QueryString.php 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483
  1. <?php
  2. /**
  3. * Simple Machines Forum (SMF)
  4. *
  5. * @package SMF
  6. * @author Simple Machines http://www.simplemachines.org
  7. * @copyright 2011 Simple Machines
  8. * @license http://www.simplemachines.org/about/smf/license.php BSD
  9. *
  10. * @version 2.0
  11. */
  12. if (!defined('SMF'))
  13. die('Hacking attempt...');
  14. /* This file does a lot of important stuff. Mainly, this means it handles
  15. the query string, request variables, and session management. It contains
  16. the following functions:
  17. void cleanRequest()
  18. - cleans the request variables (ENV, GET, POST, COOKIE, SERVER) and
  19. makes sure the query string was parsed correctly.
  20. - handles the URLs passed by the queryless URLs option.
  21. - makes sure, regardless of php.ini, everything has slashes.
  22. - sets up $board, $topic, and $scripturl and $_REQUEST['start'].
  23. - determines, or rather tries to determine, the client's IP.
  24. array escapestring__recursive(array var)
  25. - returns the var, as an array or string, with escapes as required.
  26. - importantly escapes all keys and values!
  27. - calls itself recursively if necessary.
  28. array htmlspecialchars__recursive(array var)
  29. - adds entities (&quot;, &lt;, &gt;) to the array or string var.
  30. - importantly, does not effect keys, only values.
  31. - calls itself recursively if necessary.
  32. array urldecode__recursive(array var)
  33. - takes off url encoding (%20, etc.) from the array or string var.
  34. - importantly, does it to keys too!
  35. - calls itself recursively if there are any sub arrays.
  36. array unescapestring__recursive(array var)
  37. - unescapes, recursively, from the array or string var.
  38. - effects both keys and values of arrays.
  39. - calls itself recursively to handle arrays of arrays.
  40. array stripslashes__recursive(array var)
  41. - removes slashes, recursively, from the array or string var.
  42. - effects both keys and values of arrays.
  43. - calls itself recursively to handle arrays of arrays.
  44. array htmltrim__recursive(array var)
  45. - trims a string or an the var array using html characters as well.
  46. - does not effect keys, only values.
  47. - may call itself recursively if needed.
  48. string cleanXml(string var)
  49. - removes invalid XML characters to assure the input string being
  50. parsed properly.
  51. string ob_sessrewrite(string buffer)
  52. - rewrites the URLs outputted to have the session ID, if the user
  53. is not accepting cookies and is using a standard web browser.
  54. - handles rewriting URLs for the queryless URLs option.
  55. - can be turned off entirely by setting $scripturl to an empty
  56. string, ''. (it wouldn't work well like that anyway.)
  57. - because of bugs in certain builds of PHP, does not function in
  58. versions lower than 4.3.0 - please upgrade if this hurts you.
  59. */
  60. // Clean the request variables - add html entities to GET and slashes if magic_quotes_gpc is Off.
  61. function cleanRequest()
  62. {
  63. global $board, $topic, $boardurl, $scripturl, $modSettings, $smcFunc;
  64. // Makes it easier to refer to things this way.
  65. $scripturl = $boardurl . '/index.php';
  66. // What function to use to reverse magic quotes - if sybase is on we assume that the database sensibly has the right unescape function!
  67. $removeMagicQuoteFunction = @ini_get('magic_quotes_sybase') || strtolower(@ini_get('magic_quotes_sybase')) == 'on' ? 'unescapestring__recursive' : 'stripslashes__recursive';
  68. // Save some memory.. (since we don't use these anyway.)
  69. unset($GLOBALS['HTTP_POST_VARS'], $GLOBALS['HTTP_POST_VARS']);
  70. unset($GLOBALS['HTTP_POST_FILES'], $GLOBALS['HTTP_POST_FILES']);
  71. // These keys shouldn't be set...ever.
  72. if (isset($_REQUEST['GLOBALS']) || isset($_COOKIE['GLOBALS']))
  73. die('Invalid request variable.');
  74. // Same goes for numeric keys.
  75. foreach (array_merge(array_keys($_POST), array_keys($_GET), array_keys($_FILES)) as $key)
  76. if (is_numeric($key))
  77. die('Numeric request keys are invalid.');
  78. // Numeric keys in cookies are less of a problem. Just unset those.
  79. foreach ($_COOKIE as $key => $value)
  80. if (is_numeric($key))
  81. unset($_COOKIE[$key]);
  82. // Get the correct query string. It may be in an environment variable...
  83. if (!isset($_SERVER['QUERY_STRING']))
  84. $_SERVER['QUERY_STRING'] = getenv('QUERY_STRING');
  85. // It seems that sticking a URL after the query string is mighty common, well, it's evil - don't.
  86. if (strpos($_SERVER['QUERY_STRING'], 'http') === 0)
  87. {
  88. header('HTTP/1.1 400 Bad Request');
  89. die;
  90. }
  91. // Are we going to need to parse the ; out?
  92. if ((strpos(@ini_get('arg_separator.input'), ';') === false || @version_compare(PHP_VERSION, '4.2.0') == -1) && !empty($_SERVER['QUERY_STRING']))
  93. {
  94. // Get rid of the old one! You don't know where it's been!
  95. $_GET = array();
  96. // Was this redirected? If so, get the REDIRECT_QUERY_STRING.
  97. // Do not urldecode() the querystring, unless you so much wish to break OpenID implementation. :)
  98. $_SERVER['QUERY_STRING'] = substr($_SERVER['QUERY_STRING'], 0, 5) === 'url=/' ? $_SERVER['REDIRECT_QUERY_STRING'] : $_SERVER['QUERY_STRING'];
  99. // Replace ';' with '&' and '&something&' with '&something=&'. (this is done for compatibility...)
  100. // !!! smflib
  101. parse_str(preg_replace('/&(\w+)(?=&|$)/', '&$1=', strtr($_SERVER['QUERY_STRING'], array(';?' => '&', ';' => '&', '%00' => '', "\0" => ''))), $_GET);
  102. // Magic quotes still applies with parse_str - so clean it up.
  103. if (function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc() != 0 && empty($modSettings['integrate_magic_quotes']))
  104. $_GET = $removeMagicQuoteFunction($_GET);
  105. }
  106. elseif (strpos(@ini_get('arg_separator.input'), ';') !== false)
  107. {
  108. if (function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc() != 0 && empty($modSettings['integrate_magic_quotes']))
  109. $_GET = $removeMagicQuoteFunction($_GET);
  110. // Search engines will send action=profile%3Bu=1, which confuses PHP.
  111. foreach ($_GET as $k => $v)
  112. {
  113. if (is_string($v) && strpos($k, ';') !== false)
  114. {
  115. $temp = explode(';', $v);
  116. $_GET[$k] = $temp[0];
  117. for ($i = 1, $n = count($temp); $i < $n; $i++)
  118. {
  119. @list ($key, $val) = @explode('=', $temp[$i], 2);
  120. if (!isset($_GET[$key]))
  121. $_GET[$key] = $val;
  122. }
  123. }
  124. // This helps a lot with integration!
  125. if (strpos($k, '?') === 0)
  126. {
  127. $_GET[substr($k, 1)] = $v;
  128. unset($_GET[$k]);
  129. }
  130. }
  131. }
  132. // There's no query string, but there is a URL... try to get the data from there.
  133. if (!empty($_SERVER['REQUEST_URI']))
  134. {
  135. // Remove the .html, assuming there is one.
  136. if (substr($_SERVER['REQUEST_URI'], strrpos($_SERVER['REQUEST_URI'], '.'), 4) == '.htm')
  137. $request = substr($_SERVER['REQUEST_URI'], 0, strrpos($_SERVER['REQUEST_URI'], '.'));
  138. else
  139. $request = $_SERVER['REQUEST_URI'];
  140. // !!! smflib.
  141. // Replace 'index.php/a,b,c/d/e,f' with 'a=b,c&d=&e=f' and parse it into $_GET.
  142. if (strpos($request, basename($scripturl) . '/') !== false)
  143. {
  144. parse_str(substr(preg_replace('/&(\w+)(?=&|$)/', '&$1=', strtr(preg_replace('~/([^,/]+),~', '/$1=', substr($request, strpos($request, basename($scripturl)) + strlen(basename($scripturl)))), '/', '&')), 1), $temp);
  145. if (function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc() != 0 && empty($modSettings['integrate_magic_quotes']))
  146. $temp = $removeMagicQuoteFunction($temp);
  147. $_GET += $temp;
  148. }
  149. }
  150. // If magic quotes is on we have some work...
  151. if (function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc() != 0)
  152. {
  153. $_ENV = $removeMagicQuoteFunction($_ENV);
  154. $_POST = $removeMagicQuoteFunction($_POST);
  155. $_COOKIE = $removeMagicQuoteFunction($_COOKIE);
  156. foreach ($_FILES as $k => $dummy)
  157. if (isset($_FILES[$k]['name']))
  158. $_FILES[$k]['name'] = $removeMagicQuoteFunction($_FILES[$k]['name']);
  159. }
  160. // Add entities to GET. This is kinda like the slashes on everything else.
  161. $_GET = htmlspecialchars__recursive($_GET);
  162. // Let's not depend on the ini settings... why even have COOKIE in there, anyway?
  163. $_REQUEST = $_POST + $_GET;
  164. // Make sure $board and $topic are numbers.
  165. if (isset($_REQUEST['board']))
  166. {
  167. // Make sure its a string and not something else like an array
  168. $_REQUEST['board'] = (string) $_REQUEST['board'];
  169. // If there's a slash in it, we've got a start value! (old, compatible links.)
  170. if (strpos($_REQUEST['board'], '/') !== false)
  171. list ($_REQUEST['board'], $_REQUEST['start']) = explode('/', $_REQUEST['board']);
  172. // Same idea, but dots. This is the currently used format - ?board=1.0...
  173. elseif (strpos($_REQUEST['board'], '.') !== false)
  174. list ($_REQUEST['board'], $_REQUEST['start']) = explode('.', $_REQUEST['board']);
  175. // Now make absolutely sure it's a number.
  176. $board = (int) $_REQUEST['board'];
  177. $_REQUEST['start'] = isset($_REQUEST['start']) ? (int) $_REQUEST['start'] : 0;
  178. // This is for "Who's Online" because it might come via POST - and it should be an int here.
  179. $_GET['board'] = $board;
  180. }
  181. // Well, $board is going to be a number no matter what.
  182. else
  183. $board = 0;
  184. // If there's a threadid, it's probably an old YaBB SE link. Flow with it.
  185. if (isset($_REQUEST['threadid']) && !isset($_REQUEST['topic']))
  186. $_REQUEST['topic'] = $_REQUEST['threadid'];
  187. // We've got topic!
  188. if (isset($_REQUEST['topic']))
  189. {
  190. // Make sure its a string and not something else like an array
  191. $_REQUEST['topic'] = (string) $_REQUEST['topic'];
  192. // Slash means old, beta style, formatting. That's okay though, the link should still work.
  193. if (strpos($_REQUEST['topic'], '/') !== false)
  194. list ($_REQUEST['topic'], $_REQUEST['start']) = explode('/', $_REQUEST['topic']);
  195. // Dots are useful and fun ;). This is ?topic=1.15.
  196. elseif (strpos($_REQUEST['topic'], '.') !== false)
  197. list ($_REQUEST['topic'], $_REQUEST['start']) = explode('.', $_REQUEST['topic']);
  198. $topic = (int) $_REQUEST['topic'];
  199. // Now make sure the online log gets the right number.
  200. $_GET['topic'] = $topic;
  201. }
  202. else
  203. $topic = 0;
  204. // There should be a $_REQUEST['start'], some at least. If you need to default to other than 0, use $_GET['start'].
  205. if (empty($_REQUEST['start']) || $_REQUEST['start'] < 0 || (int) $_REQUEST['start'] > 2147473647)
  206. $_REQUEST['start'] = 0;
  207. // The action needs to be a string and not an array or anything else
  208. if (isset($_REQUEST['action']))
  209. $_REQUEST['action'] = (string) $_REQUEST['action'];
  210. if (isset($_GET['action']))
  211. $_GET['action'] = (string) $_GET['action'];
  212. // Make sure we have a valid REMOTE_ADDR.
  213. if (!isset($_SERVER['REMOTE_ADDR']))
  214. {
  215. $_SERVER['REMOTE_ADDR'] = '';
  216. // A new magic variable to indicate we think this is command line.
  217. $_SERVER['is_cli'] = true;
  218. }
  219. elseif (preg_match('~^((([1]?\d)?\d|2[0-4]\d|25[0-5])\.){3}(([1]?\d)?\d|2[0-4]\d|25[0-5])$~', $_SERVER['REMOTE_ADDR']) === 0)
  220. $_SERVER['REMOTE_ADDR'] = 'unknown';
  221. // Try to calculate their most likely IP for those people behind proxies (And the like).
  222. $_SERVER['BAN_CHECK_IP'] = $_SERVER['REMOTE_ADDR'];
  223. // Find the user's IP address. (but don't let it give you 'unknown'!)
  224. if (!empty($_SERVER['HTTP_X_FORWARDED_FOR']) && !empty($_SERVER['HTTP_CLIENT_IP']) && (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['HTTP_CLIENT_IP']) == 0 || preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['REMOTE_ADDR']) != 0))
  225. {
  226. // We have both forwarded for AND client IP... check the first forwarded for as the block - only switch if it's better that way.
  227. if (strtok($_SERVER['HTTP_X_FORWARDED_FOR'], '.') != strtok($_SERVER['HTTP_CLIENT_IP'], '.') && '.' . strtok($_SERVER['HTTP_X_FORWARDED_FOR'], '.') == strrchr($_SERVER['HTTP_CLIENT_IP'], '.') && (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['HTTP_X_FORWARDED_FOR']) == 0 || preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['REMOTE_ADDR']) != 0))
  228. $_SERVER['BAN_CHECK_IP'] = implode('.', array_reverse(explode('.', $_SERVER['HTTP_CLIENT_IP'])));
  229. else
  230. $_SERVER['BAN_CHECK_IP'] = $_SERVER['HTTP_CLIENT_IP'];
  231. }
  232. if (!empty($_SERVER['HTTP_CLIENT_IP']) && (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['HTTP_CLIENT_IP']) == 0 || preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['REMOTE_ADDR']) != 0))
  233. {
  234. // Since they are in different blocks, it's probably reversed.
  235. if (strtok($_SERVER['REMOTE_ADDR'], '.') != strtok($_SERVER['HTTP_CLIENT_IP'], '.'))
  236. $_SERVER['BAN_CHECK_IP'] = implode('.', array_reverse(explode('.', $_SERVER['HTTP_CLIENT_IP'])));
  237. else
  238. $_SERVER['BAN_CHECK_IP'] = $_SERVER['HTTP_CLIENT_IP'];
  239. }
  240. elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
  241. {
  242. // If there are commas, get the last one.. probably.
  243. if (strpos($_SERVER['HTTP_X_FORWARDED_FOR'], ',') !== false)
  244. {
  245. $ips = array_reverse(explode(', ', $_SERVER['HTTP_X_FORWARDED_FOR']));
  246. // Go through each IP...
  247. foreach ($ips as $i => $ip)
  248. {
  249. // Make sure it's in a valid range...
  250. if (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $ip) != 0 && preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['REMOTE_ADDR']) == 0)
  251. continue;
  252. // Otherwise, we've got an IP!
  253. $_SERVER['BAN_CHECK_IP'] = trim($ip);
  254. break;
  255. }
  256. }
  257. // Otherwise just use the only one.
  258. elseif (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['HTTP_X_FORWARDED_FOR']) == 0 || preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['REMOTE_ADDR']) != 0)
  259. $_SERVER['BAN_CHECK_IP'] = $_SERVER['HTTP_X_FORWARDED_FOR'];
  260. }
  261. // Make sure we know the URL of the current request.
  262. if (empty($_SERVER['REQUEST_URI']))
  263. $_SERVER['REQUEST_URL'] = $scripturl . (!empty($_SERVER['QUERY_STRING']) ? '?' . $_SERVER['QUERY_STRING'] : '');
  264. elseif (preg_match('~^([^/]+//[^/]+)~', $scripturl, $match) == 1)
  265. $_SERVER['REQUEST_URL'] = $match[1] . $_SERVER['REQUEST_URI'];
  266. else
  267. $_SERVER['REQUEST_URL'] = $_SERVER['REQUEST_URI'];
  268. // And make sure HTTP_USER_AGENT is set.
  269. $_SERVER['HTTP_USER_AGENT'] = isset($_SERVER['HTTP_USER_AGENT']) ? htmlspecialchars($smcFunc['db_unescape_string']($_SERVER['HTTP_USER_AGENT']), ENT_QUOTES) : '';
  270. // Some final checking.
  271. if (preg_match('~^((([1]?\d)?\d|2[0-4]\d|25[0-5])\.){3}(([1]?\d)?\d|2[0-4]\d|25[0-5])$~', $_SERVER['BAN_CHECK_IP']) === 0)
  272. $_SERVER['BAN_CHECK_IP'] = '';
  273. if ($_SERVER['REMOTE_ADDR'] == 'unknown')
  274. $_SERVER['REMOTE_ADDR'] = '';
  275. }
  276. // Adds slashes to the array/variable. Uses two underscores to guard against overloading.
  277. function escapestring__recursive($var)
  278. {
  279. global $smcFunc;
  280. if (!is_array($var))
  281. return $smcFunc['db_escape_string']($var);
  282. // Reindex the array with slashes.
  283. $new_var = array();
  284. // Add slashes to every element, even the indexes!
  285. foreach ($var as $k => $v)
  286. $new_var[$smcFunc['db_escape_string']($k)] = escapestring__recursive($v);
  287. return $new_var;
  288. }
  289. // Adds html entities to the array/variable. Uses two underscores to guard against overloading.
  290. function htmlspecialchars__recursive($var, $level = 0)
  291. {
  292. global $smcFunc;
  293. if (!is_array($var))
  294. return isset($smcFunc['htmlspecialchars']) ? $smcFunc['htmlspecialchars']($var, ENT_QUOTES) : htmlspecialchars($var, ENT_QUOTES);
  295. // Add the htmlspecialchars to every element.
  296. foreach ($var as $k => $v)
  297. $var[$k] = $level > 25 ? null : htmlspecialchars__recursive($v, $level + 1);
  298. return $var;
  299. }
  300. // Removes url stuff from the array/variable. Uses two underscores to guard against overloading.
  301. function urldecode__recursive($var, $level = 0)
  302. {
  303. if (!is_array($var))
  304. return urldecode($var);
  305. // Reindex the array...
  306. $new_var = array();
  307. // Add the htmlspecialchars to every element.
  308. foreach ($var as $k => $v)
  309. $new_var[urldecode($k)] = $level > 25 ? null : urldecode__recursive($v, $level + 1);
  310. return $new_var;
  311. }
  312. // Unescapes any array or variable. Two underscores for the normal reason.
  313. function unescapestring__recursive($var)
  314. {
  315. global $smcFunc;
  316. if (!is_array($var))
  317. return $smcFunc['db_unescape_string']($var);
  318. // Reindex the array without slashes, this time.
  319. $new_var = array();
  320. // Strip the slashes from every element.
  321. foreach ($var as $k => $v)
  322. $new_var[$smcFunc['db_unescape_string']($k)] = unescapestring__recursive($v);
  323. return $new_var;
  324. }
  325. // Remove slashes recursively...
  326. function stripslashes__recursive($var, $level = 0)
  327. {
  328. if (!is_array($var))
  329. return stripslashes($var);
  330. // Reindex the array without slashes, this time.
  331. $new_var = array();
  332. // Strip the slashes from every element.
  333. foreach ($var as $k => $v)
  334. $new_var[stripslashes($k)] = $level > 25 ? null : stripslashes__recursive($v, $level + 1);
  335. return $new_var;
  336. }
  337. // Trim a string including the HTML space, character 160.
  338. function htmltrim__recursive($var, $level = 0)
  339. {
  340. global $smcFunc;
  341. // Remove spaces (32), tabs (9), returns (13, 10, and 11), nulls (0), and hard spaces. (160)
  342. if (!is_array($var))
  343. return isset($smcFunc) ? $smcFunc['htmltrim']($var) : trim($var, ' ' . "\t\n\r\x0B" . '\0' . "\xA0");
  344. // Go through all the elements and remove the whitespace.
  345. foreach ($var as $k => $v)
  346. $var[$k] = $level > 25 ? null : htmltrim__recursive($v, $level + 1);
  347. return $var;
  348. }
  349. // Clean up the XML to make sure it doesn't contain invalid characters.
  350. function cleanXml($string)
  351. {
  352. global $context;
  353. // http://www.w3.org/TR/2000/REC-xml-20001006#NT-Char
  354. return preg_replace('~[\x00-\x08\x0B\x0C\x0E-\x19' . ($context['utf8'] ? (@version_compare(PHP_VERSION, '4.3.3') != -1 ? '\x{D800}-\x{DFFF}\x{FFFE}\x{FFFF}' : "\xED\xA0\x80-\xED\xBF\xBF\xEF\xBF\xBE\xEF\xBF\xBF") : '') . ']~' . ($context['utf8'] ? 'u' : ''), '', $string);
  355. }
  356. function JavaScriptEscape($string)
  357. {
  358. global $scripturl;
  359. return '\'' . strtr($string, array(
  360. "\r" => '',
  361. "\n" => '\\n',
  362. "\t" => '\\t',
  363. '\\' => '\\\\',
  364. '\'' => '\\\'',
  365. '</' => '<\' + \'/',
  366. 'script' => 'scri\'+\'pt',
  367. '<a href' => '<a hr\'+\'ef',
  368. $scripturl => $scripturl . '\'+\'',
  369. )) . '\'';
  370. }
  371. // Rewrite URLs to include the session ID.
  372. function ob_sessrewrite($buffer)
  373. {
  374. global $scripturl, $modSettings, $user_info, $context;
  375. // If $scripturl is set to nothing, or the SID is not defined (SSI?) just quit.
  376. if ($scripturl == '' || !defined('SID'))
  377. return $buffer;
  378. // Do nothing if the session is cookied, or they are a crawler - guests are caught by redirectexit(). This doesn't work below PHP 4.3.0, because it makes the output buffer bigger.
  379. // !!! smflib
  380. if (empty($_COOKIE) && SID != '' && empty($context['browser']['possibly_robot']) && @version_compare(PHP_VERSION, '4.3.0') != -1)
  381. $buffer = preg_replace('/"' . preg_quote($scripturl, '/') . '(?!\?' . preg_quote(SID, '/') . ')\\??/', '"' . $scripturl . '?' . SID . '&amp;', $buffer);
  382. // Debugging templates, are we?
  383. elseif (isset($_GET['debug']))
  384. $buffer = preg_replace('/(?<!<link rel="canonical" href=)"' . preg_quote($scripturl, '/') . '\\??/', '"' . $scripturl . '?debug;', $buffer);
  385. // This should work even in 4.2.x, just not CGI without cgi.fix_pathinfo.
  386. if (!empty($modSettings['queryless_urls']) && (!$context['server']['is_cgi'] || @ini_get('cgi.fix_pathinfo') == 1 || @get_cfg_var('cgi.fix_pathinfo') == 1) && ($context['server']['is_apache'] || $context['server']['is_lighttpd']))
  387. {
  388. // Let's do something special for session ids!
  389. if (defined('SID') && SID != '')
  390. $buffer = preg_replace('/"' . preg_quote($scripturl, '/') . '\?(?:' . SID . '(?:;|&|&amp;))((?:board|topic)=[^#"]+?)(#[^"]*?)?"/e', "'\"' . \$scripturl . '/' . strtr('\$1', '&;=', '//,') . '.html?' . SID . '\$2\"'", $buffer);
  391. else
  392. $buffer = preg_replace('/"' . preg_quote($scripturl, '/') . '\?((?:board|topic)=[^#"]+?)(#[^"]*?)?"/e', "'\"' . \$scripturl . '/' . strtr('\$1', '&;=', '//,') . '.html\$2\"'", $buffer);
  393. }
  394. // Return the changed buffer.
  395. return $buffer;
  396. }
  397. ?>