use our existing random seeder function

[squirrelmail.git] / functions / global.php

diff --git a/functions/global.php b/functions/global.php
index c3b611299e4a6d5a3c47e0483b531e298b4e452f..a5c24d021c82bbd04c9ef189a74d37a314e20ce0 100644 (file)
--- a/functions/global.php
+++ b/functions/global.php
@@ -348,6 +348,69 @@ function sqgetGlobalVar($name, &$value, $search = SQ_INORDER, $default = NULL, $
     return $result;
 }
 
+/**
+ * Get an immutable copy of a configuration variable if SquirrelMail
+ * is in "secured configuration" mode.  This guarantees the caller 
+ * gets a copy of the requested value as it is set in the main 
+ * application configuration (including config_local overrides), and 
+ * not what it might be after possibly having been modified by some 
+ * other code (usually a plugin overriding configuration values for 
+ * one reason or another).
+ *
+ * WARNING: Please use this function as little as possible, because 
+ * every time it is called, it forcibly reloads the main configuration
+ * file(s).
+ *
+ * Caller beware that this function will do nothing if SquirrelMail
+ * is not in "secured configuration" mode per the $secured_config 
+ * setting.
+ *
+ * @param string $var_name The name of the desired variable
+ *
+ * @return mixed The desired value
+ *
+ * @since 1.5.2
+ *
+ */
+function get_secured_config_value($var_name) {
+
+    static $return_values = array();
+
+    // if we can avoid it, return values that have 
+    // already been retrieved (so we don't have to
+    // include the config file yet again)
+    //
+    if (isset($return_values[$var_name])) {
+        return $return_values[$var_name];
+    }
+
+
+    // load site configuration
+    //
+    require(SM_PATH . 'config/config.php');
+
+    // load local configuration overrides
+    //
+    if (file_exists(SM_PATH . 'config/config_local.php')) {
+        require(SM_PATH . 'config/config_local.php');
+    }
+
+    // if SM isn't in "secured configuration" mode,
+    // just return the desired value from the global scope
+    // 
+    if (!$secured_config) {
+        global $$var_name;
+        $return_values[$var_name] = $$var_name;
+        return $$var_name;
+    }
+
+    // else we return what we got from the config file
+    //
+    $return_values[$var_name] = $$var_name;
+    return $$var_name;
+
+}
+
 /**
  * Deletes an existing session, more advanced than the standard PHP
  * session_destroy(), it explicitly deletes the cookies and global vars.
@@ -416,12 +479,19 @@ function sqsession_start() {
     // was: @session_start();
     $session_id = session_id();
 
-    // session_starts sets the sessionid cookie buth without the httponly var
+    // session_starts sets the sessionid cookie but without the httponly var
     // setting the cookie again sets the httponly cookie attribute
-    sqsetcookie(session_name(),$session_id,false,$base_uri);
+    //
+    // need to check if headers have been sent, since sqsession_is_active()
+    // has become just a passthru to this function, so the sqsetcookie()
+    // below is called every time, even after headers have already been sent
+    //
+    if (!headers_sent())
+       sqsetcookie(session_name(),$session_id,false,$base_uri);
 }
 
 
+
 /**
  * Set a cookie
  * @param string  $sName     The name of the cookie.
@@ -474,13 +544,9 @@ function sqsetcookie($sName,$sValue='deleted',$iExpire=0,$sPath="",$sDomain="",$
  * This code is borrowed from Gallery, session.php version 1.53.2.1
  */
 if (!function_exists('session_regenerate_id')) {
-    function make_seed() {
-        list($usec, $sec) = explode(' ', microtime());
-        return (float)$sec + ((float)$usec * 100000);
-    }
 
     function php_combined_lcg() {
-        mt_srand(make_seed());
+        sq_mt_randomize();
         $tv = gettimeofday();
         $lcg['s1'] = $tv['sec'] ^ (~$tv['usec']);
         $lcg['s2'] = mt_rand();