root/releases/0.673/lib/setup.php

Revision 770, 15.1 kB (checked in by ben, 2 years ago)

Privacy policy header for MSIE, so logins in iframes work.

  • Property svn:eol-style set to native
Line 
1 <?php
2
3 // declare our globals.
4 global $db;
5 global $USER;
6 global $CFG;
7 global $SESSION;
8 global $PAGE;
9
10 /// First try to detect some attacks on older buggy PHP versions
11 if (isset($_REQUEST['GLOBALS']) || isset($_COOKIE['GLOBALS']) || isset($_FILES['GLOBALS'])) {
12     die('Fatal: Illegal GLOBALS overwrite attempt detected!');
13 }
14
15 // set up perf.
16 init_performance_info();
17
18 /// Just say no to link prefetching (Moz prefetching, Google Web Accelerator, others)
19 /// http://www.google.com/webmasters/faq.html#prefetchblock
20
21 if (!empty($_SERVER['HTTP_X_moz']) && $_SERVER['HTTP_X_moz'] === 'prefetch'){
22     header($_SERVER['SERVER_PROTOCOL'] . ' 404 Prefetch Forbidden');       
23     trigger_error('Prefetch request forbidden.');
24     exit;
25 }
26
27 // Privacy policy for IE, bless its cotton socks
28
29 header('P3P:CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"');
30
31 // Set defaults for some variables
32
33 if (!isset($CFG->tagline)) {
34     $CFG->tagline = "";
35 }
36 if (empty($CFG->debug)) {
37     $CFG->debug = 0;
38 }
39 if (empty($CFG->publicinvite)) {
40     $CFG->publicinvite = $CFG->publicreg;
41 }
42 if (empty($CFG->emailfilter)) {
43     $CFG->emailfilter = "";
44 }
45 if (empty($CFG->maxusers)) {
46     $CFG->maxusers = 0;
47 }
48 if (empty($CFG->walledgarden)) {
49     $CFG->walledgarden = 0;
50 }
51
52 if (empty($CFG->framename)) {
53     $CFG->framename = null;
54 }
55
56 if (empty($CFG->defaultlocale)) {
57     $CFG->defaultlocale = 'en';
58 }
59
60 if (empty($CFG->disable_templatechanging)) {
61     $CFG->disable_usertemplates = false;
62 }
63
64 if (empty($CFG->disable_templatechanging)) {
65     $CFG->disable_templatechanging = false;
66 }
67
68 if (empty($CFG->disable_publiccomments)) {
69     $CFG->disable_publiccomments = false;
70 }
71
72 if (empty($CFG->curlpath)) {
73     $CFG->curlpath = false;
74 }
75
76 if (empty($CFG->cookiepath)) {
77     $pathcomponents = @parse_url($CFG->wwwroot);
78     if (!empty($pathcomponents['path'])) {
79         $CFG->cookiepath = $pathcomponents['path'];
80     } else {
81         $CFG->cookiepath = '/';
82     }
83     unset($pathcomponents);
84 }
85
86 $CFG->libdir = $CFG->dirroot . 'lib';
87
88 // set up our database connection
89 if ($CFG->debug & E_USER_ERROR) {
90     require_once($CFG->dirroot . 'lib/adodb/adodb-errorhandler.inc.php');
91 }
92 require_once($CFG->dirroot . 'lib/adodb/adodb.inc.php'); // Database access functions
93
94 $db = &ADONewConnection($CFG->dbtype);
95
96 error_reporting(0);  // Hide errors
97
98 if (!empty($CFG->dbpersist)) {    // Use persistent connection (default)
99     $dbconnected = $db->PConnect($CFG->dbhost,$CFG->dbuser,$CFG->dbpass,$CFG->dbname);
100 } else {                                                     // Use single connection
101     $dbconnected = $db->Connect($CFG->dbhost,$CFG->dbuser,$CFG->dbpass,$CFG->dbname);
102 }
103 if (! $dbconnected) {
104     // In the name of protocol correctness, monitoring and performance
105     // profiling, set the appropriate error headers for machine consumption
106     if (isset($_SERVER['SERVER_PROTOCOL'])) {
107         // Avoid it with cron.php. Note that we assume it's HTTP/1.x
108         header($_SERVER['SERVER_PROTOCOL'] . ' 503 Service Unavailable');       
109     }
110     // and then for human consumption...
111     echo '<html><body>';
112     echo '<table align="center"><tr>';
113     echo '<td style="color:#990000; text-align:center; font-size:large; border-width:1px; '.
114         '    border-color:#000000; border-style:solid; border-radius: 20px; border-collapse: collapse; '.
115         '    -moz-border-radius: 20px; padding: 15px">';
116     echo '<p>Error: Database connection failed.</p>';
117     echo '<p>It is possible that the database is overloaded or otherwise not running properly.</p>';
118     echo '<p>The site administrator should also check that the database details have been correctly specified in config.php</p>';
119     echo '</td></tr></table>';
120     echo '</body></html>';
121     die;
122 } else {
123     if ($db->databaseType == 'mysql') {
124         $db->Execute("SET NAMES 'utf8'");
125         $db->Execute("SET CHARSET 'utf8'");
126     } else if ($db->databaseType == 'postgres7') {
127         $db->Execute("SET NAMES 'utf8'");
128     }
129 }
130
131 /// Load up any configuration from the config table
132 $METATABLES = $db->Metatables();
133 if ($METATABLES) {
134     $CFG = get_config();
135 }
136
137 /// Turn on SQL logging if required
138 if (!empty($CFG->logsql)) {
139     $db->LogSQL();
140 }
141
142
143 /// Set error reporting back to normal
144 if (empty($CFG->debug)) {
145     $CFG->debug = 7;
146 }
147 error_reporting($CFG->debug);
148
149 /// File permissions on created directories in the $CFG->dataroot
150
151 if (empty($CFG->directorypermissions)) {
152     $CFG->directorypermissions = 0777;      // Must be octal (that's why it's here)
153 }
154
155 /// Files might not want all the permissions that directories have, e.g. +x or g+s,
156 /// so using a separate setting for files
157 if (empty($CFG->filepermissions)) {
158     $CFG->filepermissions = 0666;      // Must be octal
159 }
160
161 if (!is_writable($CFG->dataroot)) {
162     $messages[] = "Your current dataroot directory, $CFG->dataroot is not writable by the webserver!";
163 }
164
165 /// Set up session handling
166 if(empty($CFG->respectsessionsettings)) {
167     if (empty($CFG->dbsessions)) {   /// File-based sessions
168         
169         // Some distros disable GC by setting probability to 0
170         // overriding the PHP default of 1
171         // (gc_probability is divided by gc_divisor, which defaults to 1000)
172         if (ini_get('session.gc_probability') == 0) {
173             ini_set('session.gc_probability', 1);
174         }
175         
176         if (!empty($CFG->sessiontimeout)) {
177             ini_set('session.gc_maxlifetime', $CFG->sessiontimeout);
178         }
179         
180         if (!file_exists($CFG->dataroot .'sessions')) {
181             require_once($CFG->dirroot . 'lib/uploadlib.php');
182             make_upload_directory('sessions');
183         }
184         ini_set('session.save_path', $CFG->dataroot .'sessions');
185         
186     } else {                         /// Database sessions
187         ini_set('session.save_handler', 'user');
188         
189         $ADODB_SESSION_DRIVER  = $CFG->dbtype;
190         $ADODB_SESSION_CONNECT = $CFG->dbhost;
191         $ADODB_SESSION_USER    = $CFG->dbuser;
192         $ADODB_SESSION_PWD     = $CFG->dbpass;
193         $ADODB_SESSION_DB      = $CFG->dbname;
194         $ADODB_SESSION_TBL     = $CFG->prefix.'sessions';
195         
196         require_once($CFG->libdir. '/adodb/session/adodb-session.php');
197     }
198 }
199 /// Set sessioncookie variable if it isn't already
200 if (!isset($CFG->sessioncookie)) {
201     $CFG->sessioncookie = '';
202 }
203
204 // for phpthumb
205 require_once($CFG->dirroot . 'lib/uploadlib.php');
206 make_upload_directory('cache/phpThumb');
207 // for magpie rss
208 make_upload_directory('cache/magpie');
209 define('MAGPIE_CACHE_DIR',$CFG->dataroot.'cache/magpie');
210
211 // Files
212 make_upload_directory('cache/files');
213
214 /// Configure ampersands in URLs
215
216 @ini_set('arg_separator.output', '&amp;');
217
218 /// Refuse to run with register_globals
219 if (ini_get_bool('register_globals')) {
220     die("Elgg cannot run with register_globals on");
221 }
222
223 // Now we use prepared statements everywhere,
224 // we want everything to be stripslashed
225 // rather than addslashed.
226 if (ini_get_bool('magic_quotes_gpc') ) {
227     
228     //do keys as well, cos array_map ignores them
229     function stripslashes_arraykeys($array) {
230         if (is_array($array)) {
231             $array2 = array();
232             foreach ($array as $key => $data) {
233                 if ($key != stripslashes($key)) {
234                     $array2[stripslashes($key)] = $data;
235                 } else {
236                     $array2[$key] = $data;
237                 }
238             }
239             return $array2;
240         } else {
241             return $array;
242         }
243     }
244     
245     function stripslashes_deep($value) {
246         if (is_array($value)) {
247             $value = stripslashes_arraykeys($value);
248             $value = array_map('stripslashes_deep', $value);
249         } else {
250             $value = stripslashes($value);
251         }
252         return $value;
253     }
254     
255     $_POST = stripslashes_arraykeys($_POST);
256     $_GET = stripslashes_arraykeys($_GET);
257     $_COOKIE = stripslashes_arraykeys($_COOKIE);
258     $_REQUEST = stripslashes_arraykeys($_REQUEST);
259     
260     $_POST = array_map('stripslashes_deep', $_POST);
261     $_GET = array_map('stripslashes_deep', $_GET);
262     $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
263     $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
264     if (!empty($_SERVER['REQUEST_URI'])) {
265         $_SERVER['REQUEST_URI'] = stripslashes($_SERVER['REQUEST_URI']);
266     }
267     if (!empty($_SERVER['QUERY_STRING'])) {
268         $_SERVER['QUERY_STRING'] = stripslashes($_SERVER['QUERY_STRING']);
269     }
270     if (!empty($_SERVER['HTTP_REFERER'])) {
271         $_SERVER['HTTP_REFERER'] = stripslashes($_SERVER['HTTP_REFERER']);
272     }
273     if (!empty($_SERVER['PATH_INFO'])) {
274         $_SERVER['PATH_INFO'] = stripslashes($_SERVER['PATH_INFO']);
275     }
276     if (!empty($_SERVER['PHP_SELF'])) {
277         $_SERVER['PHP_SELF'] = stripslashes($_SERVER['PHP_SELF']);
278     }
279     if (!empty($_SERVER['PATH_TRANSLATED'])) {
280         $_SERVER['PATH_TRANSLATED'] = stripslashes($_SERVER['PATH_TRANSLATED']);
281     }
282     
283 }
284
285 // wtf? $noelggcookie is never set - Sven
286 if (!isset($noelggcookie)) {
287     session_name('ElggSession'.$CFG->sessioncookie);
288     ini_set("session.cookie_path", $CFG->cookiepath);
289     @session_start();
290     if (! isset($_SESSION['SESSION'])) {
291         $_SESSION['SESSION'] = new Stdclass;
292         $_SESSION['SESSION']->session_test = random_string(10);
293         if (!empty($_COOKIE['ElggSessionTest'.$CFG->sessioncookie])) {
294             $_SESSION['SESSION']->has_timed_out = true;
295         }
296         setcookie('ElggSessionTest'.$CFG->sessioncookie, $_SESSION['SESSION']->session_test, 0, $CFG->cookiepath);
297         $_COOKIE['ElggSessionTest'.$CFG->sessioncookie] = $_SESSION['SESSION']->session_test;
298     }
299     if (! isset($_SESSION['USER']))    {
300         $_SESSION['USER']    = new StdClass;
301     }
302     
303     $SESSION = &$_SESSION['SESSION'];   // Makes them easier to reference
304     $USER    = &$_SESSION['USER'];
305 }
306 else {
307     $SESSION = NULL;
308     $USER    = NULL;
309 }
310
311 // Load textlib
312 require_once($CFG->dirroot . 'lib/textlib.class.php');
313
314 if (defined('FULLME')) {     // Usually in command-line scripts like admin/cron.php
315     $FULLME = FULLME;
316     $ME = FULLME;
317 } else {
318     $FULLME = qualified_me();
319     $ME = strip_querystring($FULLME);
320 }
321
322 /// In VERY rare cases old PHP server bugs (it has been found on PHP 4.1.2 running
323 /// as a CGI under IIS on Windows) may require that you uncomment the following:
324 //  session_register("USER");
325 //  session_register("SESSION");
326
327 /// now do a session test to prevent random user switching
328 if ($SESSION != NULL) {
329     if (empty($_COOKIE['ElggSessionTest'.$CFG->sessioncookie])) {
330         report_session_error();
331     } else if (isset($SESSION->session_test) && $_COOKIE['ElggSessionTest'.$CFG->sessioncookie] != $SESSION->session_test) {
332         report_session_error();
333     }
334 }
335
336 if (!empty($CFG->opentogoogle)) {
337     if (empty($_SESSION['USER'])) {
338         if (!empty($_SERVER['HTTP_USER_AGENT'])) {
339             if (strpos($_SERVER['HTTP_USER_AGENT'], 'Googlebot') !== false ) {
340                 $USER = guest_user();
341             }
342             if (strpos($_SERVER['HTTP_USER_AGENT'], 'google.com') !== false ) {
343                 $USER = guest_user();
344             }
345         }
346         if (empty($_SESSION['USER']) and !empty($_SERVER['HTTP_REFERER'])) {
347             if (strpos($_SERVER['HTTP_REFERER'], 'google') !== false ) {
348                 $USER = guest_user();
349             } else if (strpos($_SERVER['HTTP_REFERER'], 'altavista') !== false ) {
350                 $USER = guest_user();
351             }
352         }
353     }
354 }
355
356 /// Populates an empty $USER if is empty
357 if (empty($USER) || !isset($USER->ident)) {
358     $USER = guest_user();
359 }
360
361 /// backwards compatibility
362 fill_legacy_user_session($USER);
363
364 //////
365 ////// Load some core libraries
366 //////
367 require_once($CFG->dirroot . "lib/templates.php");
368 require_once($CFG->dirroot . "lib/displaylib.php");
369
370 //////
371 ////// Init templating basics
372 //////
373 if (!isset($CFG->templatestore)) { $CFG->templatestore = 'db' ;}
374 if (!isset($CFG->templatesroot)) { $CFG->templatesroot = $CFG->dirroot . "_templates/";}
375 if (!isset($PAGE->menu       )) { $PAGE->menu        = array();}
376 if (!isset($PAGE->menu_sub   )) { $PAGE->menu_sub    = array();}
377 if (!isset($PAGE->menu_top   )) { $PAGE->menu_top    = array();}
378 if (!isset($PAGE->menu_bottom)) { $PAGE->menu_bottom = array();}
379
380 //////
381 ////// Define what modules we have, and load their libraries
382 //////
383
384 // TODO : set up a modules table so we can do get_records('modules')
385 //        to fetch the enabled ones (instead of all the available modules)
386 //        we can also track db version with it.
387 if ($allmods = get_list_of_plugins('mod') ) {
388     foreach ($allmods as $mod) {
389         $modfile = $CFG->dirroot . 'mod/'.$mod .'/lib.php';
390         if (file_exists($modfile)) {
391             include_once($modfile);
392         }
393     }
394 }
395 // keep the global scope clean
396 unset($allmods); unset ($mod); unset($modfile);
397
398 /// Apache log integration. In apache conf file one can use ${ELGGUSER}n in
399 /// LogFormat to get the current logged in username in Elgg.
400 /// NOTE: we are grabbing the username -- see the commented out lines
401 /// for alternative things that could be logged...
402 if ($USER && function_exists('apache_note')) {
403     $apachelog_username = clean_filename($USER->username);
404     // $apachelog_name     = clean_filename($USER->firstname. " ".$USER->lastname);
405     // $apachelog_userid   = $USER->ident;
406     /* Enable this commented out section ONLY if Elgg can do
407        user masquerading...
408     if (isset($USER->realuser)) {
409         if ($realuser = get_record('users', 'ident', $USER->realuser)) {
410             $apachelog_username = clean_filename($realuser->username." as ".$apachelog_username);           
411             // $apachelog_name = clean_filename($realuser->firstname." ".$realuser->lastname ." as ".$apachelog_name);
412             // $apachelog_userid = clean_filename($realuser->id." as ".$apachelog_userid);
413         }
414     }
415     */
416     apache_note('ELGGUSER', $apachelog_username);
417 }
418
419 /// Adjust ALLOWED_TAGS
420 adjust_allowed_tags();
421
422 // backwards compatibility (this is what elgg used to use)
423 define("db_server", $CFG->dbhost);
424 define("db_user",$CFG->dbuser);
425 define("db_pass",$CFG->dbpass);
426 define("db_name",$CFG->dbname);
427
428 define("sitename", $CFG->sitename);
429 define("url",$CFG->wwwroot);
430 define("path",$CFG->dirroot);
431 define("email",$CFG->sysadminemail);
432 define("locale", $CFG->defaultlocale);
433 define("public_reg", $CFG->publicreg);
434 if (empty($CFG->default_access)) {
435     $CFG->default_access = "LOGGED_IN";
436 }
437 define("default_access",$CFG->default_access);
438
439 // figure out a noreply address if we don't have one.
440 if (empty($CFG->noreplyaddress)) {
441     $CFG->noreplyaddress = 'noreply@'.preg_replace('/([a-zA-z]*:\/\/)([a-zA-Z0-9-.]*)([:0-9]*)(\/*.*)/','$2',$CFG->wwwroot);
442 }
443
444 /***
445  *** init_performance_info() {
446  ***
447  *** Initializes our performance info early.
448  ***
449  *** Pairs up with get_performance_info() which is actually
450  *** in moodlelib.php. This function is here so that we can
451  *** call it before all the libs are pulled in.
452  ***
453  **/
454 function init_performance_info() {
455
456     global $PERF;
457
458     $PERF = new StdClass;
459     $PERF->dbqueries = 0;   
460     $PERF->logwrites = 0;
461     if (function_exists('microtime')) {
462         $PERF->starttime = microtime();
463     }
464     if (function_exists('memory_get_usage')) {
465         $PERF->startmemory = memory_get_usage();
466     }
467     if (function_exists('posix_times')) {
468         $PERF->startposixtimes = posix_times(); 
469     }
470 }
471
472 ?>
Note: See TracBrowser for help on using the browser.