kernel.php

   1 <?php
   2 /*=====================================================================*\
   3 || ###################################################################
   4 || # Blue Static ISSO Framework [#]issoversion[#]
   5 || # Copyright ©2002-[#]year[#] Blue Static
   6 || #
   7 || # This program is free software; you can redistribute it and/or modify
   8 || # it under the terms of the GNU General Public License as published by
   9 || # the Free Software Foundation; version [#]gpl[#] of the License.
  10 || #
  11 || # This program is distributed in the hope that it will be useful, but
  12 || # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13 || # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
  14 || # more details.
  15 || #
  16 || # You should have received a copy of the GNU General Public License along
  17 || # with this program; if not, write to the Free Software Foundation, Inc.,
  18 || # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
  19 || ###################################################################
  20 \*=====================================================================*/
  21
  22 /**
  23 * Blue Static ISSO Framework Kernel
  24 * kernel.php
  25 *
  26 * @package      ISSO
  27 */
  28
  29 if (!function_exists('stripos'))
  30 {
  31         trigger_error('You need PHP version 5.0.0 or newer to run ISSO', E_USER_ERROR);
  32         exit;
  33 }
  34
  35 if ((bool)ini_get('register_globals') === true)
  36 {
  37         $superglobals = array('_GET', '_COOKIE', '_FILES', '_POST', '_SERVER', '_ENV');
  38         foreach ($superglobals AS $global)
  39         {
  40                 if (is_array(${$global}))
  41                 {
  42                         foreach (${$global} AS $_key => $_val)
  43                         {
  44                                 if (isset(${$_key}))
  45                                 {
  46                                         unset(${$_key});
  47                                 }
  48                         }
  49                 }
  50         }
  51 }
  52
  53 $oldlevel = ini_get('error_reporting');
  54 $newlevel = $oldlevel;
  55 $levels = array(E_ERROR => E_USER_ERROR, E_WARNING => E_USER_WARNING, E_NOTICE => E_USER_NOTICE);
  56 foreach ($levels AS $php => $isso)
  57 {
  58         if ($oldlevel & $php)
  59         {
  60                 if (!($oldlevel & $isso))
  61                 {
  62                         $newlevel += $isso;
  63                 }
  64         }
  65         else
  66         {
  67                 if ($oldlevel & $isso)
  68                 {
  69                         $newlevel -= $isso;
  70                 }
  71         }
  72 }
  73 error_reporting($newlevel);
  74
  75 /**#@+
  76 * Input cleaning type constant
  77 */
  78 /**
  79 * Integer type
  80 */
  81 define('TYPE_INT', 1);
  82
  83 /**
  84 * Unsigned integer
  85 */
  86 define('TYPE_UINT', 2);
  87
  88 /**
  89 * Float type
  90 */
  91 define('TYPE_FLOAT', 4);
  92
  93 /**
  94 * Boolean type
  95 */
  96 define('TYPE_BOOL', 8);
  97
  98 /**
  99 * String - cleaned
 100 */
 101 define('TYPE_STR', 16);
 102
 103 /**
 104 * String - deliberate unclean
 105 */
 106 define('TYPE_STRUN', 32);
 107
 108 /**
 109 * No cleaning - here for use in API
 110 */
 111 define('TYPE_NONE', 64);
 112
 113 /**
 114 * Macro for using DB->escape_binary() without cleaning - used in API
 115 */
 116 define('TYPE_BIN', 128);
 117 /**#@-*/
 118
 119 /**
 120 * Yes, required
 121 */
 122 define('REQ_YES', 1);
 123
 124 /**
 125 * No, not required
 126 */
 127 define('REQ_NO', 0);
 128
 129 /**
 130 * Blue Static ISSO Framework (ISSO)
 131 *
 132 * This framework allows a common backend to be used amongst all Blue
 133 * Static applications and is built to be abstract and flexible.
 134 * The base framework handles all loading and module management.
 135 *
 136 * Constants:
 137 *               ISSO_NO_INPUT_SANITIZE - Disables the automatic input sanitizer
 138 *               ISSO_CHECK_POST_REFERER - Will check to make sure that on POSTed
 139 *                                                                       data, the referer matches the host
 140 *               ISSO_MT_START - Define the microtime() value at the top of your
 141 *                                               script and this will calculate the total execution
 142 *                                               time
 143 *               SVN - Place SVN keywords (like $Id) to display the information on output
 144 *
 145 * @author               Blue Static
 146 * @copyright    Copyright ©2002 - [#]year[#], Blue Static
 147 * @version              $Revision$
 148 * @package              ISSO
 149 *
 150 */
 151 class ISSO
 152 {
 153         /**
 154         * ISSO version
 155         * @var  string
 156         */
 157         private $version = '[#]issoversion[#]';
 158
 159         /**
 160         * List of all active debug messages
 161         * @var  array
 162         */
 163         private $debuginfo = array();
 164
 165         /**
 166         * List of loaded modules
 167         * @var  array
 168         */
 169         private $modules = array();
 170
 171         /**
 172         * An array of sanitized variables that have been cleaned for HTML tag openers and double quotes
 173         * @var  array
 174         */
 175         public $in = array();
 176
 177         /**
 178         * If we are running with magic_quotes_gpc on or off
 179         * @var  int
 180         */
 181         private $magicquotes = 0;
 182
 183         // ###################################################################
 184         /**
 185         * Constructor
 186         */
 187         public function __construct()
 188         {
 189                 $GLOBALS['isso:callback'] = null;
 190
 191                 // error reporting
 192                 set_error_handler(array(&$this, '_error_handler'));
 193
 194                 // magic quotes
 195                 $this->magicquotes = get_magic_quotes_gpc();
 196                 set_magic_quotes_runtime(0);
 197
 198                 // some debug info that's always useful
 199                 $this->debug('magic_quotes_gpc = ' . $this->magicquotes);
 200                 $this->debug('register_globals = ' . ini_get('register_globals'));
 201
 202                 // start input sanitize using variable_order GPC
 203                 if (!defined('ISSO_NO_INPUT_SANITIZE'))
 204                 {
 205                         $this->exec_sanitize_data();
 206                 }
 207
 208                 if (defined('ISSO_CHECK_POST_REFERER'))
 209                 {
 210                         $this->exec_referer_check();
 211                 }
 212         }
 213
 214         // ###################################################################
 215         /**
 216         * Prepares a path for being set as the sourcepath
 217         *
 218         * @param        string  Source path or URL
 219         *
 220         * @return       string  Prepared source path
 221         */
 222         public function fetch_sourcepath($source)
 223         {
 224                 if (substr($source, strlen($source) - 1) != DIRECTORY_SEPARATOR)
 225                 {
 226                         $source .= DIRECTORY_SEPARATOR;
 227                 }
 228                 return $source;
 229         }
 230
 231         // ###################################################################
 232         /**
 233         * Loads a framework module
 234         *
 235         * @param        string  Name of the framework file to load
 236         * @param        string  Internal variable to initialize as; to not instantiate (just require) leave it as NULL
 237         * @param        bool    Globalize the internal variable?
 238         *
 239         * @return       object  Instantiated instance
 240         */
 241         public function &load($framework, $asobject, $globalize = false)
 242         {
 243                 $this->check_isso_fields(null);
 244
 245                 // set the object interlock
 246                 if (!method_exists($GLOBALS['isso:callback'], 'load'))
 247                 {
 248                         $GLOBALS['isso:callback'] =& $this;
 249                         $this->modules['isso'] =& $this;
 250                 }
 251
 252                 if ($this->is_loaded($framework))
 253                 {
 254                         return $this->modules["$framework"];
 255                 }
 256
 257                 if ($this->sourcepath == '')
 258                 {
 259                         trigger_error('Invalid sourcepath specified', E_USER_ERROR);
 260                 }
 261
 262                 if (file_exists($this->sourcepath . $framework . '.php'))
 263                 {
 264                         require_once($this->sourcepath . $framework . '.php');
 265                 }
 266                 else
 267                 {
 268                         trigger_error('Could not find the framework ' . $this->sourcepath . $framework . '.php', E_USER_ERROR);
 269                 }
 270
 271                 if ($asobject === null)
 272                 {
 273                         return;
 274                 }
 275
 276                 if (isset($this->$asobject))
 277                 {
 278                         trigger_error('Cannot instantiate framework `' . $framework . '` into `' . $asobject . '`', E_USER_ERROR);
 279                 }
 280
 281                 $this->$asobject = new $framework($this);
 282
 283                 $this->modules["$framework"] =& $this->$asobject;
 284
 285                 if ($globalize)
 286                 {
 287                         $GLOBALS["$asobject"] =& $this->$asobject;
 288                 }
 289
 290                 // allow for init_as_package to link
 291                 if (method_exists($this->modules["$framework"], 'init_as_package'))
 292                 {
 293                         $this->modules[ $this->modules["$framework"]->init_as_package() ] =& $this->modules["$framework"];
 294                 }
 295
 296                 return $this->$asobject;
 297         }
 298
 299         // ###################################################################
 300         /**
 301         * Prints a list of all currently loaded framework modules
 302         *
 303         * @param        bool    Return the data as an array?
 304         *
 305         * @return       mixed   HTML output or an array of loaded modules
 306         */
 307         public function show_modules($return = false)
 308         {
 309                 $modules = array();
 310                 foreach ($this->modules AS $object)
 311                 {
 312                         $module = get_class($object);
 313                         if (method_exists($object, 'init_as_package') AND in_array($module, $modules))
 314                         {
 315                                 $module = $object->init_as_package() . " - ($module)";
 316                         }
 317
 318                         $modules[] = $module;
 319                 }
 320
 321                 if ($return)
 322                 {
 323                         return $modules;
 324                 }
 325                 else
 326                 {
 327                         $output = "\n\n<ul>\n\t<li>";
 328                         $output .= implode("</li>\n\t<li>", $modules);
 329                         $output .= "</li>\n</ul>\n\n";
 330                         $this->message('Loaded Modules', $output, 1);
 331                 }
 332         }
 333
 334         // ###################################################################
 335         /**
 336         * Verifies to see if a framework has been loaded
 337         *
 338         * @param        string  Framework name
 339         *
 340         * @return       bool    Whether or not the framework has been loaded
 341         */
 342         public function is_loaded($framework)
 343         {
 344                 if (isset($this->modules["$framework"]))
 345                 {
 346                         return true;
 347                 }
 348                 else
 349                 {
 350                         return false;
 351                 }
 352         }
 353
 354         // ###################################################################
 355         /**
 356         * Prints an ISSO message
 357         *
 358         * @param        string  The title of the message
 359         * @param        string  The content of the message
 360         * @param        integer Type of message to be printed
 361         * @param        bool    Return the output?
 362         * @param        bool    Show the debug stack?
 363         * @param        integer Message width
 364         *
 365         * @return       mixed   Output or null
 366         */
 367         public function message($title, $message, $type, $return = false, $stack = true, $width = 500)
 368         {
 369                 switch ($type)
 370                 {
 371                         // Message
 372                         case 1:
 373                                 $prefix = 'Message';
 374                                 $color = '#669900';
 375                                 $font = '#000000';
 376                         break;
 377
 378                         // Warning
 379                         case 2:
 380                                 $prefix = 'Warning';
 381                                 $color = '#003399';
 382                                 $font = '#FFFFFF';
 383                         break;
 384
 385                         case 3:
 386                                 $prefix = 'Error';
 387                                 $color = '#990000';
 388                                 $font = '#EFEFEF';
 389                         break;
 390                 }
 391
 392                 $backtrace = debug_backtrace();
 393                 array_shift($backtrace);
 394
 395                 if (isset($backtrace[0]) AND $backtrace[0]['function'] == '_error_handler')
 396                 {
 397                         array_shift($backtrace);
 398                 }
 399
 400                 $trace = $this->format_debug_trace($backtrace);
 401
 402                 $output = "\n<br />\n<table cellpadding=\"4\" cellspacing=\"1\" border=\"0\" width=\"$width\" style=\"background-color: $color; color: black; font-family: Verdana, sans-serif; font-size: 12px;\">";
 403                 $output .= "\n<tr style=\"color: $font; text-align: left\">\n\t<td><strong>$prefix: $title</strong></td>\n</tr>";
 404                 $output .= "\n<tr style=\"background-color: #FFFFFF; text-align: left\">\n\t<td>$message</td>\n</tr>";
 405                 $output .= (($stack AND $GLOBALS['isso:callback']->debug) ? "\n<tr style=\"background-color: #FFFFFF; text-align: left\">\n\t<td><strong>Debug Stack:</strong> <pre>" . implode("\n", $trace) . "</pre></td>\n</tr>" : '');
 406                 $output .= "\n</table>\n<br />\n";
 407
 408                 if ($return)
 409                 {
 410                         return $output;
 411                 }
 412                 else
 413                 {
 414                         print($output);
 415                 }
 416         }
 417
 418         // ###################################################################
 419         /**
 420         * Prepares a debug_backtrace() array for output to the browser by
 421         * compressing the array into visible text
 422         *
 423         * @param        array   debug_backtrace() array
 424         *
 425         * @return       array   Formatted trace output
 426         */
 427         public function format_debug_trace($backtrace)
 428         {
 429                 $trace = array();
 430                 foreach ($backtrace AS $i => $step)
 431                 {
 432                         $args = '';
 433                         $file = $step['file'] . ':' . $step['line'];
 434                         $funct = (isset($step['class']) ? $step['class'] . '::' . $step['function'] : $step['function']);
 435
 436                         if (isset($step['args']) AND is_array($step['args']))
 437                         {
 438                                 // we need to do this so we don't get "Array to string conversion" notices
 439                                 foreach ($step['args'] AS $id => $arg)
 440                                 {
 441                                         if (is_array($arg))
 442                                         {
 443                                                 $step['args']["$id"] = 'Array';
 444                                         }
 445                                 }
 446                                 $args = implode(', ', $step['args']);
 447                         }
 448
 449                         $trace[] = "#$i  $funct($args) called at [$file]";
 450                 }
 451
 452                 return $trace;
 453         }
 454
 455         // ###################################################################
 456         /**
 457         * Custom error handler for ISSO; only handle E_WARNING, E_NOTICE,
 458         * E_USER_ERROR, E_USER_WARNING, E_USER_NOTICE
 459         *
 460         * @param        integer Error number
 461         * @param        string  Error message string
 462         * @param        string  File that contains the error
 463         * @param        string  The line number of the error
 464         * @param        string  The active symbol table at which point the error occurred
 465         */
 466         public function _error_handler($errno, $errstr, $errfile, $errline, $errcontext)
 467         {
 468                 $level = ini_get('error_reporting');
 469
 470                 switch ($errno)
 471                 {
 472                         // Fatal
 473                         case E_USER_ERROR:
 474                                 $title = 'Fatal';
 475                                 $mode = 3;
 476                                 if (!($level & E_USER_ERROR))
 477                                 {
 478                                         return;
 479                                 }
 480                         break;
 481
 482                         // Error
 483                         case E_USER_WARNING:
 484                         case E_WARNING:
 485                                 $title = 'Warning';
 486                                 $mode = 2;
 487                                 if (! (($level & E_USER_WARNING) AND ($level & E_WARNING)) )
 488                                 {
 489                                         return;
 490                                 }
 491                         break;
 492
 493                         // Warning
 494                         case E_USER_NOTICE:
 495                         case E_NOTICE:
 496                         default:
 497                                 $title = 'Notice';
 498                                 $mode = 1;
 499                                 if (! (($level & E_USER_NOTICE) AND ($level & E_NOTICE)) )
 500                                 {
 501                                         return;
 502                                 }
 503                         break;
 504                 }
 505
 506                 $errstr .= " in <strong>$errfile</strong> on line <strong>$errline</strong>";
 507
 508                 $errstr = str_replace(array(getcwd(), dirname(getcwd())), '', $errstr);
 509
 510                 $this->message($title, $errstr, $mode);
 511
 512                 if ($errno == E_USER_ERROR)
 513                 {
 514                         exit;
 515                 }
 516         }
 517
 518         // ###################################################################
 519         /**
 520         * Creates a table that explains the error reporting levels and their
 521         * state
 522         */
 523         public function explain_error_reporting()
 524         {
 525                 $levels = array(
 526                         'E_ERROR'                       => E_ERROR,
 527                         'E_WARNING'                     => E_WARNING,
 528                         'E_PARSE'                       => E_PARSE,
 529                         'E_NOTICE'                      => E_NOTICE,
 530                         'E_CORE_ERROR'          => E_CORE_ERROR,
 531                         'E_CORE_WARNING'        => E_CORE_WARNING,
 532                         'E_COMPILE_ERROR'       => E_COMPILE_ERROR,
 533                         'E_COMPILE_WARNING'     => E_COMPILE_WARNING,
 534                         'E_USER_ERROR'          => E_USER_ERROR,
 535                         'E_USER_WARNING'        => E_USER_WARNING,
 536                         'E_USER_NOTICE'         => E_USER_NOTICE,
 537                         'E_ALL'                         => E_ALL,
 538                         'E_STRICT'                      => E_STRICT
 539                 );
 540
 541                 $table = '<table cellspacing="0" cellpadding="2" border="0">';
 542
 543                 foreach ($levels AS $name => $value)
 544                 {
 545                         $table .= '
 546                         <tr>
 547                                 <td>' . $name . '</td>
 548                                 <td>' . (ini_get('error_reporting') & $value) . '</td>
 549                         </tr>';
 550                 }
 551
 552                 $table .= '
 553                 </table>';
 554
 555                 $this->message('Error Reporting', $table, 1);
 556         }
 557
 558         // ###################################################################
 559         /**
 560         * Logs a debug message for verbose output
 561         *
 562         * @param        string  Message
 563         */
 564         public function debug($message)
 565         {
 566                 $this->debuginfo[] = $message;
 567         }
 568
 569         // ###################################################################
 570         /**
 571         * Recursive XSS cleaner
 572         *
 573         * @param        mixed   Unsanitized REQUEST data
 574         *
 575         * @return       mixed   Sanitized data
 576         */
 577         public function _sanitize_input_recursive($data)
 578         {
 579                 foreach ($data AS $key => $value)
 580                 {
 581                         if (is_array($value))
 582                         {
 583                                 $data["$key"] = $this->_sanitize_input_recursive($value);
 584                         }
 585                         else
 586                         {
 587                                 if ($this->magicquotes)
 588                                 {
 589                                         $value = str_replace("\'", "'", $value);
 590                                 }
 591                                 $data["$key"] = $this->sanitize($value);
 592                         }
 593                 }
 594                 return $data;
 595         }
 596
 597         // ###################################################################
 598         /**
 599         * Simple way to protect against HTML attacks with Unicode support
 600         *
 601         * @param        string  Unsanitzed text
 602         *
 603         * @return       string  Properly protected text that only encodes potential threats
 604         */
 605         public function sanitize($text)
 606         {
 607                 if ($this->magicquotes)
 608                 {
 609                         return str_replace(array('<', '>', '\"', '"'), array('&lt;', '&gt;', '&quot;', '&quot;'), $text);
 610                 }
 611                 else
 612                 {
 613                         return str_replace(array('<', '>', '"'), array('&lt;', '&gt;', '&quot;'), $text);
 614                 }
 615         }
 616
 617         // ###################################################################
 618         /**
 619         * Unicode-safe entity encoding system; similar to sanitize()
 620         *
 621         * @param        string  Unsanitized text
 622         *
 623         * @return       string  Unicode-safe sanitized text with entities preserved
 624         */
 625         public function entity_encode($text)
 626         {
 627                 $text = str_replace('&', '&amp;', $text);
 628                 $text = $this->sanitize($text);
 629                 return $text;
 630         }
 631
 632         // ###################################################################
 633         /**
 634         * Takes text that has been processed for HTML and unsanitizes it
 635         *
 636         * @param        string  Text that needs to be turned back into HTML
 637         *
 638         * @return       string  Unsanitized text
 639         */
 640         public function unsanitize($text)
 641         {
 642                 return str_replace(array('&lt;', '&gt;', '&quot;'), array('<', '>', '"'), $text);
 643         }
 644
 645         // ###################################################################
 646         /**
 647         * Smart addslashes() that only applies itself it the Magic Quotes GPC
 648         * is off. This should only be run on database query values that come
 649         * from ISSO->in[] input; data that needs sanitization should be run
 650         * through ISSO->DB->escape_string()
 651         *
 652         * @param        string  Some string
 653         * @param        bool    Force magic quotes to be off
 654         *
 655         * @return       string  String that has slashes added
 656         */
 657         public function escape($str, $force = true)
 658         {
 659                 if ($this->magicquotes AND !$force)
 660                 {
 661                         if (isset($this->modules[ISSO_DB_LAYER]))
 662                         {
 663                                 return $this->modules[ISSO_DB_LAYER]->escape_string(str_replace(array("\'", '\"'), array("'", '"'), $str));
 664                         }
 665                         return $str;
 666                 }
 667                 else
 668                 {
 669                         if (isset($this->modules[ISSO_DB_LAYER]))
 670                         {
 671                                 return $this->modules[ISSO_DB_LAYER]->escape_string($str);
 672                         }
 673                         return addslashes($str);
 674                 }
 675         }
 676
 677         // ###################################################################
 678         /**
 679         * Runs through all of the input data and sanitizes it.
 680         */
 681         private function exec_sanitize_data()
 682         {
 683                 $this->in = $this->_sanitize_input_recursive(array_merge($_GET, $_POST, $_COOKIE));
 684         }
 685
 686         // ###################################################################
 687         /**
 688         * Sanitize function for something other than a string (which
 689         * everything is sanitized for if you use exec_sanitize_data(). Cleaned
 690         * data is placed back into $isso->in; this makes it so you don't have
 691         * to constantly intval() [etc.] data.
 692         *
 693         * @param        array   Array of elements to clean as varname => type
 694         */
 695         public function input_clean_array($vars)
 696         {
 697                 foreach ($vars AS $varname => $type)
 698                 {
 699                         $this->input_clean($varname, $type);
 700                 }
 701         }
 702
 703         // ###################################################################
 704         /**
 705         * Sanitize function that does a single variable as oppoesd to an array
 706         * (see input_clean_array() for more details)
 707         *
 708         * @param        string  Variable name in $isso->in[]
 709         * @param        integer Sanitization type constant
 710         */
 711         public function input_clean($varname, $type)
 712         {
 713                 if (isset($this->in["$varname"]))
 714                 {
 715                         $this->in["$varname"] = $this->clean($this->in["$varname"], $type);
 716                 }
 717                 else
 718                 {
 719                         $this->in["$varname"] = $this->clean(null, $type);
 720                 }
 721
 722                 return $this->in["$varname"];
 723         }
 724
 725         // ###################################################################
 726         /**
 727         * Runs ISSO->escape() on a variable on ISSO->in[]. This is just a
 728         * short-hand wrapper so that queries can be shortened. When this is used,
 729         * the actual value in ISSO->in[] is not changed, only the return value
 730         * is escaped.
 731         *
 732         * @param        string  Input variable
 733         *
 734         * @return       string  Escaped input
 735         */
 736         public function input_escape($varname)
 737         {
 738                 if (isset($this->in["$varname"]))
 739                 {
 740                         return $this->escape($this->in["$varname"]);
 741                 }
 742                 else
 743                 {
 744                         return $this->escape(null);
 745                 }
 746         }
 747
 748         // ###################################################################
 749         /**
 750         * Cleaning function that does the work for input_clean(); this is
 751         * moved here so it can be used to clean things that aren't in
 752         * $isso->in[]
 753         *
 754         * @param        mixed   Data
 755         * @param        integer Sanitization type constant
 756         *
 757         * @return       mixed   Cleaned data
 758         */
 759         public function clean($value, $type)
 760         {
 761                 if (is_array($value))
 762                 {
 763                         return $this->clean_array($value, $type);
 764                 }
 765
 766                 if ($type == TYPE_INT)
 767                 {
 768                         $value = intval($value);
 769                 }
 770                 else if ($type == TYPE_UINT)
 771                 {
 772                         $value = (($val = intval($value)) < 0 ? 0 : $val);
 773                 }
 774                 else if ($type == TYPE_FLOAT)
 775                 {
 776                         $value = floatval($value);
 777                 }
 778                 else if ($type == TYPE_BOOL)
 779                 {
 780                         $value = (bool)$value;
 781                 }
 782                 else if ($type == TYPE_STR)
 783                 {
 784                         $value = $value;
 785                 }
 786                 else if ($type == TYPE_STRUN)
 787                 {
 788                         $value = $this->unsanitize($value);
 789                 }
 790                 else if ($type == TYPE_NOCLEAN)
 791                 {
 792                         if ($this->magicquotes)
 793                         {
 794                                 $value = str_replace(array('\"', "\'"), array('"', "'"), $value);
 795                         }
 796                         else
 797                         {
 798                                 $value = $value;
 799                         }
 800                 }
 801                 else if ($type == TYPE_BIN)
 802                 {
 803                         $value = $value;
 804                 }
 805                 else
 806                 {
 807                         trigger_error('Invalid clean type `' . $type . '` specified', E_USER_ERROR);
 808                 }
 809
 810                 return $value;
 811         }
 812
 813         // ###################################################################
 814         /**
 815         * Recursion function for ISSO->clean()
 816         *
 817         * @param        array   Uncleaned array
 818         * @param        integer Sanitization type constant
 819         *
 820         * @return       array   Cleaned array of data
 821         */
 822         private function clean_array($array, $type)
 823         {
 824                 foreach ($array AS $key => $value)
 825                 {
 826                         $array["$key"] = $this->clean($value, $type);
 827                 }
 828
 829                 return $array;
 830         }
 831
 832         // ###################################################################
 833         /**
 834         * Checks to see if a POST refer is actually from us
 835         */
 836         public function exec_referer_check()
 837         {
 838                 if ($_SERVER['REQUEST_METHOD'] == 'POST')
 839                 {
 840                         $host = ($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : $_ENV['HTTP_HOST'];
 841
 842                         if ($host AND $_SERVER['HTTP_REFERER'])
 843                         {
 844                                 $parts = parse_url($_SERVER['HTTP_REFERER']);
 845                                 $ourhost = $parts['host'] . (isset($parts['port']) ? ":$parts[port]" : '');
 846
 847                                 if ($ourhost != $host)
 848                                 {
 849                                         trigger_error('No external hosts are allowed to POST to this application', E_USER_ERROR);
 850                                 }
 851                                 $this->debug('remote post check = ok');
 852                         }
 853                         else
 854                         {
 855                                 $this->debug('remote post check = FAILED');
 856                         }
 857                 }
 858         }
 859
 860         // ###################################################################
 861         /**
 862         * Constructs a debug information box that contains various debugging
 863         * information points
 864         *
 865         * @param        bool    Show template information?
 866         *
 867         * @return       string  Debugging block
 868         */
 869         public function construct_debug_block($dotemplates)
 870         {
 871                 $debug = '';
 872
 873                 if ($this->debug)
 874                 {
 875                         $debug = "\n<ul>";
 876
 877                         // templates
 878                         if ($dotemplates)
 879                         {
 880                                 $optlist = array();
 881                                 $usage = array();
 882                                 foreach ($this->modules['template']->usage AS $name => $count)
 883                                 {
 884                                         if (in_array($name, $this->modules['template']->uncached))
 885                                         {
 886                                                 $optlist[] = $name . '[' . $count . ']';
 887                                         }
 888                                         $usage[] = $name . " ($count)";
 889                                 }
 890
 891                                 $sizeof = sizeof($this->modules['template']->uncached);
 892                                 if ($sizeof > 0)
 893                                 {
 894                                         $debug .= "\n\t<li><strong style=\"color: red\">Uncached Template(s):</strong> $sizeof ( " . implode(' &nbsp; ', $optlist) . " )</li>";
 895                                 }
 896                         }
 897
 898                         // source control
 899                         $scinfo = 'Not Under Source Control';
 900                         if (defined('SVN'))
 901                         {
 902                                 $scinfo = constant('SVN');
 903
 904                                 if (preg_match('#\$Id:?\s*\$#', $scinfo))
 905                                 {
 906                                         $scinfo = 'Not Under Source Control';
 907                                 }
 908                                 else
 909                                 {
 910                                         $scinfo = preg_replace('#\$' . '(Head)?URL: (.+?) \$#e', "end(explode('/', '\\2'))", $scinfo);
 911                                         $scinfo = preg_replace('#\$' . '(LastModified)?Revision: (.+?) \$#', 'SVN \\2', $scinfo);
 912                                         $scinfo = preg_replace('#\$' . 'Id: (.+?) ([0-9].+?) [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}(.+?) (.+?) \$#', '\\1 - SVN \\2', $scinfo);
 913                                 }
 914                         }
 915
 916                         $scinfo = trim($scinfo);
 917                         $debug .= "\n\t<li><strong>Source Control:</strong> $scinfo</li>";
 918
 919                         // query information
 920                         if (is_object($this->modules[ISSO_DB_LAYER]))
 921                         {
 922                                 $debug .= "\n\t<li><strong>Total Queries:</strong> " . sizeof($this->modules[ISSO_DB_LAYER]->history) . " (<a href=\"" . $this->sanitize($_SERVER['REQUEST_URI']) . ((strpos($_SERVER['REQUEST_URI'], '?') !== false) ? '&amp;query=1' : '?query=1') . "\">?</a>)</li>";
 923                         }
 924
 925                         // total execution time
 926                         if (defined('ISSO_MT_START'))
 927                         {
 928                                 $this->load('functions', 'functions');
 929                                 $debug .= "\n\t<li><strong>Total Execution Time:</strong> " . round($this->modules['functions']->fetch_microtime_diff(ISSO_MT_START), 10) . "</li>";
 930                         }
 931
 932                         // debug notices
 933                         $debug .= "\n\t<li>\n\t\t<select>\n\t\t\t<option>Debug Notices (" . sizeof($this->debuginfo) . ")</option>";
 934                         foreach ((array)$this->debuginfo AS $msg)
 935                         {
 936                                 $debug .= "\n\t\t\t<option>--- $msg</option>";
 937                         }
 938                         $debug .= "\n\t\t</select>\n\t</li>";
 939
 940                         // loaded modules
 941                         $modules = $this->show_modules(true);
 942                         $debug .= "\n\t<li>\n\t\t<select>\n\t\t\t<option>Loaded Modules (" . sizeof($modules) . ")</option>";
 943                         foreach ($modules AS $mod)
 944                         {
 945                                 $debug .= "\n\t\t\t<option>--- $mod</option>";
 946                         }
 947                         $debug .= "\n\t\t</select>\n\t</li>";
 948
 949                         // template usage
 950                         if ($dotemplates)
 951                         {
 952                                 $debug .= "\n\t<li>\n\t\t<select>\n\t\t\t<option>Template Usage (" . array_sum($this->modules['template']->usage) . ")</option>";
 953                                 foreach ($usage AS $tpl)
 954                                 {
 955                                         $debug .= "\n\t\t\t<option>--- $tpl</option>";
 956                                 }
 957                                 $debug .= "\n\t\t</select>\n\t</li>";
 958                         }
 959
 960                         $debug .= "\n</ul>";
 961
 962                         $debug = "\n\n<!-- dev debug -->\n<div align=\"center\">\n\n<hr />\n" . $this->message('Debug Information', $debug, 1, true, false) . "\n</div>\n<!-- / dev debug -->\n\n";
 963                 }
 964
 965                 return $debug;
 966         }
 967 }
 968
 969 /*=====================================================================*\
 970 || ###################################################################
 971 || # $HeadURL$
 972 || # $Id$
 973 || ###################################################################
 974 \*=====================================================================*/
 975 ?>