2 /*=====================================================================*\
3 || ################################################################### ||
4 || # Iris Studios Shared Object Framework [#]version[#]
5 || # --------------------------------------------------------------- # ||
6 || # All parts of this file are ©2003-[#]year[#] Iris Studios, Inc. No # ||
7 || # part of this file may be reproduced in any way: part or whole. # ||
8 || # --------------------------------------------------------------- # ||
9 || # ©2003 - [#]year[#] Iris Studios, Inc. | http://www.iris-studios.com # ||
10 || ################################################################### ||
11 \*=====================================================================*/
13 define('ERR_FATAL', E_USER_ERROR
);
14 define('ERR_ALERT', E_USER_WARNING
);
15 define('ERR_WARNING', E_USER_NOTICE
);
17 if (PHP_VERSION
< '4.1.0')
19 trigger_error('You need PHP version 4.1.0 or newer to run ISSO', ERR_FATAL
);
23 if (version_compare(PHP_VERSION
, '5.0.0', '>='))
25 if (ini_get('error_reporting') & E_NOTICE
)
27 error_reporting(ini_get('error_reporting') - E_NOTICE
);
29 if (ini_get('error_reporting') & E_USER_NOTICE
)
31 error_reporting(ini_get('error_reporting') - E_USER_NOTICE
);
35 if (!(ini_get('error_reporting') & E_NOTICE
) AND ini_get('error_reporting') & E_USER_NOTICE
)
37 error_reporting(ini_get('error_reporting') - E_USER_NOTICE
);
40 if (!(ini_get('error_reporting') & E_WARNING
) AND ini_get('error_reporting') & E_USER_WARNING
)
42 error_reporting(ini_get('error_reporting') - E_USER_WARNING
);
45 if (!(ini_get('error_reporting') & E_ERROR
) AND ini_get('error_reporting') & E_USER_ERROR
)
47 error_reporting(ini_get('error_reporting') - E_USER_ERROR
);
50 if ((bool)ini_get('register_globals') === true)
52 $superglobals = array('_GET', '_COOKIE', '_FILES', '_POST', '_SERVER', '_ENV');
53 foreach ($superglobals AS $global)
55 if (is_array(${$global}))
57 foreach (${$global} AS $_key => $_val)
69 * Iris Studios Shared Object Framework (ISSO)
71 * This framework allows a common backend to be used amongst all Iris
72 * Studios applications and can is built to be abstract and flexible.
73 * The base framework handles all loading and module management.
75 * @author Iris Studios, Inc.
76 * @copyright Copyright ©2003 - [#]year[#], Iris Studios, Inc.
80 class Shared_Object_Framework
83 * Global environment variables
85 * This is where we keep the global variables that are used within the shared framework
87 * @var version ISSO version
88 * @var sourcepath The location of the framework sources
89 * @var appath The path to the application's location
90 * @var application The name of the application that is using the framework
91 * @var appversion The version of the application
92 * @var debug Variable for debug mode
93 * @var debuginfo Listing of all debug notices
94 * @var modules An array of loaded framework modules
95 * @var input All input data for the system
96 * @var i Short-hand reference to $isso::input
97 * @var in Short-hand reference to $isso::input
98 * @var magicquotes Status of Magic Quotes GPC
99 * @var escapestrings Sets whether or not we escape strings automatically
101 var $version = '[#]version[#]';
102 var $sourcepath = '';
104 var $application = '';
105 var $appversion = '';
107 var $debuginfo = array();
108 var $modules = array();
109 var $input = array();
112 var $magicquotes = 0;
113 var $escapestrings = false;
118 function Shared_Object_Framework()
121 set_error_handler(array(&$this, '_error_handler'));
124 $this->magicquotes
= get_magic_quotes_gpc();
125 set_magic_quotes_runtime(0);
127 if (defined('ISSO_ESCAPE_STRINGS'))
129 $this->escapestrings
= (bool)constant('ISSO_ESCAPE_STRINGS');
132 // start input sanitize using variable_order GP
133 if (!$this->escapestrings
)
135 $this->exec_sanitize_data();
138 $this->modules
['kernel'] = 'Shared Object Framework Core';
142 * Prepares a path for being set as the sourcepath
144 * @param str Source path or URL
146 * @return str Prepared source path
148 function fetch_sourcepath($source)
150 if (substr($source, strlen($source) - 1) != '/')
158 * Loads a framework extension
160 * @param str Name of the framework
162 function load($framework)
164 if (!$this->is_loaded($framework))
166 $newobj = $this->locate($framework);
167 $this->$newobj['OBJ'] = new $newobj['CLASS']();
168 $GLOBALS["$newobj[OBJ]"] =& $this->$newobj['OBJ'];
169 $this->modules
["$framework"] = $newobj['OBJECT'];
174 * Includes a framework module. Module definitions need three variables:
175 * class, object, and obj. Class is the name of the class, object is
176 * the name human-readable name, and obj is the name that the module
177 * should be initialized as; this is used in class extensions.
179 * @param str Name of the framework
181 * @return array List of initialization variables
183 function locate($framework)
185 if ($this->sourcepath == '')
187 trigger_error('Invalid sourcepath specified', ERR_FATAL);
190 if (file_exists($this->sourcepath . $framework . '.php'))
192 require_once($this->sourcepath . $framework . '.php');
193 return array('CLASS' => $CLASS, 'OBJECT' => $OBJECT, 'OBJ' => $OBJ);
197 trigger_error('Could not find the framework ' . $this->sourcepath . $framework . '.php', ERR_FATAL);
203 * Prints a list of all currently loaded framework modules
205 * @param bool Return the data as an array?
207 * @return mixed HTML output or an array of loaded modules
209 function show_modules($return = false)
213 return $this->modules;
217 $output = "\n\n
<ul
>\n\t<li
>";
218 $output .= implode("</li
>\n\t<li
>", $this->modules);
219 $output .= "</li
>\n</ul
>\n\n";
220 $this->_message('Loaded Modules', $output, 1);
225 * Verifies to see if a framework has been loaded
227 * @param str Framework name
229 * @return bool Whether or not the framework has been loaded
231 function is_loaded($framework)
233 if (isset($this->modules["$framework"]))
244 * Prints an ISSO message
246 * @param str The title of the message
247 * @param str The content of the message
248 * @param int Type of message to be printed
249 * @param bool Return the output?
251 * @return mixed Output or null
253 function _message($title, $message, $type, $return = false)
278 $output = "\n<br />\n<table cellpadding=\"4\" cellspacing=\"1\" border=\"0\" width=\"500\" style=\"background-color: $color; font-family: Verdana, sans-serif; font-size: 12px;\">";
279 $output .= "\n<tr style=\"color: $font\">\n\t<td><strong>$prefix: $title</strong></td>\n</tr>";
280 $output .= "\n<tr style=\"background-color: #FFFFFF\">\n\t<td>$message</td>\n</tr>\n</table>\n<br />\n";
293 * Custom error handler for ISSO
295 * @param int Error number
296 * @param str Error message string
297 * @param str File that contains the error
298 * @param str The line number of the error
299 * @param str The active symbol table at which point the error occurred
301 function _error_handler($errno, $errstr, $errfile, $errline)
308 if (!(ini_get('error_reporting') & ERR_FATAL
))
317 if (!(ini_get('error_reporting') & ERR_ALERT
))
327 if (!(ini_get('error_reporting') & ERR_WARNING
))
334 $errfile = str_replace(getcwd(), '', $errfile);
336 $errstr .= " in <strong>$errfile</strong> on line <strong>$errline</strong>";
338 $this->_message($title, $errstr, 3);
340 if ($errno == ERR_FATAL
)
347 * Logs a debug message for verbose output
351 function debug($message)
353 $this->debuginfo
[] = $message;
357 * Recursive XSS cleaner
359 * @param mixed Unsanitized REQUEST data
361 * @return mixed Sanitized data
363 function _sanitize_input_recursive($data)
365 foreach($data AS $key => $value)
367 if (is_array($value))
369 $data["$key"] = $this->_sanitize_input_recursive($value);
373 if ($this->escapestrings)
375 $data["$key"] = $this->escape($this->sanitize($value));
379 $data["$key"] = $this->sanitize($value);
387 * Simple way to protect against HTML attacks with Unicode support
389 * @param str Unsanitzed text
391 * @return str Properly protected text that only encodes potential threats
393 function sanitize($text)
395 if ($this->magicquotes)
397 return str_replace(array('<', '>', '\"', '"'), array('<
;', '>
;', '"
;', '"
;'), $text);
401 return str_replace(array('<', '>', '"'), array('<', '>', '"'), $text);
406 * Takes text that has been processed for HTML and unsanitizes it
408 * @param str Text that needs to be turned back into HTML
409 * @param bool Force magicquotes off
411 * @return str Unsanitized text
413 function unsanitize($text, $force = false)
415 if ($this->magicquotes AND !$force)
417 return str_replace(array('<', '>', '"'), array('<', '>', '\"'), $text);
421 return str_replace(array('<', '>', '"'), array('<', '>', '"'), $text);
426 * Smart addslashes() that only applies itself it the Magic Quotes GPC is off
428 * @param str Some string
430 * @return str String that has slashes added
432 function escape($str, $binary = false, $force = false)
436 if ($this->magicquotes AND !$force)
438 if (isset($_isso->db) AND $binary)
440 if (is_resource($_isso->db->link_id))
442 return $_isso->db->escape_string(stripslashes($str));
449 if (isset($_isso->db) AND $binary)
451 if (is_resource($_isso->db->link_id))
453 return $_isso->db->escape_string($str);
456 return addslashes($str);
461 * Runs through all of the input data and sanitizes it.
463 function exec_sanitize_data()
465 $this->input = $this->_sanitize_input_recursive(array_merge($_GET, $_POST));
466 $this->i =& $this->input;
467 $this->in =& $this->input;
468 // we're now using magic quotes
469 if ($this->escapestrings
)
471 $this->magicquotes
= 1;
477 * Global callback used for module calls back to the kernel
479 $_isso = new Shared_Object_Framework();
482 * Wrapper for ternary operator that has to be in the global scope.
483 * This function is going to be removed from our applications due
484 * to it's latency in processing. This will remain here purely
485 * for legacy reasons. It will be removed when necessary.
487 * @param expr Expression
488 * @param mixed If the expression is true
489 * @param mixed If the expression is false
491 * @return mixed True or false data
493 function iff($condition, $iftrue, $iffalse = null)
495 return ($condition) ? ($iftrue) : ($iffalse);
498 if (defined('ISSO_CHECK_POST_REFERER'))
500 if ($_SERVER['REQUEST_METHOD'] == 'POST')
502 $host = ($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : $_ENV['HTTP_HOST'];
503 $parts = parse_url($_SERVER['HTTP_REFERER']);
504 $ourhost = $parts['host'] . (($parts['port']) ? ":$parts[port]" : '');
506 if ($ourhost != $host)
508 trigger_error('No external hosts are allowed to POST to this application', ERR_FATAL
);
510 $_isso->debug('remote post check = ok');
514 /*=====================================================================*\
515 || ###################################################################
518 || ###################################################################
519 \*=====================================================================*/