kernel.php

   1 <?php
   2 /*=====================================================================*\
   3 || ################################################################### ||
   4 || # Iris Studios Shared Object Framework [#]version[#]
   5 || # --------------------------------------------------------------- # ||
   6 || # Copyright ©2002-[#]year[#] by Iris Studios, Inc. All Rights Reserved. # ||
   7 || # This file may not be reproduced in any way without permission.  # ||
   8 || # --------------------------------------------------------------- # ||
   9 || # User License Agreement at http://www.iris-studios.com/license/  # ||
  10 || ################################################################### ||
  11 \*=====================================================================*/
  12
  13 if (PHP_VERSION < '4.1.0')
  14 {
  15         trigger_error('You need PHP version 4.1.0 or newer to run ISSO', E_USER_ERROR);
  16         exit;
  17 }
  18
  19 if (version_compare(PHP_VERSION, '5.0.0', '>='))
  20 {
  21         if (ini_get('error_reporting') & E_NOTICE)
  22         {
  23                 error_reporting(ini_get('error_reporting') - E_NOTICE);
  24         }
  25         if (ini_get('error_reporting') & E_USER_NOTICE)
  26         {
  27                 error_reporting(ini_get('error_reporting') - E_USER_NOTICE);
  28         }
  29 }
  30
  31 $oldlevel = ini_get('error_reporting');
  32 $newlevel = $oldlevel;
  33 $levels = array(E_ERROR => E_USER_ERROR, E_WARNING => E_USER_WARNING, E_NOTICE => E_USER_NOTICE);
  34 foreach ($levels AS $php => $isso)
  35 {
  36         if ($oldlevel & $php)
  37         {
  38                 if (!($oldlevel & $isso))
  39                 {
  40                         //echo "increasing newlevel by $isso; ";
  41                         $newlevel += $isso;
  42                 }
  43         }
  44         else
  45         {
  46                 if ($oldlevel & $isso)
  47                 {
  48                         //echo "decreasing newlevel by $isso; ";
  49                         $newlevel -= $isso;
  50                 }
  51         }
  52 }
  53 error_reporting($newlevel);
  54
  55 if ((bool)ini_get('register_globals') === true)
  56 {
  57         $superglobals = array('_GET', '_COOKIE', '_FILES', '_POST', '_SERVER', '_ENV');
  58         foreach ($superglobals AS $global)
  59         {
  60                 if (is_array(${$global}))
  61                 {
  62                         foreach (${$global} AS $_key => $_val)
  63                         {
  64                                 if (isset(${$_key}))
  65                                 {
  66                                         unset(${$_key});
  67                                 }
  68                         }
  69                 }
  70         }
  71 }
  72
  73 /**
  74 * Iris Studios Shared Object Framework (ISSO)
  75 *
  76 * This framework allows a common backend to be used amongst all Iris
  77 * Studios applications and can is built to be abstract and flexible.
  78 * The base framework handles all loading and module management.
  79 *
  80 * @author               Iris Studios, Inc.
  81 * @copyright    Copyright ©2002 - [#]year[#], Iris Studios, Inc.
  82 * @version              $Revision$
  83 *
  84 */
  85 class Shared_Object_Framework
  86 {
  87         /**
  88         * Global environment variables
  89         *
  90         * This is where we keep the global variables that are used within the shared framework
  91         *
  92         * @var  version                 ISSO version
  93         * @var  sourcepath              The location of the framework sources
  94         * @var  appath                  The path to the application's location
  95         * @var  application             The name of the application that is using the framework
  96         * @var  appversion              The version of the application
  97         * @var  debug                   Variable for debug mode
  98         * @var  debuginfo               Listing of all debug notices
  99         * @var  modules                 An array of loaded framework modules
 100         * @var  input                   All input data for the system
 101         * @var  i                               Short-hand reference to $isso::input
 102         * @var  in                              Short-hand reference to $isso::input
 103         * @var  magicquotes             Status of Magic Quotes GPC
 104         * @var  escapestrings   Sets whether or not we escape strings automatically
 105         */
 106         var $version = '[#]version[#]';
 107         var $sourcepath = '';
 108         var $apppath = '';
 109         var $application = '';
 110         var $appversion = '';
 111         var $debug = false;
 112         var $debuginfo = array();
 113         var $modules = array();
 114         var $input = array();
 115         var $i = array();
 116         var $in = array();
 117         var $magicquotes = 0;
 118         var $escapestrings = false;
 119
 120         /**
 121         * Constructor
 122         */
 123         function Shared_Object_Framework()
 124         {
 125                 // error reporting
 126                 set_error_handler(array(&$this, '_error_handler'));
 127
 128                 // magic quotes
 129                 $this->magicquotes = get_magic_quotes_gpc();
 130                 set_magic_quotes_runtime(0);
 131
 132                 if (defined('ISSO_ESCAPE_STRINGS'))
 133                 {
 134                         $this->escapestrings = (bool)constant('ISSO_ESCAPE_STRINGS');
 135                 }
 136
 137                 // start input sanitize using variable_order GP
 138                 if (!$this->escapestrings)
 139                 {
 140                         $this->exec_sanitize_data();
 141                 }
 142
 143                 $this->modules['kernel'] = 'Shared Object Framework Core';
 144         }
 145
 146         /**
 147         * Prepares a path for being set as the sourcepath
 148         *
 149         * @param        str             Source path or URL
 150         *
 151         * @return       str             Prepared source path
 152         */
 153         function fetch_sourcepath($source)
 154         {
 155                 if (substr($source, strlen($source) - 1) != '/')
 156                 {
 157                         $source .= '/';
 158                 }
 159                 return $source;
 160         }
 161
 162         /**
 163         * Loads a framework extension
 164         *
 165         * @param        str             Name of the framework
 166         */
 167         function load($framework)
 168         {
 169                 if (!$this->is_loaded($framework))
 170                 {
 171                         $newobj = $this->locate($framework);
 172                         $this->$newobj['OBJ'] = new $newobj['CLASS']();
 173                         $GLOBALS["$newobj[OBJ]"] =& $this->$newobj['OBJ'];
 174                         $this->modules["$framework"] = $newobj['OBJECT'];
 175                 }
 176         }
 177
 178         /**
 179         * Includes a framework module. Module definitions need three variables:
 180         * class, object, and obj. Class is the name of the class, object is
 181         * the name human-readable name, and obj is the name that the module
 182         * should be initialized as; this is used in class extensions.
 183         *
 184         * @param        str             Name of the framework
 185         *
 186         * @return       array   List of initialization variables
 187         */
 188         function locate($framework)
 189         {
 190                 if ($this->sourcepath == '')
 191                 {
 192                         trigger_error('Invalid sourcepath specified', E_USER_ERROR);
 193                 }
 194
 195                 if (file_exists($this->sourcepath . $framework . '.php'))
 196                 {
 197                         require_once($this->sourcepath . $framework . '.php');
 198                         return array('CLASS' => $CLASS, 'OBJECT' => $OBJECT, 'OBJ' => $OBJ);
 199                 }
 200                 else
 201                 {
 202                         trigger_error('Could not find the framework ' . $this->sourcepath . $framework . '.php', E_USER_ERROR);
 203                         exit;
 204                 }
 205         }
 206
 207         /**
 208         * Prints a list of all currently loaded framework modules
 209         *
 210         * @param        bool            Return the data as an array?
 211         *
 212         * @return       mixed           HTML output or an array of loaded modules
 213         */
 214         function show_modules($return = false)
 215         {
 216                 if ($return)
 217                 {
 218                         return $this->modules;
 219                 }
 220                 else
 221                 {
 222                         $output = "\n\n<ul>\n\t<li>";
 223                         $output .= implode("</li>\n\t<li>", $this->modules);
 224                         $output .= "</li>\n</ul>\n\n";
 225                         $this->_message('Loaded Modules', $output, 1);
 226                 }
 227         }
 228
 229         /**
 230         * Verifies to see if a framework has been loaded
 231         *
 232         * @param        str                     Framework name
 233         *
 234         * @return       bool            Whether or not the framework has been loaded
 235         */
 236         function is_loaded($framework)
 237         {
 238                 if (isset($this->modules["$framework"]))
 239                 {
 240                         return true;
 241                 }
 242                 else
 243                 {
 244                         return false;
 245                 }
 246         }
 247
 248         /**
 249         * Prints an ISSO message
 250         *
 251         * @param        str             The title of the message
 252         * @param        str             The content of the message
 253         * @param        int             Type of message to be printed
 254         * @param        bool    Return the output?
 255         *
 256         * @return       mixed   Output or null
 257         */
 258         function _message($title, $message, $type, $return = false)
 259         {
 260                 switch ($type)
 261                 {
 262                         // Message
 263                         case 1:
 264                                 $prefix = 'Message';
 265                                 $color = '#669900';
 266                                 $font = '#000000';
 267                         break;
 268
 269                         // Warning
 270                         case 2:
 271                                 $prefix = 'Warning';
 272                                 $color = '#003399';
 273                                 $font = '#FFFFFF';
 274                         break;
 275
 276                         case 3:
 277                                 $prefix = 'Error';
 278                                 $color = '#990000';
 279                                 $font = '#EFEFEF';
 280                         break;
 281                 }
 282
 283                 $output = "\n<br />\n<table cellpadding=\"4\" cellspacing=\"1\" border=\"0\" width=\"500\" style=\"background-color: $color; font-family: Verdana, sans-serif; font-size: 12px;\">";
 284                 $output .= "\n<tr style=\"color: $font\">\n\t<td><strong>$prefix: $title</strong></td>\n</tr>";
 285                 $output .= "\n<tr style=\"background-color: #FFFFFF\">\n\t<td>$message</td>\n</tr>\n</table>\n<br />\n";
 286
 287                 if ($return)
 288                 {
 289                         return $output;
 290                 }
 291                 else
 292                 {
 293                         print($output);
 294                 }
 295         }
 296
 297         /**
 298         * Custom error handler for ISSO
 299         * We only handle E_WARNING, E_NOTICE, E_USER_ERROR, E_USER_WARNING, E_USER_NOTICE
 300         *
 301         * @param        int             Error number
 302         * @param        str             Error message string
 303         * @param        str             File that contains the error
 304         * @param        str             The line number of the error
 305         * @param        str             The active symbol table at which point the error occurred
 306         */
 307         function _error_handler($errno, $errstr, $errfile, $errline)
 308         {
 309                 switch ($errno)
 310                 {
 311                         // Fatal
 312                         case E_USER_ERROR:
 313                                 $title = 'Fatal';
 314                                 if (!(ini_get('error_reporting') & E_USER_ERROR))
 315                                 {
 316                                         return;
 317                                 }
 318                         break;
 319
 320                         // Error
 321                         case E_USER_WARNING:
 322                                 $title = 'Warning';
 323                                 if (!(ini_get('error_reporting') & E_USER_WARNING) AND !(ini_get('error_reporting') & E_WARNING))
 324                                 {
 325                                         return;
 326                                 }
 327                         break;
 328
 329                         // Warning
 330                         case E_USER_NOTICE:
 331                         default:
 332                                 $title = 'Notice';
 333                                 if (!(ini_get('error_reporting') & E_USER_NOTICE) AND !(ini_get('error_reporting') & E_NOTICE))
 334                                 {
 335                                         return;
 336                                 }
 337                         break;
 338                 }
 339
 340                 $errfile = str_replace(getcwd(), '', $errfile);
 341
 342                 $errstr .= " in <strong>$errfile</strong> on line <strong>$errline</strong>";
 343
 344                 $this->_message($title, $errstr, 3);
 345
 346                 if ($errno == E_USER_ERROR)
 347                 {
 348                         exit;
 349                 }
 350         }
 351
 352         /**
 353         * Logs a debug message for verbose output
 354         *
 355         * @param        str             Message
 356         */
 357         function debug($message)
 358         {
 359                 $this->debuginfo[] = $message;
 360         }
 361
 362         /**
 363         * Recursive XSS cleaner
 364         *
 365         * @param        mixed   Unsanitized REQUEST data
 366         *
 367         * @return       mixed   Sanitized data
 368         */
 369         function _sanitize_input_recursive($data)
 370         {
 371                 foreach ($data AS $key => $value)
 372                 {
 373                         if (is_array($value))
 374                         {
 375                                 $data["$key"] = $this->_sanitize_input_recursive($value);
 376                         }
 377                         else
 378                         {
 379                                 if ($this->escapestrings)
 380                                 {
 381                                         $data["$key"] = $this->escape($this->sanitize($value));
 382                                 }
 383                                 else
 384                                 {
 385                                         $data["$key"] = $this->sanitize($value);
 386                                 }
 387                         }
 388                 }
 389                 return $data;
 390         }
 391
 392         /**
 393         * Simple way to protect against HTML attacks with Unicode support
 394         *
 395         * @param        str             Unsanitzed text
 396         *
 397         * @return       str             Properly protected text that only encodes potential threats
 398         */
 399         function sanitize($text)
 400         {
 401                 if ($this->magicquotes)
 402                 {
 403                         return str_replace(array('<', '>', '\"', '"'), array('&lt;', '&gt;', '&quot;', '&quot;'), $text);
 404                 }
 405                 else
 406                 {
 407                         return str_replace(array('<', '>', '"'), array('&lt;', '&gt;', '&quot;'), $text);
 408                 }
 409         }
 410
 411         /**
 412         * Takes text that has been processed for HTML and unsanitizes it
 413         *
 414         * @param        str             Text that needs to be turned back into HTML
 415         * @param        bool    Force magicquotes off
 416         *
 417         * @return       str             Unsanitized text
 418         */
 419         function unsanitize($text, $force = false)
 420         {
 421                 if ($this->magicquotes AND !$force)
 422                 {
 423                         return str_replace(array('&lt;', '&gt;', '&quot;'), array('<', '>', '\"'), $text);
 424                 }
 425                 else
 426                 {
 427                         return str_replace(array('&lt;', '&gt;', '&quot;'), array('<', '>', '"'), $text);
 428                 }
 429         }
 430
 431         /**
 432         * Smart addslashes() that only applies itself it the Magic Quotes GPC is off
 433         *
 434         * @param        str             Some string
 435         * @param        bool    If the data is binary; if so it'll be run through DB::escape_string()
 436         * @param        bool    Force magic quotes to be off
 437         *
 438         * @return       str             String that has slashes added
 439         */
 440         function escape($str, $binary = false, $force = false)
 441         {
 442                 global $_isso;
 443
 444                 if ($this->magicquotes AND !$force)
 445                 {
 446                         if (isset($_isso->db) AND $binary)
 447                         {
 448                                 if (is_resource($_isso->db->link_id))
 449                                 {
 450                                         return $_isso->db->escape_string(stripslashes($str));
 451                                 }
 452                         }
 453                         return $str;
 454                 }
 455                 else
 456                 {
 457                         if (isset($_isso->db) AND $binary)
 458                         {
 459                                 if (is_resource($_isso->db->link_id))
 460                                 {
 461                                         return $_isso->db->escape_string($str);
 462                                 }
 463                         }
 464                         return addslashes($str);
 465                 }
 466         }
 467
 468         /**
 469         * Runs through all of the input data and sanitizes it.
 470         */
 471         function exec_sanitize_data()
 472         {
 473                 $this->input = $this->_sanitize_input_recursive(array_merge($_GET, $_POST));
 474                 $this->i =& $this->input;
 475                 $this->in =& $this->input;
 476                 // we're now using magic quotes
 477                 if ($this->escapestrings)
 478                 {
 479                         $this->magicquotes = 1;
 480                 }
 481         }
 482 }
 483
 484 /**
 485 * Global callback used for module calls back to the kernel
 486 */
 487 $_isso = new Shared_Object_Framework();
 488
 489 /**
 490 * Wrapper for ternary operator that has to be in the global scope.
 491 * This function is going to be removed from our applications due
 492 * to it's latency in processing. This will remain here purely
 493 * for legacy reasons. It will be removed when necessary.
 494 *
 495 * @param        expr    Expression
 496 * @param        mixed   If the expression is true
 497 * @param        mixed   If the expression is false
 498 *
 499 * @return       mixed   True or false data
 500 */
 501 function iff($condition, $iftrue, $iffalse = null)
 502 {
 503         return ($condition) ? ($iftrue) : ($iffalse);
 504 }
 505
 506 if (defined('ISSO_CHECK_POST_REFERER'))
 507 {
 508         if ($_SERVER['REQUEST_METHOD'] == 'POST')
 509         {
 510                 $host = ($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : $_ENV['HTTP_HOST'];
 511                 $parts = parse_url($_SERVER['HTTP_REFERER']);
 512                 $ourhost = $parts['host'] . (($parts['port']) ? ":$parts[port]" : '');
 513
 514                 if ($ourhost != $host)
 515                 {
 516                         trigger_error('No external hosts are allowed to POST to this application', E_USER_ERROR);
 517                 }
 518                 $_isso->debug('remote post check = ok');
 519         }
 520 }
 521
 522 /*=====================================================================*\
 523 || ###################################################################
 524 || # $HeadURL$
 525 || # $Id$
 526 || ###################################################################
 527 \*=====================================================================*/
 528 ?>