Lets see if we can get this cookie thing right this time.

[squirrelmail.git] / functions / global.php

diff --git a/functions/global.php b/functions/global.php
index 6b7e39e6390d25ab47efedff9c44e588a314d3da..5221b44ec909ea1bee7f608472e917b200a94474 100644 (file)
--- a/functions/global.php
+++ b/functions/global.php
@@ -13,6 +13,12 @@
  * $Id$
  */
 
+/* If magic_quotes_runtime is on, SquirrelMail breaks in new and creative ways.
+ * Force magic_quotes_runtime off.
+ * chilts@birdbrained.org - I put it here in the hopes that all SM code includes this.
+ * If there's a better place, please let me know.
+ */
+ini_set('magic_quotes_runtime','0');
 
 /* convert old-style superglobals to current method
  * this is executed if you are running PHP 4.0.x.
@@ -20,7 +26,7 @@
  * and redirect.php. Patch submitted by Ray Black.
  */ 
 
-if ( (float)substr(PHP_VERSION,0,3) < 4.1 ) {
+if ( !check_php_version(4,1) ) {
   global $_COOKIE, $_ENV, $_FILES, $_GET, $_POST, $_SERVER, $_SESSION;
   global $HTTP_COOKIE_VARS, $HTTP_ENV_VARS, $HTTP_POST_FILES, $HTTP_GET_VARS,
          $HTTP_POST_VARS, $HTTP_SERVER_VARS, $HTTP_SESSION_VARS;
@@ -45,41 +51,65 @@ if (get_magic_quotes_gpc()) {
    This fixes hand crafted url XXS expoits for any
    page that uses PHP_SELF as the FORM action */
 
-strip_tags($_SERVER['PHP_SELF']);
+$_SERVER['PHP_SELF'] = strip_tags($_SERVER['PHP_SELF']);
+
+/* returns true if current php version is at mimimum a.b.c */
+function check_php_version ($a = '0', $b = '0', $c = '0')             
+{
+    global $SQ_PHP_VERSION;
 
+    if(!isset($SQ_PHP_VERSION))
+        $SQ_PHP_VERSION = substr( str_pad( preg_replace('/\D/','', PHP_VERSION), 3, '0'), 0, 3);
+
+    return $SQ_PHP_VERSION >= ($a.$b.$c);
+}
+
+/* recursively strip slashes from the values of an array */
 function sqstripslashes(&$array) {
-    foreach ($array as $index=>$value) {
-        if (is_array($array["$index"])) {
-            sqstripslashes($array["$index"]);
-        }
-        else {
-            $array["$index"] = stripslashes($value);
+    if(count($array) > 0) {
+        foreach ($array as $index=>$value) {
+            if (is_array($array[$index])) {
+                sqstripslashes($array[$index]);
+            }
+            else {
+                $array[$index] = stripslashes($value);
+            }
         }
     }
 }
 
 function sqsession_register ($var, $name) {
-    if ( (float)substr(PHP_VERSION,0,3) < 4.1 ) {
+
+    sqsession_is_active();
+
+    if ( !check_php_version(4,1) ) {
         global $HTTP_SESSION_VARS;
-        $HTTP_SESSION_VARS["$name"] = $var;
+        $HTTP_SESSION_VARS[$name] = $var;
     }
     else {
         $_SESSION["$name"] = $var; 
     }
+    session_register("$name");
 }
+
 function sqsession_unregister ($name) {
-    if ( (float)substr(PHP_VERSION,0,3) < 4.1 ) {
+
+    sqsession_is_active();
+
+    if ( !check_php_version(4,1) ) {
         global $HTTP_SESSION_VARS;
-        unset($HTTP_SESSION_VARS["$name"]);
+        unset($HTTP_SESSION_VARS[$name]);
     }
     else {
-        unset($_SESSION["$name"]);
+        unset($_SESSION[$name]);
     }
+    session_unregister("$name");
 }
+
 function sqsession_is_registered ($name) {
     $test_name = &$name;
     $result = false;
-    if ( (float)substr(PHP_VERSION,0,3) < 4.1 ) {
+    if ( !check_php_version(4,1) ) {
         global $HTTP_SESSION_VARS;
         if (isset($HTTP_SESSION_VARS[$test_name])) {
             $result = true;
@@ -99,7 +129,7 @@ function sqsession_is_registered ($name) {
  *  (in that order) and register it as a global var.
  */
 function sqextractGlobalVar ($name) {
-    if ( (float)substr(PHP_VERSION,0,3) < 4.1 ) {
+    if ( !check_php_version(4,1) ) {
         global $_SESSION, $_GET, $_POST;
     }
     global  $$name;
@@ -115,29 +145,51 @@ function sqextractGlobalVar ($name) {
 }
 
 function sqsession_destroy() {
-    global $base_uri;
 
-    /* start session to be able to destroy it later */
-    session_start();   
+    /*
+     * php.net says we can kill the cookie by setting just the name:
+     * http://www.php.net/manual/en/function.setcookie.php
+     * maybe this will help fix the session merging again.
+     *
+     * Changed the theory on this to kill the cookies first starting
+     * a new session will provide a new session for all instances of
+     * the browser, we don't want that, as that is what is causing the
+     * merging of sessions.
+     */
+
+    global $base_uri;
 
-    if ( (float)substr(PHP_VERSION , 0 , 3) < 4.1) {
-        global $HTTP_SESSION_VARS;
-        $HTTP_SESSION_VARS = array();
-    }
-    else {             
-        $_SESSION = array();
+    if (isset($_COOKIE[session_name()])) setcookie(session_name(), '', time() - 5, $base_uri);
+    if (isset($_COOKIE['username'])) setcookie('username','',time() - 5,$base_uri);
+    if (isset($_COOKIE['key'])) setcookie('key','',time() - 5,$base_uri);
+
+    $sessid = session_id();
+    if (!empty( $sessid )) {
+        if ( !check_php_version(4,1) ) {
+            global $HTTP_SESSION_VARS;
+            $HTTP_SESSION_VARS = array();
+        } else {
+            $_SESSION = array();
+        }
+        @session_destroy;
     }
 
-    /*
-     * now reset cookies to 5 seconds ago to delete from browser
-     */
+}
+
+/*
+ * Function to verify a session has been started.  If it hasn't
+ * start a session up.  php.net doesn't tell you that $_SESSION
+ * (even though autoglobal), is not created unless a session is
+ * started, unlike $_POST, $_GET and such
+ */
 
-    @session_destroy();
-    $cookie_params = session_get_cookie_params();      
-    setcookie(session_name(), '', time() - 5, $cookie_params['path'], 
-        $cookie_params['domain']);
-    setcookie('username', '', time() - 5, $base_uri);
-    setcookie('key', '', time() - 5 , $base_uri);
+function sqsession_is_active() {
+
+    $sessid = session_id();
+    if ( empty( $sessid ) ) {
+        session_start();
+    }
 }
 
+
 ?>