Implement checks for correct PHP variables_order and gpc_order settings

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@12363 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/src/configtest.php b/src/configtest.php
index 8e6311adfef11690bacafa308f18e8eeb8ad36c6..e57374d17b77a7f9cc0ad8825dfdcaaf426f05bd 100644 (file)
--- a/src/configtest.php
+++ b/src/configtest.php
@@ -170,7 +170,6 @@ if (! $allow_remote_configtest) {
         do_err('Enable "Allow remote configtest" option in squirrelmail configuration in order to use this script.');
     }
 }
-/* checking PHP specs */
 
 echo "<p><table>\n<tr><td>SquirrelMail version:</td><td><b>" . SM_VERSION . "</b></td></tr>\n" .
     '<tr><td>Config file version:</td><td><b>' . $config_version . "</b></td></tr>\n" .
@@ -183,6 +182,9 @@ if ($config_version!='1.5.0') {
     do_err('Configuration file version does not match required version. Please update your configuration file.');
 }
 
+
+/* checking PHP specs */
+
 echo "Checking PHP configuration...<br />\n";
 
 if(!check_php_version(4,1,0)) {
@@ -190,11 +192,54 @@ if(!check_php_version(4,1,0)) {
 }
 
 echo $IND . 'PHP version ' . PHP_VERSION . ' OK. (You have: ' . phpversion() . ". Minimum: 4.1.0)<br />\n";
-/* test for boolean false and any string that is not equal to 'off' */
+
+/* register_globals check: test for boolean false and any string that is not equal to 'off' */
+
 if ((bool) ini_get('register_globals') && 
     strtolower(ini_get('register_globals'))!='off') {
     do_err('You have register_globals turned on.  This is not an error, but it CAN be a security hazard.  Consider turning register_globals off.', false);
 }
+
+
+/* variables_order check */
+
+// FIXME(?): Hmm, how do we distinguish between when an ini setting is
+//           not available (ini_set() returns empty string) and when 
+//           the administrator set the value to an empty string?  The
+//           latter is sure to be highly rare, so for now, just assume
+//           that empty value means the setting isn't even available
+//           (could also check PHP version when this setting was implemented)
+$variables_order = ini_get('variables_order');
+if (!empty($variables_order) && (strpos($variables_order, 'G') === FALSE
+ || strpos($variables_order, 'P') === FALSE
+ || strpos($variables_order, 'C') === FALSE
+ || strpos($variables_order, 'S') === FALSE)) {
+    do_err('Your variables_order setting is insufficient for SquirrelMail to function.  It needs at least "GPCS", but you have it set to "' . $variables_order . '"', true);
+} else {
+    echo $IND . "variables_order OK: $variables_order.<br />\n";
+}
+
+
+/* gpc_order check */
+
+// FIXME(?): Hmm, how do we distinguish between when an ini setting is
+//           not available (ini_set() returns empty string) and when 
+//           the administrator set the value to an empty string?  The
+//           latter is sure to be highly rare, so for now, just assume
+//           that empty value means the setting isn't even available
+//           (could also check PHP version when this setting was implemented)
+$gpc_order = ini_get('gpc_order');
+if (!empty($gpc_order) && (strpos($gpc_order, 'G') === FALSE
+ || strpos($gpc_order, 'P') === FALSE
+ || strpos($gpc_order, 'C') === FALSE)) {
+    do_err('Your gpc_order setting is insufficient for SquirrelMail to function.  It needs to be set to "GPC", but you have it set to "' . $gpc_order . '"', true);
+} else {
+    echo $IND . "gpc_order OK: $gpc_order.<br />\n";
+}
+
+
+/* check PHP extensions */
+
 $php_exts = array('session','pcre');
 $diff = array_diff($php_exts, get_loaded_extensions());
 if(count($diff)) {