Mercurial > hg > vamp-website

annotate forum/Sources/QueryString.php @ 87:df86d318892b website

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Link to SampleType doc
author Chris Cannam
date Mon, 10 Feb 2014 18:11:48 +0000
parents e3e11437ecea
children
rev   line source
Chris@76 1 <?php
Chris@76 2
Chris@76 3 /**
Chris@76 4 * Simple Machines Forum (SMF)
Chris@76 5 *
Chris@76 6 * @package SMF
Chris@76 7 * @author Simple Machines http://www.simplemachines.org
Chris@76 8 * @copyright 2011 Simple Machines
Chris@76 9 * @license http://www.simplemachines.org/about/smf/license.php BSD
Chris@76 10 *
Chris@76 11 * @version 2.0.3
Chris@76 12 */
Chris@76 13
Chris@76 14 if (!defined('SMF'))
Chris@76 15 die('Hacking attempt...');
Chris@76 16
Chris@76 17 /* This file does a lot of important stuff. Mainly, this means it handles
Chris@76 18 the query string, request variables, and session management. It contains
Chris@76 19 the following functions:
Chris@76 20
Chris@76 21 void cleanRequest()
Chris@76 22 - cleans the request variables (ENV, GET, POST, COOKIE, SERVER) and
Chris@76 23 makes sure the query string was parsed correctly.
Chris@76 24 - handles the URLs passed by the queryless URLs option.
Chris@76 25 - makes sure, regardless of php.ini, everything has slashes.
Chris@76 26 - sets up $board, $topic, and $scripturl and $_REQUEST['start'].
Chris@76 27 - determines, or rather tries to determine, the client's IP.
Chris@76 28
Chris@76 29 array escapestring__recursive(array var)
Chris@76 30 - returns the var, as an array or string, with escapes as required.
Chris@76 31 - importantly escapes all keys and values!
Chris@76 32 - calls itself recursively if necessary.
Chris@76 33
Chris@76 34 array htmlspecialchars__recursive(array var)
Chris@76 35 - adds entities (&quot;, &lt;, &gt;) to the array or string var.
Chris@76 36 - importantly, does not effect keys, only values.
Chris@76 37 - calls itself recursively if necessary.
Chris@76 38
Chris@76 39 array urldecode__recursive(array var)
Chris@76 40 - takes off url encoding (%20, etc.) from the array or string var.
Chris@76 41 - importantly, does it to keys too!
Chris@76 42 - calls itself recursively if there are any sub arrays.
Chris@76 43
Chris@76 44 array unescapestring__recursive(array var)
Chris@76 45 - unescapes, recursively, from the array or string var.
Chris@76 46 - effects both keys and values of arrays.
Chris@76 47 - calls itself recursively to handle arrays of arrays.
Chris@76 48
Chris@76 49 array stripslashes__recursive(array var)
Chris@76 50 - removes slashes, recursively, from the array or string var.
Chris@76 51 - effects both keys and values of arrays.
Chris@76 52 - calls itself recursively to handle arrays of arrays.
Chris@76 53
Chris@76 54 array htmltrim__recursive(array var)
Chris@76 55 - trims a string or an the var array using html characters as well.
Chris@76 56 - does not effect keys, only values.
Chris@76 57 - may call itself recursively if needed.
Chris@76 58
Chris@76 59 string cleanXml(string var)
Chris@76 60 - removes invalid XML characters to assure the input string being
Chris@76 61 parsed properly.
Chris@76 62
Chris@76 63 string ob_sessrewrite(string buffer)
Chris@76 64 - rewrites the URLs outputted to have the session ID, if the user
Chris@76 65 is not accepting cookies and is using a standard web browser.
Chris@76 66 - handles rewriting URLs for the queryless URLs option.
Chris@76 67 - can be turned off entirely by setting $scripturl to an empty
Chris@76 68 string, ''. (it wouldn't work well like that anyway.)
Chris@76 69 - because of bugs in certain builds of PHP, does not function in
Chris@76 70 versions lower than 4.3.0 - please upgrade if this hurts you.
Chris@76 71 */
Chris@76 72
Chris@76 73 // Clean the request variables - add html entities to GET and slashes if magic_quotes_gpc is Off.
Chris@76 74 function cleanRequest()
Chris@76 75 {
Chris@76 76 global $board, $topic, $boardurl, $scripturl, $modSettings, $smcFunc;
Chris@76 77
Chris@76 78 // Makes it easier to refer to things this way.
Chris@76 79 $scripturl = $boardurl . '/index.php';
Chris@76 80
Chris@76 81 // What function to use to reverse magic quotes - if sybase is on we assume that the database sensibly has the right unescape function!
Chris@76 82 $removeMagicQuoteFunction = @ini_get('magic_quotes_sybase') || strtolower(@ini_get('magic_quotes_sybase')) == 'on' ? 'unescapestring__recursive' : 'stripslashes__recursive';
Chris@76 83
Chris@76 84 // Save some memory.. (since we don't use these anyway.)
Chris@76 85 unset($GLOBALS['HTTP_POST_VARS'], $GLOBALS['HTTP_POST_VARS']);
Chris@76 86 unset($GLOBALS['HTTP_POST_FILES'], $GLOBALS['HTTP_POST_FILES']);
Chris@76 87
Chris@76 88 // These keys shouldn't be set...ever.
Chris@76 89 if (isset($_REQUEST['GLOBALS']) || isset($_COOKIE['GLOBALS']))
Chris@76 90 die('Invalid request variable.');
Chris@76 91
Chris@76 92 // Same goes for numeric keys.
Chris@76 93 foreach (array_merge(array_keys($_POST), array_keys($_GET), array_keys($_FILES)) as $key)
Chris@76 94 if (is_numeric($key))
Chris@76 95 die('Numeric request keys are invalid.');
Chris@76 96
Chris@76 97 // Numeric keys in cookies are less of a problem. Just unset those.
Chris@76 98 foreach ($_COOKIE as $key => $value)
Chris@76 99 if (is_numeric($key))
Chris@76 100 unset($_COOKIE[$key]);
Chris@76 101
Chris@76 102 // Get the correct query string. It may be in an environment variable...
Chris@76 103 if (!isset($_SERVER['QUERY_STRING']))
Chris@76 104 $_SERVER['QUERY_STRING'] = getenv('QUERY_STRING');
Chris@76 105
Chris@76 106 // It seems that sticking a URL after the query string is mighty common, well, it's evil - don't.
Chris@76 107 if (strpos($_SERVER['QUERY_STRING'], 'http') === 0)
Chris@76 108 {
Chris@76 109 header('HTTP/1.1 400 Bad Request');
Chris@76 110 die;
Chris@76 111 }
Chris@76 112
Chris@76 113 // Are we going to need to parse the ; out?
Chris@76 114 if ((strpos(@ini_get('arg_separator.input'), ';') === false || @version_compare(PHP_VERSION, '4.2.0') == -1) && !empty($_SERVER['QUERY_STRING']))
Chris@76 115 {
Chris@76 116 // Get rid of the old one! You don't know where it's been!
Chris@76 117 $_GET = array();
Chris@76 118
Chris@76 119 // Was this redirected? If so, get the REDIRECT_QUERY_STRING.
Chris@76 120 // Do not urldecode() the querystring, unless you so much wish to break OpenID implementation. :)
Chris@76 121 $_SERVER['QUERY_STRING'] = substr($_SERVER['QUERY_STRING'], 0, 5) === 'url=/' ? $_SERVER['REDIRECT_QUERY_STRING'] : $_SERVER['QUERY_STRING'];
Chris@76 122
Chris@76 123 // Replace ';' with '&' and '&something&' with '&something=&'. (this is done for compatibility...)
Chris@76 124 // !!! smflib
Chris@76 125 parse_str(preg_replace('/&(\w+)(?=&|$)/', '&$1=', strtr($_SERVER['QUERY_STRING'], array(';?' => '&', ';' => '&', '%00' => '', "\0" => ''))), $_GET);
Chris@76 126
Chris@76 127 // Magic quotes still applies with parse_str - so clean it up.
Chris@76 128 if (function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc() != 0 && empty($modSettings['integrate_magic_quotes']))
Chris@76 129 $_GET = $removeMagicQuoteFunction($_GET);
Chris@76 130 }
Chris@76 131 elseif (strpos(@ini_get('arg_separator.input'), ';') !== false)
Chris@76 132 {
Chris@76 133 if (function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc() != 0 && empty($modSettings['integrate_magic_quotes']))
Chris@76 134 $_GET = $removeMagicQuoteFunction($_GET);
Chris@76 135
Chris@76 136 // Search engines will send action=profile%3Bu=1, which confuses PHP.
Chris@76 137 foreach ($_GET as $k => $v)
Chris@76 138 {
Chris@76 139 if (is_string($v) && strpos($k, ';') !== false)
Chris@76 140 {
Chris@76 141 $temp = explode(';', $v);
Chris@76 142 $_GET[$k] = $temp[0];
Chris@76 143
Chris@76 144 for ($i = 1, $n = count($temp); $i < $n; $i++)
Chris@76 145 {
Chris@76 146 @list ($key, $val) = @explode('=', $temp[$i], 2);
Chris@76 147 if (!isset($_GET[$key]))
Chris@76 148 $_GET[$key] = $val;
Chris@76 149 }
Chris@76 150 }
Chris@76 151
Chris@76 152 // This helps a lot with integration!
Chris@76 153 if (strpos($k, '?') === 0)
Chris@76 154 {
Chris@76 155 $_GET[substr($k, 1)] = $v;
Chris@76 156 unset($_GET[$k]);
Chris@76 157 }
Chris@76 158 }
Chris@76 159 }
Chris@76 160
Chris@76 161 // There's no query string, but there is a URL... try to get the data from there.
Chris@76 162 if (!empty($_SERVER['REQUEST_URI']))
Chris@76 163 {
Chris@76 164 // Remove the .html, assuming there is one.
Chris@76 165 if (substr($_SERVER['REQUEST_URI'], strrpos($_SERVER['REQUEST_URI'], '.'), 4) == '.htm')
Chris@76 166 $request = substr($_SERVER['REQUEST_URI'], 0, strrpos($_SERVER['REQUEST_URI'], '.'));
Chris@76 167 else
Chris@76 168 $request = $_SERVER['REQUEST_URI'];
Chris@76 169
Chris@76 170 // !!! smflib.
Chris@76 171 // Replace 'index.php/a,b,c/d/e,f' with 'a=b,c&d=&e=f' and parse it into $_GET.
Chris@76 172 if (strpos($request, basename($scripturl) . '/') !== false)
Chris@76 173 {
Chris@76 174 parse_str(substr(preg_replace('/&(\w+)(?=&|$)/', '&$1=', strtr(preg_replace('~/([^,/]+),~', '/$1=', substr($request, strpos($request, basename($scripturl)) + strlen(basename($scripturl)))), '/', '&')), 1), $temp);
Chris@76 175 if (function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc() != 0 && empty($modSettings['integrate_magic_quotes']))
Chris@76 176 $temp = $removeMagicQuoteFunction($temp);
Chris@76 177 $_GET += $temp;
Chris@76 178 }
Chris@76 179 }
Chris@76 180
Chris@76 181 // If magic quotes is on we have some work...
Chris@76 182 if (function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc() != 0)
Chris@76 183 {
Chris@76 184 $_ENV = $removeMagicQuoteFunction($_ENV);
Chris@76 185 $_POST = $removeMagicQuoteFunction($_POST);
Chris@76 186 $_COOKIE = $removeMagicQuoteFunction($_COOKIE);
Chris@76 187 foreach ($_FILES as $k => $dummy)
Chris@76 188 if (isset($_FILES[$k]['name']))
Chris@76 189 $_FILES[$k]['name'] = $removeMagicQuoteFunction($_FILES[$k]['name']);
Chris@76 190 }
Chris@76 191
Chris@76 192 // Add entities to GET. This is kinda like the slashes on everything else.
Chris@76 193 $_GET = htmlspecialchars__recursive($_GET);
Chris@76 194
Chris@76 195 // Let's not depend on the ini settings... why even have COOKIE in there, anyway?
Chris@76 196 $_REQUEST = $_POST + $_GET;
Chris@76 197
Chris@76 198 // Make sure $board and $topic are numbers.
Chris@76 199 if (isset($_REQUEST['board']))
Chris@76 200 {
Chris@76 201 // Make sure its a string and not something else like an array
Chris@76 202 $_REQUEST['board'] = (string) $_REQUEST['board'];
Chris@76 203
Chris@76 204 // If there's a slash in it, we've got a start value! (old, compatible links.)
Chris@76 205 if (strpos($_REQUEST['board'], '/') !== false)
Chris@76 206 list ($_REQUEST['board'], $_REQUEST['start']) = explode('/', $_REQUEST['board']);
Chris@76 207 // Same idea, but dots. This is the currently used format - ?board=1.0...
Chris@76 208 elseif (strpos($_REQUEST['board'], '.') !== false)
Chris@76 209 list ($_REQUEST['board'], $_REQUEST['start']) = explode('.', $_REQUEST['board']);
Chris@76 210 // Now make absolutely sure it's a number.
Chris@76 211 $board = (int) $_REQUEST['board'];
Chris@76 212 $_REQUEST['start'] = isset($_REQUEST['start']) ? (int) $_REQUEST['start'] : 0;
Chris@76 213
Chris@76 214 // This is for "Who's Online" because it might come via POST - and it should be an int here.
Chris@76 215 $_GET['board'] = $board;
Chris@76 216 }
Chris@76 217 // Well, $board is going to be a number no matter what.
Chris@76 218 else
Chris@76 219 $board = 0;
Chris@76 220
Chris@76 221 // If there's a threadid, it's probably an old YaBB SE link. Flow with it.
Chris@76 222 if (isset($_REQUEST['threadid']) && !isset($_REQUEST['topic']))
Chris@76 223 $_REQUEST['topic'] = $_REQUEST['threadid'];
Chris@76 224
Chris@76 225 // We've got topic!
Chris@76 226 if (isset($_REQUEST['topic']))
Chris@76 227 {
Chris@76 228 // Make sure its a string and not something else like an array
Chris@76 229 $_REQUEST['topic'] = (string) $_REQUEST['topic'];
Chris@76 230
Chris@76 231 // Slash means old, beta style, formatting. That's okay though, the link should still work.
Chris@76 232 if (strpos($_REQUEST['topic'], '/') !== false)
Chris@76 233 list ($_REQUEST['topic'], $_REQUEST['start']) = explode('/', $_REQUEST['topic']);
Chris@76 234 // Dots are useful and fun ;). This is ?topic=1.15.
Chris@76 235 elseif (strpos($_REQUEST['topic'], '.') !== false)
Chris@76 236 list ($_REQUEST['topic'], $_REQUEST['start']) = explode('.', $_REQUEST['topic']);
Chris@76 237
Chris@76 238 $topic = (int) $_REQUEST['topic'];
Chris@76 239
Chris@76 240 // Now make sure the online log gets the right number.
Chris@76 241 $_GET['topic'] = $topic;
Chris@76 242 }
Chris@76 243 else
Chris@76 244 $topic = 0;
Chris@76 245
Chris@76 246 // There should be a $_REQUEST['start'], some at least. If you need to default to other than 0, use $_GET['start'].
Chris@76 247 if (empty($_REQUEST['start']) || $_REQUEST['start'] < 0 || (int) $_REQUEST['start'] > 2147473647)
Chris@76 248 $_REQUEST['start'] = 0;
Chris@76 249
Chris@76 250 // The action needs to be a string and not an array or anything else
Chris@76 251 if (isset($_REQUEST['action']))
Chris@76 252 $_REQUEST['action'] = (string) $_REQUEST['action'];
Chris@76 253 if (isset($_GET['action']))
Chris@76 254 $_GET['action'] = (string) $_GET['action'];
Chris@76 255
Chris@76 256 // Make sure we have a valid REMOTE_ADDR.
Chris@76 257 if (!isset($_SERVER['REMOTE_ADDR']))
Chris@76 258 {
Chris@76 259 $_SERVER['REMOTE_ADDR'] = '';
Chris@76 260 // A new magic variable to indicate we think this is command line.
Chris@76 261 $_SERVER['is_cli'] = true;
Chris@76 262 }
Chris@76 263 elseif (preg_match('~^((([1]?\d)?\d|2[0-4]\d|25[0-5])\.){3}(([1]?\d)?\d|2[0-4]\d|25[0-5])$~', $_SERVER['REMOTE_ADDR']) === 0)
Chris@76 264 $_SERVER['REMOTE_ADDR'] = 'unknown';
Chris@76 265
Chris@76 266 // Try to calculate their most likely IP for those people behind proxies (And the like).
Chris@76 267 $_SERVER['BAN_CHECK_IP'] = $_SERVER['REMOTE_ADDR'];
Chris@76 268
Chris@76 269 // Find the user's IP address. (but don't let it give you 'unknown'!)
Chris@76 270 if (!empty($_SERVER['HTTP_X_FORWARDED_FOR']) && !empty($_SERVER['HTTP_CLIENT_IP']) && (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['HTTP_CLIENT_IP']) == 0 || preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['REMOTE_ADDR']) != 0))
Chris@76 271 {
Chris@76 272 // We have both forwarded for AND client IP... check the first forwarded for as the block - only switch if it's better that way.
Chris@76 273 if (strtok($_SERVER['HTTP_X_FORWARDED_FOR'], '.') != strtok($_SERVER['HTTP_CLIENT_IP'], '.') && '.' . strtok($_SERVER['HTTP_X_FORWARDED_FOR'], '.') == strrchr($_SERVER['HTTP_CLIENT_IP'], '.') && (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['HTTP_X_FORWARDED_FOR']) == 0 || preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['REMOTE_ADDR']) != 0))
Chris@76 274 $_SERVER['BAN_CHECK_IP'] = implode('.', array_reverse(explode('.', $_SERVER['HTTP_CLIENT_IP'])));
Chris@76 275 else
Chris@76 276 $_SERVER['BAN_CHECK_IP'] = $_SERVER['HTTP_CLIENT_IP'];
Chris@76 277 }
Chris@76 278 if (!empty($_SERVER['HTTP_CLIENT_IP']) && (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['HTTP_CLIENT_IP']) == 0 || preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['REMOTE_ADDR']) != 0))
Chris@76 279 {
Chris@76 280 // Since they are in different blocks, it's probably reversed.
Chris@76 281 if (strtok($_SERVER['REMOTE_ADDR'], '.') != strtok($_SERVER['HTTP_CLIENT_IP'], '.'))
Chris@76 282 $_SERVER['BAN_CHECK_IP'] = implode('.', array_reverse(explode('.', $_SERVER['HTTP_CLIENT_IP'])));
Chris@76 283 else
Chris@76 284 $_SERVER['BAN_CHECK_IP'] = $_SERVER['HTTP_CLIENT_IP'];
Chris@76 285 }
Chris@76 286 elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
Chris@76 287 {
Chris@76 288 // If there are commas, get the last one.. probably.
Chris@76 289 if (strpos($_SERVER['HTTP_X_FORWARDED_FOR'], ',') !== false)
Chris@76 290 {
Chris@76 291 $ips = array_reverse(explode(', ', $_SERVER['HTTP_X_FORWARDED_FOR']));
Chris@76 292
Chris@76 293 // Go through each IP...
Chris@76 294 foreach ($ips as $i => $ip)
Chris@76 295 {
Chris@76 296 // Make sure it's in a valid range...
Chris@76 297 if (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $ip) != 0 && preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['REMOTE_ADDR']) == 0)
Chris@76 298 continue;
Chris@76 299
Chris@76 300 // Otherwise, we've got an IP!
Chris@76 301 $_SERVER['BAN_CHECK_IP'] = trim($ip);
Chris@76 302 break;
Chris@76 303 }
Chris@76 304 }
Chris@76 305 // Otherwise just use the only one.
Chris@76 306 elseif (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['HTTP_X_FORWARDED_FOR']) == 0 || preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['REMOTE_ADDR']) != 0)
Chris@76 307 $_SERVER['BAN_CHECK_IP'] = $_SERVER['HTTP_X_FORWARDED_FOR'];
Chris@76 308 }
Chris@76 309
Chris@76 310 // Make sure we know the URL of the current request.
Chris@76 311 if (empty($_SERVER['REQUEST_URI']))
Chris@76 312 $_SERVER['REQUEST_URL'] = $scripturl . (!empty($_SERVER['QUERY_STRING']) ? '?' . $_SERVER['QUERY_STRING'] : '');
Chris@76 313 elseif (preg_match('~^([^/]+//[^/]+)~', $scripturl, $match) == 1)
Chris@76 314 $_SERVER['REQUEST_URL'] = $match[1] . $_SERVER['REQUEST_URI'];
Chris@76 315 else
Chris@76 316 $_SERVER['REQUEST_URL'] = $_SERVER['REQUEST_URI'];
Chris@76 317
Chris@76 318 // And make sure HTTP_USER_AGENT is set.
Chris@76 319 $_SERVER['HTTP_USER_AGENT'] = isset($_SERVER['HTTP_USER_AGENT']) ? htmlspecialchars($smcFunc['db_unescape_string']($_SERVER['HTTP_USER_AGENT']), ENT_QUOTES) : '';
Chris@76 320
Chris@76 321 // Some final checking.
Chris@76 322 if (preg_match('~^((([1]?\d)?\d|2[0-4]\d|25[0-5])\.){3}(([1]?\d)?\d|2[0-4]\d|25[0-5])$~', $_SERVER['BAN_CHECK_IP']) === 0)
Chris@76 323 $_SERVER['BAN_CHECK_IP'] = '';
Chris@76 324 if ($_SERVER['REMOTE_ADDR'] == 'unknown')
Chris@76 325 $_SERVER['REMOTE_ADDR'] = '';
Chris@76 326 }
Chris@76 327
Chris@76 328 // Adds slashes to the array/variable. Uses two underscores to guard against overloading.
Chris@76 329 function escapestring__recursive($var)
Chris@76 330 {
Chris@76 331 global $smcFunc;
Chris@76 332
Chris@76 333 if (!is_array($var))
Chris@76 334 return $smcFunc['db_escape_string']($var);
Chris@76 335
Chris@76 336 // Reindex the array with slashes.
Chris@76 337 $new_var = array();
Chris@76 338
Chris@76 339 // Add slashes to every element, even the indexes!
Chris@76 340 foreach ($var as $k => $v)
Chris@76 341 $new_var[$smcFunc['db_escape_string']($k)] = escapestring__recursive($v);
Chris@76 342
Chris@76 343 return $new_var;
Chris@76 344 }
Chris@76 345
Chris@76 346 // Adds html entities to the array/variable. Uses two underscores to guard against overloading.
Chris@76 347 function htmlspecialchars__recursive($var, $level = 0)
Chris@76 348 {
Chris@76 349 global $smcFunc;
Chris@76 350
Chris@76 351 if (!is_array($var))
Chris@76 352 return isset($smcFunc['htmlspecialchars']) ? $smcFunc['htmlspecialchars']($var, ENT_QUOTES) : htmlspecialchars($var, ENT_QUOTES);
Chris@76 353
Chris@76 354 // Add the htmlspecialchars to every element.
Chris@76 355 foreach ($var as $k => $v)
Chris@76 356 $var[$k] = $level > 25 ? null : htmlspecialchars__recursive($v, $level + 1);
Chris@76 357
Chris@76 358 return $var;
Chris@76 359 }
Chris@76 360
Chris@76 361 // Removes url stuff from the array/variable. Uses two underscores to guard against overloading.
Chris@76 362 function urldecode__recursive($var, $level = 0)
Chris@76 363 {
Chris@76 364 if (!is_array($var))
Chris@76 365 return urldecode($var);
Chris@76 366
Chris@76 367 // Reindex the array...
Chris@76 368 $new_var = array();
Chris@76 369
Chris@76 370 // Add the htmlspecialchars to every element.
Chris@76 371 foreach ($var as $k => $v)
Chris@76 372 $new_var[urldecode($k)] = $level > 25 ? null : urldecode__recursive($v, $level + 1);
Chris@76 373
Chris@76 374 return $new_var;
Chris@76 375 }
Chris@76 376 // Unescapes any array or variable. Two underscores for the normal reason.
Chris@76 377 function unescapestring__recursive($var)
Chris@76 378 {
Chris@76 379 global $smcFunc;
Chris@76 380
Chris@76 381 if (!is_array($var))
Chris@76 382 return $smcFunc['db_unescape_string']($var);
Chris@76 383
Chris@76 384 // Reindex the array without slashes, this time.
Chris@76 385 $new_var = array();
Chris@76 386
Chris@76 387 // Strip the slashes from every element.
Chris@76 388 foreach ($var as $k => $v)
Chris@76 389 $new_var[$smcFunc['db_unescape_string']($k)] = unescapestring__recursive($v);
Chris@76 390
Chris@76 391 return $new_var;
Chris@76 392 }
Chris@76 393
Chris@76 394 // Remove slashes recursively...
Chris@76 395 function stripslashes__recursive($var, $level = 0)
Chris@76 396 {
Chris@76 397 if (!is_array($var))
Chris@76 398 return stripslashes($var);
Chris@76 399
Chris@76 400 // Reindex the array without slashes, this time.
Chris@76 401 $new_var = array();
Chris@76 402
Chris@76 403 // Strip the slashes from every element.
Chris@76 404 foreach ($var as $k => $v)
Chris@76 405 $new_var[stripslashes($k)] = $level > 25 ? null : stripslashes__recursive($v, $level + 1);
Chris@76 406
Chris@76 407 return $new_var;
Chris@76 408 }
Chris@76 409
Chris@76 410 // Trim a string including the HTML space, character 160.
Chris@76 411 function htmltrim__recursive($var, $level = 0)
Chris@76 412 {
Chris@76 413 global $smcFunc;
Chris@76 414
Chris@76 415 // Remove spaces (32), tabs (9), returns (13, 10, and 11), nulls (0), and hard spaces. (160)
Chris@76 416 if (!is_array($var))
Chris@76 417 return isset($smcFunc) ? $smcFunc['htmltrim']($var) : trim($var, ' ' . "\t\n\r\x0B" . '\0' . "\xA0");
Chris@76 418
Chris@76 419 // Go through all the elements and remove the whitespace.
Chris@76 420 foreach ($var as $k => $v)
Chris@76 421 $var[$k] = $level > 25 ? null : htmltrim__recursive($v, $level + 1);
Chris@76 422
Chris@76 423 return $var;
Chris@76 424 }
Chris@76 425
Chris@76 426 // Clean up the XML to make sure it doesn't contain invalid characters.
Chris@76 427 function cleanXml($string)
Chris@76 428 {
Chris@76 429 global $context;
Chris@76 430
Chris@76 431 // http://www.w3.org/TR/2000/REC-xml-20001006#NT-Char
Chris@76 432 return preg_replace('~[\x00-\x08\x0B\x0C\x0E-\x19' . ($context['utf8'] ? (@version_compare(PHP_VERSION, '4.3.3') != -1 ? '\x{FFFE}\x{FFFF}' : "\xED\xA0\x80-\xED\xBF\xBF\xEF\xBF\xBE\xEF\xBF\xBF") : '') . ']~' . ($context['utf8'] ? 'u' : ''), '', $string);
Chris@76 433 }
Chris@76 434
Chris@76 435 function JavaScriptEscape($string)
Chris@76 436 {
Chris@76 437 global $scripturl;
Chris@76 438
Chris@76 439 return '\'' . strtr($string, array(
Chris@76 440 "\r" => '',
Chris@76 441 "\n" => '\\n',
Chris@76 442 "\t" => '\\t',
Chris@76 443 '\\' => '\\\\',
Chris@76 444 '\'' => '\\\'',
Chris@76 445 '</' => '<\' + \'/',
Chris@76 446 'script' => 'scri\'+\'pt',
Chris@76 447 '<a href' => '<a hr\'+\'ef',
Chris@76 448 $scripturl => $scripturl . '\'+\'',
Chris@76 449 )) . '\'';
Chris@76 450 }
Chris@76 451
Chris@76 452 // Rewrite URLs to include the session ID.
Chris@76 453 function ob_sessrewrite($buffer)
Chris@76 454 {
Chris@76 455 global $scripturl, $modSettings, $user_info, $context;
Chris@76 456
Chris@76 457 // If $scripturl is set to nothing, or the SID is not defined (SSI?) just quit.
Chris@76 458 if ($scripturl == '' || !defined('SID'))
Chris@76 459 return $buffer;
Chris@76 460
Chris@76 461 // Do nothing if the session is cookied, or they are a crawler - guests are caught by redirectexit(). This doesn't work below PHP 4.3.0, because it makes the output buffer bigger.
Chris@76 462 // !!! smflib
Chris@76 463 if (empty($_COOKIE) && SID != '' && empty($context['browser']['possibly_robot']) && @version_compare(PHP_VERSION, '4.3.0') != -1)
Chris@76 464 $buffer = preg_replace('/"' . preg_quote($scripturl, '/') . '(?!\?' . preg_quote(SID, '/') . ')\\??/', '"' . $scripturl . '?' . SID . '&amp;', $buffer);
Chris@76 465 // Debugging templates, are we?
Chris@76 466 elseif (isset($_GET['debug']))
Chris@76 467 $buffer = preg_replace('/(?<!<link rel="canonical" href=)"' . preg_quote($scripturl, '/') . '\\??/', '"' . $scripturl . '?debug;', $buffer);
Chris@76 468
Chris@76 469 // This should work even in 4.2.x, just not CGI without cgi.fix_pathinfo.
Chris@76 470 if (!empty($modSettings['queryless_urls']) && (!$context['server']['is_cgi'] || @ini_get('cgi.fix_pathinfo') == 1 || @get_cfg_var('cgi.fix_pathinfo') == 1) && ($context['server']['is_apache'] || $context['server']['is_lighttpd']))
Chris@76 471 {
Chris@76 472 // Let's do something special for session ids!
Chris@76 473 if (defined('SID') && SID != '')
Chris@76 474 $buffer = preg_replace('/"' . preg_quote($scripturl, '/') . '\?(?:' . SID . '(?:;|&|&amp;))((?:board|topic)=[^#"]+?)(#[^"]*?)?"/e', "'\"' . \$scripturl . '/' . strtr('\$1', '&;=', '//,') . '.html?' . SID . '\$2\"'", $buffer);
Chris@76 475 else
Chris@76 476 $buffer = preg_replace('/"' . preg_quote($scripturl, '/') . '\?((?:board|topic)=[^#"]+?)(#[^"]*?)?"/e', "'\"' . \$scripturl . '/' . strtr('\$1', '&;=', '//,') . '.html\$2\"'", $buffer);
Chris@76 477 }
Chris@76 478
Chris@76 479 // Return the changed buffer.
Chris@76 480 return $buffer;
Chris@76 481 }
Chris@76 482
Chris@76 483 ?>