use \Shaarli\Languages;
use \Shaarli\ThemeUtils;
use \Shaarli\Config\ConfigManager;
+use \Shaarli\LoginManager;
use \Shaarli\SessionManager;
// Ensure the PHP version is supported
// Set default cookie expiration and path.
session_set_cookie_params($cookie['lifetime'], $cookiedir, $_SERVER['SERVER_NAME']);
// Set session parameters on server side.
-// If the user does not access any page within this time, his/her session is considered expired.
-define('INACTIVITY_TIMEOUT', 3600); // in seconds.
// Use cookies to store session.
ini_set('session.use_cookies', 1);
// Force cookies for session (phpsessionID forbidden in URL).
}
$conf = new ConfigManager();
+$loginManager = new LoginManager($GLOBALS, $conf);
$sessionManager = new SessionManager($_SESSION, $conf);
+// LC_MESSAGES isn't defined without php-intl, in this case use LC_COLLATE locale instead.
+if (! defined('LC_MESSAGES')) {
+ define('LC_MESSAGES', LC_COLLATE);
+}
+
// Sniff browser language and set date format accordingly.
if (isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])) {
autoLocale($_SERVER['HTTP_ACCEPT_LANGUAGE']);
/**
* Checking session state (i.e. is the user still logged in)
*
- * @param ConfigManager $conf The configuration manager.
+ * @param ConfigManager $conf Configuration Manager instance.
+ * @param SessionManager $sessionManager SessionManager instance
*
- * @return bool: true if the user is logged in, false otherwise.
+ * @return bool true if the user is logged in, false otherwise.
*/
-function setup_login_state($conf)
+function setup_login_state($conf, $sessionManager)
{
if ($conf->get('security.open_shaarli')) {
return true;
$_COOKIE['shaarli_staySignedIn']===STAY_SIGNED_IN_TOKEN &&
!$loginFailure)
{
- fillSessionInfo($conf);
+ fillSessionInfo($conf, $sessionManager);
$userIsLoggedIn = true;
}
// If session does not exist on server side, or IP address has changed, or session has expired, logout.
if (empty($_SESSION['uid'])
- || ($conf->get('security.session_protection_disabled') === false && $_SESSION['ip'] != allIPs())
+ || ($conf->get('security.session_protection_disabled') === false && $_SESSION['ip'] != client_ip_id($_SERVER))
|| time() >= $_SESSION['expires_on'])
{
logout();
}
if (!empty($_SESSION['longlastingsession'])) {
$_SESSION['expires_on']=time()+$_SESSION['longlastingsession']; // In case of "Stay signed in" checked.
- }
- else {
- $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT; // Standard session expiration date.
+ } else {
+ $_SESSION['expires_on'] = time() + $sessionManager::$INACTIVITY_TIMEOUT;
}
if (!$loginFailure) {
$userIsLoggedIn = true;
return $userIsLoggedIn;
}
-$userIsLoggedIn = setup_login_state($conf);
+
+$userIsLoggedIn = setup_login_state($conf, $sessionManager);
// ------------------------------------------------------------------------------------------
// Session management
-// Returns the IP address of the client (Used to prevent session cookie hijacking.)
-function allIPs()
-{
- $ip = $_SERVER['REMOTE_ADDR'];
- // Then we use more HTTP headers to prevent session hijacking from users behind the same proxy.
- if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) { $ip=$ip.'_'.$_SERVER['HTTP_X_FORWARDED_FOR']; }
- if (isset($_SERVER['HTTP_CLIENT_IP'])) { $ip=$ip.'_'.$_SERVER['HTTP_CLIENT_IP']; }
- return $ip;
-}
-
/**
- * Load user session.
+ * Load user session
*
- * @param ConfigManager $conf Configuration Manager instance.
+ * @param ConfigManager $conf Configuration Manager instance.
+ * @param SessionManager $sessionManager SessionManager instance
*/
-function fillSessionInfo($conf)
+function fillSessionInfo($conf, $sessionManager)
{
$_SESSION['uid'] = sha1(uniqid('',true).'_'.mt_rand()); // Generate unique random number (different than phpsessionid)
- $_SESSION['ip']=allIPs(); // We store IP address(es) of the client to make sure session is not hijacked.
+ $_SESSION['ip'] = client_ip_id($_SERVER);
$_SESSION['username']= $conf->get('credentials.login');
- $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT; // Set session expiration.
+ $_SESSION['expires_on'] = time() + $sessionManager::$INACTIVITY_TIMEOUT;
}
/**
* Check that user/password is correct.
*
- * @param string $login Username
- * @param string $password User password
- * @param ConfigManager $conf Configuration Manager instance.
+ * @param string $login Username
+ * @param string $password User password
+ * @param ConfigManager $conf Configuration Manager instance.
+ * @param SessionManager $sessionManager SessionManager instance
*
* @return bool: authentication successful or not.
*/
-function check_auth($login, $password, $conf)
+function check_auth($login, $password, $conf, $sessionManager)
{
$hash = sha1($password . $login . $conf->get('credentials.salt'));
- if ($login == $conf->get('credentials.login') && $hash == $conf->get('credentials.hash'))
- { // Login/password is correct.
- fillSessionInfo($conf);
+ if ($login == $conf->get('credentials.login') && $hash == $conf->get('credentials.hash')) {
+ // Login/password is correct.
+ fillSessionInfo($conf, $sessionManager);
logm($conf->get('resource.log'), $_SERVER['REMOTE_ADDR'], 'Login successful');
return true;
}
unset($_SESSION['uid']);
unset($_SESSION['ip']);
unset($_SESSION['username']);
- unset($_SESSION['privateonly']);
+ unset($_SESSION['visibility']);
unset($_SESSION['untaggedonly']);
}
setcookie('shaarli_staySignedIn', FALSE, 0, WEB_PATH);
}
-
-// ------------------------------------------------------------------------------------------
-// Brute force protection system
-// Several consecutive failed logins will ban the IP address for 30 minutes.
-if (!is_file($conf->get('resource.ban_file', 'data/ipbans.php'))) {
- // FIXME! globals
- file_put_contents(
- $conf->get('resource.ban_file', 'data/ipbans.php'),
- "<?php\n\$GLOBALS['IPBANS']=".var_export(array('FAILURES'=>array(),'BANS'=>array()),true).";\n?>"
- );
-}
-include $conf->get('resource.ban_file', 'data/ipbans.php');
-/**
- * Signal a failed login. Will ban the IP if too many failures:
- *
- * @param ConfigManager $conf Configuration Manager instance.
- */
-function ban_loginFailed($conf)
-{
- $ip = $_SERVER['REMOTE_ADDR'];
- $trusted = $conf->get('security.trusted_proxies', array());
- if (in_array($ip, $trusted)) {
- $ip = getIpAddressFromProxy($_SERVER, $trusted);
- if (!$ip) {
- return;
- }
- }
- $gb = $GLOBALS['IPBANS'];
- if (! isset($gb['FAILURES'][$ip])) {
- $gb['FAILURES'][$ip]=0;
- }
- $gb['FAILURES'][$ip]++;
- if ($gb['FAILURES'][$ip] > ($conf->get('security.ban_after') - 1))
- {
- $gb['BANS'][$ip] = time() + $conf->get('security.ban_after', 1800);
- logm($conf->get('resource.log'), $_SERVER['REMOTE_ADDR'], 'IP address banned from login');
- }
- $GLOBALS['IPBANS'] = $gb;
- file_put_contents(
- $conf->get('resource.ban_file', 'data/ipbans.php'),
- "<?php\n\$GLOBALS['IPBANS']=".var_export($gb,true).";\n?>"
- );
-}
-
-/**
- * Signals a successful login. Resets failed login counter.
- *
- * @param ConfigManager $conf Configuration Manager instance.
- */
-function ban_loginOk($conf)
-{
- $ip = $_SERVER['REMOTE_ADDR'];
- $gb = $GLOBALS['IPBANS'];
- unset($gb['FAILURES'][$ip]); unset($gb['BANS'][$ip]);
- $GLOBALS['IPBANS'] = $gb;
- file_put_contents(
- $conf->get('resource.ban_file', 'data/ipbans.php'),
- "<?php\n\$GLOBALS['IPBANS']=".var_export($gb,true).";\n?>"
- );
-}
-
-/**
- * Checks if the user CAN login. If 'true', the user can try to login.
- *
- * @param ConfigManager $conf Configuration Manager instance.
- *
- * @return bool: true if the user is allowed to login.
- */
-function ban_canLogin($conf)
-{
- $ip=$_SERVER["REMOTE_ADDR"]; $gb=$GLOBALS['IPBANS'];
- if (isset($gb['BANS'][$ip]))
- {
- // User is banned. Check if the ban has expired:
- if ($gb['BANS'][$ip]<=time())
- { // Ban expired, user can try to login again.
- logm($conf->get('resource.log'), $_SERVER['REMOTE_ADDR'], 'Ban lifted.');
- unset($gb['FAILURES'][$ip]); unset($gb['BANS'][$ip]);
- file_put_contents(
- $conf->get('resource.ban_file', 'data/ipbans.php'),
- "<?php\n\$GLOBALS['IPBANS']=".var_export($gb,true).";\n?>"
- );
- return true; // Ban has expired, user can login.
- }
- return false; // User is banned.
- }
- return true; // User is not banned.
-}
-
// ------------------------------------------------------------------------------------------
// Process login form: Check if login/password is correct.
-if (isset($_POST['login']))
-{
- if (!ban_canLogin($conf)) die(t('I said: NO. You are banned for the moment. Go away.'));
+if (isset($_POST['login'])) {
+ if (! $loginManager->canLogin($_SERVER)) {
+ die(t('I said: NO. You are banned for the moment. Go away.'));
+ }
if (isset($_POST['password'])
&& $sessionManager->checkToken($_POST['token'])
- && (check_auth($_POST['login'], $_POST['password'], $conf))
- ) { // Login/password is OK.
- ban_loginOk($conf);
+ && (check_auth($_POST['login'], $_POST['password'], $conf, $sessionManager))
+ ) {
+ // Login/password is OK.
+ $loginManager->handleSuccessfulLogin($_SERVER);
+
// If user wants to keep the session cookie even after the browser closes:
- if (!empty($_POST['longlastingsession']))
- {
+ if (!empty($_POST['longlastingsession'])) {
$_SESSION['longlastingsession'] = 31536000; // (31536000 seconds = 1 year)
$expiration = time() + $_SESSION['longlastingsession']; // calculate relative cookie expiration (1 year from now)
setcookie('shaarli_staySignedIn', STAY_SIGNED_IN_TOKEN, $expiration, WEB_PATH);
}
}
header('Location: ?'); exit;
- }
- else
- {
- ban_loginFailed($conf);
+ } else {
+ $loginManager->handleFailedLogin($_SERVER);
$redir = '&username='. urlencode($_POST['login']);
if (isset($_GET['post'])) {
$redir .= '&post=' . urlencode($_GET['post']);
$pageBuilder->assign($key, $value);
}
+ $pageBuilder->assign('pagetitle', t('Daily') .' - '. $conf->get('general.title', 'Shaarli'));
$pageBuilder->renderPage('daily');
exit;
}
* @param LinkDB $LINKSDB
* @param History $history instance
* @param SessionManager $sessionManager SessionManager instance
+ * @param LoginManager $loginManager LoginManager instance
*/
-function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager)
+function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager, $loginManager)
{
$updater = new Updater(
read_updates_file($conf->get('resource.updates')),
$PAGE->assign('returnurl',(isset($_SERVER['HTTP_REFERER']) ? escape($_SERVER['HTTP_REFERER']):''));
// add default state of the 'remember me' checkbox
$PAGE->assign('remember_user_default', $conf->get('privacy.remember_user_default'));
+ $PAGE->assign('user_can_login', $loginManager->canLogin($_SERVER));
+ $PAGE->assign('pagetitle', t('Login') .' - '. $conf->get('general.title', 'Shaarli'));
$PAGE->renderPage('loginform');
exit;
}
$PAGE->assign($key, $value);
}
+ $PAGE->assign('pagetitle', t('Picture wall') .' - '. $conf->get('general.title', 'Shaarli'));
$PAGE->renderPage('picwall');
exit;
}
// -------- Tag cloud
if ($targetPage == Router::$PAGE_TAGCLOUD)
{
- $visibility = ! empty($_SESSION['privateonly']) ? 'private' : 'all';
+ $visibility = ! empty($_SESSION['visibility']) ? $_SESSION['visibility'] : '';
$filteringTags = isset($_GET['searchtags']) ? explode(' ', $_GET['searchtags']) : [];
$tags = $LINKSDB->linksCountPerTag($filteringTags, $visibility);
);
}
+ $searchTags = implode(' ', escape($filteringTags));
$data = array(
- 'search_tags' => implode(' ', escape($filteringTags)),
+ 'search_tags' => $searchTags,
'tags' => $tagList,
);
$pluginManager->executeHooks('render_tagcloud', $data, array('loggedin' => isLoggedIn()));
$PAGE->assign($key, $value);
}
+ $searchTags = ! empty($searchTags) ? $searchTags .' - ' : '';
+ $PAGE->assign('pagetitle', $searchTags. t('Tag cloud') .' - '. $conf->get('general.title', 'Shaarli'));
$PAGE->renderPage('tag.cloud');
exit;
}
// -------- Tag list
if ($targetPage == Router::$PAGE_TAGLIST)
{
- $visibility = ! empty($_SESSION['privateonly']) ? 'private' : 'all';
+ $visibility = ! empty($_SESSION['visibility']) ? $_SESSION['visibility'] : '';
$filteringTags = isset($_GET['searchtags']) ? explode(' ', $_GET['searchtags']) : [];
$tags = $LINKSDB->linksCountPerTag($filteringTags, $visibility);
foreach ($filteringTags as $tag) {
alphabetical_sort($tags, false, true);
}
+ $searchTags = implode(' ', escape($filteringTags));
$data = [
- 'search_tags' => implode(' ', escape($filteringTags)),
+ 'search_tags' => $searchTags,
'tags' => $tags,
];
$pluginManager->executeHooks('render_taglist', $data, ['loggedin' => isLoggedIn()]);
$PAGE->assign($key, $value);
}
+ $searchTags = ! empty($searchTags) ? $searchTags .' - ' : '';
+ $PAGE->assign('pagetitle', $searchTags . t('Tag list') .' - '. $conf->get('general.title', 'Shaarli'));
$PAGE->renderPage('tag.list');
exit;
}
if (empty($params['searchtags'])) {
$params['searchtags'] = trim($_GET['addtag']);
}
- else if ($addtag) {
+ elseif ($addtag) {
$params['searchtags'] = trim($params['searchtags']).' '.trim($_GET['addtag']);
}
}
// -------- User wants to see only private links (toggle)
- if (isset($_GET['privateonly'])) {
- if (empty($_SESSION['privateonly'])) {
- $_SESSION['privateonly'] = 1; // See only private links
- } else {
- unset($_SESSION['privateonly']); // See all links
+ if (isset($_GET['visibility'])) {
+ if ($_GET['visibility'] === 'private') {
+ // Visibility not set or not already private, set private, otherwise reset it
+ if (empty($_SESSION['visibility']) || $_SESSION['visibility'] !== 'private') {
+ // See only private links
+ $_SESSION['visibility'] = 'private';
+ } else {
+ unset($_SESSION['visibility']);
+ }
+ } elseif ($_GET['visibility'] === 'public') {
+ if (empty($_SESSION['visibility']) || $_SESSION['visibility'] !== 'public') {
+ // See only public links
+ $_SESSION['visibility'] = 'public';
+ } else {
+ unset($_SESSION['visibility']);
+ }
}
if (! empty($_SERVER['HTTP_REFERER'])) {
- $location = generateLocation($_SERVER['HTTP_REFERER'], $_SERVER['HTTP_HOST'], array('privateonly'));
+ $location = generateLocation($_SERVER['HTTP_REFERER'], $_SERVER['HTTP_HOST'], array('visibility'));
} else {
$location = '?';
}
$PAGE->assign($key, $value);
}
+ $PAGE->assign('pagetitle', t('Tools') .' - '. $conf->get('general.title', 'Shaarli'));
$PAGE->renderPage('tools');
exit;
}
}
else // show the change password form.
{
+ $PAGE->assign('pagetitle', t('Change password') .' - '. $conf->get('general.title', 'Shaarli'));
$PAGE->renderPage('changepassword');
exit;
}
$conf->set('general.title', escape($_POST['title']));
$conf->set('general.header_link', escape($_POST['titleLink']));
$conf->set('resource.theme', escape($_POST['theme']));
- $conf->set('redirector.url', escape($_POST['redirector']));
$conf->set('security.session_protection_disabled', !empty($_POST['disablesessionprotection']));
$conf->set('privacy.default_private_links', !empty($_POST['privateLinkByDefault']));
$conf->set('feed.rss_permalinks', !empty($_POST['enableRssPermalinks']));
$PAGE->assign('title', $conf->get('general.title'));
$PAGE->assign('theme', $conf->get('resource.theme'));
$PAGE->assign('theme_available', ThemeUtils::getThemes($conf->get('resource.raintpl_tpl')));
- $PAGE->assign('redirector', $conf->get('redirector.url'));
list($continents, $cities) = generateTimeZoneData(
timezone_identifiers_list(),
$conf->get('general.timezone')
$PAGE->assign('api_secret', $conf->get('api.secret'));
$PAGE->assign('languages', Languages::getAvailableLanguages());
$PAGE->assign('language', $conf->get('translation.language'));
+ $PAGE->assign('pagetitle', t('Configure') .' - '. $conf->get('general.title', 'Shaarli'));
$PAGE->renderPage('configure');
exit;
}
{
if (empty($_POST['fromtag']) || (empty($_POST['totag']) && isset($_POST['renametag']))) {
$PAGE->assign('fromtag', ! empty($_GET['fromtag']) ? escape($_GET['fromtag']) : '');
+ $PAGE->assign('pagetitle', t('Manage tags') .' - '. $conf->get('general.title', 'Shaarli'));
$PAGE->renderPage('changetag');
exit;
}
// -------- User wants to add a link without using the bookmarklet: Show form.
if ($targetPage == Router::$PAGE_ADDLINK)
{
+ $PAGE->assign('pagetitle', t('Shaare a new link') .' - '. $conf->get('general.title', 'Shaarli'));
$PAGE->renderPage('addlink');
exit;
}
$PAGE->assign($key, $value);
}
+ $PAGE->assign('pagetitle', t('Edit') .' '. t('Shaare') .' - '. $conf->get('general.title', 'Shaarli'));
$PAGE->renderPage('editlink');
exit;
}
if (empty($title) && strpos(get_url_scheme($url), 'http') !== false) {
// Short timeout to keep the application responsive
// The callback will fill $charset and $title with data from the downloaded page.
- get_http_response($url, 25, 4194304, get_curl_download_callback($charset, $title));
+ get_http_response(
+ $url,
+ $conf->get('general.download_timeout', 30),
+ $conf->get('general.download_max_size', 4194304),
+ get_curl_download_callback($charset, $title)
+ );
if (! empty($title) && strtolower($charset) != 'utf-8') {
$title = mb_convert_encoding($title, 'utf-8', $charset);
}
$PAGE->assign($key, $value);
}
+ $PAGE->assign('pagetitle', t('Shaare') .' - '. $conf->get('general.title', 'Shaarli'));
$PAGE->renderPage('editlink');
exit;
}
// Export links as a Netscape Bookmarks file
if (empty($_GET['selection'])) {
+ $PAGE->assign('pagetitle', t('Export') .' - '. $conf->get('general.title', 'Shaarli'));
$PAGE->renderPage('export');
exit;
}
true
)
);
+ $PAGE->assign('pagetitle', t('Import') .' - '. $conf->get('general.title', 'Shaarli'));
$PAGE->renderPage('import');
exit;
}
$PAGE->assign('enabledPlugins', $enabledPlugins);
$PAGE->assign('disabledPlugins', $disabledPlugins);
+ $PAGE->assign('pagetitle', t('Plugin administration') .' - '. $conf->get('general.title', 'Shaarli'));
$PAGE->renderPage('pluginsadmin');
exit;
}
}
} else {
// Filter links according search parameters.
- $visibility = ! empty($_SESSION['privateonly']) ? 'private' : 'all';
+ $visibility = ! empty($_SESSION['visibility']) ? $_SESSION['visibility'] : '';
$request = [
'searchtags' => $searchtags,
'searchterm' => $searchterm,
'result_count' => count($linksToDisplay),
'search_term' => $searchterm,
'search_tags' => $searchtags,
- 'visibility' => ! empty($_SESSION['privateonly']) ? 'private' : '',
+ 'visibility' => ! empty($_SESSION['visibility']) ? $_SESSION['visibility'] : '',
'redirector' => $conf->get('redirector.url'), // Optional redirector URL.
'links' => $linkDisp,
);
// If there is only a single link, we change on-the-fly the title of the page.
if (count($linksToDisplay) == 1) {
$data['pagetitle'] = $linksToDisplay[$keys[0]]['title'] .' - '. $conf->get('general.title');
+ } elseif (! empty($searchterm) || ! empty($searchtags)) {
+ $data['pagetitle'] = t('Search: ');
+ $data['pagetitle'] .= ! empty($searchterm) ? $searchterm .' ' : '';
+ $bracketWrap = function ($tag) {
+ return '['. $tag .']';
+ };
+ $data['pagetitle'] .= ! empty($searchtags)
+ ? implode(' ', array_map($bracketWrap, preg_split('/\s+/', $searchtags))).' '
+ : '';
+ $data['pagetitle'] .= '- '. $conf->get('general.title');
}
$pluginManager->executeHooks('render_linklist', $data, array('loggedin' => isLoggedIn()));
if ($response->getStatusCode() == 404 && strpos($_SERVER['REQUEST_URI'], '/api/v1') === false) {
// We use UTF-8 for proper international characters handling.
header('Content-Type: text/html; charset=utf-8');
- renderPage($conf, $pluginManager, $linkDb, $history, $sessionManager);
+ renderPage($conf, $pluginManager, $linkDb, $history, $sessionManager, $loginManager);
} else {
$app->respond($response);
}
projects / github / shaarli / Shaarli.git / blobdiff