X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=include%2Finit.php;h=05d9cbae0e8e4ac7e05b841a6974a48e69be808a;hp=b5fd16445317ac1bf5c5d5134ae9188a66185d53;hb=daf777102978219856d97b6b4e93f8b5815db234;hpb=30a428c6fdfed8389e7bf461faa361eeea149976 diff --git a/include/init.php b/include/init.php index b5fd1644..05d9cbae 100644 --- a/include/init.php +++ b/include/init.php @@ -14,8 +14,17 @@ /** * This is a development version so in order to track programmer mistakes we * set the error reporting to E_ALL +FIXME: disabling this for now, because we now have $sm_debug_mode, but the problem with that is that we don't know what it will be until we have loaded the config file, a good 175 lines below after several important files have been included, etc. For now, we'll trust that developers have turned on E_ALL in php.ini anyway, but this can be uncommented if not. */ -error_reporting(E_ALL); +//error_reporting(E_ALL); + + + +/** + * Make sure we have a page name + * + */ +if ( !defined('PAGE_NAME') ) define('PAGE_NAME', NULL); /** @@ -49,9 +58,6 @@ if ((bool) ini_get('register_globals') && case 'key': case 'value': break; - case 'sInitLocation': - // FIXME: variable must be set only in src/login.php - break; default: unset($GLOBALS[$key]); } @@ -63,7 +69,8 @@ if ((bool) ini_get('register_globals') && /** * Used as a dummy value, e.g., for passing as an empty - * hook argument. + * hook argument (where the value is passed by reference, + * and therefore NULL itself is not acceptable). */ global $null; $null = NULL; @@ -80,6 +87,7 @@ if (!(bool)ini_get('session.use_cookies') || ini_set('session.use_cookies','1'); } + /** * calculate SM_PATH and calculate the base_uri * assumptions made: init.php is only called from plugins or from the src dir. @@ -87,27 +95,29 @@ if (!(bool)ini_get('session.use_cookies') || * */ if (isset($_SERVER['SCRIPT_NAME'])) { - $a = explode('/',$_SERVER['SCRIPT_NAME']); + $a = explode('/', $_SERVER['SCRIPT_NAME']); } elseif (isset($HTTP_SERVER_VARS['SCRIPT_NAME'])) { - $a = explode('/',$HTTP_SERVER_VARS['SCRIPT_NAME']); + $a = explode('/', $HTTP_SERVER_VARS['SCRIPT_NAME']); } else { - $error = 'Unable to detect script environment. ' - .'Please test your PHP settings and send PHP core config, $_SERVER ' - .'and $HTTP_SERVER_VARS to SquirrelMail developers.'; + $error = 'Unable to detect script environment. Please test your PHP ' + . 'settings and send your PHP core configuration, $_SERVER and ' + . '$HTTP_SERVER_VARS contents to the SquirrelMail developers.'; die($error); } $sSM_PATH = ''; -for($i = count($a) -2;$i > -1; --$i) { +for($i = count($a) -2; $i > -1; --$i) { $sSM_PATH .= '../'; if ($a[$i] === 'src' || $a[$i] === 'plugins') { break; } } -$base_uri = implode('/',array_slice($a,0,$i)). '/'; +$base_uri = implode('/', array_slice($a, 0, $i)). '/'; define('SM_PATH',$sSM_PATH); define('SM_BASE_URI', $base_uri); + + /** * global var $bInit is used to check if initialisation took place. * At this moment it's a workarounf for the include of addrbook_search_html @@ -140,7 +150,9 @@ $color[14] = '#ff0000'; /* (red) Color for quoted text -- >> 2 or more $color[15] = '#002266'; /* (dark blue) Unselectable folders */ $color[16] = '#ff9933'; /* (orange) Highlight color */ +require(SM_PATH . 'include/constants.php'); require(SM_PATH . 'functions/global.php'); +require(SM_PATH . 'functions/strings.php'); require(SM_PATH . 'functions/arrays.php'); /* load default configuration */ @@ -160,8 +172,22 @@ if (file_exists(SM_PATH . 'config/config_local.php')) { require(SM_PATH . 'config/config_local.php'); } + +/** + * Set PHP error reporting level based on the SquirrelMail debug mode + */ +$error_level = 0; +if ($sm_debug_mode & SM_DEBUG_MODE_SIMPLE) + $error_level |= E_ERROR; +if ($sm_debug_mode & SM_DEBUG_MODE_MODERATE + || $sm_debug_mode & SM_DEBUG_MODE_ADVANCED) + $error_level |= E_ALL; +if ($sm_debug_mode & SM_DEBUG_MODE_STRICT) + $error_level |= E_STRICT; +error_reporting($error_level); + + require(SM_PATH . 'functions/plugin.php'); -require(SM_PATH . 'include/constants.php'); require(SM_PATH . 'include/languages.php'); require(SM_PATH . 'class/template/Template.class.php'); require(SM_PATH . 'class/error.class.php'); @@ -177,7 +203,7 @@ ini_set('magic_quotes_runtime','0'); /* if running with magic_quotes_gpc then strip the slashes from POST and GET global arrays */ -if (get_magic_quotes_gpc()) { +if (function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc()) { sqstripslashes($_GET); sqstripslashes($_POST); } @@ -200,11 +226,11 @@ if (!isset($session_name) || !$session_name) { } /** - * if session.auto_start is On then close the session + * When session.auto_start is On we want to destroy/close the session */ $sSessionAutostartName = session_name(); -if ((isset($sSessionAutostartName) || $sSessionAutostartName == '') && - $sSessionAutostartName !== $session_name) { +$sCookiePath = null; +if (isset($sSessionAutostartName) && $sSessionAutostartName !== $session_name) { $sCookiePath = ini_get('session.cookie_path'); $sCookieDomain = ini_get('session.cookie_domain'); // reset the cookie @@ -223,15 +249,101 @@ session_set_cookie_params (0, $base_uri); sqsession_is_active(); /** - * SquirrelMail version number -- DO NOT CHANGE + * When on login page, have to reset the user session, making + * sure to save session restore data first */ -$version = '1.5.2 [CVS]'; +if (PAGE_NAME == 'login') { + if (!sqGetGlobalVar('session_expired_post', $sep, SQ_SESSION)) + $sep = ''; + if (!sqGetGlobalVar('session_expired_location', $sel, SQ_SESSION)) + $sel = ''; + sqsession_destroy(); + session_write_close(); + + /** + * in some rare instances, the session seems to stick + * around even after destroying it (!!), so if it does, + * we'll manually flatten the $_SESSION data + */ + if (!empty($_SESSION)) + $_SESSION = array(); + + /** + * Allow administrators to define custom session handlers + * for SquirrelMail without needing to change anything in + * php.ini (application-level). + * + * In config_local.php, admin needs to put: + * + * $custom_session_handlers = array( + * 'my_open_handler', + * 'my_close_handler', + * 'my_read_handler', + * 'my_write_handler', + * 'my_destroy_handler', + * 'my_gc_handler', + * ); + * session_module_name('user'); + * session_set_save_handler( + * $custom_session_handlers[0], + * $custom_session_handlers[1], + * $custom_session_handlers[2], + * $custom_session_handlers[3], + * $custom_session_handlers[4], + * $custom_session_handlers[5] + * ); + * + * We need to replicate that code once here because PHP has + * long had a bug that resets the session handler mechanism + * when the session data is also destroyed. Because of this + * bug, even administrators who define custom session handlers + * via a PHP pre-load defined in php.ini (auto_prepend_file) + * will still need to define the $custom_session_handlers array + * in config_local.php. + */ + global $custom_session_handlers; + if (!empty($custom_session_handlers)) { + $open = $custom_session_handlers[0]; + $close = $custom_session_handlers[1]; + $read = $custom_session_handlers[2]; + $write = $custom_session_handlers[3]; + $destroy = $custom_session_handlers[4]; + $gc = $custom_session_handlers[5]; + session_module_name('user'); + session_set_save_handler($open, $close, $read, $write, $destroy, $gc); + } + + sqsession_is_active(); + session_regenerate_id(); + + // put session restore data back into session if necessary + if (!empty($sel)) { + sqsession_register($sel, 'session_expired_location'); + if (!empty($sep)) + sqsession_register($sep, 'session_expired_post'); + } +} /** * SquirrelMail internal version number -- DO NOT CHANGE * $sm_internal_version = array (release, major, minor) */ -$SQM_INTERNAL_VERSION = array(1,5,2); +$SQM_INTERNAL_VERSION = explode('.', SM_VERSION, 3); +$SQM_INTERNAL_VERSION[2] = intval($SQM_INTERNAL_VERSION[2]); + + +/* load prefs system; even when user not logged in, should be OK to do this here */ +require(SM_PATH . 'functions/prefs.php'); + +// FIXME: config/plugin_hooks.php has not yet been loaded (see a few lines below); so this hook call should I think not be working -- has anyone actually tested it? Is there any reason we cannot move this prefs code block down below "MAIN PLUGIN LOADING CODE HERE" (see below)? Reading the code, I *think* it should be OK, but.... Also, note that this code would then be placed immediately next to the config_override hook, and since it makes little sense to execute two hooks in a row, I will propose removing config_override (although sadly, it is less clear to plugin authors that they should use the prefs_backend hook to do any configuration override work in their plugin) +$prefs_backend = do_hook('prefs_backend', $null); +if (isset($prefs_backend) && !empty($prefs_backend) && file_exists(SM_PATH . $prefs_backend)) { + require(SM_PATH . $prefs_backend); +} elseif (isset($prefs_dsn) && !empty($prefs_dsn)) { + require(SM_PATH . 'functions/db_prefs.php'); +} else { + require(SM_PATH . 'functions/file_prefs.php'); +} /* if plugins are disabled only for one user and @@ -279,7 +391,8 @@ do_hook('config_override', $null); * * Code can be utilized when session is started, but data is not loaded. * We have already loaded configuration and other important vars. Can't - * clean session globals here. + * clean session globals here, beside, the cleanout of globals at the + * top of this file will have removed anything this code would find anyway. if ((bool) @ini_get('register_globals') && strtolower(ini_get('register_globals'))!='off') { foreach ($_SESSION as $key => $value) { @@ -299,13 +412,10 @@ if (! sqgetGlobalVar('squirrelmail_language',$squirrelmail_language,SQ_COOKIE)) /** - * @var $sInitlocation From where do we include. + * Do something special for some pages. This is based on the PAGE_NAME constant + * set at the top of every page. */ -if (!isset($sInitLocation)) { - $sInitLocation=NULL; -} - -switch ($sInitLocation) { +switch (PAGE_NAME) { case 'style': // need to get the right template set up @@ -338,23 +448,14 @@ switch ($sInitLocation) { session_write_close(); break; + case 'mailto': + // nothing to do + break; + case 'redirect': - /** - * directory hashing functions are needed for all setups in case - * plugins use own pref files. - */ - require(SM_PATH . 'functions/prefs.php'); require(SM_PATH . 'functions/auth.php'); - /* hook loads custom prefs backend plugins */ - $prefs_backend = do_hook('prefs_backend', $null); - if (isset($prefs_backend) && !empty($prefs_backend) && file_exists(SM_PATH . $prefs_backend)) { - require(SM_PATH . $prefs_backend); - } elseif (isset($prefs_dsn) && !empty($prefs_dsn)) { - require(SM_PATH . 'functions/db_prefs.php'); - } else { - require(SM_PATH . 'functions/file_prefs.php'); - } //nobreak; + case 'login': require(SM_PATH . 'functions/display_messages.php' ); require(SM_PATH . 'functions/page_header.php'); @@ -397,7 +498,6 @@ switch ($sInitLocation) { require(SM_PATH . 'functions/display_messages.php' ); require(SM_PATH . 'functions/page_header.php'); require(SM_PATH . 'functions/html.php'); - require(SM_PATH . 'functions/strings.php'); /** @@ -406,22 +506,32 @@ switch ($sInitLocation) { require(SM_PATH . 'functions/auth.php'); if ( !sqsession_is_registered('user_is_logged_in') ) { + + // use $message to indicate what logout text the user + // will see... if 0, typical "You must be logged in" + // if 1, information that the user session was saved + // and will be resumed after (re)login + // + $message = 0; + // First we store some information in the new session to prevent // information-loss. // $session_expired_post = $_POST; - $session_expired_location = $PHP_SELF; + $session_expired_location = PAGE_NAME; if (!sqsession_is_registered('session_expired_post')) { sqsession_register($session_expired_post,'session_expired_post'); } if (!sqsession_is_registered('session_expired_location')) { sqsession_register($session_expired_location,'session_expired_location'); + if ($session_expired_location == 'compose') + $message = 1; } // signout page will deal with users who aren't logged // in on its own; don't show error here // - if (strpos($PHP_SELF, 'signout.php') !== FALSE) { - return; + if ( PAGE_NAME == 'signout' ) { + return; } /** @@ -436,12 +546,13 @@ switch ($sInitLocation) { $oTemplate = Template::construct_template($sTemplateID); set_up_language($squirrelmail_language, true); - logout_error( _("You must be logged in to access this page.") ); + if (!$message) + logout_error( _("You must be logged in to access this page.") ); + else + logout_error( _("Your session has expired, but will be resumed after logging in again.") ); exit; } -//FIXME: remove next line if the placement of the copy of this line above does not prove to be problematic - sqgetGlobalVar('username',$username,SQ_SESSION); sqgetGlobalVar('authz',$authz,SQ_SESSION); /** @@ -457,18 +568,6 @@ switch ($sInitLocation) { $prefs_cache = false; //array(); } - /* see 'redirect' case */ - require(SM_PATH . 'functions/prefs.php'); - - $prefs_backend = do_hook('prefs_backend', $null); - if (isset($prefs_backend) && !empty($prefs_backend) && file_exists(SM_PATH . $prefs_backend)) { - require(SM_PATH . $prefs_backend); - } elseif (isset($prefs_dsn) && !empty($prefs_dsn)) { - require(SM_PATH . 'functions/db_prefs.php'); - } else { - require(SM_PATH . 'functions/file_prefs.php'); - } - /** * initializing user settings */ @@ -495,12 +594,9 @@ switch ($sInitLocation) { // Japanese translation used without mbstring support if ($err==2) { - $sError = - "

You need to have PHP installed with the multibyte string function \n". - "enabled (using configure option --enable-mbstring).

\n". - "

System assumed that you accidently switched to Japanese translation \n". - "and reverted your language preference to English.

\n". - "

Please refresh this page in order to use webmail.

\n"; + $sError = "

Your administrator needs to have PHP installed with the multibyte string extension enabled (using configure option --enable-mbstring).

\n" + . "

This system has assumed that you accidently switched to Japanese and has reverted your language preference to English.

\n" + . "

Please refresh this page in order to continue using your webmail.

\n"; error_box($sError); } @@ -571,13 +667,21 @@ if (empty($oTemplate)) { } // We want some variables to always be available to the template -$oTemplate->assign('javascript_on', checkForJavascript()); +// +$oTemplate->assign('javascript_on', + (sqGetGlobalVar('user_is_logged_in', $user_is_logged_in, SQ_SESSION) + ? checkForJavascript() : 0)); $oTemplate->assign('base_uri', sqm_baseuri()); $always_include = array('sTemplateID', 'icon_theme_path'); foreach ($always_include as $var) { $oTemplate->assign($var, (isset($$var) ? $$var : NULL)); } +// A few output elements are used often, so just get them once here +// +$nbsp = $oTemplate->fetch('non_breaking_space.tpl'); +$br = $oTemplate->fetch('line_break.tpl'); + /** * Initialize our custom error handler object */ @@ -592,6 +696,12 @@ if (version_compare(PHP_VERSION, "4.3.0", ">=")) { $oldErrorHandler = set_error_handler('SquirrelMailErrorhandler'); } + +// ============================================================================ +// ================= End of Live Code, Beginning of Functions ================= +// ============================================================================ + + /** * Javascript support detection function * @param boolean $reset recheck javascript support if set to true. @@ -604,12 +714,8 @@ function checkForJavascript($reset = FALSE) { if ( !$reset && sqGetGlobalVar('javascript_on', $javascript_on, SQ_SESSION) ) return $javascript_on; - if ( ( $reset || !isset($javascript_setting) ) - // getPref() not defined (nor is it meaningful) when user not - // logged in, but that begs the question if $javascript_on is - // not in the session in that case, where do we get it from? - && ( sqGetGlobalVar('user_is_logged_in', $user_is_logged_in, SQ_SESSION) - && $user_is_logged_in) ) + $user_is_logged_in = FALSE; + if ( $reset || !isset($javascript_setting) ) $javascript_setting = getPref($data_dir, $username, 'javascript_setting', SMPREF_JS_AUTODETECT); if ( !sqGetGlobalVar('new_js_autodetect_results', $js_autodetect_results) &&