7 files changed, 353 insertions, 16 deletions

diff --git a/application/HttpUtils.php b/application/HttpUtils.php
index 2e0792f9..e705cfd6 100644
--- a/application/HttpUtils.php
+++ b/application/HttpUtils.php
@@ -1,6 +1,7 @@
 <?php
 /**
  * GET an HTTP URL to retrieve its content
+ * Uses the cURL library or a fallback method 
  *
  * @param string $url      URL to get (http://...)
  * @param int    $timeout  network timeout (in seconds)
@@ -20,38 +21,177 @@
  *      echo 'There was an error: '.htmlspecialchars($headers[0]);
  *  }
  *
- * @see http://php.net/manual/en/function.file-get-contents.php
- * @see http://php.net/manual/en/function.stream-context-create.php
- * @see http://php.net/manual/en/function.get-headers.php
+ * @see https://secure.php.net/manual/en/ref.curl.php
+ * @see https://secure.php.net/manual/en/functions.anonymous.php
+ * @see https://secure.php.net/manual/en/function.preg-split.php
+ * @see https://secure.php.net/manual/en/function.explode.php
+ * @see http://stackoverflow.com/q/17641073
+ * @see http://stackoverflow.com/q/9183178
+ * @see http://stackoverflow.com/q/1462720
  */
 function get_http_response($url, $timeout = 30, $maxBytes = 4194304)
 {
     $urlObj = new Url($url);
     $cleanUrl = $urlObj->idnToAscii();
 
-    if (! filter_var($cleanUrl, FILTER_VALIDATE_URL) || ! $urlObj->isHttp()) {
+    if (!filter_var($cleanUrl, FILTER_VALIDATE_URL) || !$urlObj->isHttp()) {
         return array(array(0 => 'Invalid HTTP Url'), false);
     }
 
+    $userAgent =
+        'Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:45.0)'
+        . ' Gecko/20100101 Firefox/45.0';
+    $acceptLanguage =
+        substr(setlocale(LC_COLLATE, 0), 0, 2) . ',en-US;q=0.7,en;q=0.3';
+    $maxRedirs = 3;
+
+    if (!function_exists('curl_init')) {
+        return get_http_response_fallback(
+            $cleanUrl,
+            $timeout,
+            $maxBytes,
+            $userAgent,
+            $acceptLanguage,
+            $maxRedirs
+        );
+    }
+
+    $ch = curl_init($cleanUrl);
+    if ($ch === false) {
+        return array(array(0 => 'curl_init() error'), false);
+    }
+
+    // General cURL settings
+    curl_setopt($ch, CURLOPT_AUTOREFERER,       true);
+    curl_setopt($ch, CURLOPT_FOLLOWLOCATION,    true);
+    curl_setopt($ch, CURLOPT_HEADER,            true);
+    curl_setopt(
+        $ch,
+        CURLOPT_HTTPHEADER,
+        array('Accept-Language: ' . $acceptLanguage)
+    );
+    curl_setopt($ch, CURLOPT_MAXREDIRS,         $maxRedirs);
+    curl_setopt($ch, CURLOPT_RETURNTRANSFER,    true);
+    curl_setopt($ch, CURLOPT_TIMEOUT,           $timeout);
+    curl_setopt($ch, CURLOPT_USERAGENT,         $userAgent);
+
+    // Max download size management
+    curl_setopt($ch, CURLOPT_BUFFERSIZE,        1024);
+    curl_setopt($ch, CURLOPT_NOPROGRESS,        false);
+    curl_setopt($ch, CURLOPT_PROGRESSFUNCTION,
+        function($arg0, $arg1, $arg2, $arg3, $arg4 = 0) use ($maxBytes)
+        {
+            if (version_compare(phpversion(), '5.5', '<')) {
+                // PHP version lower than 5.5
+                // Callback has 4 arguments
+                $downloaded = $arg1;
+            } else {
+                // Callback has 5 arguments
+                $downloaded = $arg2;
+            }
+            // Non-zero return stops downloading
+            return ($downloaded > $maxBytes) ? 1 : 0;
+        }
+    );
+
+    $response = curl_exec($ch);
+    $errorNo = curl_errno($ch);
+    $errorStr = curl_error($ch);
+    $headSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
+    curl_close($ch);
+
+    if ($response === false) {
+        if ($errorNo == CURLE_COULDNT_RESOLVE_HOST) {
+            /*
+             * Workaround to match fallback method behaviour
+             * Removing this would require updating
+             * GetHttpUrlTest::testGetInvalidRemoteUrl()
+             */
+            return array(false, false);
+        }
+        return array(array(0 => 'curl_exec() error: ' . $errorStr), false);
+    }
+
+    // Formatting output like the fallback method
+    $rawHeaders = substr($response, 0, $headSize);
+
+    // Keep only headers from latest redirection
+    $rawHeadersArrayRedirs = explode("\r\n\r\n", trim($rawHeaders));
+    $rawHeadersLastRedir = end($rawHeadersArrayRedirs);
+
+    $content = substr($response, $headSize);
+    $headers = array();
+    foreach (preg_split('~[\r\n]+~', $rawHeadersLastRedir) as $line) {
+        if (empty($line) or ctype_space($line)) {
+            continue;
+        }
+        $splitLine = explode(': ', $line, 2);
+        if (count($splitLine) > 1) {
+            $key = $splitLine[0];
+            $value = $splitLine[1];
+            if (array_key_exists($key, $headers)) {
+                if (!is_array($headers[$key])) {
+                    $headers[$key] = array(0 => $headers[$key]);
+                }
+                $headers[$key][] = $value;
+            } else {
+                $headers[$key] = $value;
+            }
+        } else {
+            $headers[] = $splitLine[0];
+        }
+    }
+
+    return array($headers, $content);
+}
+
+/**
+ * GET an HTTP URL to retrieve its content (fallback method)
+ *
+ * @param string $cleanUrl       URL to get (http://... valid and in ASCII form)
+ * @param int    $timeout        network timeout (in seconds)
+ * @param int    $maxBytes       maximum downloaded bytes
+ * @param string $userAgent      "User-Agent" header
+ * @param string $acceptLanguage "Accept-Language" header
+ * @param int    $maxRedr        maximum amount of redirections followed
+ *
+ * @return array HTTP response headers, downloaded content
+ *
+ * Output format:
+ *  [0] = associative array containing HTTP response headers
+ *  [1] = URL content (downloaded data)
+ *
+ * @see http://php.net/manual/en/function.file-get-contents.php
+ * @see http://php.net/manual/en/function.stream-context-create.php
+ * @see http://php.net/manual/en/function.get-headers.php
+ */
+function get_http_response_fallback(
+    $cleanUrl,
+    $timeout,
+    $maxBytes,
+    $userAgent,
+    $acceptLanguage,
+    $maxRedr
+) {
     $options = array(
         'http' => array(
             'method' => 'GET',
             'timeout' => $timeout,
-            'user_agent' => 'Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:45.0)'
-                         .' Gecko/20100101 Firefox/45.0',
-            'accept_language' => substr(setlocale(LC_COLLATE, 0), 0, 2) . ',en-US;q=0.7,en;q=0.3',
+            'user_agent' => $userAgent,
+            'header' => "Accept: */*\r\n"
+                . 'Accept-Language: ' . $acceptLanguage
         )
     );
 
     stream_context_set_default($options);
-    list($headers, $finalUrl) = get_redirected_headers($cleanUrl);
+    list($headers, $finalUrl) = get_redirected_headers($cleanUrl, $maxRedr);
     if (! $headers || strpos($headers[0], '200 OK') === false) {
         $options['http']['request_fulluri'] = true;
         stream_context_set_default($options);
-        list($headers, $finalUrl) = get_redirected_headers($cleanUrl);
+        list($headers, $finalUrl) = get_redirected_headers($cleanUrl, $maxRedr);
     }
 
-    if (! $headers || strpos($headers[0], '200 OK') === false) {
+    if (! $headers) {
         return array($headers, false);
     }
 
@@ -215,3 +355,29 @@ function page_url($server)
     }
     return index_url($server);
 }
+
+/**
+ * Retrieve the initial IP forwarded by the reverse proxy.
+ *
+ * Inspired from: https://github.com/zendframework/zend-http/blob/master/src/PhpEnvironment/RemoteAddress.php
+ *
+ * @param array $server     $_SERVER array which contains HTTP headers.
+ * @param array $trustedIps List of trusted IP from the configuration.
+ *
+ * @return string|bool The forwarded IP, or false if none could be extracted.
+ */
+function getIpAddressFromProxy($server, $trustedIps)
+{
+    $forwardedIpHeader = 'HTTP_X_FORWARDED_FOR';
+    if (empty($server[$forwardedIpHeader])) {
+        return false;
+    }
+
+    $ips = preg_split('/\s*,\s*/', $server[$forwardedIpHeader]);
+    $ips = array_diff($ips, $trustedIps);
+    if (empty($ips)) {
+        return false;
+    }
+
+    return array_pop($ips);
+}
diff --git a/application/Languages.php b/application/Languages.php
new file mode 100644
index 00000000..c8b0a25a
--- /dev/null
+++ b/application/Languages.php
@@ -0,0 +1,21 @@
+<?php
+
+/**
+ * Wrapper function for translation which match the API
+ * of gettext()/_() and ngettext().
+ *
+ * Not doing translation for now.
+ *
+ * @param string $text  Text to translate.
+ * @param string $nText The plural message ID.
+ * @param int    $nb    The number of items for plural forms.
+ *
+ * @return String Text translated.
+ */
+function t($text, $nText = '', $nb = 0) {
+    if (empty($nText)) {
+        return $text;
+    }
+    $actualForm = $nb > 1 ? $nText : $text;
+    return sprintf($actualForm, $nb);
+}
diff --git a/application/NetscapeBookmarkUtils.php b/application/NetscapeBookmarkUtils.php
index fdbb0ad7..c3181254 100644
--- a/application/NetscapeBookmarkUtils.php
+++ b/application/NetscapeBookmarkUtils.php
@@ -51,4 +51,145 @@ class NetscapeBookmarkUtils
 
         return $bookmarkLinks;
     }
+
+    /**
+     * Generates an import status summary
+     *
+     * @param string $filename       name of the file to import
+     * @param int    $filesize       size of the file to import
+     * @param int    $importCount    how many links were imported
+     * @param int    $overwriteCount how many links were overwritten
+     * @param int    $skipCount      how many links were skipped
+     *
+     * @return string Summary of the bookmark import status
+     */
+    private static function importStatus(
+        $filename,
+        $filesize,
+        $importCount=0,
+        $overwriteCount=0,
+        $skipCount=0
+    )
+    {
+        $status = 'File '.$filename.' ('.$filesize.' bytes) ';
+        if ($importCount == 0 && $overwriteCount == 0 && $skipCount == 0) {
+            $status .= 'has an unknown file format. Nothing was imported.';
+        } else {
+            $status .= 'was successfully processed: '.$importCount.' links imported, ';
+            $status .= $overwriteCount.' links overwritten, ';
+            $status .= $skipCount.' links skipped.';
+        }
+        return $status;
+    }
+
+    /**
+     * Imports Web bookmarks from an uploaded Netscape bookmark dump
+     *
+     * @param array  $post      Server $_POST parameters
+     * @param array  $file      Server $_FILES parameters
+     * @param LinkDB $linkDb    Loaded LinkDB instance
+     * @param string $pagecache Page cache
+     *
+     * @return string Summary of the bookmark import status
+     */
+    public static function import($post, $files, $linkDb, $pagecache)
+    {
+        $filename = $files['filetoupload']['name'];
+        $filesize = $files['filetoupload']['size'];
+        $data = file_get_contents($files['filetoupload']['tmp_name']);
+
+        if (strpos($data, '<!DOCTYPE NETSCAPE-Bookmark-file-1>') === false) {
+            return self::importStatus($filename, $filesize);
+        }
+
+        // Overwrite existing links?
+        $overwrite = ! empty($post['overwrite']);
+
+        // Add tags to all imported links?
+        if (empty($post['default_tags'])) {
+            $defaultTags = array();
+        } else {
+            $defaultTags = preg_split(
+                '/[\s,]+/',
+                escape($post['default_tags'])
+            );
+        }
+
+        // links are imported as public by default
+        $defaultPrivacy = 0;
+
+        $parser = new NetscapeBookmarkParser(
+            true,                       // nested tag support
+            $defaultTags,               // additional user-specified tags
+            strval(1 - $defaultPrivacy) // defaultPub = 1 - defaultPrivacy
+        );
+        $bookmarks = $parser->parseString($data);
+
+        $importCount = 0;
+        $overwriteCount = 0;
+        $skipCount = 0;
+
+        foreach ($bookmarks as $bkm) {
+            $private = $defaultPrivacy;
+            if (empty($post['privacy']) || $post['privacy'] == 'default') {
+                // use value from the imported file
+                $private = $bkm['pub'] == '1' ? 0 : 1;
+            } else if ($post['privacy'] == 'private') {
+                // all imported links are private
+                $private = 1;
+            } else if ($post['privacy'] == 'public') {
+                // all imported links are public
+                $private = 0;
+            }                
+
+            $newLink = array(
+                'title' => $bkm['title'],
+                'url' => $bkm['uri'],
+                'description' => $bkm['note'],
+                'private' => $private,
+                'linkdate'=> '',
+                'tags' => $bkm['tags']
+            );
+
+            $existingLink = $linkDb->getLinkFromUrl($bkm['uri']);
+
+            if ($existingLink !== false) {
+                if ($overwrite === false) {
+                    // Do not overwrite an existing link
+                    $skipCount++;
+                    continue;
+                }
+
+                // Overwrite an existing link, keep its date
+                $newLink['linkdate'] = $existingLink['linkdate'];
+                $linkDb[$existingLink['linkdate']] = $newLink;
+                $importCount++;
+                $overwriteCount++;
+                continue;
+            }
+
+            // Add a new link
+            $newLinkDate = new DateTime('@'.strval($bkm['time']));
+            while (!empty($linkDb[$newLinkDate->format(LinkDB::LINK_DATE_FORMAT)])) {
+                // Ensure the date/time is not already used
+                // - this hack is necessary as the date/time acts as a primary key
+                // - apply 1 second increments until an unused index is found
+                // See https://github.com/shaarli/Shaarli/issues/351
+                $newLinkDate->add(new DateInterval('PT1S'));
+            }
+            $linkDbDate = $newLinkDate->format(LinkDB::LINK_DATE_FORMAT);
+            $newLink['linkdate'] = $linkDbDate;
+            $linkDb[$linkDbDate] = $newLink;
+            $importCount++;
+        }
+
+        $linkDb->savedb($pagecache);
+        return self::importStatus(
+            $filename,
+            $filesize,
+            $importCount,
+            $overwriteCount,
+            $skipCount
+        );
+    }
 }
diff --git a/application/PageBuilder.php b/application/PageBuilder.php
index 1ca0260a..42932f32 100644
--- a/application/PageBuilder.php
+++ b/application/PageBuilder.php
@@ -80,6 +80,7 @@ class PageBuilder
         if (!empty($GLOBALS['plugin_errors'])) {
             $this->tpl->assign('plugin_errors', $GLOBALS['plugin_errors']);
         }
+        $this->tpl->assign('token', getToken($this->conf));
         // To be removed with a proper theme configuration.
         $this->tpl->assign('conf', $this->conf);
     }
diff --git a/application/PluginManager.php b/application/PluginManager.php
index dca7e63e..1e132a7f 100644
--- a/application/PluginManager.php
+++ b/application/PluginManager.php
@@ -185,7 +185,11 @@ class PluginManager
                     continue;
                 }
 
-                $metaData[$plugin]['parameters'][$param] = '';
+                $metaData[$plugin]['parameters'][$param]['value'] = '';
+                // Optional parameter description in parameter.PARAM_NAME=
+                if (isset($metaData[$plugin]['parameter.'. $param])) {
+                    $metaData[$plugin]['parameters'][$param]['desc'] = $metaData[$plugin]['parameter.'. $param];
+                }
             }
         }
 
@@ -210,4 +214,4 @@ class PluginFileNotFoundException extends Exception
     {
         $this->message = 'Plugin "'. $pluginName .'" files not found.';
     }
-}
\ No newline at end of file
+}
diff --git a/application/Router.php b/application/Router.php
index 2c3934b0..caed4a28 100644
--- a/application/Router.php
+++ b/application/Router.php
@@ -138,4 +138,4 @@ class Router
 
         return self::$PAGE_LINKLIST;
     }
-}
\ No newline at end of file
+}
diff --git a/application/config/ConfigPlugin.php b/application/config/ConfigPlugin.php
index 047d2b03..cb0b6fce 100644
--- a/application/config/ConfigPlugin.php
+++ b/application/config/ConfigPlugin.php
@@ -80,9 +80,13 @@ function validate_plugin_order($formData)
 }
 
 /**
- * Affect plugin parameters values into plugins array.
+ * Affect plugin parameters values from the ConfigManager into plugins array.
  *
- * @param mixed $plugins Plugins array ($plugins[<plugin_name>]['parameters']['param_name'] = <value>.
+ * @param mixed $plugins Plugins array:
+ *                         $plugins[<plugin_name>]['parameters'][<param_name>] = [
+ *                                                                                 'value' => <value>,
+ *                                                                                 'desc' => <description>
+ *                                                                               ]
  * @param mixed $conf  Plugins configuration.
  *
  * @return mixed Updated $plugins array.
@@ -97,7 +101,7 @@ function load_plugin_parameter_values($plugins, $conf)
 
         foreach ($plugin['parameters'] as $key => $param) {
             if (!empty($conf[$key])) {
-                $out[$name]['parameters'][$key] = $conf[$key];
+                $out[$name]['parameters'][$key]['value'] = $conf[$key];
             }
         }
     }