* It also has some session register functions that work across various
* php versions.
*
- * @copyright © 1999-2007 The SquirrelMail Project Team
+ * @copyright 1999-2009 The SquirrelMail Project Team
* @license http://opensource.org/licenses/gpl-license.php GNU Public License
* @version $Id$
* @package squirrelmail
*/
/**
+ * These constants are used in the function sqgetGlobalVar(). See
+ * sqgetGlobalVar() for a description of what they mean.
+ *
+ * @since 1.4.0
*/
define('SQ_INORDER',0);
define('SQ_GET',1);
unset($_SESSION[$name]);
- session_unregister("$name");
+ // starts throwing warnings in PHP 5.3.0 and is
+ // removed in PHP 6 and is redundant anyway
+ //session_unregister("$name");
}
/**
/**
- * Search for the var $name in $_SESSION, $_POST, $_GET, $_COOKIE, or $_SERVER
- * and set it in provided var.
+ * Search for the variable $name in one or more of the global variables
+ * $_SESSION, $_POST, $_GET, $_COOKIE, and $_SERVER, and set the value of it in
+ * the variable $vaule.
*
- * If $search is not provided, or if it is SQ_INORDER, it will search $_SESSION,
- * then $_POST, then $_GET. If $search is SQ_FORM it will search $_POST and
- * $_GET. Otherwise, use one of the defined constants to look for a var in one
- * place specifically.
+ * $search must be one of the defined constants below. The default is
+ * SQ_INORDER. Both SQ_INORDER and SQ_FORM stops on the first match.
*
- * Note: $search is an int value equal to one of the constants defined above.
+ * SQ_INORDER searches $_SESSION, then $_POST, and then $_GET.
+ * SQ_FORM searches $_POST and then $_GET.
+ * SQ_COOKIE searches $_COOKIE only.
+ * SQ_GET searches $_GET only.
+ * SQ_POST searches $_POST only.
+ * SQ_SERVER searches $_SERVER only.
+ * SQ_SESSION searches $_SESSION only.
*
* Example:
- * sqgetGlobalVar('username',$username,SQ_SESSION);
- * // No quotes around last param, it's a constant - not a string!
+ * sqgetGlobalVar('username', $username, SQ_SESSION);
+ * // No quotes around the last parameter, it's a constant - not a string!
*
* @param string name the name of the var to search
* @param mixed value the variable to return
*
* @return bool whether variable is found.
*/
-function sqgetGlobalVar($name, &$value, $search = SQ_INORDER, $default = NULL, $typecast = false) {
-
- $result = false;
+function sqgetGlobalVar($name, &$value, $search = SQ_INORDER, $default = NULL, $typecast = FALSE) {
+ // The return value defaults to FALSE, i.e. the variable wasn't found.
+ $result = FALSE;
+ // Search the global variables to find a match.
switch ($search) {
- /* we want the default case to be first here,
- so that if a valid value isn't specified,
- all three arrays will be searched. */
- default:
- case SQ_INORDER: // check session, post, get
- case SQ_SESSION:
- if( isset($_SESSION[$name]) ) {
- $value = $_SESSION[$name];
- $result = TRUE;
- break;
- } elseif ( $search == SQ_SESSION ) {
- break;
- }
- case SQ_FORM: // check post, get
- case SQ_POST:
- if( isset($_POST[$name]) ) {
- $value = $_POST[$name];
- $result = TRUE;
- break;
- } elseif ( $search == SQ_POST ) {
- break;
- }
- case SQ_GET:
- if ( isset($_GET[$name]) ) {
- $value = $_GET[$name];
- $result = TRUE;
+ default:
+ // The default needs to be first here so SQ_INORDER will be used if
+ // $search isn't a valid constant.
+ case SQ_INORDER:
+ // Search $_SESSION, then $_POST, and then $_GET. Stop on the first
+ // match.
+ case SQ_SESSION:
+ if (isset($_SESSION[$name])) {
+ // If a match is found, set the specified variable to the found
+ // value, indicate a match, and stop the search.
+ $value = $_SESSION[$name];
+ $result = TRUE;
+ break;
+ } elseif ($search == SQ_SESSION) {
+ // Only stop the search if SQ_SESSION is set. SQ_INORDER will
+ // continue with the next clause.
+ break;
+ }
+ case SQ_FORM:
+ // Search $_POST and then $_GET. Stop on the first match.
+ case SQ_POST:
+ if (isset($_POST[$name])) {
+ // If a match is found, set the specified variable to the found
+ // value, indicate a match, and stop the search.
+ $value = $_POST[$name];
+ $result = TRUE;
+ break;
+ } elseif ($search == SQ_POST) {
+ // Only stop the search if SQ_POST is set. SQ_INORDER and
+ // SQ_FORM will continue with the next clause.
+ break;
+ }
+ case SQ_GET:
+ if (isset($_GET[$name])) {
+ // If a match is found, set the specified variable to the found
+ // value, indicate a match, and stop the search.
+ $value = $_GET[$name];
+ $result = TRUE;
+ break;
+ }
+ // Stop the search regardless of if SQ_INORDER, SQ_FORM, or SQ_GET
+ // is set. All three of them ends here.
break;
- }
- /* NO IF HERE. FOR SQ_INORDER CASE, EXIT after GET */
- break;
- case SQ_COOKIE:
- if ( isset($_COOKIE[$name]) ) {
- $value = $_COOKIE[$name];
- $result = TRUE;
+ case SQ_COOKIE:
+ if (isset($_COOKIE[$name])) {
+ // If a match is found, set the specified variable to the found
+ // value, indicate a match, and stop the search.
+ $value = $_COOKIE[$name];
+ $result = TRUE;
+ break;
+ }
+ // Stop the search.
break;
- }
- break;
- case SQ_SERVER:
- if ( isset($_SERVER[$name]) ) {
- $value = $_SERVER[$name];
- $result = TRUE;
+ case SQ_SERVER:
+ if (isset($_SERVER[$name])) {
+ // If a match is found, set the specified variable to the found
+ // value, indicate a match, and stop the search.
+ $value = $_SERVER[$name];
+ $result = TRUE;
+ break;
+ }
+ // Stop the search.
break;
- }
- break;
}
+
if ($result && $typecast) {
+ // Only typecast if it's requested and a match is found. The default is
+ // not to typecast, which will happen if a valid constant isn't
+ // specified.
switch ($typecast) {
- case SQ_TYPE_INT: $value = (int) $value; break;
- case SQ_TYPE_STRING: $value = (string) $value; break;
- case SQ_TYPE_BOOL: $value = (bool) $value; break;
- default: break;
+ case SQ_TYPE_INT:
+ // Typecast the value and stop.
+ $value = (int) $value;
+ break;
+ case SQ_TYPE_STRING:
+ // Typecast the value and stop.
+ $value = (string) $value;
+ break;
+ case SQ_TYPE_BOOL:
+ // Typecast the value and stop.
+ $value = (bool) $value;
+ break;
+ case SQ_TYPE_BIGINT:
+ // Typecast the value and stop.
+ $value = (preg_match('/^[0-9]+$/', $value) ? $value : '0');
+ break;
+ default:
+ // The default is to do nothing.
+ break;
}
} else if (!$result && !is_null($default)) {
+ // If no match is found and a default value is specified, set it.
$value = $default;
}
+
+ // Return if a match was found or not.
return $result;
}
global $base_uri, $_COOKIE, $_SESSION;
- if (isset($_COOKIE[session_name()]) && session_name()) sqsetcookie(session_name(), $_COOKIE[session_name()], 1, $base_uri);
+ if (isset($_COOKIE[session_name()]) && session_name()) {
+ sqsetcookie(session_name(), $_COOKIE[session_name()], 1, $base_uri);
+
+ /*
+ * Make sure to kill /src and /src/ cookies, just in case there are
+ * some left-over or malicious ones set in user's browser.
+ * NB: Note that an attacker could try to plant a cookie for one
+ * of the /plugins/* directories. Such cookies can block
+ * access to certain plugin pages, but they do not influence
+ * or fixate the $base_uri cookie, so we don't worry about
+ * trying to delete all of them here.
+ */
+ sqsetcookie(session_name(), $_COOKIE[session_name()], 1, $base_uri . 'src');
+ sqsetcookie(session_name(), $_COOKIE[session_name()], 1, $base_uri . 'src/');
+ }
+
if (isset($_COOKIE['key']) && $_COOKIE['key']) sqsetcookie('key','SQMTRASH',1,$base_uri);
+ /* Make sure new session id is generated on subsequent session_start() */
+ unset($_COOKIE[session_name()]);
+ unset($_GET[session_name()]);
+ unset($_POST[session_name()]);
+
$sessid = session_id();
if (!empty( $sessid )) {
$_SESSION = array();
* session_regenerate_id replacement for PHP < 4.3.2
*
* This code is borrowed from Gallery, session.php version 1.53.2.1
+FIXME: I saw this code on php.net (in the manual); that's where it comes from originally, but I don't think we need it - it's just redundant to all the hard work we already did seeding the random number generator IMO. I think we can just call to GenerateRandomString() and dump the rest.
*/
if (!function_exists('session_regenerate_id')) {
* @since 1.2.3
*/
function php_self () {
- if ( sqgetGlobalVar('REQUEST_URI', $req_uri, SQ_SERVER) && !empty($req_uri) ) {
- return $req_uri;
- }
+ // PHP 4.4.4 apparently gives the wrong value here - missing the query string
+ // this code is commented out in the 1.4.x code, so we'll do the same here
+ //if ( sqgetGlobalVar('REQUEST_URI', $req_uri, SQ_SERVER) && !empty($req_uri) ) {
+ // return $req_uri;
+ //}
if ( sqgetGlobalVar('PHP_SELF', $php_self, SQ_SERVER) && !empty($php_self) ) {
}
+/**
+ * Endeavor to detect what user and group PHP is currently
+ * running as. Probably only works in non-Windows environments.
+ *
+ * @return mixed Boolean FALSE is returned if something went wrong,
+ * otherwise an array is returned with the following
+ * elements:
+ * uid The current process' UID (integer)
+ * euid The current process' effective UID (integer)
+ * gid The current process' GID (integer)
+ * egid The current process' effective GID (integer)
+ * name The current process' name/handle (string)
+ * ename The current process' effective name/handle (string)
+ * group The current process' group name (string)
+ * egroup The current process' effective group name (string)
+ * Note that some of these elements may have empty
+ * values, especially if they could not be determined.
+ *
+ * @since 1.5.2
+ *
+ */
+function get_process_owner_info()
+{
+ if (!function_exists('posix_getuid'))
+ return FALSE;
+
+ $process_info['uid'] = posix_getuid();
+ $process_info['euid'] = posix_geteuid();
+ $process_info['gid'] = posix_getgid();
+ $process_info['egid'] = posix_getegid();
+
+ $user_info = posix_getpwuid($process_info['uid']);
+ $euser_info = posix_getpwuid($process_info['euid']);
+ $group_info = posix_getgrgid($process_info['gid']);
+ $egroup_info = posix_getgrgid($process_info['egid']);
+
+ $process_info['name'] = $user_info['name'];
+ $process_info['ename'] = $euser_info['name'];
+ $process_info['group'] = $user_info['name'];
+ $process_info['egroup'] = $euser_info['name'];
+
+ return $process_info;
+}
+
+