|
|
@@ -1,6 +1,9 @@
|
|
|
<?php
|
|
|
|
|
|
/**
|
|
|
+ * This file does a lot of important stuff. Mainly, this means it handles
|
|
|
+ the query string, request variables, and session management.
|
|
|
+ *
|
|
|
* Simple Machines Forum (SMF)
|
|
|
*
|
|
|
* @package SMF
|
|
|
@@ -14,63 +17,18 @@
|
|
|
if (!defined('SMF'))
|
|
|
die('Hacking attempt...');
|
|
|
|
|
|
-/* This file does a lot of important stuff. Mainly, this means it handles
|
|
|
- the query string, request variables, and session management. It contains
|
|
|
- the following functions:
|
|
|
-
|
|
|
- void cleanRequest()
|
|
|
- - cleans the request variables (ENV, GET, POST, COOKIE, SERVER) and
|
|
|
+/**
|
|
|
+ * Clean the request variables - add html entities to GET and slashes if magic_quotes_gpc is Off.
|
|
|
+ *
|
|
|
+ * What it does:
|
|
|
+ * - cleans the request variables (ENV, GET, POST, COOKIE, SERVER) and
|
|
|
makes sure the query string was parsed correctly.
|
|
|
- handles the URLs passed by the queryless URLs option.
|
|
|
- makes sure, regardless of php.ini, everything has slashes.
|
|
|
- sets up $board, $topic, and $scripturl and $_REQUEST['start'].
|
|
|
- determines, or rather tries to determine, the client's IP.
|
|
|
+ */
|
|
|
|
|
|
- array escapestring__recursive(array var)
|
|
|
- - returns the var, as an array or string, with escapes as required.
|
|
|
- - importantly escapes all keys and values!
|
|
|
- - calls itself recursively if necessary.
|
|
|
-
|
|
|
- array htmlspecialchars__recursive(array var)
|
|
|
- - adds entities (", <, >) to the array or string var.
|
|
|
- - importantly, does not effect keys, only values.
|
|
|
- - calls itself recursively if necessary.
|
|
|
-
|
|
|
- array urldecode__recursive(array var)
|
|
|
- - takes off url encoding (%20, etc.) from the array or string var.
|
|
|
- - importantly, does it to keys too!
|
|
|
- - calls itself recursively if there are any sub arrays.
|
|
|
-
|
|
|
- array unescapestring__recursive(array var)
|
|
|
- - unescapes, recursively, from the array or string var.
|
|
|
- - effects both keys and values of arrays.
|
|
|
- - calls itself recursively to handle arrays of arrays.
|
|
|
-
|
|
|
- array stripslashes__recursive(array var)
|
|
|
- - removes slashes, recursively, from the array or string var.
|
|
|
- - effects both keys and values of arrays.
|
|
|
- - calls itself recursively to handle arrays of arrays.
|
|
|
-
|
|
|
- array htmltrim__recursive(array var)
|
|
|
- - trims a string or an the var array using html characters as well.
|
|
|
- - does not effect keys, only values.
|
|
|
- - may call itself recursively if needed.
|
|
|
-
|
|
|
- string cleanXml(string var)
|
|
|
- - removes invalid XML characters to assure the input string being
|
|
|
- parsed properly.
|
|
|
-
|
|
|
- string ob_sessrewrite(string buffer)
|
|
|
- - rewrites the URLs outputted to have the session ID, if the user
|
|
|
- is not accepting cookies and is using a standard web browser.
|
|
|
- - handles rewriting URLs for the queryless URLs option.
|
|
|
- - can be turned off entirely by setting $scripturl to an empty
|
|
|
- string, ''. (it wouldn't work well like that anyway.)
|
|
|
- - because of bugs in certain builds of PHP, does not function in
|
|
|
- versions lower than 4.3.0 - please upgrade if this hurts you.
|
|
|
-*/
|
|
|
-
|
|
|
-// Clean the request variables - add html entities to GET and slashes if magic_quotes_gpc is Off.
|
|
|
function cleanRequest()
|
|
|
{
|
|
|
global $board, $topic, $boardurl, $scripturl, $modSettings, $smcFunc;
|
|
|
@@ -325,7 +283,16 @@ function cleanRequest()
|
|
|
$_SERVER['REMOTE_ADDR'] = '';
|
|
|
}
|
|
|
|
|
|
-// Adds slashes to the array/variable. Uses two underscores to guard against overloading.
|
|
|
+/**
|
|
|
+ * Adds slashes to the array/variable.
|
|
|
+ * What it does:
|
|
|
+ * - returns the var, as an array or string, with escapes as required.
|
|
|
+ - importantly escapes all keys and values!
|
|
|
+ - calls itself recursively if necessary.
|
|
|
+ *
|
|
|
+ * @param array|string $var
|
|
|
+ * @return array|string
|
|
|
+ */
|
|
|
function escapestring__recursive($var)
|
|
|
{
|
|
|
global $smcFunc;
|
|
|
@@ -343,7 +310,16 @@ function escapestring__recursive($var)
|
|
|
return $new_var;
|
|
|
}
|
|
|
|
|
|
-// Adds html entities to the array/variable. Uses two underscores to guard against overloading.
|
|
|
+/**
|
|
|
+ * Adds html entities to the array/variable. Uses two underscores to guard against overloading.
|
|
|
+ * What it does:
|
|
|
+ * - adds entities (", <, >) to the array or string var.
|
|
|
+ - importantly, does not effect keys, only values.
|
|
|
+ - calls itself recursively if necessary.
|
|
|
+ * @param array|string $var
|
|
|
+ * @param int $level = 0
|
|
|
+ * @return array|string
|
|
|
+ */
|
|
|
function htmlspecialchars__recursive($var, $level = 0)
|
|
|
{
|
|
|
global $smcFunc;
|
|
|
@@ -358,7 +334,17 @@ function htmlspecialchars__recursive($var, $level = 0)
|
|
|
return $var;
|
|
|
}
|
|
|
|
|
|
-// Removes url stuff from the array/variable. Uses two underscores to guard against overloading.
|
|
|
+/**
|
|
|
+ * Removes url stuff from the array/variable. Uses two underscores to guard against overloading.
|
|
|
+ * What it does:
|
|
|
+ * - takes off url encoding (%20, etc.) from the array or string var.
|
|
|
+ - importantly, does it to keys too!
|
|
|
+ - calls itself recursively if there are any sub arrays.
|
|
|
+ *
|
|
|
+ * @param array|string $var
|
|
|
+ * @param int $level = 0
|
|
|
+ * @return array|string
|
|
|
+ */
|
|
|
function urldecode__recursive($var, $level = 0)
|
|
|
{
|
|
|
if (!is_array($var))
|
|
|
@@ -373,7 +359,16 @@ function urldecode__recursive($var, $level = 0)
|
|
|
|
|
|
return $new_var;
|
|
|
}
|
|
|
-// Unescapes any array or variable. Two underscores for the normal reason.
|
|
|
+/**
|
|
|
+ * Unescapes any array or variable. Uses two underscores to guard against overloading.
|
|
|
+ * What it does:
|
|
|
+ * - unescapes, recursively, from the array or string var.
|
|
|
+ - effects both keys and values of arrays.
|
|
|
+ - calls itself recursively to handle arrays of arrays.
|
|
|
+ *
|
|
|
+ * @param array|string $var
|
|
|
+ * @return array|string
|
|
|
+ */
|
|
|
function unescapestring__recursive($var)
|
|
|
{
|
|
|
global $smcFunc;
|
|
|
@@ -391,7 +386,17 @@ function unescapestring__recursive($var)
|
|
|
return $new_var;
|
|
|
}
|
|
|
|
|
|
-// Remove slashes recursively...
|
|
|
+/**
|
|
|
+ * Remove slashes recursively. Uses two underscores to guard against overloading.
|
|
|
+ * What it does:
|
|
|
+ * - removes slashes, recursively, from the array or string var.
|
|
|
+ - effects both keys and values of arrays.
|
|
|
+ - calls itself recursively to handle arrays of arrays.
|
|
|
+ *
|
|
|
+ * @param array|string $var
|
|
|
+ * @param int $level = 0
|
|
|
+ * @return array|string
|
|
|
+ */
|
|
|
function stripslashes__recursive($var, $level = 0)
|
|
|
{
|
|
|
if (!is_array($var))
|
|
|
@@ -407,7 +412,17 @@ function stripslashes__recursive($var, $level = 0)
|
|
|
return $new_var;
|
|
|
}
|
|
|
|
|
|
-// Trim a string including the HTML space, character 160.
|
|
|
+/**
|
|
|
+ * Trim a string including the HTML space, character 160. Uses two underscores to guard against overloading.
|
|
|
+ * What it does:
|
|
|
+ * - trims a string or an the var array using html characters as well.
|
|
|
+ - does not effect keys, only values.
|
|
|
+ - may call itself recursively if needed.
|
|
|
+ *
|
|
|
+ * @param array|string $var
|
|
|
+ * @param int $level = 0
|
|
|
+ * @return array|string
|
|
|
+ */
|
|
|
function htmltrim__recursive($var, $level = 0)
|
|
|
{
|
|
|
global $smcFunc;
|
|
|
@@ -423,7 +438,15 @@ function htmltrim__recursive($var, $level = 0)
|
|
|
return $var;
|
|
|
}
|
|
|
|
|
|
-// Clean up the XML to make sure it doesn't contain invalid characters.
|
|
|
+/**
|
|
|
+ * Clean up the XML to make sure it doesn't contain invalid characters.
|
|
|
+ * What it does:
|
|
|
+ * - removes invalid XML characters to assure the input string being
|
|
|
+ parsed properly.
|
|
|
+ *
|
|
|
+ * @param string $string
|
|
|
+ * @return string
|
|
|
+ */
|
|
|
function cleanXml($string)
|
|
|
{
|
|
|
global $context;
|
|
|
@@ -432,6 +455,12 @@ function cleanXml($string)
|
|
|
return preg_replace('~[\x00-\x08\x0B\x0C\x0E-\x19' . ($context['utf8'] ? (@version_compare(PHP_VERSION, '4.3.3') != -1 ? '\x{D800}-\x{DFFF}\x{FFFE}\x{FFFF}' : "\xED\xA0\x80-\xED\xBF\xBF\xEF\xBF\xBE\xEF\xBF\xBF") : '') . ']~' . ($context['utf8'] ? 'u' : ''), '', $string);
|
|
|
}
|
|
|
|
|
|
+/**
|
|
|
+ * @todo needs a description
|
|
|
+ *
|
|
|
+ * @param string $string
|
|
|
+ * @return string
|
|
|
+ */
|
|
|
function JavaScriptEscape($string)
|
|
|
{
|
|
|
global $scripturl;
|
|
|
@@ -449,7 +478,20 @@ function JavaScriptEscape($string)
|
|
|
)) . '\'';
|
|
|
}
|
|
|
|
|
|
-// Rewrite URLs to include the session ID.
|
|
|
+/**
|
|
|
+ * Rewrite URLs to include the session ID.
|
|
|
+ * What it does:
|
|
|
+ * - rewrites the URLs outputted to have the session ID, if the user
|
|
|
+ is not accepting cookies and is using a standard web browser.
|
|
|
+ - handles rewriting URLs for the queryless URLs option.
|
|
|
+ - can be turned off entirely by setting $scripturl to an empty
|
|
|
+ string, ''. (it wouldn't work well like that anyway.)
|
|
|
+ - because of bugs in certain builds of PHP, does not function in
|
|
|
+ versions lower than 4.3.0 - please upgrade if this hurts you.
|
|
|
+ *
|
|
|
+ * @param string $buffer
|
|
|
+ * @return string
|
|
|
+ */
|
|
|
function ob_sessrewrite($buffer)
|
|
|
{
|
|
|
global $scripturl, $modSettings, $user_info, $context;
|
Spuds