* It also has some session register functions that work across various
* php versions.
*
- * @copyright © 1999-2009 The SquirrelMail Project Team
+ * @copyright 1999-2009 The SquirrelMail Project Team
* @license http://opensource.org/licenses/gpl-license.php GNU Public License
* @version $Id$
* @package squirrelmail
*/
/**
+ * These constants are used in the function sqgetGlobalVar(). See
+ * sqgetGlobalVar() for a description of what they mean.
+ *
+ * @since 1.4.0
*/
define('SQ_INORDER',0);
define('SQ_GET',1);
* executed will be returned.
*
*/
-function sq_call_function_suppress_errors($function, $args=NULL) {
+function sq_call_function_suppress_errors($function, $args=array()) {
global $sm_debug_mode;
$display_errors = ini_get('display_errors');
/**
- * Search for the var $name in $_SESSION, $_POST, $_GET, $_COOKIE, or $_SERVER
- * and set it in provided var.
+ * Search for the variable $name in one or more of the global variables
+ * $_SESSION, $_POST, $_GET, $_COOKIE, and $_SERVER, and set the value of it in
+ * the variable $vaule.
*
- * If $search is not provided, or if it is SQ_INORDER, it will search $_SESSION,
- * then $_POST, then $_GET. If $search is SQ_FORM it will search $_POST and
- * $_GET. Otherwise, use one of the defined constants to look for a var in one
- * place specifically.
+ * $search must be one of the defined constants below. The default is
+ * SQ_INORDER. Both SQ_INORDER and SQ_FORM stops on the first match.
*
- * Note: $search is an int value equal to one of the constants defined above.
+ * SQ_INORDER searches $_SESSION, then $_POST, and then $_GET.
+ * SQ_FORM searches $_POST and then $_GET.
+ * SQ_COOKIE searches $_COOKIE only.
+ * SQ_GET searches $_GET only.
+ * SQ_POST searches $_POST only.
+ * SQ_SERVER searches $_SERVER only.
+ * SQ_SESSION searches $_SESSION only.
*
* Example:
- * sqgetGlobalVar('username',$username,SQ_SESSION);
- * // No quotes around last param, it's a constant - not a string!
+ * sqgetGlobalVar('username', $username, SQ_SESSION);
+ * // No quotes around the last parameter, it's a constant - not a string!
*
* @param string name the name of the var to search
* @param mixed value the variable to return
*
* @return bool whether variable is found.
*/
-function sqgetGlobalVar($name, &$value, $search = SQ_INORDER, $default = NULL, $typecast = false) {
-
- $result = false;
+function sqgetGlobalVar($name, &$value, $search = SQ_INORDER, $default = NULL, $typecast = FALSE) {
+ // The return value defaults to FALSE, i.e. the variable wasn't found.
+ $result = FALSE;
+ // Search the global variables to find a match.
switch ($search) {
- /* we want the default case to be first here,
- so that if a valid value isn't specified,
- all three arrays will be searched. */
- default:
- case SQ_INORDER: // check session, post, get
- case SQ_SESSION:
- if( isset($_SESSION[$name]) ) {
- $value = $_SESSION[$name];
- $result = TRUE;
- break;
- } elseif ( $search == SQ_SESSION ) {
- break;
- }
- case SQ_FORM: // check post, get
- case SQ_POST:
- if( isset($_POST[$name]) ) {
- $value = $_POST[$name];
- $result = TRUE;
- break;
- } elseif ( $search == SQ_POST ) {
- break;
- }
- case SQ_GET:
- if ( isset($_GET[$name]) ) {
- $value = $_GET[$name];
- $result = TRUE;
+ default:
+ // The default needs to be first here so SQ_INORDER will be used if
+ // $search isn't a valid constant.
+ case SQ_INORDER:
+ // Search $_SESSION, then $_POST, and then $_GET. Stop on the first
+ // match.
+ case SQ_SESSION:
+ if (isset($_SESSION[$name])) {
+ // If a match is found, set the specified variable to the found
+ // value, indicate a match, and stop the search.
+ $value = $_SESSION[$name];
+ $result = TRUE;
+ break;
+ } elseif ($search == SQ_SESSION) {
+ // Only stop the search if SQ_SESSION is set. SQ_INORDER will
+ // continue with the next clause.
+ break;
+ }
+ case SQ_FORM:
+ // Search $_POST and then $_GET. Stop on the first match.
+ case SQ_POST:
+ if (isset($_POST[$name])) {
+ // If a match is found, set the specified variable to the found
+ // value, indicate a match, and stop the search.
+ $value = $_POST[$name];
+ $result = TRUE;
+ break;
+ } elseif ($search == SQ_POST) {
+ // Only stop the search if SQ_POST is set. SQ_INORDER and
+ // SQ_FORM will continue with the next clause.
+ break;
+ }
+ case SQ_GET:
+ if (isset($_GET[$name])) {
+ // If a match is found, set the specified variable to the found
+ // value, indicate a match, and stop the search.
+ $value = $_GET[$name];
+ $result = TRUE;
+ break;
+ }
+ // Stop the search regardless of if SQ_INORDER, SQ_FORM, or SQ_GET
+ // is set. All three of them ends here.
break;
- }
- /* NO IF HERE. FOR SQ_INORDER CASE, EXIT after GET */
- break;
- case SQ_COOKIE:
- if ( isset($_COOKIE[$name]) ) {
- $value = $_COOKIE[$name];
- $result = TRUE;
+ case SQ_COOKIE:
+ if (isset($_COOKIE[$name])) {
+ // If a match is found, set the specified variable to the found
+ // value, indicate a match, and stop the search.
+ $value = $_COOKIE[$name];
+ $result = TRUE;
+ break;
+ }
+ // Stop the search.
break;
- }
- break;
- case SQ_SERVER:
- if ( isset($_SERVER[$name]) ) {
- $value = $_SERVER[$name];
- $result = TRUE;
+ case SQ_SERVER:
+ if (isset($_SERVER[$name])) {
+ // If a match is found, set the specified variable to the found
+ // value, indicate a match, and stop the search.
+ $value = $_SERVER[$name];
+ $result = TRUE;
+ break;
+ }
+ // Stop the search.
break;
- }
- break;
}
+
if ($result && $typecast) {
+ // Only typecast if it's requested and a match is found. The default is
+ // not to typecast, which will happen if a valid constant isn't
+ // specified.
switch ($typecast) {
- case SQ_TYPE_INT: $value = (int) $value; break;
- case SQ_TYPE_STRING: $value = (string) $value; break;
- case SQ_TYPE_BOOL: $value = (bool) $value; break;
+ case SQ_TYPE_INT:
+ // Typecast the value and stop.
+ $value = (int) $value;
+ break;
+ case SQ_TYPE_STRING:
+ // Typecast the value and stop.
+ $value = (string) $value;
+ break;
+ case SQ_TYPE_BOOL:
+ // Typecast the value and stop.
+ $value = (bool) $value;
+ break;
case SQ_TYPE_BIGINT:
+ // Typecast the value and stop.
$value = (preg_match('/^[0-9]+$/', $value) ? $value : '0');
break;
- default: break;
+ default:
+ // The default is to do nothing.
+ break;
}
} else if (!$result && !is_null($default)) {
+ // If no match is found and a default value is specified, set it.
$value = $default;
}
+
+ // Return if a match was found or not.
return $result;
}
global $base_uri, $_COOKIE, $_SESSION;
- if (isset($_COOKIE[session_name()]) && session_name()) sqsetcookie(session_name(), $_COOKIE[session_name()], 1, $base_uri);
+ if (isset($_COOKIE[session_name()]) && session_name()) {
+ sqsetcookie(session_name(), $_COOKIE[session_name()], 1, $base_uri);
+
+ /*
+ * Make sure to kill /src and /src/ cookies, just in case there are
+ * some left-over or malicious ones set in user's browser.
+ * NB: Note that an attacker could try to plant a cookie for one
+ * of the /plugins/* directories. Such cookies can block
+ * access to certain plugin pages, but they do not influence
+ * or fixate the $base_uri cookie, so we don't worry about
+ * trying to delete all of them here.
+ */
+ sqsetcookie(session_name(), $_COOKIE[session_name()], 1, $base_uri . 'src');
+ sqsetcookie(session_name(), $_COOKIE[session_name()], 1, $base_uri . 'src/');
+ }
+
if (isset($_COOKIE['key']) && $_COOKIE['key']) sqsetcookie('key','SQMTRASH',1,$base_uri);
+ /* Make sure new session id is generated on subsequent session_start() */
+ unset($_COOKIE[session_name()]);
+ unset($_GET[session_name()]);
+ unset($_POST[session_name()]);
+
$sessid = session_id();
if (!empty( $sessid )) {
$_SESSION = array();
* session_regenerate_id replacement for PHP < 4.3.2
*
* This code is borrowed from Gallery, session.php version 1.53.2.1
+FIXME: I saw this code on php.net (in the manual); that's where it comes from originally, but I don't think we need it - it's just redundant to all the hard work we already did seeding the random number generator IMO. I think we can just call to GenerateRandomString() and dump the rest.
*/
if (!function_exists('session_regenerate_id')) {
* @since 1.2.3
*/
function php_self () {
- // PHP 4.4.4 apparently gives the wrong value here - missing the query string
- // this code is commented out in the 1.4.x code, so we'll do the same here
- //if ( sqgetGlobalVar('REQUEST_URI', $req_uri, SQ_SERVER) && !empty($req_uri) ) {
- // return $req_uri;
- //}
- if ( sqgetGlobalVar('PHP_SELF', $php_self, SQ_SERVER) && !empty($php_self) ) {
+ if (sqgetGlobalVar('PHP_SELF', $php_self, SQ_SERVER)
+ && !empty($php_self)) {
- // need to add query string to end of PHP_SELF to match REQUEST_URI
- //
- if ( sqgetGlobalVar('QUERY_STRING', $query_string, SQ_SERVER) && !empty($query_string) ) {
- $php_self .= '?' . $query_string;
- }
+ // need to add query string to end of PHP_SELF to match REQUEST_URI
+ //
+ if (sqgetGlobalVar('QUERY_STRING', $query_string, SQ_SERVER)
+ && !empty($query_string)) {
+ $php_self .= '?' . $query_string;
+ }
- return $php_self;
+ return $php_self;
+ }
+
+ // some versions of PHP, perhaps specifically in use with lighttpd,
+ // return a blank string for PHP_SELF, so we use REQUEST_URI as a backup:
+ //
+ else if (sqgetGlobalVar('REQUEST_URI', $req_uri, SQ_SERVER)
+ && !empty($req_uri)) {
+
+ // some versions of PHP (such as 4.4.4) don't include the query
+ // string in REQUEST_URI, but most do... here's a fix for the
+ // odd ones out (assuming QUERY_STRING is reliable in those cases)
+ //
+ if (strpos($req_uri, '?') === FALSE
+ && sqgetGlobalVar('QUERY_STRING', $query_string, SQ_SERVER)
+ && !empty($query_string)) {
+
+ $req_uri .= '?' . $query_string;
+ }
+
+ return $req_uri;
}
return '';
projects / squirrelmail.git / blobdiff