Clarify and simplify how session is destroyed and separate from session restore mechanism
[squirrelmail.git] / include / init.php
CommitLineData
202bcbcc 1<?php
2
3/**
4 * init.php -- initialisation file
5 *
6 * File should be loaded in every file in src/ or plugins that occupate an entire frame
7 *
8 * @copyright &copy; 2006 The SquirrelMail Project Team
9 * @license http://opensource.org/licenses/gpl-license.php GNU Public License
10 * @version $Id$
11 * @package squirrelmail
12 */
13
202bcbcc 14/**
15 * This is a development version so in order to track programmer mistakes we
16 * set the error reporting to E_ALL
17 */
202bcbcc 18error_reporting(E_ALL);
19
20
21/**
6a2a6e44 22 * If register_globals are on, unregister globals.
a3b99374 23 * Second test covers boolean set as string (php_value register_globals off).
6a2a6e44 24 */
55dd9abf 25if ((bool) ini_get('register_globals') &&
a3b99374 26 strtolower(ini_get('register_globals'))!='off') {
6a2a6e44 27 /**
55dd9abf 28 * Remove all globals that are not reserved by PHP
29 * 'value' and 'key' are used by foreach. Don't unset them inside foreach.
6a2a6e44 30 */
55dd9abf 31 foreach ($GLOBALS as $key => $value) {
32 switch($key) {
33 case 'HTTP_POST_VARS':
34 case '_POST':
35 case 'HTTP_GET_VARS':
36 case '_GET':
37 case 'HTTP_COOKIE_VARS':
38 case '_COOKIE':
39 case 'HTTP_SERVER_VARS':
40 case '_SERVER':
41 case 'HTTP_ENV_VARS':
42 case '_ENV':
43 case 'HTTP_POST_FILES':
44 case '_FILES':
45 case '_REQUEST':
46 case 'HTTP_SESSION_VARS':
47 case '_SESSION':
48 case 'GLOBALS':
49 case 'key':
50 case 'value':
51 break;
55dd9abf 52 default:
53 unset($GLOBALS[$key]);
54 }
6a2a6e44 55 }
55dd9abf 56 // Unset variables used in foreach
57 unset($GLOBALS['key']);
58 unset($GLOBALS['value']);
6a2a6e44 59}
60
71efd1ed 61/**
d849b570 62 * Used as a dummy value, e.g., for passing as an empty
e39d00e9 63 * hook argument (where the value is passed by reference,
64 * and therefore NULL itself is not acceptable).
d849b570 65 */
086ad092 66global $null;
d849b570 67$null = NULL;
68
69/**
71efd1ed 70 * [#1518885] session.use_cookies = off breaks SquirrelMail
71 *
086ad092 72 * When session cookies are not used, all http redirects, meta refreshes,
73 * src/download.php and javascript URLs are broken. Setting must be set
71efd1ed 74 * before session is started.
75 */
76if (!(bool)ini_get('session.use_cookies') ||
77 ini_get('session.use_cookies') == 'off') {
78 ini_set('session.use_cookies','1');
79}
6a2a6e44 80
81/**
202bcbcc 82 * calculate SM_PATH and calculate the base_uri
83 * assumptions made: init.php is only called from plugins or from the src dir.
84 * files in the plugin directory may not be part of a subdirectory called "src"
85 *
86 */
87if (isset($_SERVER['SCRIPT_NAME'])) {
88 $a = explode('/',$_SERVER['SCRIPT_NAME']);
89} elseif (isset($HTTP_SERVER_VARS['SCRIPT_NAME'])) {
b0829edf 90 $a = explode('/',$HTTP_SERVER_VARS['SCRIPT_NAME']);
91} else {
92 $error = 'Unable to detect script environment. '
93 .'Please test your PHP settings and send PHP core config, $_SERVER '
94 .'and $HTTP_SERVER_VARS to SquirrelMail developers.';
95 die($error);
202bcbcc 96}
97$sSM_PATH = '';
98for($i = count($a) -2;$i > -1; --$i) {
99 $sSM_PATH .= '../';
100 if ($a[$i] === 'src' || $a[$i] === 'plugins') {
101 break;
102 }
103}
104
105$base_uri = implode('/',array_slice($a,0,$i)). '/';
106
202bcbcc 107define('SM_PATH',$sSM_PATH);
6a2a6e44 108define('SM_BASE_URI', $base_uri);
202bcbcc 109/**
110 * global var $bInit is used to check if initialisation took place.
111 * At this moment it's a workarounf for the include of addrbook_search_html
112 * inside compose.php. If we found a better way then remove this. Do only use
113 * this var if you know for sure a page can be called stand alone and be included
114 * in another file.
115 */
116$bInit = true;
117
8e1e2794 118/**
119 * This theme as a failsafe if no themes were found, or if we error
120 * out before anything could be initialised.
121 */
122$color = array();
123$color[0] = '#DCDCDC'; /* light gray TitleBar */
124$color[1] = '#800000'; /* red */
125$color[2] = '#CC0000'; /* light red Warning/Error Messages */
126$color[3] = '#A0B8C8'; /* green-blue Left Bar Background */
127$color[4] = '#FFFFFF'; /* white Normal Background */
128$color[5] = '#FFFFCC'; /* light yellow Table Headers */
129$color[6] = '#000000'; /* black Text on left bar */
130$color[7] = '#0000CC'; /* blue Links */
131$color[8] = '#000000'; /* black Normal text */
132$color[9] = '#ABABAB'; /* mid-gray Darker version of #0 */
133$color[10] = '#666666'; /* dark gray Darker version of #9 */
134$color[11] = '#770000'; /* dark red Special Folders color */
135$color[12] = '#EDEDED';
136$color[13] = '#800000'; /* (dark red) Color for quoted text -- > 1 quote */
137$color[14] = '#ff0000'; /* (red) Color for quoted text -- >> 2 or more */
138$color[15] = '#002266'; /* (dark blue) Unselectable folders */
139$color[16] = '#ff9933'; /* (orange) Highlight color */
140
202bcbcc 141require(SM_PATH . 'functions/global.php');
4ffcf13a 142require(SM_PATH . 'functions/strings.php');
918fcc1d 143require(SM_PATH . 'functions/arrays.php');
5e68a08e 144
145/* load default configuration */
146require(SM_PATH . 'config/config_default.php');
147/* reset arrays in default configuration */
148$ldap_server = array();
149$plugins = array();
150$fontsets = array();
5e68a08e 151$aTemplateSet = array();
28294310 152$aTemplateSet[0]['ID'] = 'default';
153$aTemplateSet[0]['NAME'] = 'Default';
01fd1d1a 154
5e68a08e 155/* load site configuration */
202bcbcc 156require(SM_PATH . 'config/config.php');
5e68a08e 157/* load local configuration overrides */
158if (file_exists(SM_PATH . 'config/config_local.php')) {
159 require(SM_PATH . 'config/config_local.php');
160}
161
202bcbcc 162require(SM_PATH . 'functions/plugin.php');
163require(SM_PATH . 'include/constants.php');
164require(SM_PATH . 'include/languages.php');
42b5e8aa 165require(SM_PATH . 'class/template/Template.class.php');
5ab684a5 166require(SM_PATH . 'class/error.class.php');
202bcbcc 167
168/**
169 * If magic_quotes_runtime is on, SquirrelMail breaks in new and creative ways.
170 * Force magic_quotes_runtime off.
171 * tassium@squirrelmail.org - I put it here in the hopes that all SM code includes this.
172 * If there's a better place, please let me know.
173 */
174ini_set('magic_quotes_runtime','0');
175
176
177/* if running with magic_quotes_gpc then strip the slashes
178 from POST and GET global arrays */
179if (get_magic_quotes_gpc()) {
180 sqstripslashes($_GET);
181 sqstripslashes($_POST);
182}
183
202bcbcc 184
185/* strip any tags added to the url from PHP_SELF.
186This fixes hand crafted url XXS expoits for any
187 page that uses PHP_SELF as the FORM action */
188$_SERVER['PHP_SELF'] = strip_tags($_SERVER['PHP_SELF']);
189
190$PHP_SELF = php_self();
191
192/**
193 * Initialize the session
194 */
195
e8c4e350 196/** set the name of the session cookie */
197if (!isset($session_name) || !$session_name) {
198 $session_name = 'SQMSESSID';
199}
200
201/**
202 * if session.auto_start is On then close the session
1d537493 203 */
204$sSessionAutostartName = session_name();
bf6140e3 205$sCookiePath = null;
1d537493 206if ((isset($sSessionAutostartName) || $sSessionAutostartName == '') &&
207 $sSessionAutostartName !== $session_name) {
208 $sCookiePath = ini_get('session.cookie_path');
209 $sCookieDomain = ini_get('session.cookie_domain');
e8c4e350 210 // reset the cookie
1d537493 211 setcookie($sSessionAutostartName,'',time() - 604800,$sCookiePath,$sCookieDomain);
e8c4e350 212 @session_destroy();
213 session_write_close();
1d537493 214}
e8c4e350 215
202bcbcc 216/**
217 * includes from classes stored in the session
218 */
219require(SM_PATH . 'class/mime.class.php');
220
202bcbcc 221ini_set('session.name' , $session_name);
222session_set_cookie_params (0, $base_uri);
223sqsession_is_active();
224
202bcbcc 225/**
5aed95be 226 * SquirrelMail internal version number -- DO NOT CHANGE
227 * $sm_internal_version = array (release, major, minor)
228 */
a895042a 229$SQM_INTERNAL_VERSION = explode('.', SM_VERSION, 3);
b37e457f 230$SQM_INTERNAL_VERSION[2] = intval($SQM_INTERNAL_VERSION[2]);
5aed95be 231
93d67e0d 232
6d5775db 233/* load prefs system; even when user not logged in, should be OK to do this here */
234require(SM_PATH . 'functions/prefs.php');
235
236$prefs_backend = do_hook('prefs_backend', $null);
237if (isset($prefs_backend) && !empty($prefs_backend) && file_exists(SM_PATH . $prefs_backend)) {
238 require(SM_PATH . $prefs_backend);
239} elseif (isset($prefs_dsn) && !empty($prefs_dsn)) {
240 require(SM_PATH . 'functions/db_prefs.php');
241} else {
242 require(SM_PATH . 'functions/file_prefs.php');
243}
244
245
086ad092 246/* if plugins are disabled only for one user and
93d67e0d 247 * the current user is NOT that user, turn them
248 * back on
249 */
250sqgetGlobalVar('username',$username,SQ_SESSION);
251if ($disable_plugins && !empty($disable_plugins_user)
252 && $username != $disable_plugins_user) {
253 $disable_plugins = false;
254}
255
256/* remove all plugins if they are disabled */
257if ($disable_plugins) {
258 $plugins = array();
259}
260
261
5aed95be 262/**
263 * Include Compatibility plugin if available.
264 */
93d67e0d 265if (!$disable_plugins && file_exists(SM_PATH . 'plugins/compatibility/functions.php'))
5aed95be 266 include_once(SM_PATH . 'plugins/compatibility/functions.php');
267
268/**
269 * MAIN PLUGIN LOADING CODE HERE
086ad092 270 * On init, we no longer need to load all plugin setup files.
5aed95be 271 * Now, we load the statically generated hook registrations here
272 * and let the hook calls include only the plugins needed.
273 */
274$squirrelmail_plugin_hooks = array();
93d67e0d 275if (!$disable_plugins && file_exists(SM_PATH . 'config/plugin_hooks.php')) {
5aed95be 276 require(SM_PATH . 'config/plugin_hooks.php');
277}
278
279/**
280 * allow plugins to override main configuration; hook is placed
281 * here to allow plugins to use session information to do their work
282 */
d849b570 283do_hook('config_override', $null);
5aed95be 284
285/**
3464e1f4 286 * DISABLED.
202bcbcc 287 * Remove globalized session data in rg=on setups
086ad092 288 *
3464e1f4 289 * Code can be utilized when session is started, but data is not loaded.
086ad092 290 * We have already loaded configuration and other important vars. Can't
3464e1f4 291 * clean session globals here.
292if ((bool) @ini_get('register_globals') &&
293 strtolower(ini_get('register_globals'))!='off') {
202bcbcc 294 foreach ($_SESSION as $key => $value) {
295 unset($GLOBALS[$key]);
296 }
297}
3464e1f4 298*/
6a2a6e44 299
826ddd72 300sqsession_register(SM_BASE_URI,'base_uri');
6a2a6e44 301
202bcbcc 302/**
303 * Retrieve the language cookie
304 */
305if (! sqgetGlobalVar('squirrelmail_language',$squirrelmail_language,SQ_COOKIE)) {
306 $squirrelmail_language = '';
307}
308
bf3abdc3 309
202bcbcc 310/**
9e06a3ea 311 * Do something special for some pages. This is based on the PAGE_NAME constand
312 * set at the top of every page.
202bcbcc 313 */
9e06a3ea 314if ( !defined('PAGE_NAME') ) define('PAGE_NAME', NULL);
315switch (PAGE_NAME) {
086ad092 316 case 'style':
c4e5f61f 317
2b26084f 318 // need to get the right template set up
28294310 319 //
320 sqGetGlobalVar('templateid', $templateid, SQ_GET);
c4e5f61f 321
2b26084f 322 // sanitize just in case...
28294310 323 //
324 $templateid = preg_replace('/(\.\.\/){1,}/', '', $templateid);
325
326 // make sure given template actually is available
327 //
28294310 328 $found_templateset = false;
329 for ($i = 0; $i < count($aTemplateSet); ++$i) {
330 if ($aTemplateSet[$i]['ID'] == $templateid) {
331 $found_templateset = true;
332 break;
333 }
334 }
c4e5f61f 335
be155e14 336// FIXME: do we need/want to check here for actual (physical) presence of template sets?
28294310 337 // selected template not available, fall back to default template
338 //
339 if (!$found_templateset) {
42b5e8aa 340 $sTemplateID = Template::get_default_template_set();
28294310 341 } else {
342 $sTemplateID = $templateid;
c4e5f61f 343 }
344
2b26084f 345 session_write_close();
c4e5f61f 346 break;
347
202bcbcc 348 case 'redirect':
2e616fa4 349 require(SM_PATH . 'functions/auth.php');
202bcbcc 350 //nobreak;
bf3abdc3 351
202bcbcc 352 case 'login':
353 require(SM_PATH . 'functions/display_messages.php' );
354 require(SM_PATH . 'functions/page_header.php');
355 require(SM_PATH . 'functions/html.php');
42b5e8aa 356
357 // reset template file cache
358 //
359 $sTemplateID = Template::get_default_template_set();
360 Template::cache_template_file_hierarchy(TRUE);
361
1d537493 362 /**
01fd1d1a 363 * Make sure icon variables are setup for the login page.
364 */
365 $icon_theme = $icon_themes[$icon_theme_def]['PATH'];
366 /*
367 * NOTE: The $icon_theme_path var should contain the path to the icon
368 * theme to use. If the admin has disabled icons, or the user has
369 * set the icon theme to "None," no icons will be used.
370 */
371 $icon_theme_path = (!$use_icons || $icon_theme=='none') ? NULL : ($icon_theme == 'template' ? SM_PATH . Template::calculate_template_images_directory($sTemplateID) : $icon_theme);
372
373 /**
1d537493 374 * cleanup old cookies with a cookie path the same as the standard php.ini
375 * cookie path. All previous SquirrelMail version used the standard php.ini
376 * cookie path for storing the session name. That behaviour changed.
377 */
378 if ($sCookiePath !== SM_BASE_URI) {
379 /**
380 * do not delete the standard sessions with session.name is i.e. PHPSESSID
381 * because they probably belong to other php apps
382 */
383 if (ini_get('session.name') !== $sSessionAutostartName) {
30a428c6 384 // This does not work. Sometimes the cookie with SQSESSID=deleted and path /
385 // is picked up in webmail.php => login will fail
386 //sqsetcookie(ini_get('session.name'),'',0,$sCookiePath);
1d537493 387 }
388 }
202bcbcc 389 break;
390 default:
391 require(SM_PATH . 'functions/display_messages.php' );
392 require(SM_PATH . 'functions/page_header.php');
393 require(SM_PATH . 'functions/html.php');
202bcbcc 394
395
396 /**
397 * Check if we are logged in
398 */
399 require(SM_PATH . 'functions/auth.php');
400
401 if ( !sqsession_is_registered('user_is_logged_in') ) {
402 // First we store some information in the new session to prevent
403 // information-loss.
404 //
405 $session_expired_post = $_POST;
406 $session_expired_location = $PHP_SELF;
407 if (!sqsession_is_registered('session_expired_post')) {
408 sqsession_register($session_expired_post,'session_expired_post');
409 }
410 if (!sqsession_is_registered('session_expired_location')) {
411 sqsession_register($session_expired_location,'session_expired_location');
412 }
413 // signout page will deal with users who aren't logged
414 // in on its own; don't show error here
415 //
9e06a3ea 416 if ( PAGE_NAME == 'signout' ) {
a140422a 417 return;
202bcbcc 418 }
419
8efadc6b 420 /**
421 * Initialize the template object (logout_error uses it)
422 */
8efadc6b 423 /*
086ad092 424 * $sTemplateID is not initialized when a user is not logged in, so we
425 * will use the config file defaults here. If the neccesary variables
28294310 426 * are net set, force a default value.
8efadc6b 427 */
42b5e8aa 428 $sTemplateID = Template::get_default_template_set();
28294310 429 $oTemplate = Template::construct_template($sTemplateID);
8efadc6b 430
202bcbcc 431 set_up_language($squirrelmail_language, true);
432 logout_error( _("You must be logged in to access this page.") );
433 exit;
434 }
435
93d67e0d 436//FIXME: remove next line if the placement of the copy of this line above does not prove to be problematic
202bcbcc 437 sqgetGlobalVar('username',$username,SQ_SESSION);
79524620 438 sqgetGlobalVar('authz',$authz,SQ_SESSION);
202bcbcc 439
440 /**
441 * Setting the prefs backend
442 */
443 sqgetGlobalVar('prefs_cache', $prefs_cache, SQ_SESSION );
444 sqgetGlobalVar('prefs_are_cached', $prefs_are_cached, SQ_SESSION );
445
446 if ( !sqsession_is_registered('prefs_are_cached') ||
447 !isset( $prefs_cache) ||
448 !is_array( $prefs_cache)) {
449 $prefs_are_cached = false;
450 $prefs_cache = false; //array();
451 }
452
202bcbcc 453 /**
454 * initializing user settings
455 */
456 require(SM_PATH . 'include/load_prefs.php');
457
202bcbcc 458// i do not understand the frames language cookie story
459 /**
460 * We'll need this to later have a noframes version
461 *
462 * Check if the user has a language preference, but no cookie.
463 * Send him a cookie with his language preference, if there is
464 * such discrepancy.
465 */
466 $my_language = getPref($data_dir, $username, 'language');
467 if ($my_language != $squirrelmail_language) {
468 sqsetcookie('squirrelmail_language', $my_language, time()+2592000, $base_uri);
469 }
470// /dont understand
471
472 /**
473 * Set up the language.
474 */
475 $err=set_up_language(getPref($data_dir, $username, 'language'));
202bcbcc 476
477 // Japanese translation used without mbstring support
478 if ($err==2) {
479 $sError =
480 "<p>You need to have PHP installed with the multibyte string function \n".
481 "enabled (using configure option --enable-mbstring).</p>\n".
482 "<p>System assumed that you accidently switched to Japanese translation \n".
483 "and reverted your language preference to English.</p>\n".
484 "<p>Please refresh this page in order to use webmail.</p>\n";
485 error_box($sError);
486 }
487
488 $timeZone = getPref($data_dir, $username, 'timezone');
489
490 /* Check to see if we are allowed to set the TZ environment variable.
491 * We are able to do this if ...
492 * safe_mode is disabled OR
493 * safe_mode_allowed_env_vars is empty (you are allowed to set any) OR
494 * safe_mode_allowed_env_vars contains TZ
495 */
496 $tzChangeAllowed = (!ini_get('safe_mode')) ||
497 !strcmp(ini_get('safe_mode_allowed_env_vars'),'') ||
498 preg_match('/^([\w_]+,)*TZ/', ini_get('safe_mode_allowed_env_vars'));
499
500 if ( $timeZone != SMPREF_NONE && ($timeZone != "")
501 && $tzChangeAllowed ) {
502
503 // get time zone key, if strict or custom strict timezones are used
504 if (isset($time_zone_type) &&
505 ($time_zone_type == 1 || $time_zone_type == 3)) {
506 /* load time zone functions */
507 require(SM_PATH . 'include/timezones.php');
508 $realTimeZone = sq_get_tz_key($timeZone);
509 } else {
510 $realTimeZone = $timeZone;
511 }
512
513 // set time zone
514 if ($realTimeZone) {
515 putenv("TZ=".$realTimeZone);
516 }
517 }
867fed37 518
519 /**
520 * php 5.1.0 added time zone functions. Set time zone with them in order
521 * to prevent E_STRICT notices and allow time zone modifications in safe_mode.
522 */
523 if (function_exists('date_default_timezone_set')) {
524 if ($timeZone != SMPREF_NONE && $timeZone != "") {
525 date_default_timezone_set($timeZone);
526 } else {
527 // interface runs on server's time zone. Remove php E_STRICT complains
528 $default_timezone = @date_default_timezone_get();
086ad092 529 date_default_timezone_set($default_timezone);
867fed37 530 }
531 }
202bcbcc 532 break;
533}
534
202bcbcc 535/*
086ad092 536 * $sTemplateID is not initialized when a user is not logged in, so we
537 * will use the config file defaults here. If the neccesary variables
28294310 538 * are not set, force a default value.
086ad092 539 *
540 * If the user is logged in, $sTemplateID will be set in load_prefs.php,
28294310 541 * so we shouldn't change it here.
202bcbcc 542 */
28294310 543if (!isset($sTemplateID)) {
42b5e8aa 544 $sTemplateID = Template::get_default_template_set();
28294310 545 $icon_theme_path = !$use_icons ? NULL : Template::calculate_template_images_directory($sTemplateID);
3aa46abc 546}
be155e14 547
548// template object may have already been constructed in load_prefs.php
549//
550if (empty($oTemplate)) {
551 $oTemplate = Template::construct_template($sTemplateID);
552}
202bcbcc 553
7aae649d 554// We want some variables to always be available to the template
e39d00e9 555$oTemplate->assign('javascript_on',
556 (sqGetGlobalVar('user_is_logged_in', $user_is_logged_in, SQ_SESSION)
557 ? checkForJavascript() : 0));
fe8103c2 558$oTemplate->assign('base_uri', sqm_baseuri());
457e8593 559$always_include = array('sTemplateID', 'icon_theme_path');
7aae649d 560foreach ($always_include as $var) {
561 $oTemplate->assign($var, (isset($$var) ? $$var : NULL));
562}
563
202bcbcc 564/**
565 * Initialize our custom error handler object
566 */
202bcbcc 567$oErrorHandler = new ErrorHandler($oTemplate,'error_message.tpl');
568
569/**
570 * Activate custom error handling
571 */
572if (version_compare(PHP_VERSION, "4.3.0", ">=")) {
573 $oldErrorHandler = set_error_handler(array($oErrorHandler, 'SquirrelMailErrorhandler'));
574} else {
575 $oldErrorHandler = set_error_handler('SquirrelMailErrorhandler');
576}
577
578/**
579 * Javascript support detection function
580 * @param boolean $reset recheck javascript support if set to true.
867fed37 581 * @return integer SMPREF_JS_ON or SMPREF_JS_OFF ({@see include/constants.php})
202bcbcc 582 * @since 1.5.1
583 */
202bcbcc 584function checkForJavascript($reset = FALSE) {
585 global $data_dir, $username, $javascript_on, $javascript_setting;
586
587 if ( !$reset && sqGetGlobalVar('javascript_on', $javascript_on, SQ_SESSION) )
588 return $javascript_on;
589
e39d00e9 590 $user_is_logged_in = FALSE;
bf3abdc3 591 if ( $reset || !isset($javascript_setting) )
202bcbcc 592 $javascript_setting = getPref($data_dir, $username, 'javascript_setting', SMPREF_JS_AUTODETECT);
593
594 if ( !sqGetGlobalVar('new_js_autodetect_results', $js_autodetect_results) &&
595 !sqGetGlobalVar('js_autodetect_results', $js_autodetect_results) )
596 $js_autodetect_results = SMPREF_JS_OFF;
597
598 if ( $javascript_setting == SMPREF_JS_AUTODETECT )
599 $javascript_on = $js_autodetect_results;
600 else
601 $javascript_on = $javascript_setting;
602
603 sqsession_register($javascript_on, 'javascript_on');
604 return $javascript_on;
605}
606
607function sqm_baseuri() {
608 global $base_uri;
609 return $base_uri;
8e1e2794 610}