1 files changed, 101 insertions, 82 deletions

diff --git a/index.php b/index.php
index 218d317d..e1516d37 100644
--- a/index.php
+++ b/index.php
@@ -64,7 +64,6 @@ require_once 'application/FeedBuilder.php';
 require_once 'application/FileUtils.php';
 require_once 'application/History.php';
 require_once 'application/HttpUtils.php';
-require_once 'application/Languages.php';
 require_once 'application/LinkDB.php';
 require_once 'application/LinkFilter.php';
 require_once 'application/LinkUtils.php';
@@ -76,8 +75,10 @@ require_once 'application/Utils.php';
 require_once 'application/PluginManager.php';
 require_once 'application/Router.php';
 require_once 'application/Updater.php';
+use \Shaarli\Languages;
 use \Shaarli\ThemeUtils;
 use \Shaarli\Config\ConfigManager;
+use \Shaarli\SessionManager;
 
 // Ensure the PHP version is supported
 try {
@@ -88,7 +89,7 @@ try {
     exit;
 }
 
-define('shaarli_version', ApplicationUtils::getVersion(__DIR__ .'/'. ApplicationUtils::$VERSION_FILE));
+define('SHAARLI_VERSION', ApplicationUtils::getVersion(__DIR__ .'/'. ApplicationUtils::$VERSION_FILE));
 
 // Force cookie path (but do not change lifetime)
 $cookie = session_get_cookie_params();
@@ -115,14 +116,23 @@ if (session_id() == '') {
 }
 
 // Regenerate session ID if invalid or not defined in cookie.
-if (isset($_COOKIE['shaarli']) && !is_session_id_valid($_COOKIE['shaarli'])) {
+if (isset($_COOKIE['shaarli']) && !SessionManager::checkId($_COOKIE['shaarli'])) {
     session_regenerate_id(true);
     $_COOKIE['shaarli'] = session_id();
 }
 
 $conf = new ConfigManager();
+$sessionManager = new SessionManager($_SESSION, $conf);
+
+// Sniff browser language and set date format accordingly.
+if (isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])) {
+    autoLocale($_SERVER['HTTP_ACCEPT_LANGUAGE']);
+}
+
+new Languages(setlocale(LC_MESSAGES, 0), $conf);
+
 $conf->setEmpty('general.timezone', date_default_timezone_get());
-$conf->setEmpty('general.title', 'Shared links on '. escape(index_url($_SERVER)));
+$conf->setEmpty('general.title', t('Shared links on '). escape(index_url($_SERVER)));
 RainTPL::$tpl_dir = $conf->get('resource.raintpl_tpl').'/'.$conf->get('resource.theme').'/'; // template directory
 RainTPL::$cache_dir = $conf->get('resource.raintpl_tmp'); // cache directory
 
@@ -144,7 +154,7 @@ if (! is_file($conf->getConfigFileExt())) {
     $errors = ApplicationUtils::checkResourcePermissions($conf);
 
     if ($errors != array()) {
-        $message = '<p>Insufficient permissions:</p><ul>';
+        $message = '<p>'. t('Insufficient permissions:') .'</p><ul>';
 
         foreach ($errors as $error) {
             $message .= '<li>'.$error.'</li>';
@@ -157,17 +167,12 @@ if (! is_file($conf->getConfigFileExt())) {
     }
 
     // Display the installation form if no existing config is found
-    install($conf);
+    install($conf, $sessionManager);
 }
 
 // a token depending of deployment salt, user password, and the current ip
 define('STAY_SIGNED_IN_TOKEN', sha1($conf->get('credentials.hash') . $_SERVER['REMOTE_ADDR'] . $conf->get('credentials.salt')));
 
-// Sniff browser language and set date format accordingly.
-if (isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])) {
-    autoLocale($_SERVER['HTTP_ACCEPT_LANGUAGE']);
-}
-
 /**
  * Checking session state (i.e. is the user still logged in)
  *
@@ -376,9 +381,9 @@ function ban_canLogin($conf)
 // Process login form: Check if login/password is correct.
 if (isset($_POST['login']))
 {
-    if (!ban_canLogin($conf)) die('I said: NO. You are banned for the moment. Go away.');
+    if (!ban_canLogin($conf)) die(t('I said: NO. You are banned for the moment. Go away.'));
     if (isset($_POST['password'])
-        && tokenOk($_POST['token'])
+        && $sessionManager->checkToken($_POST['token'])
         && (check_auth($_POST['login'], $_POST['password'], $conf))
     ) {   // Login/password is OK.
         ban_loginOk($conf);
@@ -440,7 +445,8 @@ if (isset($_POST['login']))
                 }
             }
         }
-        echo '<script>alert("Wrong login/password.");document.location=\'?do=login'.$redir.'\';</script>'; // Redirect to login screen.
+        // Redirect to login screen.
+        echo '<script>alert("'. t("Wrong login/password.") .'");document.location=\'?do=login'.$redir.'\';</script>';
         exit;
     }
 }
@@ -451,32 +457,6 @@ if (isset($_POST['login']))
 if (!isset($_SESSION['tokens'])) $_SESSION['tokens']=array();  // Token are attached to the session.
 
 /**
- * Returns a token.
- *
- * @param ConfigManager $conf Configuration Manager instance.
- *
- * @return string token.
- */
-function getToken($conf)
-{
-    $rnd = sha1(uniqid('', true) .'_'. mt_rand() . $conf->get('credentials.salt'));  // We generate a random string.
-    $_SESSION['tokens'][$rnd]=1;  // Store it on the server side.
-    return $rnd;
-}
-
-// Tells if a token is OK. Using this function will destroy the token.
-// true=token is OK.
-function tokenOk($token)
-{
-    if (isset($_SESSION['tokens'][$token]))
-    {
-        unset($_SESSION['tokens'][$token]); // Token is used: destroy it.
-        return true; // Token is OK.
-    }
-    return false; // Wrong token, or already used.
-}
-
-/**
  * Daily RSS feed: 1 RSS entry per day giving all the links on that day.
  * Gives the last 7 days (which have links).
  * This RSS feed cannot be filtered.
@@ -683,12 +663,13 @@ function showLinkList($PAGE, $LINKSDB, $conf, $pluginManager) {
 /**
  * Render HTML page (according to URL parameters and user rights)
  *
- * @param ConfigManager $conf          Configuration Manager instance.
- * @param PluginManager $pluginManager Plugin Manager instance,
- * @param LinkDB        $LINKSDB
- * @param History       $history       instance
+ * @param ConfigManager  $conf           Configuration Manager instance.
+ * @param PluginManager  $pluginManager  Plugin Manager instance,
+ * @param LinkDB         $LINKSDB
+ * @param History        $history        instance
+ * @param SessionManager $sessionManager SessionManager instance
  */
-function renderPage($conf, $pluginManager, $LINKSDB, $history)
+function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager)
 {
     $updater = new Updater(
         read_updates_file($conf->get('resource.updates')),
@@ -709,7 +690,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
         die($e->getMessage());
     }
 
-    $PAGE = new PageBuilder($conf, $LINKSDB);
+    $PAGE = new PageBuilder($conf, $LINKSDB, $sessionManager->generateToken());
     $PAGE->assign('linkcount', count($LINKSDB));
     $PAGE->assign('privateLinkcount', count_private($LINKSDB));
     $PAGE->assign('plugin_errors', $pluginManager->getErrors());
@@ -718,6 +699,23 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
     $query = (isset($_SERVER['QUERY_STRING'])) ? $_SERVER['QUERY_STRING'] : '';
     $targetPage = Router::findPage($query, $_GET, isLoggedIn());
 
+    if (
+        // if the user isn't logged in
+        !isLoggedIn() &&
+        // and Shaarli doesn't have public content...
+        $conf->get('privacy.hide_public_links') &&
+        // and is configured to enforce the login
+        $conf->get('privacy.force_login') &&
+        // and the current page isn't already the login page
+        $targetPage !== Router::$PAGE_LOGIN &&
+        // and the user is not requesting a feed (which would lead to a different content-type as expected)
+        $targetPage !== Router::$PAGE_FEED_ATOM &&
+        $targetPage !== Router::$PAGE_FEED_RSS
+    ) {
+        // force current page to be the login page
+        $targetPage = Router::$PAGE_LOGIN;
+    }
+
     // Call plugin hooks for header, footer and includes, specifying which page will be rendered.
     // Then assign generated data to RainTPL.
     $common_hooks = array(
@@ -823,7 +821,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
         }
 
         $data = array(
-            'search_tags' => implode(' ', $filteringTags),
+            'search_tags' => implode(' ', escape($filteringTags)),
             'tags' => $tagList,
         );
         $pluginManager->executeHooks('render_tagcloud', $data, array('loggedin' => isLoggedIn()));
@@ -853,7 +851,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
         }
 
         $data = [
-            'search_tags' => implode(' ', $filteringTags),
+            'search_tags' => implode(' ', escape($filteringTags)),
             'tags' => $tags,
         ];
         $pluginManager->executeHooks('render_taglist', $data, ['loggedin' => isLoggedIn()]);
@@ -1083,16 +1081,19 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
     if ($targetPage == Router::$PAGE_CHANGEPASSWORD)
     {
         if ($conf->get('security.open_shaarli')) {
-            die('You are not supposed to change a password on an Open Shaarli.');
+            die(t('You are not supposed to change a password on an Open Shaarli.'));
         }
 
         if (!empty($_POST['setpassword']) && !empty($_POST['oldpassword']))
         {
-            if (!tokenOk($_POST['token'])) die('Wrong token.'); // Go away!
+            if (!$sessionManager->checkToken($_POST['token'])) die(t('Wrong token.')); // Go away!
 
             // Make sure old password is correct.
             $oldhash = sha1($_POST['oldpassword'].$conf->get('credentials.login').$conf->get('credentials.salt'));
-            if ($oldhash!= $conf->get('credentials.hash')) { echo '<script>alert("The old password is not correct.");document.location=\'?do=changepasswd\';</script>'; exit; }
+            if ($oldhash!= $conf->get('credentials.hash')) {
+                echo '<script>alert("'. t('The old password is not correct.') .'");document.location=\'?do=changepasswd\';</script>';
+                exit;
+            }
             // Save new password
             // Salt renders rainbow-tables attacks useless.
             $conf->set('credentials.salt', sha1(uniqid('', true) .'_'. mt_rand()));
@@ -1110,7 +1111,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
                 echo '<script>alert("'. $e->getMessage() .'");document.location=\'?do=tools\';</script>';
                 exit;
             }
-            echo '<script>alert("Your password has been changed.");document.location=\'?do=tools\';</script>';
+            echo '<script>alert("'. t('Your password has been changed') .'");document.location=\'?do=tools\';</script>';
             exit;
         }
         else // show the change password form.
@@ -1125,8 +1126,8 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
     {
         if (!empty($_POST['title']) )
         {
-            if (!tokenOk($_POST['token'])) {
-                die('Wrong token.'); // Go away!
+            if (!$sessionManager->checkToken($_POST['token'])) {
+                die(t('Wrong token.')); // Go away!
             }
             $tz = 'UTC';
             if (!empty($_POST['continent']) && !empty($_POST['city'])
@@ -1146,6 +1147,8 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
             $conf->set('privacy.hide_public_links', !empty($_POST['hidePublicLinks']));
             $conf->set('api.enabled', !empty($_POST['enableApi']));
             $conf->set('api.secret', escape($_POST['apiSecret']));
+            $conf->set('translation.language', escape($_POST['language']));
+
             try {
                 $conf->write(isLoggedIn());
                 $history->updateSettings();
@@ -1161,7 +1164,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
                 echo '<script>alert("'. $e->getMessage() .'");document.location=\'?do=configure\';</script>';
                 exit;
             }
-            echo '<script>alert("Configuration was saved.");document.location=\'?do=configure\';</script>';
+            echo '<script>alert("'. t('Configuration was saved.') .'");document.location=\'?do=configure\';</script>';
             exit;
         }
         else // Show the configuration form.
@@ -1183,6 +1186,8 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
             $PAGE->assign('hide_public_links', $conf->get('privacy.hide_public_links', false));
             $PAGE->assign('api_enabled', $conf->get('api.enabled', true));
             $PAGE->assign('api_secret', $conf->get('api.secret'));
+            $PAGE->assign('languages', Languages::getAvailableLanguages());
+            $PAGE->assign('language', $conf->get('translation.language'));
             $PAGE->renderPage('configure');
             exit;
         }
@@ -1197,8 +1202,8 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
             exit;
         }
 
-        if (!tokenOk($_POST['token'])) {
-            die('Wrong token.');
+        if (!$sessionManager->checkToken($_POST['token'])) {
+            die(t('Wrong token.'));
         }
 
         $alteredLinks = $LINKSDB->renameTag(escape($_POST['fromtag']), escape($_POST['totag']));
@@ -1208,9 +1213,10 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
         }
         $delete = empty($_POST['totag']);
         $redirect = $delete ? 'do=changetag' : 'searchtags='. urlencode(escape($_POST['totag']));
+        $count = count($alteredLinks);
         $alert = $delete
-            ? sprintf(t('The tag was removed from %d links.'), count($alteredLinks))
-            : sprintf(t('The tag was renamed in %d links.'), count($alteredLinks));
+            ? sprintf(t('The tag was removed from %d link.', 'The tag was removed from %d links.', $count), $count)
+            : sprintf(t('The tag was renamed in %d link.', 'The tag was renamed in %d links.', $count), $count);
         echo '<script>alert("'. $alert .'");document.location=\'?'. $redirect .'\';</script>';
         exit;
     }
@@ -1226,8 +1232,8 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
     if (isset($_POST['save_edit']))
     {
         // Go away!
-        if (! tokenOk($_POST['token'])) {
-            die('Wrong token.');
+        if (! $sessionManager->checkToken($_POST['token'])) {
+            die(t('Wrong token.'));
         }
 
         // lf_id should only be present if the link exists.
@@ -1326,8 +1332,8 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
     // -------- User clicked the "Delete" button when editing a link: Delete link from database.
     if ($targetPage == Router::$PAGE_DELETELINK)
     {
-        if (! tokenOk($_GET['token'])) {
-            die('Wrong token.');
+        if (! $sessionManager->checkToken($_GET['token'])) {
+            die(t('Wrong token.'));
         }
 
         $ids = trim($_GET['lf_linkdate']);
@@ -1426,7 +1432,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
 
             if ($url == '') {
                 $url = '?' . smallHash($linkdate . $LINKSDB->getNextId());
-                $title = 'Note: ';
+                $title = $conf->get('general.default_note_title', t('Note: '));
             }
             $url = escape($url);
             $title = escape($title);
@@ -1533,14 +1539,17 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
         // Import bookmarks from an uploaded file
         if (isset($_FILES['filetoupload']['size']) && $_FILES['filetoupload']['size'] == 0) {
             // The file is too big or some form field may be missing.
-            echo '<script>alert("The file you are trying to upload is probably'
-                .' bigger than what this webserver can accept ('
-                .get_max_upload_size(ini_get('post_max_size'), ini_get('upload_max_filesize')).').'
-                .' Please upload in smaller chunks.");document.location=\'?do='
-                .Router::$PAGE_IMPORT .'\';</script>';
+            $msg = sprintf(
+                t(
+                    'The file you are trying to upload is probably bigger than what this webserver can accept'
+                    .' (%s). Please upload in smaller chunks.'
+                ),
+                get_max_upload_size(ini_get('post_max_size'), ini_get('upload_max_filesize'))
+            );
+            echo '<script>alert("'. $msg .'");document.location=\'?do='.Router::$PAGE_IMPORT .'\';</script>';
             exit;
         }
-        if (! tokenOk($_POST['token'])) {
+        if (! $sessionManager->checkToken($_POST['token'])) {
             die('Wrong token.');
         }
         $status = NetscapeBookmarkUtils::import(
@@ -1607,7 +1616,7 @@ function renderPage($conf, $pluginManager, $LINKSDB, $history)
     // Get a fresh token
     if ($targetPage == Router::$GET_TOKEN) {
         header('Content-Type:text/plain');
-        echo getToken($conf);
+        echo $sessionManager->generateToken($conf);
         exit;
     }
 
@@ -1933,10 +1942,10 @@ function lazyThumbnail($conf, $url,$href=false)
  * Installation
  * This function should NEVER be called if the file data/config.php exists.
  *
- * @param ConfigManager $conf Configuration Manager instance.
+ * @param ConfigManager  $conf           Configuration Manager instance.
+ * @param SessionManager $sessionManager SessionManager instance
  */
-function install($conf)
-{
+function install($conf, $sessionManager) {
     // On free.fr host, make sure the /sessions directory exists, otherwise login will not work.
     if (endsWith($_SERVER['HTTP_HOST'],'.free.fr') && !is_dir($_SERVER['DOCUMENT_ROOT'].'/sessions')) mkdir($_SERVER['DOCUMENT_ROOT'].'/sessions',0705);
 
@@ -1945,12 +1954,20 @@ function install($conf)
     // (Because on some hosts, session.save_path may not be set correctly,
     // or we may not have write access to it.)
     if (isset($_GET['test_session']) && ( !isset($_SESSION) || !isset($_SESSION['session_tested']) || $_SESSION['session_tested']!='Working'))
-    {   // Step 2: Check if data in session is correct.
-        echo '<pre>Sessions do not seem to work correctly on your server.<br>';
-        echo 'Make sure the variable session.save_path is set correctly in your php config, and that you have write access to it.<br>';
-        echo 'It currently points to '.session_save_path().'<br>';
-        echo 'Check that the hostname used to access Shaarli contains a dot. On some browsers, accessing your server via a hostname like \'localhost\' or any custom hostname without a dot causes cookie storage to fail. We recommend accessing your server via it\'s IP address or Fully Qualified Domain Name.<br>';
-        echo '<br><a href="?">Click to try again.</a></pre>';
+    {
+        // Step 2: Check if data in session is correct.
+        $msg = t(
+            '<pre>Sessions do not seem to work correctly on your server.<br>'.
+            'Make sure the variable "session.save_path" is set correctly in your PHP config, '.
+            'and that you have write access to it.<br>'.
+            'It currently points to %s.<br>'.
+            'On some browsers, accessing your server via a hostname like \'localhost\' '.
+            'or any custom hostname without a dot causes cookie storage to fail. '.
+            'We recommend accessing your server via it\'s IP address or Fully Qualified Domain Name.<br>'
+        );
+        $msg = sprintf($msg, session_save_path());
+        echo $msg;
+        echo '<br><a href="?">'. t('Click to try again.') .'</a></pre>';
         die;
     }
     if (!isset($_SESSION['session_tested']))
@@ -1983,6 +2000,7 @@ function install($conf)
         } else {
             $conf->set('general.title', 'Shared links on '.escape(index_url($_SERVER)));
         }
+        $conf->set('translation.language', escape($_POST['language']));
         $conf->set('updates.check_updates', !empty($_POST['updateCheck']));
         $conf->set('api.enabled', !empty($_POST['enableApi']));
         $conf->set(
@@ -2010,10 +2028,11 @@ function install($conf)
         exit;
     }
 
-    $PAGE = new PageBuilder($conf);
+    $PAGE = new PageBuilder($conf, null, $sessionManager->generateToken());
     list($continents, $cities) = generateTimeZoneData(timezone_identifiers_list(), date_default_timezone_get());
     $PAGE->assign('continents', $continents);
     $PAGE->assign('cities', $cities);
+    $PAGE->assign('languages', Languages::getAvailableLanguages());
     $PAGE->renderPage('install');
     exit;
 }
@@ -2286,7 +2305,7 @@ $response = $app->run(true);
 if ($response->getStatusCode() == 404 && strpos($_SERVER['REQUEST_URI'], '/api/v1') === false) {
     // We use UTF-8 for proper international characters handling.
     header('Content-Type: text/html; charset=utf-8');
-    renderPage($conf, $pluginManager, $linkDb, $history);
+    renderPage($conf, $pluginManager, $linkDb, $history, $sessionManager);
 } else {
     $app->respond($response);
 }