_url($url,PHP_URL_HOST);
1802     if ($domain=='youtube.com' || $domain=='www.youtube.com')
1803     {
1804         parse_str(parse_url($url,PHP_URL_QUERY), $params); // Extract video ID and get thumbnail
1805         if (!empty($params['v'])) return array('src'=>'http://img.youtube.com/vi/'.$params['v'].'/default.jpg',
1806                                                'href'=>$href,'width'=>'120','height'=>'90','alt'=>'YouTube thumbnail');
1807     }
1808     if ($domain=='youtu.be') // Youtube short links
1809     {
1810         $path = parse_url($url,PHP_URL_PATH);
1811         return array('src'=>'http://img.youtube.com/vi'.$path.'/default.jpg',
1812                      'href'=>$href,'width'=>'120','height'=>'90','alt'=>'YouTube thumbnail');
1813     }
1814     if ($domain=='pix.toile-libre.org') // pix.toile-libre.org image hosting
1815     {
1816         parse_str(parse_url($url,PHP_URL_QUERY), $params); // Extract image filename.
1817         if (!empty($params) && !empty($params['img'])) return array('src'=>'http://pix.toile-libre.org/upload/thumb/'.urlencode($params['img']),
1818                                                                     'href'=>$href,'style'=>'max-width:120px; max-height:150px','alt'=>'pix.toile-libre.org thumbnail');
1819     }
1820
1821     if ($domain=='imgur.com')
1822     {
1823         $path = parse_url($url,PHP_URL_PATH);
1824         if (startsWith($path,'/a/')) return array(); // Thumbnails for albums are not available.
1825         if (startsWith($path,'/r/')) return array('src'=>'http://i.imgur.com/'.basename($path).'s.jpg',
1826                                                   'href'=>$href,'width'=>'90','height'=>'90','alt'=>'imgur.com thumbnail');
1827         if (startsWith($path,'/gallery/')) return array('src'=>'http://i.imgur.com'.substr($path,8).'s.jpg',
1828                                                         'href'=>$href,'width'=>'90','height'=>'90','alt'=>'imgur.com thumbnail');
1829
1830         if (substr_count($path,'/')==1) return array('src'=>'http://i.imgur.com/'.substr($path,1).'s.jpg',
1831                                                      'href'=>$href,'width'=>'90','height'=>'90','alt'=>'imgur.com thumbnail');
1832     }
1833     if ($domain=='i.imgur.com')
1834     {
1835         $pi = pathinfo(parse_url($url,PHP_URL_PATH));
1836         if (!empty($pi['filename'])) return array('src'=>'http://i.imgur.com/'.$pi['filename'].'s.jpg',
1837                                                   'href'=>$href,'width'=>'90','height'=>'90','alt'=>'imgur.com thumbnail');
1838     }
1839     if ($domain=='dailymotion.com' || $domain=='www.dailymotion.com')
1840     {
1841         if (strpos($url,'dailymotion.com/video/')!==false)
1842         {
1843             $thumburl=str_replace('dailymotion.com/video/','dailymotion.com/thumbnail/video/',$url);
1844             return array('src'=>$thumburl,
1845                          'href'=>$href,'width'=>'120','style'=>'height:auto;','alt'=>'DailyMotion thumbnail');
1846         }
1847     }
1848     if (endsWith($domain,'.imageshack.us'))
1849     {
1850         $ext=strtolower(pathinfo($url,PATHINFO_EXTENSION));
1851         if ($ext=='jpg' || $ext=='jpeg' || $ext=='png' || $ext=='gif')
1852         {
1853             $thumburl = substr($url,0,strlen($url)-strlen($ext)).'th.'.$ext;
1854             return array('src'=>$thumburl,
1855                          'href'=>$href,'width'=>'120','style'=>'height:auto;','alt'=>'imageshack.us thumbnail');
1856         }
1857     }
1858
1859     // Some other hosts are SLOW AS HELL and usually require an extra HTTP request to get the thumbnail URL.
1860     // So we deport the thumbnail generation in order not to slow down page generation
1861     // (and we also cache the thumbnail)
1862
1863     if (!$GLOBALS['config']['ENABLE_LOCALCACHE']) return array(); // If local cache is disabled, no thumbnails for services which require the use a local cache.
1864
1865     if ($domain=='flickr.com' || endsWith($domain,'.flickr.com')
1866         || $domain=='vimeo.com'
1867         || $domain=='ted.com' || endsWith($domain,'.ted.com')
1868         || $domain=='xkcd.com' || endsWith($domain,'.xkcd.com')
1869     )
1870     {
1871         if ($domain=='vimeo.com')
1872         {   // Make sure this vimeo url points to a video (/xxx... where xxx is numeric)
1873             $path = parse_url($url,PHP_URL_PATH);
1874             if (!preg_match('!/\d+.+?!',$path)) return array(); // This is not a single video URL.
1875         }
1876         if ($domain=='xkcd.com' || endsWith($domain,'.xkcd.com'))
1877         {   // Make sure this url points to a single comic (/xxx... where xxx is numeric)
1878             $path = parse_url($url,PHP_URL_PATH);
1879             if (!preg_match('!/\d+.+?!',$path)) return array();
1880         }
1881         if ($domain=='ted.com' || endsWith($domain,'.ted.com'))
1882         {   // Make sure this TED url points to a video (/talks/...)
1883             $path = parse_url($url,PHP_URL_PATH);
1884             if ("/talks/" !== substr($path,0,7)) return array(); // This is not a single video URL.
1885         }
1886         $sign = hash_hmac('sha256', $url, $GLOBALS['salt']); // We use the salt to sign data (it's random, secret, and specific to each installation)
1887         return array('src'=>indexUrl().'?do=genthumbnail&hmac='.htmlspecialchars($sign).'&url='.urlencode($url),
1888                      'href'=>$href,'width'=>'120','style'=>'height:auto;','alt'=>'thumbnail');
1889     }
1890
1891     // For all other, we try to make a thumbnail of links ending with .jpg/jpeg/png/gif
1892     // Technically speaking, we should download ALL links and check their Content-Type to see if they are images.
1893     // But using the extension will do.
1894     $ext=strtolower(pathinfo($url,PATHINFO_EXTENSION));
1895     if ($ext=='jpg' || $ext=='jpeg' || $ext=='png' || $ext=='gif')
1896     {
1897         $sign = hash_hmac('sha256', $url, $GLOBALS['salt']); // We use the salt to sign data (it's random, secret, and specific to each installation)
1898         return array('src'=>indexUrl().'?do=genthumbnail&hmac='.htmlspecialchars($sign).'&url='.urlencode($url),
1899                      'href'=>$href,'width'=>'120','style'=>'height:auto;','alt'=>'thumbnail');
1900     }
1901     return array(); // No thumbnail.
1902
1903 }
1904
1905
1906 // Returns the HTML code to display a thumbnail for a link
1907 // with a link to the original URL.
1908 // Understands various services (youtube.com...)
1909 // Input: $url = url for which the thumbnail must be found.
1910 //        $href = if provided, this URL will be followed instead of $url
1911 // Returns '' if no thumbnail available.
1912 function thumbnail($url,$href=false)
1913 {
1914     $t = computeThumbnail($url,$href);
1915     if (count($t)==0) return ''; // Empty array = no thumbnail for this URL.
1916
1917     $html='<a href="'.htmlspecialchars($t['href']).'"><img src="'.htmlspecialchars($t['src']).'"';
1918     if (!empty($t['width']))  $html.=' width="'.htmlspecialchars($t['width']).'"';
1919     if (!empty($t['height'])) $html.=' height="'.htmlspecialchars($t['height']).'"';
1920     if (!empty($t['style']))  $html.=' style="'.htmlspecialchars($t['style']).'"';
1921     if (!empty($t['alt']))    $html.=' alt="'.htmlspecialchars($t['alt']).'"';
1922     $html.='></a>';
1923     return $html;
1924 }
1925
1926
1927 // Returns the HTML code to display a thumbnail for a link
1928 // for the picture wall (using lazy image loading)
1929 // Understands various services (youtube.com...)
1930 // Input: $url = url for which the thumbnail must be found.
1931 //        $href = if provided, this URL will be followed instead of $url
1932 // Returns '' if no thumbnail available.
1933 function lazyThumbnail($url,$href=false)
1934 {
1935     $t = computeThumbnail($url,$href);
1936     if (count($t)==0) return ''; // Empty array = no thumbnail for this URL.
1937
1938     $html='<a href="'.htmlspecialchars($t['href']).'">';
1939
1940     // Lazy image (only loaded by javascript when in the viewport).
1941     $html.='<img class="lazyimage" src="#" data-original="'.htmlspecialchars($t['src']).'"';
1942     if (!empty($t['width']))  $html.=' width="'.htmlspecialchars($t['width']).'"';
1943     if (!empty($t['height'])) $html.=' height="'.htmlspecialchars($t['height']).'"';
1944     if (!empty($t['style']))  $html.=' style="'.htmlspecialchars($t['style']).'"';
1945     if (!empty($t['alt']))    $html.=' alt="'.htmlspecialchars($t['alt']).'"';
1946     $html.='>';
1947
1948     // No-javascript fallback:
1949     $html.='<noscript><img src="'.htmlspecialchars($t['src']).'"';
1950     if (!empty($t['width']))  $html.=' width="'.htmlspecialchars($t['width']).'"';
1951     if (!empty($t['height'])) $html.=' height="'.htmlspecialchars($t['height']).'"';
1952     if (!empty($t['style']))  $html.=' style="'.htmlspecialchars($t['style']).'"';
1953     if (!empty($t['alt']))    $html.=' alt="'.htmlspecialchars($t['alt']).'"';
1954     $html.='></noscript></a>';
1955
1956     return $html;
1957 }
1958
1959
1960 // -----------------------------------------------------------------------------------------------
1961 // Installation
1962 // This function should NEVER be called if the file data/config.php exists.
1963 function install()
1964 {
1965     // On free.fr host, make sure the /sessions directory exists, otherwise login will not work.
1966     if (endsWith($_SERVER['SERVER_NAME'],'.free.fr') && !is_dir($_SERVER['DOCUMENT_ROOT'].'/sessions')) mkdir($_SERVER['DOCUMENT_ROOT'].'/sessions',0705);
1967
1968     if (!empty($_POST['setlogin']) && !empty($_POST['setpassword']))
1969     {
1970         $tz = 'UTC';
1971         if (!empty($_POST['continent']) && !empty($_POST['city']))
1972             if (isTZvalid($_POST['continent'],$_POST['city']))
1973                 $tz = $_POST['continent'].'/'.$_POST['city'];
1974         $GLOBALS['timezone'] = $tz;
1975         // Everything is ok, let's create config file.
1976         $GLOBALS['login'] = $_POST['setlogin'];
1977         $GLOBALS['salt'] = sha1(uniqid('',true).'_'.mt_rand()); // Salt renders rainbow-tables attacks useless.
1978         $GLOBALS['hash'] = sha1($_POST['setpassword'].$GLOBALS['login'].$GLOBALS['salt']);
1979         $GLOBALS['title'] = (empty($_POST['title']) ? 'Shared links on '.htmlspecialchars(indexUrl()) : $_POST['title'] );
1980         writeConfig();
1981         echo '<script language="JavaScript">alert("Shaarli is now configured. Please enter your login/password and start shaaring your links !");document.location=\'?do=login\';</script>';
1982         exit;
1983     }
1984
1985     // Display config form:
1986     list($timezone_form,$timezone_js) = templateTZform();
1987     $timezone_html=''; if ($timezone_form!='') $timezone_html='<tr><td valign="top"><b>Timezone:</b></td><td>'.$timezone_form.'</td></tr>';
1988
1989     $PAGE = new pageBuilder;
1990     $PAGE->assign('timezone_html',$timezone_html);
1991     $PAGE->assign('timezone_js',$timezone_js);
1992     $PAGE->renderPage('install');
1993     exit;
1994 }
1995
1996 // Generates the timezone selection form and javascript.
1997 // Input: (optional) current timezone (can be 'UTC/UTC'). It will be pre-selected.
1998 // Output: array(html,js)
1999 // Example: list($htmlform,$js) = templateTZform('Europe/Paris');  // Europe/Paris pre-selected.
2000 // Returns array('','') if server does not support timezones list. (eg. php 5.1 on free.fr)
2001 function templateTZform($ptz=false)
2002 {
2003     if (function_exists('timezone_identifiers_list')) // because of old php version (5.1) which can be found on free.fr
2004     {
2005         // Try to split the provided timezone.
2006         if ($ptz==false) { $l=timezone_identifiers_list(); $ptz=$l[0]; }
2007         $spos=strpos($ptz,'/'); $pcontinent=substr($ptz,0,$spos); $pcity=substr($ptz,$spos+1);
2008
2009         // Display config form:
2010         $timezone_form = '';
2011         $timezone_js = '';
2012         // The list is in the forme "Europe/Paris", "America/Argentina/Buenos_Aires"...
2013         // We split the list in continents/cities.
2014         $continents = array();
2015         $cities = array();
2016         foreach(timezone_identifiers_list() as $tz)
2017         {
2018             if ($tz=='UTC') $tz='UTC/UTC';
2019             $spos = strpos($tz,'/');
2020             if ($spos!==false)
2021             {
2022                 $continent=substr($tz,0,$spos); $city=substr($tz,$spos+1);
2023                 $continents[$continent]=1;
2024                 if (!isset($cities[$continent])) $cities[$continent]='';
2025                 $cities[$continent].='<option value="'.$city.'"'.($pcity==$city?'selected':'').'>'.$city.'</option>';
2026             }
2027         }
2028         $continents_html = '';
2029         $continents = array_keys($continents);
2030         foreach($continents as $continent)
2031             $continents_html.='<option  value="'.$continent.'"'.($pcontinent==$continent?'selected':'').'>'.$continent.'</option>';
2032         $cities_html = $cities[$pcontinent];
2033         $timezone_form = "Continent: <select name=\"continent\" id=\"continent\" onChange=\"onChangecontinent();\">${continents_html}</select><br /><br />";
2034         $timezone_form .= "City: <select name=\"city\" id=\"city\">${cities[$pcontinent]}</select><br /><br />";
2035         $timezone_js = "<script language=\"JavaScript\">";
2036         $timezone_js .= "function onChangecontinent(){document.getElementById(\"city\").innerHTML = citiescontinent[document.getElementById(\"continent\").value];}";
2037         $timezone_js .= "var citiescontinent = ".json_encode($cities).";" ;
2038         $timezone_js .= "</script>" ;
2039         return array($timezone_form,$timezone_js);
2040     }
2041     return array('','');
2042 }
2043
2044 // Tells if a timezone is valid or not.
2045 // If not valid, returns false.
2046 // If system does not support timezone list, returns false.
2047 function isTZvalid($continent,$city)
2048 {
2049     $tz = $continent.'/'.$city;
2050     if (function_exists('timezone_identifiers_list')) // because of old php version (5.1) which can be found on free.fr
2051     {
2052         if (in_array($tz, timezone_identifiers_list())) // it's a valid timezone ?
2053                     return true;
2054     }
2055     return false;
2056 }
2057
2058
2059 // Webservices (for use with jQuery/jQueryUI)
2060 // eg.  index.php?ws=tags&term=minecr
2061 function processWS()
2062 {
2063     if (empty($_GET['ws']) || empty($_GET['term'])) return;
2064     $term = $_GET['term'];
2065     $LINKSDB=new linkdb(isLoggedIn() || $GLOBALS['config']['OPEN_SHAARLI']);  // Read links from database (and filter private links if used it not logged in).
2066     header('Content-Type: application/json; charset=utf-8');
2067
2068     // Search in tags (case insentitive, cumulative search)
2069     if ($_GET['ws']=='tags')
2070     {
2071         $tags=explode(' ',str_replace(',',' ',$term)); $last = array_pop($tags); // Get the last term ("a b c d" ==> "a b c", "d")
2072         $addtags=''; if ($tags) $addtags=implode(' ',$tags).' '; // We will pre-pend previous tags
2073         $suggested=array();
2074         /* To speed up things, we store list of tags in session */
2075         if (empty($_SESSION['tags'])) $_SESSION['tags'] = $LINKSDB->allTags();
2076         foreach($_SESSION['tags'] as $key=>$value)
2077         {
2078             if (startsWith($key,$last,$case=false) && !in_array($key,$tags)) $suggested[$addtags.$key.' ']=0;
2079         }
2080         echo json_encode(array_keys($suggested));
2081         exit;
2082     }
2083
2084     // Search a single tag (case sentitive, single tag search)
2085     if ($_GET['ws']=='singletag')
2086     {
2087         /* To speed up things, we store list of tags in session */
2088         if (empty($_SESSION['tags'])) $_SESSION['tags'] = $LINKSDB->allTags();
2089         foreach($_SESSION['tags'] as $key=>$value)
2090         {
2091             if (startsWith($key,$term,$case=true)) $suggested[$key]=0;
2092         }
2093         echo json_encode(array_keys($suggested));
2094         exit;
2095     }
2096 }
2097
2098 // Re-write configuration file according to globals.
2099 // Requires some $GLOBALS to be set (login,hash,salt,title).
2100 // If the config file cannot be saved, an error message is dislayed and the user is redirected to "Tools" menu.
2101 // (otherwise, the function simply returns.)
2102 function writeConfig()
2103 {
2104     if (is_file($GLOBALS['config']['CONFIG_FILE']) && !isLoggedIn()) die('You are not authorized to alter config.'); // Only logged in user can alter config.
2105     if (empty($GLOBALS['redirector'])) $GLOBALS['redirector']='';
2106     if (empty($GLOBALS['disablesessionprotection'])) $GLOBALS['disablesessionprotection']=false;
2107     $config='<?php $GLOBALS[\'login\']='.var_export($GLOBALS['login'],true).'; $GLOBALS[\'hash\']='.var_export($GLOBALS['hash'],true).'; $GLOBALS[\'salt\']='.var_export($GLOBALS['salt'],true).'; ';
2108     $config .='$GLOBALS[\'timezone\']='.var_export($GLOBALS['timezone'],true).'; date_default_timezone_set('.var_export($GLOBALS['timezone'],true).'); $GLOBALS[\'title\']='.var_export($GLOBALS['title'],true).';';
2109     $config .= '$GLOBALS[\'redirector\']='.var_export($GLOBALS['redirector'],true).'; ';
2110     $config .= '$GLOBALS[\'disablesessionprotection\']='.var_export($GLOBALS['disablesessionprotection'],true).'; ';
2111     $config .= ' ?>';
2112     if (!file_put_contents($GLOBALS['config']['CONFIG_FILE'],$config) || strcmp(file_get_contents($GLOBALS['config']['CONFIG_FILE']),$config)!=0)
2113     {
2114         echo '<script language="JavaScript">alert("Shaarli could not create the config file. Please make sure Shaarli has the right to write in the folder is it installed in.");document.location=\'?\';</script>';
2115         exit;
2116     }
2117 }
2118
2119 /* Because some f*cking services like Flickr require an extra HTTP request to get the thumbnail URL,
2120    I have deported the thumbnail URL code generation here, otherwise this would slow down page generation.
2121    The following function takes the URL a link (eg. a flickr page) and return the proper thumbnail.
2122    This function is called by passing the url:
2123    http://mywebsite.com/shaarli/?do=genthumbnail&hmac=[HMAC]&url=[URL]
2124    [URL] is the URL of the link (eg. a flickr page)
2125    [HMAC] is the signature for the [URL] (so that these URL cannot be forged).
2126    The function below will fetch the image from the webservice and store it in the cache.
2127 */
2128 function genThumbnail()
2129 {
2130     // Make sure the parameters in the URL were generated by us.
2131     $sign = hash_hmac('sha256', $_GET['url'], $GLOBALS['salt']);
2132     if ($sign!=$_GET['hmac']) die('Naughty boy !');
2133
2134     // Let's see if we don't already have the image for this URL in the cache.
2135     $thumbname=hash('sha1',$_GET['url']).'.jpg';
2136     if (is_file($GLOBALS['config']['CACHEDIR'].'/'.$thumbname))
2137     {   // We have the thumbnail, just serve it:
2138         header('Content-Type: image/jpeg');
2139         echo file_get_contents($GLOBALS['config']['CACHEDIR'].'/'.$thumbname);
2140         return;
2141     }
2142     // We may also serve a blank image (if service did not respond)
2143     $blankname=hash('sha1',$_GET['url']).'.gif';
2144     if (is_file($GLOBALS['config']['CACHEDIR'].'/'.$blankname))
2145     {
2146         header('Content-Type: image/gif');
2147         echo file_get_contents($GLOBALS['config']['CACHEDIR'].'/'.$blankname);
2148         return;
2149     }
2150
2151     // Otherwise, generate the thumbnail.
2152     $url = $_GET['url'];
2153     $domain = parse_url($url,PHP_URL_HOST);
2154
2155     if ($domain=='flickr.com' || endsWith($domain,'.flickr.com'))
2156     {
2157         // Crude replacement to handle new Flickr domain policy (They prefer www. now)
2158         $url = str_replace('http://flickr.com/','http://www.flickr.com/',$url);
2159
2160         // Is this a link to an image, or to a flickr page ?
2161         $imageurl='';
2162         if (endswith(parse_url($url,PHP_URL_PATH),'.jpg'))
2163         {  // This is a direct link to an image. eg. http://farm1.staticflickr.com/5/5921913_ac83ed27bd_o.jpg
2164             preg_match('!(http://farm\d+\.staticflickr\.com/\d+/\d+_\w+_)\w.jpg!',$url,$matches);
2165             if (!empty($matches[1])) $imageurl=$matches[1].'m.jpg';
2166         }
2167         else // this is a flickr page (html)
2168         {
2169             list($httpstatus,$headers,$data) = getHTTP($url,20); // Get the flickr html page.
2170             if (strpos($httpstatus,'200 OK')!==false)
2171             {
2172                 // Flickr now nicely provides the URL of the thumbnail in each flickr page.
2173                 preg_match('!<link rel=\"image_src\" href=\"(.+?)\"!',$data,$matches);
2174                 if (!empty($matches[1])) $imageurl=$matches[1];
2175
2176                 // In albums (and some other pages), the link rel="image_src" is not provided,
2177                 // but flickr provides:
2178                 // <meta property="og:image" content="http://farm4.staticflickr.com/3398/3239339068_25d13535ff_z.jpg" />
2179                 if ($imageurl=='')
2180                 {
2181                     preg_match('!<meta property=\"og:image\" content=\"(.+?)\"!',$data,$matches);
2182                     if (!empty($matches[1])) $imageurl=$matches[1];
2183                 }
2184             }
2185         }
2186
2187         if ($imageurl!='')
2188         {   // Let's download the image.
2189             list($httpstatus,$headers,$data) = getHTTP($imageurl,10); // Image is 240x120, so 10 seconds to download should be enough.
2190             if (strpos($httpstatus,'200 OK')!==false)
2191             {
2192                 file_put_contents($GLOBALS['config']['CACHEDIR'].'/'.$thumbname,$data); // Save image to cache.
2193                 header('Content-Type: image/jpeg');
2194                 echo $data;
2195                 return;
2196             }
2197         }
2198     }
2199
2200     elseif ($domain=='vimeo.com' )
2201     {
2202         // This is more complex: we have to perform a HTTP request, then parse the result.
2203         // Maybe we should deport this to javascript ? Example: http://stackoverflow.com/questions/1361149/get-img-thumbnails-from-vimeo/4285098#4285098
2204         $vid = substr(parse_url($url,PHP_URL_PATH),1);
2205         list($httpstatus,$headers,$data) = getHTTP('http://vimeo.com/api/v2/video/'.htmlspecialchars($vid).'.php',5);
2206         if (strpos($httpstatus,'200 OK')!==false)
2207         {
2208             $t = unserialize($data);
2209             $imageurl = $t[0]['thumbnail_medium'];
2210             // Then we download the image and serve it to our client.
2211             list($httpstatus,$headers,$data) = getHTTP($imageurl,10);
2212             if (strpos($httpstatus,'200 OK')!==false)
2213             {
2214                 file_put_contents($GLOBALS['config']['CACHEDIR'].'/'.$thumbname,$data); // Save image to cache.
2215                 header('Content-Type: image/jpeg');
2216                 echo $data;
2217                 return;
2218             }
2219         }
2220     }
2221
2222     elseif ($domain=='ted.com' || endsWith($domain,'.ted.com'))
2223     {
2224         // The thumbnail for TED talks is located in the <link rel="image_src" [...]> tag on that page
2225         // http://www.ted.com/talks/mikko_hypponen_fighting_viruses_defending_the_net.html
2226         // <link rel="image_src" href="http://images.ted.com/images/ted/28bced335898ba54d4441809c5b1112ffaf36781_389x292.jpg" />
2227         list($httpstatus,$headers,$data) = getHTTP($url,5);
2228         if (strpos($httpstatus,'200 OK')!==false)
2229         {
2230             // Extract the link to the thumbnail
2231             preg_match('!link rel="image_src" href="(http://images.ted.com/images/ted/.+_\d+x\d+\.jpg)"!',$data,$matches);
2232             if (!empty($matches[1]))
2233             {   // Let's download the image.
2234                 $imageurl=$matches[1];
2235                 list($httpstatus,$headers,$data) = getHTTP($imageurl,20); // No control on image size, so wait long enough.
2236                 if (strpos($httpstatus,'200 OK')!==false)
2237                 {
2238                     $filepath=$GLOBALS['config']['CACHEDIR'].'/'.$thumbname;
2239                     file_put_contents($filepath,$data); // Save image to cache.
2240                     if (resizeImage($filepath))
2241                     {
2242                         header('Content-Type: image/jpeg');
2243                         echo file_get_contents($filepath);
2244                         return;
2245                     }
2246                 }
2247             }
2248         }
2249     }
2250
2251     elseif ($domain=='xkcd.com' || endsWith($domain,'.xkcd.com'))
2252     {
2253         // There is no thumbnail available for xkcd comics, so download the whole image and resize it.
2254         // http://xkcd.com/327/
2255         // <img src="http://imgs.xkcd.com/comics/exploits_of_a_mom.png" title="<BLABLA>" alt="<BLABLA>" />
2256         list($httpstatus,$headers,$data) = getHTTP($url,5);
2257         if (strpos($httpstatus,'200 OK')!==false)
2258         {
2259             // Extract the link to the thumbnail
2260             preg_match('!<img src="(http://imgs.xkcd.com/comics/.*)" title="[^s]!',$data,$matches);
2261             if (!empty($matches[1]))
2262             {   // Let's download the image.
2263                 $imageurl=$matches[1];
2264                 list($httpstatus,$headers,$data) = getHTTP($imageurl,20); // No control on image size, so wait long enough.
2265                 if (strpos($httpstatus,'200 OK')!==false)
2266                 {
2267                     $filepath=$GLOBALS['config']['CACHEDIR'].'/'.$thumbname;
2268                     file_put_contents($filepath,$data); // Save image to cache.
2269                     if (resizeImage($filepath))
2270                     {
2271                         header('Content-Type: image/jpeg');
2272                         echo file_get_contents($filepath);
2273                         return;
2274                     }
2275                 }
2276             }
2277         }
2278     }
2279
2280     else
2281     {
2282         // For all other domains, we try to download the image and make a thumbnail.
2283         list($httpstatus,$headers,$data) = getHTTP($url,30);  // We allow 30 seconds max to download (and downloads are limited to 4 Mb)
2284         if (strpos($httpstatus,'200 OK')!==false)
2285         {
2286             $filepath=$GLOBALS['config']['CACHEDIR'].'/'.$thumbname;
2287             file_put_contents($filepath,$data); // Save image to cache.
2288             if (resizeImage($filepath))
2289             {
2290                 header('Content-Type: image/jpeg');
2291                 echo file_get_contents($filepath);
2292                 return;
2293             }
2294         }
2295     }
2296
2297
2298     // Otherwise, return an empty image (8x8 transparent gif)
2299     $blankgif = base64_decode('R0lGODlhCAAIAIAAAP///////yH5BAEKAAEALAAAAAAIAAgAAAIHjI+py+1dAAA7');
2300     file_put_contents($GLOBALS['config']['CACHEDIR'].'/'.$blankname,$blankgif); // Also put something in cache so that this URL is not requested twice.
2301     header('Content-Type: image/gif');
2302     echo $blankgif;
2303 }
2304
2305 // Make a thumbnail of the image (to width: 120 pixels)
2306 // Returns true if success, false otherwise.
2307 function resizeImage($filepath)
2308 {
2309     if (!function_exists('imagecreatefromjpeg')) return false; // GD not present: no thumbnail possible.
2310
2311     // Trick: some stupid people rename GIF as JPEG... or else.
2312     // So we really try to open each image type whatever the extension is.
2313     $header=file_get_contents($filepath,false,NULL,0,256); // Read first 256 bytes and try to sniff file type.
2314     $im=false;
2315     $i=strpos($header,'GIF8'); if (($i!==false) && ($i==0)) $im = imagecreatefromgif($filepath); // Well this is crude, but it should be enough.
2316     $i=strpos($header,'PNG'); if (($i!==false) && ($i==1)) $im = imagecreatefrompng($filepath);
2317     $i=strpos($header,'JFIF'); if ($i!==false) $im = imagecreatefromjpeg($filepath);
2318     if (!$im) return false;  // Unable to open image (corrupted or not an image)
2319     $w = imagesx($im);
2320     $h = imagesy($im);
2321     $ystart = 0; $yheight=$h;
2322     if ($h>$w) { $ystart= ($h/2)-($w/2); $yheight=$w/2; }
2323     $nw = 120;   // Desired width
2324     $nh = min(floor(($h*$nw)/$w),120); // Compute new width/height, but maximum 120 pixels height.
2325     // Resize image:
2326     $im2 = imagecreatetruecolor($nw,$nh);
2327     imagecopyresampled($im2, $im, 0, 0, 0, $ystart, $nw, $nh, $w, $yheight);
2328     imageinterlace($im2,true); // For progressive JPEG.
2329     $tempname=$filepath.'_TEMP.jpg';
2330     imagejpeg($im2, $tempname, 90);
2331     imagedestroy($im);
2332     imagedestroy($im2);
2333     rename($tempname,$filepath);  // Overwrite original picture with thumbnail.
2334     return true;
2335 }
2336
2337 // Invalidate caches when the database is changed or the user logs out.
2338 // (eg. tags cache).
2339 function invalidateCaches()
2340 {
2341     unset($_SESSION['tags']);  // Purge cache attached to session.
2342     pageCache::purgeCache();   // Purge page cache shared by sessions.
2343 }
2344
2345 if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=genthumbnail')) { genThumbnail(); exit; }  // Thumbnail generation/cache does not need the link database.
2346 if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=rss')) { showRSS(); exit; }
2347 if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=atom')) { showATOM(); exit; }
2348 if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=dailyrss')) { showDailyRSS(); exit; }
2349 if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'do=daily')) { showDaily(); exit; }
2350 if (isset($_SERVER["QUERY_STRING"]) && startswith($_SERVER["QUERY_STRING"],'ws=')) { processWS(); exit; } // Webservices (for jQuery/jQueryUI)
2351 if (!isset($_SESSION['LINKS_PER_PAGE'])) $_SESSION['LINKS_PER_PAGE']=$GLOBALS['config']['LINKS_PER_PAGE'];
2352 renderPage();
2353 ?>