]> src.bluestatic.org Git - isso.git/blob - kernel.php
Removing the binary switch from ISSO::escape()
[isso.git] / kernel.php
1 <?php
2 /*=====================================================================*\
3 || ###################################################################
4 || # Iris Studios Shared Object Framework [#]version[#]
5 || # Copyright ©2002-[#]year[#] Iris Studios, Inc.
6 || #
7 || # This program is free software; you can redistribute it and/or modify
8 || # it under the terms of the GNU General Public License as published by
9 || # the Free Software Foundation; version [#]gpl[#] of the License.
10 || #
11 || # This program is distributed in the hope that it will be useful, but
12 || # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 || # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
14 || # more details.
15 || #
16 || # You should have received a copy of the GNU General Public License along
17 || # with this program; if not, write to the Free Software Foundation, Inc.,
18 || # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
19 || ###################################################################
20 \*=====================================================================*/
21
22 /**
23 * Iris Studios Shared Object Framework Kernel
24 * kernel.php
25 *
26 * @package ISSO
27 */
28
29 if (!function_exists('version_compare'))
30 {
31 trigger_error('You need PHP version 4.1.0 or newer to run ISSO', E_USER_ERROR);
32 exit;
33 }
34
35 // when we are PHP5-nat instead of PHP5-compat, we can remove this
36 if (version_compare(PHP_VERSION, '5.0.0', '>='))
37 {
38 if (ini_get('error_reporting') & E_NOTICE)
39 {
40 error_reporting(ini_get('error_reporting') - E_NOTICE);
41 }
42 if (ini_get('error_reporting') & E_USER_NOTICE)
43 {
44 error_reporting(ini_get('error_reporting') - E_USER_NOTICE);
45 }
46 }
47
48 if ((bool)ini_get('register_globals') === true)
49 {
50 $superglobals = array('_GET', '_COOKIE', '_FILES', '_POST', '_SERVER', '_ENV');
51 foreach ($superglobals AS $global)
52 {
53 if (is_array(${$global}))
54 {
55 foreach (${$global} AS $_key => $_val)
56 {
57 if (isset(${$_key}))
58 {
59 unset(${$_key});
60 }
61 }
62 }
63 }
64 }
65
66 $oldlevel = ini_get('error_reporting');
67 $newlevel = $oldlevel;
68 $levels = array(E_ERROR => E_USER_ERROR, E_WARNING => E_USER_WARNING, E_NOTICE => E_USER_NOTICE);
69 foreach ($levels AS $php => $isso)
70 {
71 if ($oldlevel & $php)
72 {
73 if (!($oldlevel & $isso))
74 {
75 $newlevel += $isso;
76 }
77 }
78 else
79 {
80 if ($oldlevel & $isso)
81 {
82 $newlevel -= $isso;
83 }
84 }
85 }
86 error_reporting($newlevel);
87
88 /**#@+
89 * Input cleaning type constant
90 */
91 /**
92 * Integer type
93 */
94 define('TYPE_INT', 1);
95
96 /**
97 * Unsigned integer
98 */
99 define('TYPE_UINT', 2);
100
101 /**
102 * Float type
103 */
104 define('TYPE_FLOAT', 4);
105
106 /**
107 * Boolean type
108 */
109 define('TYPE_BOOL', 8);
110
111 /**
112 * String - cleaned
113 */
114 define('TYPE_STR', 16);
115
116 /**
117 * String - deliberate unclean
118 */
119 define('TYPE_STRUN', 32);
120
121 /**
122 * No cleaning - here for use in API
123 */
124 define('TYPE_NOCLEAN', 64);
125 /**#@-*/
126
127 /**
128 * Yes, required
129 */
130 define('REQ_YES', 1);
131
132 /**
133 * No, not required
134 */
135 define('REQ_NO', 0);
136
137 /**
138 * Iris Studios Shared Object Framework (ISSO)
139 *
140 * This framework allows a common backend to be used amongst all Iris
141 * Studios applications and is built to be abstract and flexible.
142 * The base framework handles all loading and module management.
143 *
144 * Constants:
145 * ISSO_NO_INPUT_SANITIZE - Disables the automatic input sanitizer
146 * ISSO_CHECK_POST_REFERER - Will check to make sure that on POSTed
147 * data, the referer matches the host
148 * ISSO_MT_START - Define the microtime() value at the top of your
149 * script and this will calculate the total execution
150 * time
151 * SVN - Place SVN keywords (like $Id) to display the information on output
152 *
153 * @author Iris Studios, Inc.
154 * @copyright Copyright ©2002 - [#]year[#], Iris Studios, Inc.
155 * @version $Revision$
156 * @package ISSO
157 *
158 */
159 class ISSO
160 {
161 /**
162 * ISSO version
163 * @var string
164 * @access private
165 */
166 var $version = '[#]version[#]';
167
168 /**
169 * Location of ISSO, used for internal linking
170 * @var string
171 * @access private
172 */
173 var $sourcepath = '';
174
175 /**
176 * Path of the current application
177 * @var string
178 * @access private
179 */
180 var $apppath = '';
181
182 /**
183 * Web path used to get the web location of the installation of ISSO; only used for Printer module
184 * @var string
185 * @access private
186 */
187 var $webpath = '';
188
189 /**
190 * Name of the current application
191 * @var string
192 * @access private
193 */
194 var $application = '';
195
196 /**
197 * Version of the current application
198 * @var string
199 * @access private
200 */
201 var $appversion = '';
202
203 /**
204 * Whether debug mode is on or off
205 * @var bool
206 * @access private
207 */
208 var $debug = false;
209
210 /**
211 * List of all active debug messages
212 * @var array
213 * @access private
214 */
215 var $debuginfo = array();
216
217 /**
218 * List of loaded modules
219 * @var array
220 * @access private
221 */
222 var $modules = array();
223
224 /**
225 * An array of sanitized variables that have been cleaned for HTML tag openers and double quotes
226 * @var array
227 * @access public
228 */
229 var $in = array();
230
231 /**
232 * If we are running with magic_quotes_gpc on or off
233 * @var int
234 * @access private
235 */
236 var $magicquotes = 0;
237
238 /**
239 * Array of user-specified fields that are required for ISSO initialization
240 * fieldname => array(REQUIRED, CALLBACK PARSER, SET)
241 * @var array
242 * @access private
243 */
244 var $fields = array(
245 'sourcepath' => array(REQ_YES, 'fetch_sourcepath', false),
246 'apppath' => array(REQ_YES, 'fetch_sourcepath', false),
247 'webpath' => array(REQ_NO, 'fetch_sourcepath', false),
248 'application' => array(REQ_YES, null, false),
249 'appversion' => array(REQ_NO, null, false),
250 'debug' => array(REQ_NO, null, false)
251 );
252
253 // ###################################################################
254 /**
255 * Constructor
256 */
257 function __construct()
258 {
259 $GLOBALS['isso:callback'] = null;
260
261 // error reporting
262 set_error_handler(array(&$this, '_error_handler'));
263
264 // magic quotes
265 $this->magicquotes = get_magic_quotes_gpc();
266 set_magic_quotes_runtime(0);
267
268 // attempt to set the sourcepath
269 $path = call_user_func('debug_backtrace');
270 $this->set('sourcepath', str_replace('kernel.php', '', $path[0]['file']));
271
272 // start input sanitize using variable_order GPC
273 if (!defined('ISSO_NO_INPUT_SANITIZE'))
274 {
275 $this->exec_sanitize_data();
276 }
277
278 if (defined('ISSO_CHECK_POST_REFERER'))
279 {
280 $this->exec_referer_check();
281 }
282 }
283
284 // ###################################################################
285 /**
286 * (PHP 4) Constructor
287 */
288 function ISSO()
289 {
290 $this->__construct();
291 }
292
293 // ###################################################################
294 /**
295 * Sets a specified field in the ISSO. This is used to set all the
296 * required fields that ISSO uses for linking. It replaces the old
297 * method of setting the instance variables directly.
298 *
299 * @access public
300 *
301 * @param string Field name
302 * @param mixed Value of the field
303 */
304 function set($fieldname, $value)
305 {
306 $this->do_set($fieldname, $value, null);
307 }
308
309 // ###################################################################
310 /**
311 * Does the actual setting of the field. set() is defined in each
312 * module, but this controls the actual data. This is done so that
313 * there isn't an extra parameter in set() that controls module spaces
314 *
315 * @access protected
316 *
317 * @param string Field name
318 * @param mixed Value
319 * @param string Module name (as referred to in ISSO->modules[]) to place in
320 */
321 function do_set($fieldname, $value, $module)
322 {
323 if ($module == null)
324 {
325 $field =& $this->fields["$fieldname"];
326 }
327 else
328 {
329 $field =& $this->modules["$module"]->fields["$fieldname"];
330 }
331
332 if (is_array($field))
333 {
334 if ($field[1] != null)
335 {
336 if (preg_match('#^\$(.*)#', $field[1]))
337 {
338 $caller = preg_replace('#^\$(.*)->([a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*)$#', 'array(&$\1, "\2")', $field[1]);
339 eval('$caller = ' . $caller . ';');
340 }
341 else
342 {
343 $caller = array(&$this, $field[1]);
344 }
345
346 $value = call_user_func($caller, $value);
347 }
348
349 if ($module == null)
350 {
351 $this->$fieldname = $value;
352 }
353 else
354 {
355 $this->modules["$module"]->$fieldname = $value;
356 }
357
358 $field[2] = true;
359 }
360 else
361 {
362 trigger_error('Invalid field `' . $module . '.' . $fieldname . '` specified in ISSO->do_set()', E_USER_ERROR);
363 }
364 }
365
366 // ###################################################################
367 /**
368 * Fetches the value of a field. This is protected because get() should
369 * be defined in each module to make a call to this function.
370 *
371 * @access protected
372 *
373 * @param string Field name
374 * @param string Module name (as referred to in ISSO->modules[]) to fetch from
375 */
376 function do_get($fieldname, $module)
377 {
378 if ($module == null)
379 {
380 $field =& $this->fields["$fieldname"];
381 }
382 else
383 {
384 $field =& $this->modules["$module"]->fields["$fieldname"];
385 }
386
387 if (is_array($field))
388 {
389 if ($field[2] == false)
390 {
391 trigger_error('Field ' . $module . ':: ' . $filedname . ' is not set and therefore cannot be get()', E_USER_ERROR);
392 }
393
394 if ($module == null)
395 {
396 return $this->$fieldname;
397 }
398 else
399 {
400 return $this->modules["$module"]->$fieldname;
401 }
402
403 $field[2] = true;
404 }
405 else
406 {
407 trigger_error('Invalid field `' . $module . '.' . $fieldname . '` specified in ISSO->do_get()', E_USER_ERROR);
408 }
409 }
410
411 // ###################################################################
412 /**
413 * Returns the value of an ISSO field. You should not access any instance
414 * variables directly, use this instead.
415 *
416 * @access public
417 *
418 * @param string Field name
419 *
420 * @return mixed Value of the field
421 */
422 function get($fieldname)
423 {
424 return $this->do_get($fieldname, null);
425 }
426
427 // ###################################################################
428 /**
429 * Makes sure that all of the required fields in ISSO are set before
430 * any action is done. This will throw an error block describing
431 * the fields that need to be set if any are missing.
432 *
433 * @access public
434 *
435 * @param string Module to check for; null is kernel, string is a module name, false is all
436 * @param bool Is this a non-error environment that should display all fields?
437 */
438 function check_isso_fields($module = null, $called = false)
439 {
440 $missing = array();
441
442 if ($module === false)
443 {
444 $modules = $this->show_modules(true);
445 }
446 else if ($module === null)
447 {
448 $modules = array(get_class($this));
449 }
450 else
451 {
452 $modules = array($module);
453 }
454
455 foreach ($modules AS $module)
456 {
457 if (empty($this->modules["$module"]->fields))
458 {
459 continue;
460 }
461
462 foreach ($this->modules["$module"]->fields AS $name => $field)
463 {
464 if ($field[0] == REQ_YES AND $field[2] == false AND $called == false)
465 {
466 $missing[] = $module . ':: ' . $name;
467 }
468 else if ($called == true AND $field[2] == false)
469 {
470 $missing[] = $module . ':: ' . $name . ($field[0] == REQ_YES ? ' <strong>(REQUIRED)</strong>' : '');
471 }
472 }
473 }
474
475 if (sizeof($missing) > 0)
476 {
477 $error = ($called ? 'The following fields are not set:' : 'You are missing required ISSO fields. Please make sure you have set:');
478 $error .= "\n";
479 $error .= '<ul>';
480
481 foreach ($missing AS $field)
482 {
483 $error .= "\n\t" . '<li>' . $field . '</li>';
484 }
485
486 $error .= "\n" . '</ul>';
487
488 $this->message(($called ? '' : 'Missing ') . 'Fields', $error, ($called ? 1 : 3));
489
490 if ($called == false)
491 {
492 exit;
493 }
494 }
495 }
496
497 // ###################################################################
498 /**
499 * Prepares a path for being set as the sourcepath
500 *
501 * @access public
502 *
503 * @param string Source path or URL
504 *
505 * @return string Prepared source path
506 */
507 function fetch_sourcepath($source)
508 {
509 if (substr($source, strlen($source) - 1) != DIRECTORY_SEPARATOR)
510 {
511 $source .= DIRECTORY_SEPARATOR;
512 }
513 return $source;
514 }
515
516 // ###################################################################
517 /**
518 * Loads a framework module
519 *
520 * @access public
521 *
522 * @param string Name of the framework file to load
523 * @param string Internal variable to initialize as; to not instantiate (just require) leave it as NULL
524 * @param bool Globalize the internal variable?
525 *
526 * @return object Instantiated instance
527 */
528 function &load($framework, $asobject, $globalize = false)
529 {
530 $this->check_isso_fields(null);
531
532 // set the object interlock
533 if (!method_exists($GLOBALS['isso:callback'], 'load'))
534 {
535 $GLOBALS['isso:callback'] =& $this;
536 $this->modules['isso'] =& $this;
537 }
538
539 if ($this->is_loaded($framework))
540 {
541 return $this->modules["$framework"];
542 }
543
544 if ($this->sourcepath == '')
545 {
546 trigger_error('Invalid sourcepath specified', E_USER_ERROR);
547 }
548
549 if (file_exists($this->sourcepath . $framework . '.php'))
550 {
551 require_once($this->sourcepath . $framework . '.php');
552 }
553 else
554 {
555 trigger_error('Could not find the framework ' . $this->sourcepath . $framework . '.php', E_USER_ERROR);
556 }
557
558 if ($asobject === null)
559 {
560 return;
561 }
562
563 if (isset($this->$asobject))
564 {
565 trigger_error('Cannot instantiate framework `' . $framework . '` into `' . $asobject . '`', E_USER_ERROR);
566 }
567
568 $this->$asobject = new $framework($this);
569
570 $this->modules["$framework"] =& $this->$asobject;
571
572 if ($globalize)
573 {
574 $GLOBALS["$asobject"] =& $this->$asobject;
575 }
576
577 // allow for init_as_package to link
578 if (method_exists($this->modules["$framework"], 'init_as_package'))
579 {
580 $this->modules[ $this->modules["$framework"]->init_as_package() ] =& $this->modules["$framework"];
581 }
582
583 return $this->$asobject;
584 }
585
586 // ###################################################################
587 /**
588 * Prints a list of all currently loaded framework modules
589 *
590 * @access public
591 *
592 * @param bool Return the data as an array?
593 *
594 * @return mixed HTML output or an array of loaded modules
595 */
596 function show_modules($return = false)
597 {
598 $modules = array();
599 foreach ($this->modules AS $object)
600 {
601 $module = get_class($object);
602 if (method_exists($object, 'init_as_package') AND in_array($module, $modules))
603 {
604 $module = $object->init_as_package() . " - ($module)";
605 }
606
607 $modules[] = $module;
608 }
609
610 if ($return)
611 {
612 return $modules;
613 }
614 else
615 {
616 $output = "\n\n<ul>\n\t<li>";
617 $output .= implode("</li>\n\t<li>", $modules);
618 $output .= "</li>\n</ul>\n\n";
619 $this->message('Loaded Modules', $output, 1);
620 }
621 }
622
623 // ###################################################################
624 /**
625 * Verifies to see if a framework has been loaded
626 *
627 * @access public
628 *
629 * @param string Framework name
630 *
631 * @return bool Whether or not the framework has been loaded
632 */
633 function is_loaded($framework)
634 {
635 if (isset($this->modules["$framework"]))
636 {
637 return true;
638 }
639 else
640 {
641 return false;
642 }
643 }
644
645 // ###################################################################
646 /**
647 * Prints an ISSO message
648 *
649 * @access public
650 *
651 * @param string The title of the message
652 * @param string The content of the message
653 * @param integer Type of message to be printed
654 * @param bool Return the output?
655 * @param bool Show the debug stack?
656 * @param integer Message width
657 *
658 * @return mixed Output or null
659 */
660 function message($title, $message, $type, $return = false, $stack = true, $width = 500)
661 {
662 switch ($type)
663 {
664 // Message
665 case 1:
666 $prefix = 'Message';
667 $color = '#669900';
668 $font = '#000000';
669 break;
670
671 // Warning
672 case 2:
673 $prefix = 'Warning';
674 $color = '#003399';
675 $font = '#FFFFFF';
676 break;
677
678 case 3:
679 $prefix = 'Error';
680 $color = '#990000';
681 $font = '#EFEFEF';
682 break;
683 }
684
685 $backtrace = debug_backtrace();
686 array_shift($backtrace);
687
688 if (isset($backtrace[0]) AND $backtrace[0]['function'] == '_error_handler')
689 {
690 array_shift($backtrace);
691 }
692
693 $trace = $this->format_debug_trace($backtrace);
694
695 $output = "\n<br />\n<table cellpadding=\"4\" cellspacing=\"1\" border=\"0\" width=\"$width\" style=\"background-color: $color; color: black; font-family: Verdana, sans-serif; font-size: 12px;\">";
696 $output .= "\n<tr style=\"color: $font; text-align: left\">\n\t<td><strong>$prefix: $title</strong></td>\n</tr>";
697 $output .= "\n<tr style=\"background-color: #FFFFFF; text-align: left\">\n\t<td>$message</td>\n</tr>";
698 $output .= (($stack AND $GLOBALS['isso:callback']->debug) ? "\n<tr style=\"background-color: #FFFFFF; text-align: left\">\n\t<td><strong>Debug Stack:</strong> <pre>" . implode("\n", $trace) . "</pre></td>\n</tr>" : '');
699 $output .= "\n</table>\n<br />\n";
700
701 if ($return)
702 {
703 return $output;
704 }
705 else
706 {
707 print($output);
708 }
709 }
710
711 // ###################################################################
712 /**
713 * Prepares a debug_backtrace() array for output to the browser by
714 * compressing the array into visible text
715 *
716 * @access public
717 *
718 * @param array debug_backtrace() array
719 *
720 * @return array Formatted trace output
721 */
722 function format_debug_trace($backtrace)
723 {
724 $trace = array();
725 foreach ($backtrace AS $i => $step)
726 {
727 $file = $step['file'] . ':' . $step['line'];
728 $funct = (isset($step['class']) ? $step['class'] . '::' . $step['function'] : $step['function']);
729 $args = (is_array($step['args']) ? implode(', ', $step['args']) : '');
730
731 $trace[] = "#$i $funct($args) called at [$file]";
732 }
733
734 return $trace;
735 }
736
737 // ###################################################################
738 /**
739 * Custom error handler for ISSO; only handle E_WARNING, E_NOTICE,
740 * E_USER_ERROR, E_USER_WARNING, E_USER_NOTICE
741 *
742 * @access private
743 *
744 * @param integer Error number
745 * @param string Error message string
746 * @param string File that contains the error
747 * @param string The line number of the error
748 * @param string The active symbol table at which point the error occurred
749 */
750 function _error_handler($errno, $errstr, $errfile, $errline)
751 {
752 switch ($errno)
753 {
754 // Fatal
755 case E_USER_ERROR:
756 $title = 'Fatal';
757 $level = 3;
758 if (!(ini_get('error_reporting') & E_USER_ERROR))
759 {
760 return;
761 }
762 break;
763
764 // Error
765 case E_USER_WARNING:
766 $title = 'Warning';
767 $level = 2;
768 if (!(ini_get('error_reporting') & E_USER_WARNING) AND !(ini_get('error_reporting') & E_WARNING))
769 {
770 return;
771 }
772 break;
773
774 // Warning
775 case E_USER_NOTICE:
776 default:
777 $title = 'Notice';
778 $level = 1;
779 if (!(ini_get('error_reporting') & E_USER_NOTICE) AND !(ini_get('error_reporting') & E_NOTICE))
780 {
781 return;
782 }
783 break;
784 }
785
786 $errstr .= " in <strong>$errfile</strong> on line <strong>$errline</strong>";
787
788 $errstr = str_replace(array(getcwd(), dirname(getcwd())), '', $errstr);
789
790 $this->message($title, $errstr, $level);
791
792 if ($errno == E_USER_ERROR)
793 {
794 exit;
795 }
796 }
797
798 // ###################################################################
799 /**
800 * Creates a table that explains the error reporting levels and their
801 * state
802 *
803 * @access public
804 */
805 function explain_error_reporting()
806 {
807 $levels = array(
808 'E_ERROR' => E_ERROR,
809 'E_WARNING' => E_WARNING,
810 'E_PARSE' => E_PARSE,
811 'E_NOTICE' => E_NOTICE,
812 'E_CORE_ERROR' => E_CORE_ERROR,
813 'E_CORE_WARNING' => E_CORE_WARNING,
814 'E_COMPILE_ERROR' => 64,
815 'E_COMPILE_WARNING' => 128,
816 'E_USER_ERROR' => E_USER_ERROR,
817 'E_USER_WARNING' => E_USER_WARNING,
818 'E_USER_NOTICE' => E_USER_NOTICE,
819 'E_ALL' => E_ALL,
820 'E_STRICT' => 2048
821 );
822
823 $table = '<table cellspacing="0" cellpadding="2" border="0">';
824
825 foreach ($levels AS $name => $value)
826 {
827 $table .= '
828 <tr>
829 <td>' . $name . '</td>
830 <td>' . (ini_get('error_reporting') & $value) . '</td>
831 </tr>';
832 }
833
834 $table .= '
835 </table>';
836
837 $this->message('Error Reporting', $table, 1);
838 }
839
840 // ###################################################################
841 /**
842 * Logs a debug message for verbose output
843 *
844 * @access public
845 *
846 * @param string Message
847 */
848 function debug($message)
849 {
850 $this->debuginfo[] = $message;
851 }
852
853 // ###################################################################
854 /**
855 * Recursive XSS cleaner
856 *
857 * @access private
858 *
859 * @param mixed Unsanitized REQUEST data
860 *
861 * @return mixed Sanitized data
862 */
863 function _sanitize_input_recursive($data)
864 {
865 foreach ($data AS $key => $value)
866 {
867 if (is_array($value))
868 {
869 $data["$key"] = $this->_sanitize_input_recursive($value);
870 }
871 else
872 {
873 $data["$key"] = $this->sanitize($value);
874 }
875 }
876 return $data;
877 }
878
879 // ###################################################################
880 /**
881 * Simple way to protect against HTML attacks with Unicode support
882 *
883 * @access public
884 *
885 * @param string Unsanitzed text
886 *
887 * @return string Properly protected text that only encodes potential threats
888 */
889 function sanitize($text)
890 {
891 if ($this->magicquotes)
892 {
893 return str_replace(array('<', '>', '\"', '"'), array('&lt;', '&gt;', '&quot;', '&quot;'), $text);
894 }
895 else
896 {
897 return str_replace(array('<', '>', '"'), array('&lt;', '&gt;', '&quot;'), $text);
898 }
899 }
900
901 // ###################################################################
902 /**
903 * Unicode-safe entity encoding system; similar to sanitize()
904 *
905 * @access public
906 *
907 * @param string Unsanitized text
908 *
909 * @return string Unicode-safe sanitized text with entities preserved
910 */
911 function entity_encode($text)
912 {
913 $text = str_replace('&', '&amp;', $text);
914 $text = $this->sanitize($text);
915 return $text;
916 }
917
918 // ###################################################################
919 /**
920 * Takes text that has been processed for HTML and unsanitizes it
921 *
922 * @access public
923 *
924 * @param string Text that needs to be turned back into HTML
925 *
926 * @return string Unsanitized text
927 */
928 function unsanitize($text)
929 {
930 return str_replace(array('&lt;', '&gt;', '&quot;'), array('<', '>', '"'), $text);
931 }
932
933 // ###################################################################
934 /**
935 * Smart addslashes() that only applies itself it the Magic Quotes GPC
936 * is off. This should only be run on database query values.
937 *
938 * @access public
939 *
940 * @param string Some string
941 * @param bool Force magic quotes to be off
942 *
943 * @return string String that has slashes added
944 */
945 function escape($str, $force = true)
946 {
947 if ($this->magicquotes AND !$force)
948 {
949 if (isset($this->modules[ISSO_DB_LAYER]))
950 {
951 return $this->modules[ISSO_DB_LAYER]->escape_string(str_replace(array("\'", '\"'), array("'", '"'), $str));
952 }
953 return $str;
954 }
955 else
956 {
957 if (isset($this->modules[ISSO_DB_LAYER]))
958 {
959 return $this->modules[ISSO_DB_LAYER]->escape_string($str);
960 }
961 return addslashes($str);
962 }
963 }
964
965 // ###################################################################
966 /**
967 * Runs through all of the input data and sanitizes it.
968 *
969 * @access private
970 */
971 function exec_sanitize_data()
972 {
973 $this->in = $this->_sanitize_input_recursive(array_merge($_GET, $_POST, $_COOKIE));
974 }
975
976 // ###################################################################
977 /**
978 * Sanitize function for something other than a string (which
979 * everything is sanitized for if you use exec_sanitize_data(). Cleaned
980 * data is placed back into $isso->in; this makes it so you don't have
981 * to constantly intval() [etc.] data.
982 *
983 * @access public
984 *
985 * @param array Array of elements to clean as varname => type
986 */
987 function input_clean_array($vars)
988 {
989 foreach ($vars AS $varname => $type)
990 {
991 $this->input_clean($varname, $type);
992 }
993 }
994
995 // ###################################################################
996 /**
997 * Sanitize function that does a single variable as oppoesd to an array
998 * (see input_clean_array() for more details)
999 *
1000 * @access public
1001 *
1002 * @param string Variable name in $isso->in[]
1003 * @param integer Sanitization type constant
1004 */
1005 function input_clean($varname, $type)
1006 {
1007 if (isset($this->in["$varname"]))
1008 {
1009 $this->in["$varname"] = $this->clean($this->in["$varname"], $type);
1010 }
1011 else
1012 {
1013 $this->in["$varname"] = null;
1014 }
1015
1016 return $this->in["$varname"];
1017 }
1018
1019 // ###################################################################
1020 /**
1021 * Cleaning function that does the work for input_clean(); this is
1022 * moved here so it can be used to clean things that aren't in
1023 * $isso->in[]
1024 *
1025 * @access public
1026 *
1027 * @param mixed Data
1028 * @param integer Sanitization type constant
1029 *
1030 * @return mixed Cleaned data
1031 */
1032 function clean($value, $type)
1033 {
1034 if (is_array($value))
1035 {
1036 return $this->clean_array($value, $type);
1037 }
1038
1039 if ($type == TYPE_INT)
1040 {
1041 $value = intval($value);
1042 }
1043 else if ($type == TYPE_UINT)
1044 {
1045 $value = (($val = intval($value)) < 0 ? 0 : $val);
1046 }
1047 else if ($type == TYPE_FLOAT)
1048 {
1049 $value = floatval($value);
1050 }
1051 else if ($type == TYPE_BOOL)
1052 {
1053 $value = (bool)$value;
1054 }
1055 else if ($type == TYPE_STR)
1056 {
1057 $value = $value;
1058 }
1059 else if ($type == TYPE_STRUN)
1060 {
1061 $value = $this->unsanitize($value);
1062 }
1063 else if ($type == TYPE_NOCLEAN)
1064 {
1065 $value = $value;
1066 }
1067 else
1068 {
1069 trigger_error('Invalid clean type `' . $type . '` specified', E_USER_ERROR);
1070 }
1071
1072 return $value;
1073 }
1074
1075 // ###################################################################
1076 /**
1077 * Recursion function for ISSO->clean()
1078 *
1079 * @access private
1080 *
1081 * @param array Uncleaned array
1082 * @param integer Sanitization type constant
1083 *
1084 * @return array Cleaned array of data
1085 */
1086 function clean_array($array, $type)
1087 {
1088 foreach ($array AS $key => $value)
1089 {
1090 $array["$key"] = $this->clean($value, $type);
1091 }
1092
1093 return $array;
1094 }
1095
1096 // ###################################################################
1097 /**
1098 * Checks to see if a POST refer is actually from us
1099 *
1100 * @access public
1101 */
1102 function exec_referer_check()
1103 {
1104 if ($_SERVER['REQUEST_METHOD'] == 'POST')
1105 {
1106 $host = ($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : $_ENV['HTTP_HOST'];
1107
1108 if ($host AND $_SERVER['HTTP_REFERER'])
1109 {
1110 $parts = parse_url($_SERVER['HTTP_REFERER']);
1111 $ourhost = $parts['host'] . (isset($parts['port']) ? ":$parts[port]" : '');
1112
1113 if ($ourhost != $host)
1114 {
1115 trigger_error('No external hosts are allowed to POST to this application', E_USER_ERROR);
1116 }
1117 $this->debug('remote post check = ok');
1118 }
1119 else
1120 {
1121 $this->debug('remote post check = FAILED');
1122 }
1123 }
1124 }
1125
1126 // ###################################################################
1127 /**
1128 * Constructs a debug information box that contains various debugging
1129 * information points
1130 *
1131 * @access public
1132 *
1133 * @param bool Show template information?
1134 *
1135 * @return string Debugging block
1136 */
1137 function construct_debug_block($dotemplates)
1138 {
1139 $debug = '';
1140
1141 if ($this->debug)
1142 {
1143 $debug = "\n<ul>";
1144
1145 // templates
1146 if ($dotemplates)
1147 {
1148 $optlist = array();
1149 $usage = array();
1150 foreach ($this->modules['template']->usage AS $name => $count)
1151 {
1152 if (in_array($name, $this->modules['template']->uncached))
1153 {
1154 $optlist[] = $name . '[' . $count . ']';
1155 }
1156 $usage[] = $name . " ($count)";
1157 }
1158
1159 $sizeof = sizeof($this->modules['template']->uncached);
1160 if ($sizeof > 0)
1161 {
1162 $debug .= "\n\t<li><strong style=\"color: red\">Uncached Template(s):</strong> $sizeof ( " . implode(' &nbsp; ', $optlist) . " )</li>";
1163 }
1164 }
1165
1166 // source control
1167 $scinfo = 'Not Under Source Control';
1168 if (defined('SVN'))
1169 {
1170 $scinfo = constant('SVN');
1171
1172 if (preg_match('#\$Id:?\s*\$#', $scinfo))
1173 {
1174 $scinfo = 'Not Under Source Control';
1175 }
1176 else
1177 {
1178 $scinfo = preg_replace('#\$' . '(Head)?URL: (.+?) \$#e', "end(explode('/', '\\2'))", $scinfo);
1179 $scinfo = preg_replace('#\$' . '(LastModified)?Revision: (.+?) \$#', 'SVN \\2', $scinfo);
1180 $scinfo = preg_replace('#\$' . 'Id: (.+?) ([0-9].+?) [0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}(.+?) (.+?) \$#', '\\1 - SVN \\2', $scinfo);
1181 }
1182 }
1183
1184 $scinfo = trim($scinfo);
1185 $debug .= "\n\t<li><strong>Source Control:</strong> $scinfo</li>";
1186
1187 // query information
1188 if (is_object($this->modules[ISSO_DB_LAYER]))
1189 {
1190 $debug .= "\n\t<li><strong>Total Queries:</strong> " . sizeof($this->modules[ISSO_DB_LAYER]->history) . " (<a href=\"" . $this->sanitize($_SERVER['REQUEST_URI']) . ((strpos($_SERVER['REQUEST_URI'], '?') !== false) ? '&amp;query=1' : '?query=1') . "\">?</a>)</li>";
1191 }
1192
1193 // total execution time
1194 if (defined('ISSO_MT_START'))
1195 {
1196 $this->load('functions', 'functions');
1197 $debug .= "\n\t<li><strong>Total Execution Time:</strong> " . round($this->modules['functions']->fetch_microtime_diff(ISSO_MT_START), 10) . "</li>";
1198 }
1199
1200 // debug notices
1201 $debug .= "\n\t<li>\n\t\t<select>\n\t\t\t<option>Debug Notices (" . sizeof($this->debuginfo) . ")</option>";
1202 foreach ((array)$this->debuginfo AS $msg)
1203 {
1204 $debug .= "\n\t\t\t<option>--- $msg</option>";
1205 }
1206 $debug .= "\n\t\t</select>\n\t</li>";
1207
1208 // loaded modules
1209 $modules = $this->show_modules(true);
1210 $debug .= "\n\t<li>\n\t\t<select>\n\t\t\t<option>Loaded Modules (" . sizeof($modules) . ")</option>";
1211 foreach ($modules AS $mod)
1212 {
1213 $debug .= "\n\t\t\t<option>--- $mod</option>";
1214 }
1215 $debug .= "\n\t\t</select>\n\t</li>";
1216
1217 // template usage
1218 if ($dotemplates)
1219 {
1220 $debug .= "\n\t<li>\n\t\t<select>\n\t\t\t<option>Template Usage (" . array_sum($this->modules['template']->usage) . ")</option>";
1221 foreach ($usage AS $tpl)
1222 {
1223 $debug .= "\n\t\t\t<option>--- $tpl</option>";
1224 }
1225 $debug .= "\n\t\t</select>\n\t</li>";
1226 }
1227
1228 $debug .= "\n</ul>";
1229
1230 $debug = "\n\n<!-- dev debug -->\n<div align=\"center\">\n\n<hr />\n" . $this->message('Debug Information', $debug, 1, true, false) . "\n</div>\n<!-- / dev debug -->\n\n";
1231 }
1232
1233 return $debug;
1234 }
1235 }
1236
1237 /*=====================================================================*\
1238 || ###################################################################
1239 || # $HeadURL$
1240 || # $Id$
1241 || ###################################################################
1242 \*=====================================================================*/
1243 ?>