Menu
▾
▴
[Phpbb-checkins] r9185 [4/4] - in /branches/acydburn/phpBB/includes: acm/index.php acp/auth.php auth.php auth/auth_db.php auth/db.php classes/acl.php classes/acl_admin.php classes/session.php classes/user.php core/core_security.php core/core_url.php session.php
|
From: Meik S. <acy...@ph...> - 2008-12-11 17:43:29
|
Added: branches/acydburn/phpBB/includes/core/core_url.php
==============================================================================
*** branches/acydburn/phpBB/includes/core/core_url.php (added)
--- branches/acydburn/phpBB/includes/core/core_url.php Thu Dec 11 17:39:51 2008
***************
*** 0 ****
--- 1,662 ----
+ <?php
+ // Server functions (building urls, redirecting...)
+ class phpbb_url
+ {
+ public function __construct() { }
+
+ /*
+ * Checks if a path ($path) is absolute or relative
+ *
+ * @param string $path Path to check absoluteness of
+ * @return boolean
+ */
+ function is_absolute($path)
+ {
+ return ($path[0] == '/' || (DIRECTORY_SEPARATOR == '\\' && preg_match('#^[a-z]:/#i', $path))) ? true : false;
+ }
+
+ /**
+ * @author Chris Smith <ch...@pr...>
+ * @copyright 2006 Project Minerva Team
+ * @param string $path The path which we should attempt to resolve.
+ * @return mixed
+ */
+ private function own_realpath($path)
+ {
+ // Now to perform funky shizzle
+
+ // Switch to use UNIX slashes
+ $path = str_replace(DIRECTORY_SEPARATOR, '/', $path);
+ $path_prefix = '';
+
+ // Determine what sort of path we have
+ if (is_absolute($path))
+ {
+ $absolute = true;
+
+ if ($path[0] == '/')
+ {
+ // Absolute path, *NIX style
+ $path_prefix = '';
+ }
+ else
+ {
+ // Absolute path, Windows style
+ // Remove the drive letter and colon
+ $path_prefix = $path[0] . ':';
+ $path = substr($path, 2);
+ }
+ }
+ else
+ {
+ // Relative Path
+ // Prepend the current working directory
+ if (function_exists('getcwd'))
+ {
+ // This is the best method, hopefully it is enabled!
+ $path = str_replace(DIRECTORY_SEPARATOR, '/', getcwd()) . '/' . $path;
+ $absolute = true;
+ if (preg_match('#^[a-z]:#i', $path))
+ {
+ $path_prefix = $path[0] . ':';
+ $path = substr($path, 2);
+ }
+ else
+ {
+ $path_prefix = '';
+ }
+ }
+ else if (isset($_SERVER['SCRIPT_FILENAME']) && !empty($_SERVER['SCRIPT_FILENAME']))
+ {
+ // Warning: If chdir() has been used this will lie!
+ // Warning: This has some problems sometime (CLI can create them easily)
+ $path = str_replace(DIRECTORY_SEPARATOR, '/', dirname($_SERVER['SCRIPT_FILENAME'])) . '/' . $path;
+ $absolute = true;
+ $path_prefix = '';
+ }
+ else
+ {
+ // We have no way of getting the absolute path, just run on using relative ones.
+ $absolute = false;
+ $path_prefix = '.';
+ }
+ }
+
+ // Remove any repeated slashes
+ $path = preg_replace('#/{2,}#', '/', $path);
+
+ // Remove the slashes from the start and end of the path
+ $path = trim($path, '/');
+
+ // Break the string into little bits for us to nibble on
+ $bits = explode('/', $path);
+
+ // Remove any . in the path, renumber array for the loop below
+ $bits = array_values(array_diff($bits, array('.')));
+
+ // Lets get looping, run over and resolve any .. (up directory)
+ for ($i = 0, $max = sizeof($bits); $i < $max; $i++)
+ {
+ // @todo Optimise
+ if ($bits[$i] == '..' )
+ {
+ if (isset($bits[$i - 1]))
+ {
+ if ($bits[$i - 1] != '..')
+ {
+ // We found a .. and we are able to traverse upwards, lets do it!
+ unset($bits[$i]);
+ unset($bits[$i - 1]);
+ $i -= 2;
+ $max -= 2;
+ $bits = array_values($bits);
+ }
+ }
+ else if ($absolute) // ie. !isset($bits[$i - 1]) && $absolute
+ {
+ // We have an absolute path trying to descend above the root of the filesystem
+ // ... Error!
+ return false;
+ }
+ }
+ }
+
+ // Prepend the path prefix
+ array_unshift($bits, $path_prefix);
+
+ $resolved = '';
+
+ $max = sizeof($bits) - 1;
+
+ // Check if we are able to resolve symlinks, Windows cannot.
+ $symlink_resolve = (function_exists('readlink')) ? true : false;
+
+ foreach ($bits as $i => $bit)
+ {
+ if (@is_dir("$resolved/$bit") || ($i == $max && @is_file("$resolved/$bit")))
+ {
+ // Path Exists
+ if ($symlink_resolve && is_link("$resolved/$bit") && ($link = readlink("$resolved/$bit")))
+ {
+ // Resolved a symlink.
+ $resolved = $link . (($i == $max) ? '' : '/');
+ continue;
+ }
+ }
+ else
+ {
+ // Something doesn't exist here!
+ // This is correct realpath() behaviour but sadly open_basedir and safe_mode make this problematic
+ // return false;
+ }
+ $resolved .= $bit . (($i == $max) ? '' : '/');
+ }
+
+ // @todo If the file exists fine and open_basedir only has one path we should be able to prepend it
+ // because we must be inside that basedir, the question is where...
+ // @internal The slash in is_dir() gets around an open_basedir restriction
+ if (!@file_exists($resolved) || (!is_dir($resolved . '/') && !is_file($resolved)))
+ {
+ return false;
+ }
+
+ // Put the slashes back to the native operating systems slashes
+ $resolved = str_replace('/', DIRECTORY_SEPARATOR, $resolved);
+
+ // Check for DIRECTORY_SEPARATOR at the end (and remove it!)
+ if (substr($resolved, -1) == DIRECTORY_SEPARATOR)
+ {
+ return substr($resolved, 0, -1);
+ }
+
+ return $resolved; // We got here, in the end!
+ }
+
+ /**
+ * A wrapper for realpath
+ */
+ function realpath($path)
+ {
+ static $_phpbb_realpath_exist;
+
+ if (!isset($_phpbb_realpath_exist))
+ {
+ $_phpbb_realpath_exist = (!function_exists('realpath')) ? false : true;
+ }
+
+ if (!$_phpbb_realpath_exist)
+ {
+ return $this->own_realpath($path);
+ }
+
+ $realpath = realpath($path);
+
+ // Strangely there are provider not disabling realpath but returning strange values. :o
+ // We at least try to cope with them.
+ if ($realpath === $path || $realpath === false)
+ {
+ $_phpbb_realpath_exist = false;
+ return $this->own_realpath($path);
+ }
+
+ // Check for DIRECTORY_SEPARATOR at the end (and remove it!)
+ if (substr($realpath, -1) == DIRECTORY_SEPARATOR)
+ {
+ $realpath = substr($realpath, 0, -1);
+ }
+
+ return $realpath;
+ }
+
+ /**
+ * URL wrapper, hookable, all urls are run through this... either after append_sid() or not
+ */
+ public function get($url)
+ {
+ //if ($_fnc = array(__CLASS__, __FUNCTION__) && phpbb::$hooks->call($_fnc, $url) && phpbb::$hooks->return($_fnc)) return phpbb::$hooks->return_result($_fnc);
+ return $url;
+ }
+
+ /**
+ * Append session id to url.
+ * This function supports hooks.
+ *
+ * @param string $url The url the session id needs to be appended to (can have params)
+ * @param mixed $params String or array of additional url parameters
+ * @param bool $is_amp Is url using & (true) or & (false)
+ * @param string $session_id Possibility to use a custom session id instead of the global one
+ *
+ * Examples:
+ * <code>
+ * append_sid(PHPBB_ROOT_PATH . 'viewtopic.' . PHP_EXT . '?t=1&f=2');
+ * append_sid(PHPBB_ROOT_PATH . 'viewtopic.' . PHP_EXT, 't=1&f=2');
+ * append_sid('viewtopic', 't=1&f=2'); // short notation of the above example
+ * append_sid('viewtopic', 't=1&f=2', false);
+ * append_sid('viewtopic', array('t' => 1, 'f' => 2));
+ * </code>
+ *
+ */
+ public function append_sid($url, $params = false, $is_amp = true, $session_id = false)
+ {
+ global $_SID, $_EXTRA_URL;
+ static $parsed_urls = array();
+
+ // The following code is used to make sure such calls like append_sid('viewtopic') (ommitting phpbb_root_path and php_ext) work as intended
+ if (isset($parsed_urls[$url]))
+ {
+ // Set an url like 'viewtopic' to PHPBB_ROOT_PATH . 'viewtopic.' . PHP_EXT
+ $url = $parsed_urls[$url];
+ }
+ else
+ {
+ // If we detect an url without root path and extension, and also not a relative or absolute path, we add it and put it to the parsed urls
+ if (strpos($url, '.' . PHP_EXT) === false && $url[0] != '.' && $url[0] != '/')
+ {
+ $parsed_urls[$url] = $url = PHPBB_ROOT_PATH . $url . '.' . PHP_EXT;
+ }
+ }
+
+ if (empty($params))
+ {
+ $params = false;
+ }
+
+ $params_is_array = is_array($params);
+
+ // Get anchor
+ $anchor = '';
+ if (strpos($url, '#') !== false)
+ {
+ list($url, $anchor) = explode('#', $url, 2);
+ $anchor = '#' . $anchor;
+ }
+ else if (!$params_is_array && strpos($params, '#') !== false)
+ {
+ list($params, $anchor) = explode('#', $params, 2);
+ $anchor = '#' . $anchor;
+ }
+
+ // Handle really simple cases quickly
+ if ($_SID == '' && $session_id === false && empty($_EXTRA_URL) && !$params_is_array && !$anchor)
+ {
+ if ($params === false)
+ {
+ return $this->get($url);
+ }
+
+ $url_delim = (strpos($url, '?') === false) ? '?' : (($is_amp) ? '&' : '&');
+ return $this->get($url . ($params !== false ? $url_delim. $params : ''));
+ }
+
+ // Assign sid if session id is not specified
+ if ($session_id === false)
+ {
+ $session_id = $_SID;
+ }
+
+ $amp_delim = ($is_amp) ? '&' : '&';
+ $url_delim = (strpos($url, '?') === false) ? '?' : $amp_delim;
+
+ // Appending custom url parameter?
+ $append_url = (!empty($_EXTRA_URL)) ? implode($amp_delim, $_EXTRA_URL) : '';
+
+ // Use the short variant if possible ;)
+ if ($params === false)
+ {
+ // Append session id
+ if (!$session_id)
+ {
+ return $this->get($url . (($append_url) ? $url_delim . $append_url : '') . $anchor);
+ }
+ else
+ {
+ return $this->get($url . (($append_url) ? $url_delim . $append_url . $amp_delim : $url_delim) . 'sid=' . $session_id . $anchor);
+ }
+ }
+
+ // Build string if parameters are specified as array
+ if (is_array($params))
+ {
+ $output = array();
+
+ foreach ($params as $key => $item)
+ {
+ if ($item === NULL)
+ {
+ continue;
+ }
+
+ if ($key == '#')
+ {
+ $anchor = '#' . $item;
+ continue;
+ }
+
+ $output[] = $key . '=' . $item;
+ }
+
+ $params = implode($amp_delim, $output);
+ }
+
+ // Append session id and parameters (even if they are empty)
+ // If parameters are empty, the developer can still append his/her parameters without caring about the delimiter
+ return $this->get($url . (($append_url) ? $url_delim . $append_url . $amp_delim : $url_delim) . $params . ((!$session_id) ? '' : $amp_delim . 'sid=' . $session_id) . $anchor);
+ }
+
+ /**
+ * Generate board url (example: http://www.example.com/phpBB)
+ * @param bool $without_script_path if set to true the script path gets not appended (example: http://www.example.com)
+ */
+ public function generate_board_url($without_script_path = false)
+ {
+ $server_name = phpbb::$user->server['host'];
+ $server_port = phpbb::$user->server['port'];
+
+ // Forcing server vars is the only way to specify/override the protocol
+ if ($config['force_server_vars'] || !$server_name)
+ {
+ $server_protocol = ($config['server_protocol']) ? $config['server_protocol'] : (($config['cookie_secure']) ? 'https://' : 'http://');
+ $server_name = $config['server_name'];
+ $server_port = (int) $config['server_port'];
+ $script_path = $config['script_path'];
+
+ $url = $server_protocol . $server_name;
+ $cookie_secure = $config['cookie_secure'];
+ }
+ else
+ {
+ // Do not rely on cookie_secure, users seem to think that it means a secured cookie instead of an encrypted connection
+ $cookie_secure = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? 1 : 0;
+ $url = (($cookie_secure) ? 'https://' : 'http://') . $server_name;
+
+ $script_path = $user->page['root_script_path'];
+ }
+
+ if ($server_port && (($cookie_secure && $server_port <> 443) || (!$cookie_secure && $server_port <> 80)))
+ {
+ // HTTP HOST can carry a port number (we fetch $user->host, but for old versions this may be true)
+ if (strpos($server_name, ':') === false)
+ {
+ $url .= ':' . $server_port;
+ }
+ }
+
+ if (!$without_script_path)
+ {
+ $url .= $script_path;
+ }
+
+ // Strip / from the end
+ if (substr($url, -1, 1) == '/')
+ {
+ $url = substr($url, 0, -1);
+ }
+
+ return $url;
+ }
+
+ /**
+ * Redirects the user to another page then exits the script nicely
+ * This function is intended for urls within the board. It's not meant to redirect to cross-domains.
+ *
+ * @param string $url The url to redirect to
+ * @param bool $return If true, do not redirect but return the sanitized URL. Default is no return.
+ * @param bool $disable_cd_check If true, redirect() will redirect to an external domain. If false, the redirect point to the boards url if it does not match the current domain. Default is false.
+ */
+ function redirect($url, $return = false, $disable_cd_check = false)
+ {
+ global $db, $cache, $config, $user;
+
+ if (empty($user->lang))
+ {
+ $user->add_lang('common');
+ }
+
+ if (!$return)
+ {
+ garbage_collection();
+ }
+
+ // Make sure no &'s are in, this will break the redirect
+ $url = str_replace('&', '&', $url);
+
+ // Determine which type of redirect we need to handle...
+ $url_parts = parse_url($url);
+
+ if ($url_parts === false)
+ {
+ // Malformed url, redirect to current page...
+ $url = generate_board_url() . '/' . $user->page['page'];
+ }
+ else if (!empty($url_parts['scheme']) && !empty($url_parts['host']))
+ {
+ // Attention: only able to redirect within the same domain if $disable_cd_check is false (yourdomain.com -> www.yourdomain.com will not work)
+ if (!$disable_cd_check && $url_parts['host'] !== $user->host)
+ {
+ $url = generate_board_url();
+ }
+ }
+ else if ($url[0] == '/')
+ {
+ // Absolute uri, prepend direct url...
+ $url = generate_board_url(true) . $url;
+ }
+ else
+ {
+ // Relative uri
+ $pathinfo = pathinfo($url);
+
+ // Is the uri pointing to the current directory?
+ if ($pathinfo['dirname'] == '.')
+ {
+ $url = str_replace('./', '', $url);
+
+ // Strip / from the beginning
+ if ($url && substr($url, 0, 1) == '/')
+ {
+ $url = substr($url, 1);
+ }
+
+ if ($user->page['page_dir'])
+ {
+ $url = generate_board_url() . '/' . $user->page['page_dir'] . '/' . $url;
+ }
+ else
+ {
+ $url = generate_board_url() . '/' . $url;
+ }
+ }
+ else
+ {
+ // Used ./ before, but PHPBB_ROOT_PATH is working better with urls within another root path
+ $root_dirs = explode('/', str_replace('\\', '/', $this->realpath(PHPBB_ROOT_PATH)));
+ $page_dirs = explode('/', str_replace('\\', '/', $this->realpath($pathinfo['dirname'])));
+ $intersection = array_intersect_assoc($root_dirs, $page_dirs);
+
+ $root_dirs = array_diff_assoc($root_dirs, $intersection);
+ $page_dirs = array_diff_assoc($page_dirs, $intersection);
+
+ $dir = str_repeat('../', sizeof($root_dirs)) . implode('/', $page_dirs);
+
+ // Strip / from the end
+ if ($dir && substr($dir, -1, 1) == '/')
+ {
+ $dir = substr($dir, 0, -1);
+ }
+
+ // Strip / from the beginning
+ if ($dir && substr($dir, 0, 1) == '/')
+ {
+ $dir = substr($dir, 1);
+ }
+
+ $url = str_replace($pathinfo['dirname'] . '/', '', $url);
+
+ // Strip / from the beginning
+ if (substr($url, 0, 1) == '/')
+ {
+ $url = substr($url, 1);
+ }
+
+ $url = (!empty($dir) ? $dir . '/' : '') . $url;
+ $url = generate_board_url() . '/' . $url;
+ }
+ }
+
+ // Make sure no linebreaks are there... to prevent http response splitting for PHP < 4.4.2
+ if (strpos(urldecode($url), "\n") !== false || strpos(urldecode($url), "\r") !== false || strpos($url, ';') !== false)
+ {
+ trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR);
+ }
+
+ // Now, also check the protocol and for a valid url the last time...
+ $allowed_protocols = array('http', 'https', 'ftp', 'ftps');
+ $url_parts = parse_url($url);
+
+ if ($url_parts === false || empty($url_parts['scheme']) || !in_array($url_parts['scheme'], $allowed_protocols))
+ {
+ trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR);
+ }
+
+ if ($return)
+ {
+ return $url;
+ }
+
+ // Redirect via an HTML form for PITA webservers
+ if (@preg_match('#Microsoft|WebSTAR|Xitami#', getenv('SERVER_SOFTWARE')))
+ {
+ header('Refresh: 0; URL=' . $url);
+
+ echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">';
+ echo '<html xmlns="http://www.w3.org/1999/xhtml" dir="' . $user->lang['DIRECTION'] . '" lang="' . $user->lang['USER_LANG'] . '" xml:lang="' . $user->lang['USER_LANG'] . '">';
+ echo '<head>';
+ echo '<meta http-equiv="content-type" content="text/html; charset=utf-8" />';
+ echo '<meta http-equiv="refresh" content="0; url=' . str_replace('&', '&', $url) . '" />';
+ echo '<title>' . $user->lang['REDIRECT'] . '</title>';
+ echo '</head>';
+ echo '<body>';
+ echo '<div style="text-align: center;">' . sprintf($user->lang['URL_REDIRECT'], '<a href="' . str_replace('&', '&', $url) . '">', '</a>') . '</div>';
+ echo '</body>';
+ echo '</html>';
+
+ exit;
+ }
+
+ // Behave as per HTTP/1.1 spec for others
+ header('Location: ' . $url);
+ exit;
+ }
+
+ /**
+ * Re-Apply session id after page reloads
+ */
+ function reapply_sid($url)
+ {
+ if ($url === 'index.' . PHP_EXT)
+ {
+ return append_sid('index.' . PHP_EXT);
+ }
+ else if ($url === PHPBB_ROOT_PATH . 'index.' . PHP_EXT)
+ {
+ return append_sid('index');
+ }
+
+ // Remove previously added sid
+ if (strpos($url, '?sid=') !== false)
+ {
+ $url = preg_replace('/(\?)sid=[a-z0-9]+(&|&)?/', '\1', $url);
+ }
+ else if (strpos($url, '&sid=') !== false)
+ {
+ $url = preg_replace('/&sid=[a-z0-9]+(&)?/', '\1', $url);
+ }
+ else if (strpos($url, '&sid=') !== false)
+ {
+ $url = preg_replace('/&sid=[a-z0-9]+(&)?/', '\1', $url);
+ }
+
+ return append_sid($url);
+ }
+
+ /**
+ * Returns url from the session/current page with an re-appended SID with optionally stripping vars from the url
+ */
+ function build_url($strip_vars = false)
+ {
+ global $user;
+
+ // Append SID
+ $redirect = append_sid($user->page['page'], false, false);
+
+ // Add delimiter if not there...
+ if (strpos($redirect, '?') === false)
+ {
+ $redirect .= '?';
+ }
+
+ // Strip vars...
+ if ($strip_vars !== false && strpos($redirect, '?') !== false)
+ {
+ if (!is_array($strip_vars))
+ {
+ $strip_vars = array($strip_vars);
+ }
+
+ $query = $_query = array();
+
+ $args = substr($redirect, strpos($redirect, '?') + 1);
+ $args = ($args) ? explode('&', $args) : array();
+ $redirect = substr($redirect, 0, strpos($redirect, '?'));
+
+ foreach ($args as $argument)
+ {
+ $arguments = explode('=', $argument);
+ $key = $arguments[0];
+ unset($arguments[0]);
+
+ $query[$key] = implode('=', $arguments);
+ }
+
+ // Strip the vars off
+ foreach ($strip_vars as $strip)
+ {
+ if (isset($query[$strip]))
+ {
+ unset($query[$strip]);
+ }
+ }
+
+ // Glue the remaining parts together... already urlencoded
+ foreach ($query as $key => $value)
+ {
+ $_query[] = $key . '=' . $value;
+ }
+ $query = implode('&', $_query);
+
+ $redirect .= ($query) ? '?' . $query : '';
+ }
+
+ return PHPBB_ROOT_PATH . str_replace('&', '&', $redirect);
+ }
+
+ /**
+ * Meta refresh assignment
+ */
+ function meta_refresh($time, $url)
+ {
+ global $template;
+
+ $url = redirect($url, true);
+ $url = str_replace('&', '&', $url);
+
+ // For XHTML compatibility we change back & to &
+ $template->assign_vars(array(
+ 'META' => '<meta http-equiv="refresh" content="' . $time . ';url=' . $url . '" />')
+ );
+
+ return $url;
+ }
+ }
+
+ ?>
\ No newline at end of file
Propchange: branches/acydburn/phpBB/includes/core/core_url.php
------------------------------------------------------------------------------
svn:eol-style = LF
Propchange: branches/acydburn/phpBB/includes/core/core_url.php
------------------------------------------------------------------------------
svn:keywords = "Author Date Id Revision"
Removed: branches/acydburn/phpBB/includes/session.php
==============================================================================
*** branches/acydburn/phpBB/includes/session.php (original)
--- branches/acydburn/phpBB/includes/session.php (removed)
***************
*** 1,2146 ****
- <?php
- /**
- *
- * @package phpBB3
- * @version $Id$
- * @copyright (c) 2005 phpBB Group
- * @license http://opensource.org/licenses/gpl-license.php GNU Public License
- *
- */
-
- /**
- * @ignore
- */
- if (!defined('IN_PHPBB'))
- {
- exit;
- }
-
- /**
- * Session class
- * @package phpBB3
- */
- class session
- {
- var $cookie_data = array();
- var $page = array();
- var $data = array();
- var $browser = '';
- var $forwarded_for = '';
- var $host = '';
- var $session_id = '';
- var $ip = '';
- var $load = 0;
- var $time_now = 0;
- var $update_session_page = true;
-
- /**
- * Extract current session page
- *
- * @param string $root_path current root path (phpbb_root_path)
- */
- public static function extract_current_page($root_path)
- {
- $page_array = array();
-
- // First of all, get the request uri...
- $script_name = (!empty($_SERVER['PHP_SELF'])) ? $_SERVER['PHP_SELF'] : getenv('PHP_SELF');
- $args = (!empty($_SERVER['QUERY_STRING'])) ? explode('&', $_SERVER['QUERY_STRING']) : explode('&', getenv('QUERY_STRING'));
-
- // If we are unable to get the script name we use REQUEST_URI as a failover and note it within the page array for easier support...
- if (!$script_name)
- {
- $script_name = (!empty($_SERVER['REQUEST_URI'])) ? $_SERVER['REQUEST_URI'] : getenv('REQUEST_URI');
- $script_name = (($pos = strpos($script_name, '?')) !== false) ? substr($script_name, 0, $pos) : $script_name;
- $page_array['failover'] = 1;
- }
-
- // Replace backslashes and doubled slashes (could happen on some proxy setups)
- $script_name = str_replace(array('\\', '//'), '/', $script_name);
-
- // Now, remove the sid and let us get a clean query string...
- $use_args = array();
-
- // Since some browser do not encode correctly we need to do this with some "special" characters...
- // " -> %22, ' => %27, < -> %3C, > -> %3E
- $find = array('"', "'", '<', '>');
- $replace = array('%22', '%27', '%3C', '%3E');
-
- foreach ($args as $argument)
- {
- if (strpos($argument, 'sid=') === 0)
- {
- continue;
- }
-
- $use_args[] = str_replace($find, $replace, $argument);
- }
- unset($args);
-
- // The following examples given are for an request uri of {path to the phpbb directory}/adm/index.php?i=10&b=2
-
- // The current query string
- $query_string = trim(implode('&', $use_args));
-
- // basenamed page name (for example: index.php)
- $page_name = basename($script_name);
- $page_name = urlencode(htmlspecialchars($page_name));
-
- // current directory within the phpBB root (for example: adm)
- $root_dirs = explode('/', str_replace('\\', '/', phpbb_realpath($root_path)));
- $page_dirs = explode('/', str_replace('\\', '/', phpbb_realpath('./')));
- $intersection = array_intersect_assoc($root_dirs, $page_dirs);
-
- $root_dirs = array_diff_assoc($root_dirs, $intersection);
- $page_dirs = array_diff_assoc($page_dirs, $intersection);
-
- $page_dir = str_repeat('../', sizeof($root_dirs)) . implode('/', $page_dirs);
-
- if ($page_dir && substr($page_dir, -1, 1) == '/')
- {
- $page_dir = substr($page_dir, 0, -1);
- }
-
- // Current page from phpBB root (for example: adm/index.php?i=10&b=2)
- $page = (($page_dir) ? $page_dir . '/' : '') . $page_name . (($query_string) ? "?$query_string" : '');
-
- // The script path from the webroot to the current directory (for example: /phpBB3/adm/) : always prefixed with / and ends in /
- $script_path = trim(str_replace('\\', '/', dirname($script_name)));
-
- // The script path from the webroot to the phpBB root (for example: /phpBB3/)
- $script_dirs = explode('/', $script_path);
- array_splice($script_dirs, -sizeof($page_dirs));
- $root_script_path = implode('/', $script_dirs) . (sizeof($root_dirs) ? '/' . implode('/', $root_dirs) : '');
-
- // We are on the base level (phpBB root == webroot), lets adjust the variables a bit...
- if (!$root_script_path)
- {
- $root_script_path = ($page_dir) ? str_replace($page_dir, '', $script_path) : $script_path;
- }
-
- $script_path .= (substr($script_path, -1, 1) == '/') ? '' : '/';
- $root_script_path .= (substr($root_script_path, -1, 1) == '/') ? '' : '/';
-
- $page_array += array(
- 'page_name' => $page_name,
- 'page_dir' => $page_dir,
-
- 'query_string' => $query_string,
- 'script_path' => str_replace(' ', '%20', htmlspecialchars($script_path)),
- 'root_script_path' => str_replace(' ', '%20', htmlspecialchars($root_script_path)),
-
- 'page' => $page
- );
-
- return $page_array;
- }
-
- /**
- * Get valid hostname/port. HTTP_HOST is used, SERVER_NAME if HTTP_HOST not present.
- */
- function extract_current_hostname()
- {
- global $config;
-
- // Get hostname
- $host = (!empty($_SERVER['HTTP_HOST'])) ? $_SERVER['HTTP_HOST'] : ((!empty($_SERVER['SERVER_NAME'])) ? $_SERVER['SERVER_NAME'] : getenv('SERVER_NAME'));
-
- // Should be a string and lowered
- $host = (string) strtolower($host);
-
- // If host is equal the cookie domain or the server name (if config is set), then we assume it is valid
- if ((isset($config['cookie_domain']) && $host === $config['cookie_domain']) || (isset($config['server_name']) && $host === $config['server_name']))
- {
- return $host;
- }
-
- // Is the host actually a IP? If so, we use the IP... (IPv4)
- if (long2ip(ip2long($host)) === $host)
- {
- return $host;
- }
-
- // Now return the hostname (this also removes any port definition). The http:// is prepended to construct a valid URL, hosts never have a scheme assigned
- $host = @parse_url('http://' . $host, PHP_URL_HOST);
-
- // Remove any portions not removed by parse_url (#)
- $host = str_replace('#', '', $host);
-
- // If, by any means, the host is now empty, we will use a "best approach" way to guess one
- if (empty($host))
- {
- if (!empty($config['server_name']))
- {
- $host = $config['server_name'];
- }
- else if (!empty($config['cookie_domain']))
- {
- $host = (strpos($config['cookie_domain'], '.') === 0) ? substr($config['cookie_domain'], 1) : $config['cookie_domain'];
- }
- else
- {
- // Set to OS hostname or localhost
- $host = (function_exists('php_uname')) ? php_uname('n') : 'localhost';
- }
- }
-
- // It may be still no valid host, but for sure only a hostname (we may further expand on the cookie domain... if set)
- return $host;
- }
-
- /**
- * Start session management
- *
- * This is where all session activity begins. We gather various pieces of
- * information from the client and server. We test to see if a session already
- * exists. If it does, fine and dandy. If it doesn't we'll go on to create a
- * new one ... pretty logical heh? We also examine the system load (if we're
- * running on a system which makes such information readily available) and
- * halt if it's above an admin definable limit.
- *
- * @param bool $update_session_page if true the session page gets updated.
- * This can be set to circumvent certain scripts to update the users last visited page.
- */
- function session_begin($update_session_page = true)
- {
- global $SID, $_SID, $_EXTRA_URL, $db, $config;
-
- // Give us some basic information
- $this->time_now = time();
- $this->cookie_data = array('u' => 0, 'k' => '');
- $this->update_session_page = $update_session_page;
- $this->browser = (!empty($_SERVER['HTTP_USER_AGENT'])) ? htmlspecialchars((string) $_SERVER['HTTP_USER_AGENT']) : '';
- $this->referer = (!empty($_SERVER['HTTP_REFERER'])) ? htmlspecialchars((string) $_SERVER['HTTP_REFERER']) : '';
- $this->forwarded_for = (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) ? (string) $_SERVER['HTTP_X_FORWARDED_FOR'] : '';
-
- $this->host = self::extract_current_hostname();
- $this->page = self::extract_current_page(PHPBB_ROOT_PATH);
-
- // if the forwarded for header shall be checked we have to validate its contents
- if ($config['forwarded_for_check'])
- {
- $this->forwarded_for = preg_replace('#, +#', ', ', $this->forwarded_for);
-
- // split the list of IPs
- $ips = explode(', ', $this->forwarded_for);
- foreach ($ips as $ip)
- {
- // check IPv4 first, the IPv6 is hopefully only going to be used very seldomly
- if (!empty($ip) && !preg_match(get_preg_expression('ipv4'), $ip) && !preg_match(get_preg_expression('ipv6'), $ip))
- {
- // contains invalid data, don't use the forwarded for header
- $this->forwarded_for = '';
- break;
- }
- }
- }
- else
- {
- $this->forwarded_for = '';
- }
-
- // Add forum to the page for tracking online users - also adding a "x" to the end to properly identify the number
- $forum = request_var('f', 0);
- $this->page['page'] .= ($forum) ? ((strpos($this->page['page'], '?') !== false) ? '&' : '?') . '_f_=' . $forum . 'x' : '';
-
- if (request::is_set($config['cookie_name'] . '_sid', request::COOKIE) || request::is_set($config['cookie_name'] . '_u', request::COOKIE))
- {
- $this->cookie_data['u'] = request_var($config['cookie_name'] . '_u', 0, false, true);
- $this->cookie_data['k'] = request_var($config['cookie_name'] . '_k', '', false, true);
- $this->session_id = request_var($config['cookie_name'] . '_sid', '', false, true);
-
- $SID = (defined('NEED_SID')) ? '?sid=' . $this->session_id : '?sid=';
- $_SID = (defined('NEED_SID')) ? $this->session_id : '';
-
- if (empty($this->session_id))
- {
- $this->session_id = $_SID = request_var('sid', '');
- $SID = '?sid=' . $this->session_id;
- $this->cookie_data = array('u' => 0, 'k' => '');
- }
- }
- else
- {
- $this->session_id = $_SID = request_var('sid', '');
- $SID = '?sid=' . $this->session_id;
- }
-
- $_EXTRA_URL = array();
-
- // Why no forwarded_for et al? Well, too easily spoofed. With the results of my recent requests
- // it's pretty clear that in the majority of cases you'll at least be left with a proxy/cache ip.
- $this->ip = (!empty($_SERVER['REMOTE_ADDR'])) ? htmlspecialchars($_SERVER['REMOTE_ADDR']) : '';
- $this->load = false;
-
- // Load limit check (if applicable)
- if ($config['limit_load'] || $config['limit_search_load'])
- {
- if ((function_exists('sys_getloadavg') && $load = sys_getloadavg()) || ($load = explode(' ', @file_get_contents('/proc/loadavg'))))
- {
- $this->load = array_slice($load, 0, 1);
- $this->load = floatval($this->load[0]);
- }
- else
- {
- set_config('limit_load', '0');
- set_config('limit_search_load', '0');
- }
- }
-
- // Is session_id is set or session_id is set and matches the url param if required
- if (!empty($this->session_id) && (!defined('NEED_SID') || $this->session_id === request::variable('sid', '', false, request::GET)))
- {
- $sql = 'SELECT u.*, s.*
- FROM ' . SESSIONS_TABLE . ' s, ' . USERS_TABLE . " u
- WHERE s.session_id = '" . $db->sql_escape($this->session_id) . "'
- AND u.user_id = s.session_user_id";
- $result = $db->sql_query($sql);
- $this->data = $db->sql_fetchrow($result);
- $db->sql_freeresult($result);
-
- // Did the session exist in the DB?
- if (isset($this->data['user_id']))
- {
- // Validate IP length according to admin ... enforces an IP
- // check on bots if admin requires this
- // $quadcheck = ($config['ip_check_bot'] && $this->data['user_type'] & USER_BOT) ? 4 : $config['ip_check'];
-
- if (strpos($this->ip, ':') !== false && strpos($this->data['session_ip'], ':') !== false)
- {
- $s_ip = short_ipv6($this->data['session_ip'], $config['ip_check']);
- $u_ip = short_ipv6($this->ip, $config['ip_check']);
- }
- else
- {
- $s_ip = implode('.', array_slice(explode('.', $this->data['session_ip']), 0, $config['ip_check']));
- $u_ip = implode('.', array_slice(explode('.', $this->ip), 0, $config['ip_check']));
- }
-
- $s_browser = ($config['browser_check']) ? trim(strtolower(substr($this->data['session_browser'], 0, 149))) : '';
- $u_browser = ($config['browser_check']) ? trim(strtolower(substr($this->browser, 0, 149))) : '';
-
- $s_forwarded_for = ($config['forwarded_for_check']) ? substr($this->data['session_forwarded_for'], 0, 254) : '';
- $u_forwarded_for = ($config['forwarded_for_check']) ? substr($this->forwarded_for, 0, 254) : '';
-
- // referer checks
- $check_referer_path = $config['referer_validation'] == REFERER_VALIDATE_PATH;
- $referer_valid = true;
- // we assume HEAD and TRACE to be foul play and thus only whitelist GET
- if ($config['referer_validation'] && isset($_SERVER['REQUEST_METHOD']) && strtolower($_SERVER['REQUEST_METHOD']) !== 'get')
- {
- $referer_valid = $this->validate_referer($check_referer_path);
- }
-
-
- if ($u_ip === $s_ip && $s_browser === $u_browser && $s_forwarded_for === $u_forwarded_for && $referer_valid)
- {
- $session_expired = false;
-
- // Check whether the session is still valid if we have one
- $method = basename(trim($config['auth_method']));
- include_once(PHPBB_ROOT_PATH . 'includes/auth/auth_' . $method . '.' . PHP_EXT);
-
- $method = 'validate_session_' . $method;
- if (function_exists($method))
- {
- if (!$method($this->data))
- {
- $session_expired = true;
- }
- }
-
- if (!$session_expired)
- {
- // Check the session length timeframe if autologin is not enabled.
- // Else check the autologin length... and also removing those having autologin enabled but no longer allowed board-wide.
- if (!$this->data['session_autologin'])
- {
- if ($this->data['session_time'] < $this->time_now - ($config['session_length'] + 60))
- {
- $session_expired = true;
- }
- }
- else if (!$config['allow_autologin'] || ($config['max_autologin_time'] && $this->data['session_time'] < $this->time_now - (86400 * (int) $config['max_autologin_time']) + 60))
- {
- $session_expired = true;
- }
- }
-
- if (!$session_expired)
- {
- // Only update session DB a minute or so after last update or if page changes
- if ($this->time_now - $this->data['session_time'] > 60 || ($this->update_session_page && $this->data['session_page'] != $this->page['page']))
- {
- $sql_ary = array('session_time' => $this->time_now);
-
- if ($this->update_session_page)
- {
- $sql_ary['session_page'] = substr($this->page['page'], 0, 199);
- }
-
- $db->sql_return_on_error(true);
-
- $sql = 'UPDATE ' . SESSIONS_TABLE . ' SET ' . $db->sql_build_array('UPDATE', $sql_ary) . "
- WHERE session_id = '" . $db->sql_escape($this->session_id) . "'";
- $result = $db->sql_query($sql);
-
- $db->sql_return_on_error(false);
-
- // If the database is not yet updated, there will be an error due to the session_forum_id
- // @todo REMOVE for 3.0.2
- if ($result === false)
- {
- unset($sql_ary['session_forum_id']);
-
- $sql = 'UPDATE ' . SESSIONS_TABLE . ' SET ' . $db->sql_build_array('UPDATE', $sql_ary) . "
- WHERE session_id = '" . $db->sql_escape($this->session_id) . "'";
- $db->sql_query($sql);
- }
- }
-
- $this->data['is_registered'] = ($this->data['user_id'] != ANONYMOUS && ($this->data['user_type'] == USER_NORMAL || $this->data['user_type'] == USER_FOUNDER)) ? true : false;
- $this->data['is_bot'] = (!$this->data['is_registered'] && $this->data['user_id'] != ANONYMOUS) ? true : false;
- $this->data['user_lang'] = basename($this->data['user_lang']);
-
- return true;
- }
- }
- else
- {
- // Added logging temporarly to help debug bugs...
- if (defined('DEBUG_EXTRA') && $this->data['user_id'] != ANONYMOUS)
- {
- if ($referer_valid)
- {
- add_log('critical', 'LOG_IP_BROWSER_FORWARDED_CHECK', $u_ip, $s_ip, $u_browser, $s_browser, htmlspecialchars($u_forwarded_for), htmlspecialchars($s_forwarded_for));
- }
- else
- {
- add_log('critical', 'LOG_REFERER_INVALID', $this->referer);
- }
- }
- }
- }
- }
-
- // If we reach here then no (valid) session exists. So we'll create a new one
- return $this->session_create();
- }
-
- /**
- * Create a new session
- *
- * If upon trying to start a session we discover there is nothing existing we
- * jump here. Additionally this method is called directly during login to regenerate
- * the session for the specific user. In this method we carry out a number of tasks;
- * garbage collection, (search)bot checking, banned user comparison. Basically
- * though this method will result in a new session for a specific user.
- */
- function session_create($user_id = false, $set_admin = false, $persist_login = false, $viewonline = true)
- {
- global $SID, $_SID, $db, $config, $cache;
-
- $this->data = array();
-
- /* Garbage collection ... remove old sessions updating user information
- // if necessary. It means (potentially) 11 queries but only infrequently
- if ($this->time_now > $config['session_last_gc'] + $config['session_gc'])
- {
- $this->session_gc();
- }*/
-
- // Do we allow autologin on this board? No? Then override anything
- // that may be requested here
- if (!$config['allow_autologin'])
- {
- $this->cookie_data['k'] = $persist_login = false;
- }
-
- /**
- * Here we do a bot check, oh er saucy! No, not that kind of bot
- * check. We loop through the list of bots defined by the admin and
- * see if we have any useragent and/or IP matches. If we do, this is a
- * bot, act accordingly
- */
- $bot = false;
- $active_bots = cache::obtain_bots();
-
- foreach ($active_bots as $row)
- {
- if ($row['bot_agent'] && preg_match('#' . str_replace('\*', '.*?', preg_quote($row['bot_agent'], '#')) . '#i', $this->browser))
- {
- $bot = $row['user_id'];
- }
-
- // If ip is supplied, we will make sure the ip is matching too...
- if ($row['bot_ip'] && ($bot || !$row['bot_agent']))
- {
- // Set bot to false, then we only have to set it to true if it is matching
- $bot = false;
-
- foreach (explode(',', $row['bot_ip']) as $bot_ip)
- {
- if (strpos($this->ip, $bot_ip) === 0)
- {
- $bot = (int) $row['user_id'];
- break;
- }
- }
- }
-
- if ($bot)
- {
- break;
- }
- }
-
- $method = basename(trim($config['auth_method']));
- include_once(PHPBB_ROOT_PATH . 'includes/auth/auth_' . $method . '.' . PHP_EXT);
-
- $method = 'autologin_' . $method;
- if (function_exists($method))
- {
- $this->data = $method();
-
- if (sizeof($this->data))
- {
- $this->cookie_data['k'] = '';
- $this->cookie_data['u'] = $this->data['user_id'];
- }
- }
-
- // If we're presented with an autologin key we'll join against it.
- // Else if we've been passed a user_id we'll grab data based on that
- if (isset($this->cookie_data['k']) && $this->cookie_data['k'] && $this->cookie_data['u'] && !sizeof($this->data))
- {
- $sql = 'SELECT u.*
- FROM ' . USERS_TABLE . ' u, ' . SESSIONS_KEYS_TABLE . ' k
- WHERE u.user_id = ' . (int) $this->cookie_data['u'] . '
- AND u.user_type IN (' . USER_NORMAL . ', ' . USER_FOUNDER . ")
- AND k.user_id = u.user_id
- AND k.key_id = '" . $db->sql_escape(md5($this->cookie_data['k'])) . "'";
- $result = $db->sql_query($sql);
- $this->data = $db->sql_fetchrow($result);
- $db->sql_freeresult($result);
- $bot = false;
- }
- else if ($user_id !== false && !sizeof($this->data))
- {
- $this->cookie_data['k'] = '';
- $this->cookie_data['u'] = $user_id;
-
- $sql = 'SELECT *
- FROM ' . USERS_TABLE . '
- WHERE user_id = ' . (int) $this->cookie_data['u'] . '
- AND user_type IN (' . USER_NORMAL . ', ' . USER_FOUNDER . ')';
- $result = $db->sql_query($sql);
- $this->data = $db->sql_fetchrow($result);
- $db->sql_freeresult($result);
- $bot = false;
- }
-
- // If no data was returned one or more of the following occurred:
- // Key didn't match one in the DB
- // User does not exist
- // User is inactive
- // User is bot
- if (!sizeof($this->data) || !is_array($this->data))
- {
- $this->cookie_data['k'] = '';
- $this->cookie_data['u'] = ($bot) ? $bot : ANONYMOUS;
-
- if (!$bot)
- {
- $sql = 'SELECT *
- FROM ' . USERS_TABLE . '
- WHERE user_id = ' . (int) $this->cookie_data['u'];
- }
- else
- {
- // We give bots always the same session if it is not yet expired.
- $sql = 'SELECT u.*, s.*
- FROM ' . USERS_TABLE . ' u
- LEFT JOIN ' . SESSIONS_TABLE . ' s ON (s.session_user_id = u.user_id)
- WHERE u.user_id = ' . (int) $bot;
- }
-
- $result = $db->sql_query($sql);
- $this->data = $db->sql_fetchrow($result);
- $db->sql_freeresult($result);
- }
-
- if ($this->data['user_id'] != ANONYMOUS && !$bot)
- {
- $this->data['session_last_visit'] = (isset($this->data['session_time']) && $this->data['session_time']) ? $this->data['session_time'] : (($this->data['user_lastvisit']) ? $this->data['user_lastvisit'] : time());
- }
- else
- {
- $this->data['session_last_visit'] = $this->time_now;
- }
-
- // Force user id to be integer...
- $this->data['user_id'] = (int) $this->data['user_id'];
-
- // At this stage we should have a filled data array, defined cookie u and k data.
- // data array should contain recent session info if we're a real user and a recent
- // session exists in which case session_id will also be set
-
- // Is user banned? Are they excluded? Won't return on ban, exists within method
- if ($this->data['user_type'] != USER_FOUNDER)
- {
- if (!$config['forwarded_for_check'])
- {
- $this->check_ban($this->data['user_id'], $this->ip);
- }
- else
- {
- $ips = explode(', ', $this->forwarded_for);
- $ips[] = $this->ip;
- $this->check_ban($this->data['user_id'], $ips);
- }
- }
-
- $this->data['is_registered'] = (!$bot && $this->data['user_id'] != ANONYMOUS && ($this->data['user_type'] == USER_NORMAL || $this->data['user_type'] == USER_FOUNDER)) ? true : false;
- $this->data['is_bot'] = ($bot) ? true : false;
-
- // If our friend is a bot, we re-assign a previously assigned session
- if ($this->data['is_bot'] && $bot == $this->data['user_id'] && $this->data['session_id'])
- {
- // Only assign the current session if the ip, browser and forwarded_for match...
- if (strpos($this->ip, ':') !== false && strpos($this->data['session_ip'], ':') !== false)
- {
- $s_ip = short_ipv6($this->data['session_ip'], $config['ip_check']);
- $u_ip = short_ipv6($this->ip, $config['ip_check']);
- }
- else
- {
- $s_ip = implode('.', array_slice(explode('.', $this->data['session_ip']), 0, $config['ip_check']));
- $u_ip = implode('.', array_slice(explode('.', $this->ip), 0, $config['ip_check']));
- }
-
- $s_browser = ($config['browser_check']) ? trim(strtolower(substr($this->data['session_browser'], 0, 149))) : '';
- $u_browser = ($config['browser_check']) ? trim(strtolower(substr($this->browser, 0, 149))) : '';
-
- $s_forwarded_for = ($config['forwarded_for_check']) ? substr($this->data['session_forwarded_for'], 0, 254) : '';
- $u_forwarded_for = ($config['forwarded_for_check']) ? substr($this->forwarded_for, 0, 254) : '';
-
- if ($u_ip === $s_ip && $s_browser === $u_browser && $s_forwarded_for === $u_forwarded_for)
- {
- $this->session_id = $this->data['session_id'];
-
- // Only update session DB a minute or so after last update or if page changes
- if ($this->time_now - $this->data['session_time'] > 60 || ($this->update_session_page && $this->data['session_page'] != $this->page['page']))
- {
- $this->data['session_time'] = $this->data['session_last_visit'] = $this->time_now;
-
- $sql_ary = array('session_time' => $this->time_now, 'session_last_visit' => $this->time_now, 'session_admin' => 0);
-
- if ($this->update_session_page)
- {
- $sql_ary['session_page'] = substr($this->page['page'], 0, 199);
- }
-
- $sql = 'UPDATE ' . SESSIONS_TABLE . ' SET ' . $db->sql_build_array('UPDATE', $sql_ary) . "
- WHERE session_id = '" . $db->sql_escape($this->session_id) . "'";
- $db->sql_query($sql);
-
- // Update the last visit time
- $sql = 'UPDATE ' . USERS_TABLE . '
- SET user_lastvisit = ' . (int) $this->data['session_time'] . '
- WHERE user_id = ' . (int) $this->data['user_id'];
- $db->sql_query($sql);
- }
-
- $SID = '?sid=';
- $_SID = '';
- return true;
- }
- else
- {
- // If the ip and browser does not match make sure we only have one bot assigned to one session
- $db->sql_query('DELETE FROM ' . SESSIONS_TABLE . ' WHERE session_user_id = ' . $this->data['user_id']);
- }
- }
-
- $session_autologin = (($this->cookie_data['k'] || $persist_login) && $this->data['is_registered']) ? true : false;
- $set_admin = ($set_admin && $this->data['is_registered']) ? true : false;
-
- // Create or update the session
- $sql_ary = array(
- 'session_user_id' => (int) $this->data['user_id'],
- 'session_start' => (int) $this->time_now,
- 'session_last_visit' => (int) $this->data['session_last_visit'],
- 'session_time' => (int) $this->time_now,
- 'session_browser' => (string) trim(substr($this->browser, 0, 149)),
- 'session_forwarded_for' => (string) $this->forwarded_for,
- 'session_ip' => (string) $this->ip,
- 'session_autologin' => ($session_autologin) ? 1 : 0,
- 'session_admin' => ($set_admin) ? 1 : 0,
- 'session_viewonline' => ($viewonline) ? 1 : 0,
- );
-
- if ($this->update_session_page)
- {
- $sql_ary['session_page'] = (string) substr($this->page['page'], 0, 199);
- }
-
- $db->sql_return_on_error(true);
-
- $sql = 'DELETE
- FROM ' . SESSIONS_TABLE . '
- WHERE session_id = \'' . $db->sql_escape($this->session_id) . '\'
- AND session_user_id = ' . ANONYMOUS;
-
- if (!defined('IN_ERROR_HANDLER') && (!$this->session_id || !$db->sql_query($sql) || !$db->sql_affectedrows()))
- {
- // Limit new sessions in 1 minute period (if required)
- if (empty($this->data['session_time']) && $config['active_sessions'])
- {
- $sql = 'SELECT COUNT(session_id) AS sessions
- FROM ' . SESSIONS_TABLE . '
- WHERE session_time >= ' . ($this->time_now - 60);
- $result = $db->sql_query($sql);
- $row = $db->sql_fetchrow($result);
- $db->sql_freeresult($result);
-
- if ((int) $row['sessions'] > (int) $config['active_sessions'])
- {
- header('HTTP/1.1 503 Service Unavailable');
- trigger_error('BOARD_UNAVAILABLE');
- }
- }
- }
-
- $this->session_id = $this->data['session_id'] = md5(unique_id());
-
- $sql_ary['session_id'] = (string) $this->session_id;
- $sql_ary['session_page'] = (string) substr($this->page['page'], 0, 199);
-
- $sql = 'INSERT INTO ' . SESSIONS_TABLE . ' ' . $db->sql_build_array('INSERT', $sql_ary);
- $db->sql_query($sql);
-
- $db->sql_return_on_error(false);
-
- // Regenerate autologin/persistent login key
- if ($session_autologin)
- {
- $this->set_login_key();
- }
-
- // refresh data
- $SID = '?sid=' . $this->session_id;
- $_SID = $this->session_id;
- $this->data = array_merge($this->data, $sql_ary);
-
- if (!$bot)
- {
- $cookie_expire = $this->time_now + (($config['max_autologin_time']) ? 86400 * (int) $config['max_autologin_time'] : 31536000);
-
- $this->set_cookie('u', $this->cookie_data['u'], $cookie_expire);
- $this->set_cookie('k', $this->cookie_data['k'], $cookie_expire);
- $this->set_cookie('sid', $this->session_id, $cookie_expire);
-
- unset($cookie_expire);
-
- $sql = 'SELECT COUNT(session_id) AS sessions
- FROM ' . SESSIONS_TABLE . '
- WHERE session_user_id = ' . (int) $this->data['user_id'] . '
- AND session_time >= ' . (int) ($this->time_now - (max($config['session_length'], $config['form_token_lifetime'])));
- $result = $db->sql_query($sql);
- $row = $db->sql_fetchrow($result);
- $db->sql_freeresult($result);
-
- if ((int) $row['sessions'] <= 1 || empty($this->data['user_form_salt']))
- {
- $this->data['user_form_salt'] = unique_id();
- // Update the form key
- $sql = 'UPDATE ' . USERS_TABLE . '
- SET user_form_salt = \'' . $db->sql_escape($this->data['user_form_salt']) . '\'
- WHERE user_id = ' . (int) $this->data['user_id'];
- $db->sql_query($sql);
- }
- }
- else
- {
- $this->data['session_time'] = $this->data['session_last_visit'] = $this->time_now;
-
- // Update the last visit time
- $sql = 'UPDATE ' . USERS_TABLE . '
- SET user_lastvisit = ' . (int) $this->data['session_time'] . '
- WHERE user_id = ' . (int) $this->data['user_id'];
- $db->sql_query($sql);
-
- $SID = '?sid=';
- $_SID = '';
- }
-
- return true;
- }
-
- /**
- * Kills a session
- *
- * This method does what it says on the tin. It will delete a pre-existing session.
- * It resets cookie information (destroying any autologin key within that cookie data)
- * and update the users information from the relevant session data. It will then
- * grab guest user information.
- */
- function session_kill($new_session = true)
- {
- global $SID, $_SID, $db, $config;
-
- $sql = 'DELETE FROM ' . SESSIONS_TABLE . "
- WHERE session_id = '" . $db->sql_escape($this->session_id) . "'
- AND session_user_id = " . (int) $this->data['user_id'];
- $db->sql_query($sql);
-
- // Allow connecting logout with external auth method logout
- $method = basename(trim($config['auth_method']));
- include_once(PHPBB_ROOT_PATH . 'includes/auth/auth_' . $method . '.' . PHP_EXT);
-
- $method = 'logout_' . $method;
- if (function_exists($method))
- {
- $method($this->data, $new_session);
- }
-
- if ($this->data['user_id'] != ANONYMOUS)
- {
- // Delete existing session, update last visit info first!
- if (!isset($this->data['session_time']))
- {
- $this->data['session_time'] = time();
- }
-
- $sql = 'UPDATE ' . USERS_TABLE . '
- SET user_lastvisit = ' . (int) $this->data['session_time'] . '
- WHERE user_id = ' . (int) $this->data['user_id'];
- $db->sql_query($sql);
-
- if ($this->cookie_data['k'])
- {
- $sql = 'DELETE FROM ' . SESSIONS_KEYS_TABLE . '
- WHERE user_id = ' . (int) $this->data['user_id'] . "
- AND key_id = '" . $db->sql_escape(md5($this->cookie_data['k'])) . "'";
- $db->sql_query($sql);
- }
-
- // Reset the data array
- $this->data = array();
-
- $sql = 'SELECT *
- FROM ' . USERS_TABLE . '
- WHERE user_id = ' . ANONYMOUS;
- $result = $db->sql_query($sql);
- $this->data = $db->sql_fetchrow($result);
- $db->sql_freeresult($result);
- }
-
- $cookie_expire = $this->time_now - 31536000;
- $this->set_cookie('u', '', $cookie_expire);
- $this->set_cookie('k', '', $cookie_expire);
- $this->set_cookie('sid', '', $cookie_expire);
- unset($cookie_expire);
-
- $SID = '?sid=';
- $this->session_id = $_SID = '';
-
- // To make sure a valid session is created we create one for the anonymous user
- if ($new_session)
- {
- $this->session_create(ANONYMOUS);
- }
-
- return true;
- }
-
- /**
- * Session garbage collection
- *
- * This looks a lot more complex than it really is. Effectively we are
- * deleting any sessions older than an admin definable limit. Due to the
- * way in which we maintain session data we have to ensure we update user
- * data before those sessions are destroyed. In addition this method
- * removes autologin key information that is older than an admin defined
- * limit.
- */
- function session_gc()
- {
- global $db, $config;
-
- $batch_size = 10;
-
- if (!$this->time_now)
- {
- $this->time_now = time();
- }
-
- // Firstly, delete guest sessions
- $sql = 'DELETE FROM ' . SESSIONS_TABLE . '
- WHERE session_user_id = ' . ANONYMOUS . '
- AND session_time < ' . (int) ($this->time_now - $config['session_length']);
- $db->sql_query($sql);
-
- // Get expired sessions, only most recent for each user
- $sql = 'SELECT session_user_id, session_page, MAX(session_time) AS recent_time
- FROM ' . SESSIONS_TABLE . '
- WHERE session_time < ' . ($this->time_now - $config['session_length']) . '
- GROUP BY session_user_id, session_page';
- $result = $db->sql_query_limit($sql, $batch_size);
-
- $del_user_id = array();
- $del_sessions = 0;
-
- while ($row = $db->sql_fetchrow($result))
- {
- $sql = 'UPDATE ' . USERS_TABLE . '
- SET user_lastvisit = ' . (int) $row['recent_time'] . ", user_lastpage = '" . $db->sql_escape($row['session_page']) . "'
- WHERE user_id = " . (int) $row['session_user_id'];
- $db->sql_query($sql);
-
- $del_user_id[] = (int) $row['session_user_id'];
- $del_sessions++;
- }
- $db->sql_freeresult($result);
-
- if (sizeof($del_user_id))
- {
- // Delete expired sessions
- $sql = 'DELETE FROM ' . SESSIONS_TABLE . '
- WHERE ' . $db->sql_in_set('session_user_id', $del_user_id) . '
- AND session_time < ' . ($this->time_now - $config['session_length']);
- $db->sql_query($sql);
- }
-
- if ($del_sessions < $batch_size)
- {
- // Less than 10 users, update gc timer ... else we want gc
- // called again to delete other sessions
- set_config('session_last_gc', $this->time_now, true);
-
- if ($config['max_autologin_time'])
- {
- $sql = 'DELETE FROM ' . SESSIONS_KEYS_TABLE . '
- WHERE last_login < ' . (time() - (86400 * (int) $config['max_autologin_time']));
- $db->sql_query($sql);
- }
-
- // only called from CRON; should be a safe workaround until the infrastructure gets going
- if (!class_exists('captcha_factory'))
- {
- include(PHPBB_ROOT_PATH . "includes/captcha/captcha_factory." . PHP_EXT);
- }
- captcha_factory::garbage_collect($config['captcha_plugin']);
- }
-
- return;
- }
-
-
- /**
- * Sets a cookie
- *
- * Sets a cookie of the given name with the specified data for the given length of time. If no time is specified, a session cookie will be set.
- *
- * @param string $name Name of the cookie, will be automatically prefixed with the phpBB cookie name. track becomes [cookie_name]_track then.
- * @param string $cookiedata The data to hold within the cookie
- * @param int $cookietime The expiration time as UNIX timestamp. If 0 is provided, a session cookie is set.
- */
- function set_cookie($name, $cookiedata, $cookietime)
- {
- global $config;
-
- $name_data = rawurlencode($config['cookie_name'] . '_' . $name) . '=' . rawurlencode($cookiedata);
- $expire = gmdate('D, d-M-Y H:i:s \\G\\M\\T', $cookietime);
- $domain = (!$config['cookie_domain'] || $config['cookie_domain'] == 'localhost' || $config['cookie_domain'] == '127.0.0.1') ? '' : '; domain=' . $config['cookie_domain'];
-
- header('Set-Cookie: ' . $name_data . (($cookietime) ? '; expires=' . $expire : '') . '; path=' . $config['cookie_path'] . $domain . ((!$config['cookie_secure']) ? '' : '; secure') . '; HttpOnly', false);
- }
-
- /**
- * Check for banned user
- *
- * Checks whether the supplied user is banned by id, ip or email. If no parameters
- * are passed to the method pre-existing session data is used. If $return is false
- * this routine does not return on finding a banned user, it outputs a relevant
- * message and stops execution.
- *
- * @param string|array $user_ips Can contain a string with one IP or an array of multiple IPs
- */
- function check_ban($user_id = false, $user_ips = false, $user_email = false, $return = false)
- {
- global $config, $db;
-
- if (defined('IN_CHECK_BAN'))
- {
- return;
- }
-
- $banned = false;
- $cache_ttl = 3600;
- $where_sql = array();
-
- $sql = 'SELECT ban_ip, ban_userid, ban_email, ban_exclude, ban_give_reason, ban_end
- FROM ' . BANLIST_TABLE . '
- WHERE ';
-
- // Determine which entries to check, only return those
- if ($user_email === false)
- {
- $where_sql[] = "ban_email = ''";
- }
-
- if ($user_ips === false)
- {
- $where_sql[] = "(ban_ip = '' OR ban_exclude = 1)";
- }
-
- if ($user_id === false)
- {
- $where_sql[] = '(ban_userid = 0 OR ban_exclude = 1)';
- }
- else
- {
- $cache_ttl = ($user_id == ANONYMOUS) ? 3600 : 0;
- $_sql = '(ban_userid = ' . $user_id;
-
- if ($user_email !== false)
- {
- $_sql .= " OR ban_email <> ''";
- }
-
- if ($user_ips !== false)
- {
- $_sql .= " OR ban_ip <> ''";
- }
-
- $_sql .= ')';
-
- $where_sql[] = $_sql;
- }
-
- $sql .= (sizeof($where_sql)) ? implode(' AND ', $where_sql) : '';
- $result = $db->sql_query($sql, $cache_ttl);
-
- $ban_triggered_by = 'user';
- while ($row = $db->sql_fetchrow($result))
- {
- if ($row['ban_end'] && $row['ban_end'] < time())
- {
- continue;
- }
-
- $ip_banned = false;
- if (!empty($row['ban_ip']))
- {
- if (!is_array($user_ips))
- {
- $ip_banned = preg_match('#^' . str_replace('\*', '.*?', preg_quote($row['ban_ip'], '#')) . '$#i', $user_ips);
- }
- else
- {
- foreach ($user_ips as $user_ip)
- {
- if (preg_match('#^' . str_replace('\*', '.*?', preg_quote($row['ban_ip'], '#')) . '$#i', $user_ip))
- {
- $ip_banned = true;
- break;
- }
- }
- }
- }
-
- if ((!empty($row['ban_userid']) && intval($row['ban_userid']) == $user_id) ||
- $ip_banned ||
- (!empty($row['ban_email']) && preg_match('#^' . str_replace('\*', '.*?', preg_quote($row['ban_email'], '#')) . '$#i', $user_email)))
- {
- if (!empty($row['ban_exclude']))
- {
- $banned = false;
- break;
- }
- else
- {
- $banned = true;
- $ban_row = $row;
-
- if (!empty($row['ban_userid']) && intval($row['ban_userid']) == $user_id)
- {
- $ban_triggered_by = 'user';
- }
- else if ($ip_banned)
- {
- $ban_triggered_by = 'ip';
- }
- else
- {
- $ban_triggered_by = 'email';
- }
-
- // Don't break. Check if there is an exclude rule for this user
- }
- }
- }
- $db->sql_freeresult($result);
-
- if ($banned && !$return)
- {
- global $template;
-
- // If the session is empty we need to create a valid one...
- if (empty($this->session_id))
- {
- // This seems to be no longer needed? - #14971
- // $this->session_create(ANONYMOUS);
- }
-
- // Initiate environment ... since it won't be set at this stage
- $this->setup();
-
- // Logout the user, banned users are unable to use the normal 'logout' link
- if ($this->data['user_id'] != ANONYMOUS)
- {
- $this->session_kill();
- }
-
- // We show a login box here to allow founders accessing the board if banned by IP
- if (defined('IN_LOGIN') && $this->data['user_id'] == ANONYMOUS)
- {
- $this->setup('ucp');
- $this->data['is_registered'] = $this->data['is_bot'] = false;
-
- // Set as a precaution to allow login_box() handling this case correctly as well as this function not being executed again.
- define('IN_CHECK_BAN', 1);
-
- login_box('index.' . PHP_EXT);
-
- // The false here is needed, else the user is able to circumvent the ban.
- $this->session_kill(false);
- }
-
- // Ok, we catch the case of...
[truncated message content] |
