functions/global.php

   1 <?php
   2
   3 /**
   4  * global.php
   5  *
   6  * Copyright (c) 1999-2004 The SquirrelMail Project Team
   7  * Licensed under the GNU GPL. For full terms see the file COPYING.
   8  *
   9  * This includes code to update < 4.1.0 globals to the newer format
  10  * It also has some session register functions that work across various
  11  * php versions.
  12  *
  13  * @version $Id$
  14  * @package squirrelmail
  15  */
  16
  17 /** Bring in the config file. */
  18 require_once(SM_PATH . 'config/config.php');
  19
  20 /** set the name of the session cookie */
  21 if(isset($session_name) && $session_name) {
  22     ini_set('session.name' , $session_name);
  23 } else {
  24     ini_set('session.name' , 'SQMSESSID');
  25 }
  26
  27 /**
  28  * If magic_quotes_runtime is on, SquirrelMail breaks in new and creative ways.
  29  * Force magic_quotes_runtime off.
  30  * tassium@squirrelmail.org - I put it here in the hopes that all SM code includes this.
  31  * If there's a better place, please let me know.
  32  */
  33 ini_set('magic_quotes_runtime','0');
  34
  35 /* Since we decided all IMAP servers must implement the UID command as defined in
  36  * the IMAP RFC, we force $uid_support to be on.
  37  */
  38
  39 global $uid_support;
  40 $uid_support = true;
  41
  42 sqsession_is_active();
  43
  44 /* if running with magic_quotes_gpc then strip the slashes
  45    from POST and GET global arrays */
  46
  47 if (get_magic_quotes_gpc()) {
  48     sqstripslashes($_GET);
  49     sqstripslashes($_POST);
  50 }
  51
  52 /* strip any tags added to the url from PHP_SELF.
  53    This fixes hand crafted url XXS expoits for any
  54    page that uses PHP_SELF as the FORM action */
  55
  56 $_SERVER['PHP_SELF'] = strip_tags($_SERVER['PHP_SELF']);
  57
  58 /**
  59  * returns true if current php version is at mimimum a.b.c
  60  *
  61  * Called: check_php_version(4,1)
  62  * @param int a major version number
  63  * @param int b minor version number
  64  * @param int c release number
  65  * @return bool
  66  */
  67 function check_php_version ($a = '0', $b = '0', $c = '0')
  68 {
  69     return version_compare ( PHP_VERSION, "$a.$b.$c", 'ge' );
  70 }
  71
  72 /**
  73  * returns true if the current internal SM version is at minimum a.b.c
  74  * These are plain integer comparisons, as our internal version is
  75  * constructed by us, as an array of 3 ints.
  76  *
  77  * Called: check_sm_version(1,3,3)
  78  * @param int a major version number
  79  * @param int b minor version number
  80  * @param int c release number
  81  * @return bool
  82  */
  83 function check_sm_version($a = 0, $b = 0, $c = 0)
  84 {
  85     global $SQM_INTERNAL_VERSION;
  86     if ( !isset($SQM_INTERNAL_VERSION) ||
  87          $SQM_INTERNAL_VERSION[0] < $a ||
  88          ( $SQM_INTERNAL_VERSION[0] == $a &&
  89            $SQM_INTERNAL_VERSION[1] < $b) ||
  90          ( $SQM_INTERNAL_VERSION[0] == $a &&
  91            $SQM_INTERNAL_VERSION[1] == $b &&
  92            $SQM_INTERNAL_VERSION[2] < $c ) ) {
  93         return FALSE;
  94     }
  95     return TRUE;
  96 }
  97
  98
  99 /**
 100  * Recursively strip slashes from the values of an array.
 101  * @param array array the array to strip, passed by reference
 102  * @return void
 103  */
 104 function sqstripslashes(&$array) {
 105     if(count($array) > 0) {
 106         foreach ($array as $index=>$value) {
 107             if (is_array($array[$index])) {
 108                 sqstripslashes($array[$index]);
 109             }
 110             else {
 111                 $array[$index] = stripslashes($value);
 112             }
 113         }
 114     }
 115 }
 116
 117 /**
 118  * Add a variable to the session.
 119  * @param mixed $var the variable to register
 120  * @param string $name the name to refer to this variable
 121  * @return void
 122  */
 123 function sqsession_register ($var, $name) {
 124
 125     sqsession_is_active();
 126
 127     $_SESSION["$name"] = $var;
 128
 129     session_register("$name");
 130 }
 131
 132 /**
 133  * Delete a variable from the session.
 134  * @param string $name the name of the var to delete
 135  * @return void
 136  */
 137 function sqsession_unregister ($name) {
 138
 139     sqsession_is_active();
 140
 141     unset($_SESSION[$name]);
 142
 143     session_unregister("$name");
 144 }
 145
 146 /**
 147  * Checks to see if a variable has already been registered
 148  * in the session.
 149  * @param string $name the name of the var to check
 150  * @return bool whether the var has been registered
 151  */
 152 function sqsession_is_registered ($name) {
 153     $test_name = &$name;
 154     $result = false;
 155
 156     if (isset($_SESSION[$test_name])) {
 157         $result = true;
 158     }
 159
 160     return $result;
 161 }
 162
 163
 164 define('SQ_INORDER',0);
 165 define('SQ_GET',1);
 166 define('SQ_POST',2);
 167 define('SQ_SESSION',3);
 168 define('SQ_COOKIE',4);
 169 define('SQ_SERVER',5);
 170 define('SQ_FORM',6);
 171
 172 /**
 173  * Search for the var $name in $_SESSION, $_POST, $_GET,
 174  * $_COOKIE, or $_SERVER and set it in provided var.
 175  *
 176  * If $search is not provided,  or == SQ_INORDER, it will search
 177  * $_SESSION, then $_POST, then $_GET. Otherwise,
 178  * use one of the defined constants to look for
 179  * a var in one place specifically.
 180  *
 181  * Note: $search is an int value equal to one of the
 182  * constants defined above.
 183  *
 184  * example:
 185  *    sqgetGlobalVar('username',$username,SQ_SESSION);
 186  *  -- no quotes around last param!
 187  *
 188  * @param string name the name of the var to search
 189  * @param mixed value the variable to return
 190  * @param int search constant defining where to look
 191  * @return bool whether variable is found.
 192  */
 193 function sqgetGlobalVar($name, &$value, $search = SQ_INORDER) {
 194
 195     /* NOTE: DO NOT enclose the constants in the switch
 196        statement with quotes. They are constant values,
 197        enclosing them in quotes will cause them to evaluate
 198        as strings. */
 199     switch ($search) {
 200         /* we want the default case to be first here,
 201            so that if a valid value isn't specified,
 202            all three arrays will be searched. */
 203       default:
 204       case SQ_INORDER: // check session, post, get
 205       case SQ_SESSION:
 206         if( isset($_SESSION[$name]) ) {
 207             $value = $_SESSION[$name];
 208             return TRUE;
 209         } elseif ( $search == SQ_SESSION ) {
 210             break;
 211         }
 212       case SQ_FORM:   // check post, get
 213       case SQ_POST:
 214         if( isset($_POST[$name]) ) {
 215             $value = $_POST[$name];
 216             return TRUE;
 217         } elseif ( $search == SQ_POST ) {
 218           break;
 219         }
 220       case SQ_GET:
 221         if ( isset($_GET[$name]) ) {
 222             $value = $_GET[$name];
 223             return TRUE;
 224         }
 225         /* NO IF HERE. FOR SQ_INORDER CASE, EXIT after GET */
 226         break;
 227       case SQ_COOKIE:
 228         if ( isset($_COOKIE[$name]) ) {
 229             $value = $_COOKIE[$name];
 230             return TRUE;
 231         }
 232         break;
 233       case SQ_SERVER:
 234         if ( isset($_SERVER[$name]) ) {
 235             $value = $_SERVER[$name];
 236             return TRUE;
 237         }
 238         break;
 239     }
 240     return FALSE;
 241 }
 242
 243 /**
 244  * Deletes an existing session, more advanced than the standard PHP
 245  * session_destroy(), it explicitly deletes the cookies and global vars.
 246  */
 247 function sqsession_destroy() {
 248
 249     /*
 250      * php.net says we can kill the cookie by setting just the name:
 251      * http://www.php.net/manual/en/function.setcookie.php
 252      * maybe this will help fix the session merging again.
 253      *
 254      * Changed the theory on this to kill the cookies first starting
 255      * a new session will provide a new session for all instances of
 256      * the browser, we don't want that, as that is what is causing the
 257      * merging of sessions.
 258      */
 259
 260     global $base_uri;
 261
 262     if (isset($_COOKIE[session_name()])) setcookie(session_name(), '', time() - 5, $base_uri);
 263     if (isset($_COOKIE['username'])) setcookie('username','',time() - 5,$base_uri);
 264     if (isset($_COOKIE['key'])) setcookie('key','',time() - 5,$base_uri);
 265
 266     $sessid = session_id();
 267     if (!empty( $sessid )) {
 268         $_SESSION = array();
 269         @session_destroy();
 270     }
 271
 272 }
 273
 274 /**
 275  * Function to verify a session has been started.  If it hasn't
 276  * start a session up.  php.net doesn't tell you that $_SESSION
 277  * (even though autoglobal), is not created unless a session is
 278  * started, unlike $_POST, $_GET and such
 279  */
 280
 281 function sqsession_is_active() {
 282
 283     $sessid = session_id();
 284     if ( empty( $sessid ) ) {
 285         session_start();
 286     }
 287 }
 288
 289 // vim: et ts=4
 290 ?>