includes/common.php~
changeset 3 2b2084ca1e60
parent 2 0931d60f5bdb
child 4 0b3a0aedfd53
equal deleted inserted replaced
2:0931d60f5bdb 3:2b2084ca1e60
     1 <?php
       
     2 
       
     3 /*
       
     4  * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between
       
     5  * Version 1.0 (Banshee)
       
     6  * Copyright (C) 2006-2007 Dan Fuhry
       
     7  *
       
     8  * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License
       
     9  * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
       
    10  *
       
    11  * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
       
    12  * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.
       
    13  */
       
    14 
       
    15 if(isset($_REQUEST['GLOBALS']))
       
    16 {
       
    17   ?>
       
    18   <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html><head><title>Hacking Attempt</title><meta http-equiv="Content-type" content="text/html; charset=utf-8" /></head><style type="text/css">body{background-color:#000;color:#CCC;font-family:trebuchet ms,sans-serif;font-size:9pt;}a{color:#FFF;}</style><body><p>Hacking attempt using <a href="http://www.hardened-php.net/index.76.html">PHP $GLOBALS overwrite vulnerability</a> detected, reported to admin</p><p>You're worse than this guy! Unless you are this guy...</p><p id="billp"><img alt=" " src="about:blank" id="billi" /></p><script type="text/javascript">// <![CDATA[
       
    19   window.onload=function(){counter();setInterval('counter();', 1000);};var text=false;var cnt=10;function counter(){if(!text){text=document.createElement('span');text.id='billc';text.innerHTML=cnt;text.style.fontSize='96pt';text.style.color='#FF0000';p=document.getElementById('billp');p.appendChild(text);}else{if(cnt==1){document.getElementById('billi').src='http://upload.wikimedia.org/wikipedia/commons/7/7f/Bill_Gates_2004_cr.jpg';document.getElementById('billc').innerHTML='';return;}cnt--;document.getElementById('billc').innerHTML=cnt+' ';}}
       
    20   // ]]>
       
    21   </script><p><span style="color:black;">Powered by Enano and valid XHTML 1.1</span></p></body></html>
       
    22   <?php
       
    23   exit;
       
    24 }
       
    25 
       
    26 $version = '1.0';
       
    27 
       
    28 function microtime_float()
       
    29 {
       
    30   list($usec, $sec) = explode(" ", microtime());
       
    31   return ((float)$usec + (float)$sec);
       
    32 }
       
    33 
       
    34 global $_starttime;
       
    35 $_starttime = microtime_float();
       
    36 
       
    37 error_reporting(E_ALL);
       
    38 
       
    39 if(!defined('ENANO_ROOT')) // ENANO_ROOT is sometimes defined by plugins like AjIM that need the constant before the Enano API is initialized
       
    40   define('ENANO_ROOT', dirname(dirname(__FILE__)));
       
    41 
       
    42 if(defined('ENANO_DEBUG') && version_compare(PHP_VERSION, '5.0.0') < 0)
       
    43 {
       
    44   die(__FILE__.':'.__LINE__.': The debugConsole requires PHP 5.x.x or greater. Please comment out the ENANO_DEBUG constant in your index.php.');
       
    45 }
       
    46 
       
    47 if(defined('ENANO_DEBUG'))
       
    48 {
       
    49   require_once(ENANO_ROOT.'/includes/debugger/debugConsole.php');
       
    50 } else {
       
    51   function dc_here($m)     { return false; }
       
    52   function dc_dump($a, $g) { return false; }
       
    53   function dc_watch($n)    { return false; }
       
    54   function dc_start_timer($u) { return false; }
       
    55   function dc_stop_timer($m) { return false; }
       
    56 }
       
    57 
       
    58 if ( file_exists( ENANO_ROOT . '/_nightly.php') )
       
    59   require(ENANO_ROOT.'/_nightly.php');
       
    60 
       
    61 // Start including files. LOTS of files. Yeah!
       
    62 require_once(ENANO_ROOT.'/includes/constants.php');
       
    63 dc_here('Enano CMS '.$version.' (dev) - debug window<br />Powered by debugConsole');
       
    64 dc_here('common: including files');
       
    65 require_once(ENANO_ROOT.'/includes/functions.php');
       
    66 require_once(ENANO_ROOT.'/includes/dbal.php');
       
    67 require_once(ENANO_ROOT.'/includes/paths.php');
       
    68 require_once(ENANO_ROOT.'/includes/sessions.php');
       
    69 require_once(ENANO_ROOT.'/includes/template.php');
       
    70 require_once(ENANO_ROOT.'/includes/plugins.php');
       
    71 require_once(ENANO_ROOT.'/includes/comment.php');
       
    72 require_once(ENANO_ROOT.'/includes/wikiformat.php');
       
    73 require_once(ENANO_ROOT.'/includes/diff.php');
       
    74 require_once(ENANO_ROOT.'/includes/render.php');
       
    75 require_once(ENANO_ROOT.'/includes/stats.php');
       
    76 require_once(ENANO_ROOT.'/includes/pageutils.php');
       
    77 require_once(ENANO_ROOT.'/includes/js-compressor.php');
       
    78 require_once(ENANO_ROOT.'/includes/rijndael.php');
       
    79 require_once(ENANO_ROOT.'/includes/email.php');
       
    80 require_once(ENANO_ROOT.'/includes/search.php');
       
    81 require_once(ENANO_ROOT.'/includes/json.php');
       
    82 require_once(ENANO_ROOT.'/includes/wikiengine/Tables.php');
       
    83 
       
    84 strip_magic_quotes_gpc();
       
    85 
       
    86 // Enano has five parts: the database abstraction layer (DBAL), the session manager, the path/URL manager, the template engine, and the plugin manager.
       
    87 // Each part has its own class and a global var; nearly all Enano functions are handled by one of these five components.
       
    88 
       
    89 global $db, $session, $paths, $template, $plugins; // Common objects
       
    90 global $enano_config; // A global used to cache config information without making loads of queries ;-)
       
    91                       // In addition, $enano_config is used to fetch config information if die_semicritical() is called.
       
    92                       
       
    93 global $email;
       
    94 
       
    95 if(!isset($_SERVER['HTTP_HOST'])) grinding_halt('Cannot get hostname', '<p>Your web browser did not provide the HTTP Host: field. This site requires a modern browser that supports the HTTP 1.1 standard.</p>');
       
    96                      
       
    97 $db = new mysql();
       
    98 dc_here('common: calling $db->connect();');
       
    99 $db->connect(); // Redirects to install.php if an installation is not detected
       
   100 
       
   101 if(strstr(contentPath, '?')) $sep = '&';
       
   102 else $sep = '?';
       
   103 define('urlSeparator', $sep);
       
   104 unset($sep); // save 10 bytes of memory...
       
   105 
       
   106 // See if any diagnostic actions have been requested
       
   107 if ( isset($_GET['do']) && $_GET['do'] == 'diag' && isset($_GET['sub']) )
       
   108 {
       
   109   switch($_GET['sub'])
       
   110   {
       
   111     case 'cookie_destroy':
       
   112       unset($_COOKIE['sid']);
       
   113       setcookie('sid', '', time()-3600*24, scriptPath);
       
   114       setcookie('sid', '', time()-3600*24, scriptPath.'/');
       
   115       die('Session cookie cleared. <a href="'.$_SERVER['PHP_SELF'].'">Continue</a>');
       
   116       break;
       
   117   }
       
   118 }
       
   119 
       
   120 // Select and fetch the site configuration
       
   121 dc_here('common: selecting global config data');
       
   122 $e = $db->sql_query('SELECT config_name, config_value FROM '.table_prefix.'config;');
       
   123 if(!$e) $db->_die('Some critical configuration information could not be selected.');
       
   124 else define('ENANO_CONFIG_FETCHED', ''); // Used in die_semicritical to figure out whether to call getConfig() or not
       
   125 
       
   126 dc_here('common: fetching $enano_config');
       
   127 $enano_config = Array();
       
   128 while($r = $db->fetchrow())
       
   129 {
       
   130   $enano_config[$r['config_name']] = $r['config_value'];
       
   131 }
       
   132 
       
   133 $db->free_result();
       
   134 
       
   135 if(enano_version(false, true) != $version)
       
   136 {
       
   137   grinding_halt('Version mismatch', '<p>It seems that the Enano release we\'re trying to run ('.$version.') is different from the version specified in your database ('.enano_version().'). Perhaps you need to <a href="'.scriptPath.'/upgrade.php">upgrade</a>?</p>');
       
   138 }
       
   139 
       
   140 // Our list of tables included in Enano
       
   141 $system_table_list = Array(
       
   142     table_prefix.'categories',
       
   143     table_prefix.'comments',
       
   144     table_prefix.'config',
       
   145     table_prefix.'logs',
       
   146     table_prefix.'page_text',
       
   147     table_prefix.'session_keys',
       
   148     table_prefix.'pages',
       
   149     table_prefix.'users',
       
   150     table_prefix.'themes',
       
   151     table_prefix.'buddies',
       
   152     table_prefix.'banlist',
       
   153     table_prefix.'files',
       
   154     table_prefix.'privmsgs',
       
   155     table_prefix.'sidebar',
       
   156     table_prefix.'hits',
       
   157     table_prefix.'search_index',
       
   158     table_prefix.'groups',
       
   159     table_prefix.'group_members',
       
   160     table_prefix.'acl',
       
   161     table_prefix.'search_cache'
       
   162   );
       
   163 
       
   164 dc_here('common: initializing base classes');
       
   165 $plugins = new pluginLoader();
       
   166 
       
   167 // So where does the majority of Enano get executed? How about the next nine lines of code :)
       
   168 dc_here('common: ok, we\'re set up, starting mainstream execution');
       
   169 
       
   170 $plugins->loadAll();
       
   171 dc_here('common: loading plugins');
       
   172   global $plugins;
       
   173   foreach($plugins->load_list as $f) { include_once $f; } // Can't be in object context when this is done
       
   174 
       
   175 $session = new sessionManager();
       
   176 $paths = new pathManager();
       
   177 $template = new template();
       
   178 $email = new EmailEncryptor();
       
   179 
       
   180 define('ENANO_BASE_CLASSES_INITIALIZED', '');
       
   181 
       
   182 $code = $plugins->setHook('base_classes_initted');
       
   183 foreach ( $code as $cmd )
       
   184 {
       
   185   eval($cmd);
       
   186 }
       
   187   
       
   188 $p = RenderMan::strToPageId($paths->get_pageid_from_url());
       
   189 if( ( $p[1] == 'Admin' || $p[1] == 'Special' ) && function_exists('page_'.$p[1].'_'.$p[0].'_preloader'))
       
   190 {
       
   191   @call_user_func('page_'.$p[1].'_'.$p[0].'_preloader');
       
   192 }
       
   193 
       
   194 $session->start();
       
   195 $paths->init();
       
   196 
       
   197 define('ENANO_MAINSTREAM', '');
       
   198 
       
   199 // If the site is disabled, bail out, unless we're trying to log in or administer the site
       
   200 if(getConfig('site_disabled') == '1')
       
   201 {
       
   202   if ( $paths->namespace == 'Admin' || ( $paths->namespace == 'Special' && ( $paths->cpage['urlname_nons'] == 'CSS' || $paths->cpage['urlname_nons'] == 'Administration' || $paths->cpage['urlname_nons'] == 'Login' ) ) )
       
   203   {
       
   204     // do nothing; allow execution to continue
       
   205   }
       
   206   else
       
   207   {
       
   208     if(!$n = getConfig('site_disabled_notice')) $n = 'The administrator has disabled the site. Please check back later.';
       
   209     
       
   210     $text = RenderMan::render($n) . '
       
   211     <div class="info-box">
       
   212       If you have an administrative account, you may <a href="'.makeUrlNS('Special', 'Login').'">log in</a> to the site or <a href="'.makeUrlNS('Special', 'Administration').'">use the administration panel</a>.
       
   213     </div>';
       
   214     $paths->wiki_mode = 0;
       
   215     die_semicritical('Site disabled', $text);
       
   216   }
       
   217 }
       
   218 
       
   219 $code = $plugins->setHook('session_started');
       
   220 foreach ( $code as $cmd )
       
   221 {
       
   222   eval($cmd);
       
   223 }
       
   224 
       
   225 if(isset($_GET['noheaders'])) $template->no_headers = true;
       
   226 
       
   227 ?>