."If you installed Shaarli through Git or using the development branch,\n"
."please refer to the installation documentation to install PHP"
." dependencies using Composer:\n"
- ."- https://github.com/shaarli/Shaarli/wiki/Server-requirements\n"
- ."- https://github.com/shaarli/Shaarli/wiki/Download-and-Installation";
+ ."- https://shaarli.readthedocs.io/en/master/Server-requirements/\n"
+ ."- https://shaarli.readthedocs.io/en/master/Download-and-Installation/";
exit;
}
require_once 'inc/rain.tpl.class.php';
ob_start(); // Output buffering for the page cache.
-// In case stupid admin has left magic_quotes enabled in php.ini:
-if (get_magic_quotes_gpc())
-{
- function stripslashes_deep($value) { $value = is_array($value) ? array_map('stripslashes_deep', $value) : stripslashes($value); return $value; }
- $_POST = array_map('stripslashes_deep', $_POST);
- $_GET = array_map('stripslashes_deep', $_GET);
- $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
-}
-
// Prevent caching on client side or proxy: (yes, it's ugly)
header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
header("Cache-Control: no-store, no-cache, must-revalidate");
*/
function setup_login_state($conf)
{
- if ($conf->get('security.open_shaarli')) {
- return true;
- }
- $userIsLoggedIn = false; // By default, we do not consider the user as logged in;
- $loginFailure = false; // If set to true, every attempt to authenticate the user will fail. This indicates that an important condition isn't met.
- if (! $conf->exists('credentials.login')) {
- $userIsLoggedIn = false; // Shaarli is not configured yet.
- $loginFailure = true;
- }
- if (isset($_COOKIE['shaarli_staySignedIn']) &&
- $_COOKIE['shaarli_staySignedIn']===STAY_SIGNED_IN_TOKEN &&
- !$loginFailure)
- {
- fillSessionInfo($conf);
- $userIsLoggedIn = true;
- }
- // If session does not exist on server side, or IP address has changed, or session has expired, logout.
- if (empty($_SESSION['uid'])
+ if ($conf->get('security.open_shaarli')) {
+ return true;
+ }
+ $userIsLoggedIn = false; // By default, we do not consider the user as logged in;
+ $loginFailure = false; // If set to true, every attempt to authenticate the user will fail. This indicates that an important condition isn't met.
+ if (! $conf->exists('credentials.login')) {
+ $userIsLoggedIn = false; // Shaarli is not configured yet.
+ $loginFailure = true;
+ }
+ if (isset($_COOKIE['shaarli_staySignedIn']) &&
+ $_COOKIE['shaarli_staySignedIn']===STAY_SIGNED_IN_TOKEN &&
+ !$loginFailure)
+ {
+ fillSessionInfo($conf);
+ $userIsLoggedIn = true;
+ }
+ // If session does not exist on server side, or IP address has changed, or session has expired, logout.
+ if (empty($_SESSION['uid'])
|| ($conf->get('security.session_protection_disabled') === false && $_SESSION['ip'] != allIPs())
|| time() >= $_SESSION['expires_on'])
- {
- logout();
- $userIsLoggedIn = false;
- $loginFailure = true;
- }
- if (!empty($_SESSION['longlastingsession'])) {
- $_SESSION['expires_on']=time()+$_SESSION['longlastingsession']; // In case of "Stay signed in" checked.
- }
- else {
- $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT; // Standard session expiration date.
- }
- if (!$loginFailure) {
- $userIsLoggedIn = true;
- }
-
- return $userIsLoggedIn;
+ {
+ logout();
+ $userIsLoggedIn = false;
+ $loginFailure = true;
+ }
+ if (!empty($_SESSION['longlastingsession'])) {
+ $_SESSION['expires_on']=time()+$_SESSION['longlastingsession']; // In case of "Stay signed in" checked.
+ }
+ else {
+ $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT; // Standard session expiration date.
+ }
+ if (!$loginFailure) {
+ $userIsLoggedIn = true;
+ }
+
+ return $userIsLoggedIn;
}
$userIsLoggedIn = setup_login_state($conf);
*/
function fillSessionInfo($conf)
{
- $_SESSION['uid'] = sha1(uniqid('',true).'_'.mt_rand()); // Generate unique random number (different than phpsessionid)
- $_SESSION['ip']=allIPs(); // We store IP address(es) of the client to make sure session is not hijacked.
- $_SESSION['username']= $conf->get('credentials.login');
- $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT; // Set session expiration.
+ $_SESSION['uid'] = sha1(uniqid('',true).'_'.mt_rand()); // Generate unique random number (different than phpsessionid)
+ $_SESSION['ip']=allIPs(); // We store IP address(es) of the client to make sure session is not hijacked.
+ $_SESSION['username']= $conf->get('credentials.login');
+ $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT; // Set session expiration.
}
/**
$hash = sha1($password . $login . $conf->get('credentials.salt'));
if ($login == $conf->get('credentials.login') && $hash == $conf->get('credentials.hash'))
{ // Login/password is correct.
- fillSessionInfo($conf);
+ fillSessionInfo($conf);
logm($conf->get('resource.log'), $_SERVER['REMOTE_ADDR'], 'Login successful');
return true;
}
// If user wants to keep the session cookie even after the browser closes:
if (!empty($_POST['longlastingsession']))
{
- setcookie('shaarli_staySignedIn', STAY_SIGNED_IN_TOKEN, time()+31536000, WEB_PATH);
- $_SESSION['longlastingsession']=31536000; // (31536000 seconds = 1 year)
- $_SESSION['expires_on']=time()+$_SESSION['longlastingsession']; // Set session expiration on server-side.
+ $_SESSION['longlastingsession'] = 31536000; // (31536000 seconds = 1 year)
+ $expiration = time() + $_SESSION['longlastingsession']; // calculate relative cookie expiration (1 year from now)
+ setcookie('shaarli_staySignedIn', STAY_SIGNED_IN_TOKEN, $expiration, WEB_PATH);
+ $_SESSION['expires_on'] = $expiration; // Set session expiration on server-side.
$cookiedir = ''; if(dirname($_SERVER['SCRIPT_NAME'])!='/') $cookiedir=dirname($_SERVER["SCRIPT_NAME"]).'/';
session_set_cookie_params($_SESSION['longlastingsession'],$cookiedir,$_SERVER['SERVER_NAME']); // Set session cookie expiration on client side
*/
function showDaily($pageBuilder, $LINKSDB, $conf, $pluginManager)
{
- $day=date('Ymd',strtotime('-1 day')); // Yesterday, in format YYYYMMDD.
- if (isset($_GET['day'])) $day=$_GET['day'];
+ $day = date('Ymd', strtotime('-1 day')); // Yesterday, in format YYYYMMDD.
+ if (isset($_GET['day'])) {
+ $day = $_GET['day'];
+ }
$days = $LINKSDB->days();
- $i = array_search($day,$days);
- if ($i===false) { $i=count($days)-1; $day=$days[$i]; }
- $previousday='';
- $nextday='';
- if ($i!==false)
- {
- if ($i>=1) $previousday=$days[$i-1];
- if ($i<count($days)-1) $nextday=$days[$i+1];
+ $i = array_search($day, $days);
+ if ($i === false && count($days)) {
+ // no links for day, but at least one day with links
+ $i = count($days) - 1;
+ $day = $days[$i];
}
+ $previousday = '';
+ $nextday = '';
+ if ($i !== false) {
+ if ($i >= 1) {
+ $previousday=$days[$i - 1];
+ }
+ if ($i < count($days) - 1) {
+ $nextday = $days[$i + 1];
+ }
+ }
try {
$linksToDisplay = $LINKSDB->filterDay($day);
} catch (Exception $exc) {
}
// We pre-format some fields for proper output.
- foreach($linksToDisplay as $key=>$link)
- {
-
+ foreach($linksToDisplay as $key => $link) {
$taglist = explode(' ',$link['tags']);
uasort($taglist, 'strcasecmp');
$linksToDisplay[$key]['taglist']=$taglist;
so I manually spread entries with a simple method: I roughly evaluate the
height of a div according to title and description length.
*/
- $columns=array(array(),array(),array()); // Entries to display, for each column.
- $fill=array(0,0,0); // Rough estimate of columns fill.
- foreach($linksToDisplay as $key=>$link)
- {
+ $columns = array(array(), array(), array()); // Entries to display, for each column.
+ $fill = array(0, 0, 0); // Rough estimate of columns fill.
+ foreach($linksToDisplay as $key => $link) {
// Roughly estimate length of entry (by counting characters)
// Title: 30 chars = 1 line. 1 line is 30 pixels height.
// Description: 836 characters gives roughly 342 pixel height.
// This is not perfect, but it's usually OK.
- $length=strlen($link['title'])+(342*strlen($link['description']))/836;
- if ($link['thumbnail']) $length +=100; // 1 thumbnails roughly takes 100 pixels height.
+ $length = strlen($link['title']) + (342 * strlen($link['description'])) / 836;
+ if ($link['thumbnail']) {
+ $length += 100; // 1 thumbnails roughly takes 100 pixels height.
+ }
// Then put in column which is the less filled:
- $smallest=min($fill); // find smallest value in array.
- $index=array_search($smallest,$fill); // find index of this smallest value.
- array_push($columns[$index],$link); // Put entry in this column.
- $fill[$index]+=$length;
+ $smallest = min($fill); // find smallest value in array.
+ $index = array_search($smallest, $fill); // find index of this smallest value.
+ array_push($columns[$index], $link); // Put entry in this column.
+ $fill[$index] += $length;
}
$dayDate = DateTime::createFromFormat(LinkDB::LINK_DATE_FORMAT, $day.'_000000');
$PAGE->assign('username', escape($_GET['username']));
}
$PAGE->assign('returnurl',(isset($_SERVER['HTTP_REFERER']) ? escape($_SERVER['HTTP_REFERER']):''));
+ // add default state of the 'remember me' checkbox
+ $PAGE->assign('remember_user_default', $conf->get('privacy.remember_user_default'));
$PAGE->renderPage('loginform');
exit;
}
$maxcount = max($maxcount, $value);
}
- alphabetical_sort($tags, true, true);
+ alphabetical_sort($tags, false, true);
$tagList = array();
foreach($tags as $key => $value) {
// Linkdate is kept here to:
// - use the same permalink for notes as they're displayed when creating them
// - let users hack creation date of their posts
- // See: https://github.com/shaarli/Shaarli/wiki/Datastore-hacks#changing-the-timestamp-for-a-link
+ // See: https://shaarli.readthedocs.io/en/master/Various-hacks/#changing-the-timestamp-for-a-shaare
$linkdate = escape($_POST['lf_linkdate']);
if (isset($LINKSDB[$id])) {
// Edit
// Remove duplicates.
$tags = implode(' ', array_unique(explode(' ', $tags)));
+ if (empty(trim($_POST['lf_url']))) {
+ $_POST['lf_url'] = '?' . smallHash($linkdate . $id);
+ }
$url = whitelist_protocols(trim($_POST['lf_url']), $conf->get('security.allowed_protocols'));
$link = array(
die('Wrong token.');
}
- if (strpos($_GET['lf_linkdate'], ' ') !== false) {
- $ids = array_values(array_filter(preg_split('/\s+/', escape($_GET['lf_linkdate']))));
+ $ids = trim($_GET['lf_linkdate']);
+ if (strpos($ids, ' ') !== false) {
+ // multiple, space-separated ids provided
+ $ids = array_values(array_filter(preg_split('/\s+/', escape($ids))));
} else {
- $ids = [$_GET['lf_linkdate']];
+ // only a single id provided
+ $ids = [$ids];
+ }
+ // assert at least one id is given
+ if(!count($ids)){
+ die('no id provided');
}
foreach ($ids as $id) {
$id = (int) escape($id);
projects / github / shaarli / Shaarli.git / commitdiff
