CSRF protection in user registration

[quix0rs-gnu-social.git] / lib / util.php

diff --git a/lib/util.php b/lib/util.php
index 9033d7d1ac9475ebda5bb02f517744f9d899791c..f06f49d71be682e9660a962237a646ddc9115b3a 100644 (file)
--- a/lib/util.php
+++ b/lib/util.php
@@ -131,16 +131,28 @@ function common_end_xml() {
        $xw->flush();
 }
 
+function common_init_language() {
+       mb_internal_encoding('UTF-8');
+       $language = common_language();
+       # So we don't have to make people install the gettext locales
+       putenv('LANGUAGE='.$language);
+       putenv('LANG='.$language);      
+       $locale_set = setlocale(LC_ALL, $language . ".utf8",
+                                                       $language . ".UTF8",
+                                                       $language . ".utf-8",
+                                                       $language . ".UTF-8",
+                                                       $language);
+       bindtextdomain("laconica", common_config('site','locale_path'));
+       bind_textdomain_codeset("laconica", "UTF-8");
+       textdomain("laconica");
+       setlocale(LC_CTYPE, 'C');
+}
+
 define('PAGE_TYPE_PREFS', 'text/html,application/xhtml+xml,application/xml;q=0.3,text/xml;q=0.2');
 
 function common_show_header($pagetitle, $callable=NULL, $data=NULL, $headercall=NULL) {
        global $config, $xw;
 
-       $language = common_language();
-       setlocale(LC_ALL, $language);
-       bindtextdomain("laconica", $config['site']['locale_path']);
-       textdomain("laconica");
-       
        $httpaccept = isset($_SERVER['HTTP_ACCEPT']) ? $_SERVER['HTTP_ACCEPT'] : NULL;
 
        # XXX: allow content negotiation for RDF, RSS, or XRDS
@@ -161,6 +173,8 @@ function common_show_header($pagetitle, $callable=NULL, $data=NULL, $headercall=
 
        # FIXME: correct language for interface
 
+       $language = common_language();
+       
        common_element_start('html', array('xmlns' => 'http://www.w3.org/1999/xhtml',
                                                                           'xml:lang' => $language,
                                                                           'lang' => $language));
@@ -285,11 +299,8 @@ function common_nav_menu() {
                common_menu_item(common_local_url('all', array('nickname' => $user->nickname)),
                                                 _('Home'));
        }
-       common_menu_item(common_local_url('public'), _('Public'));
        common_menu_item(common_local_url('peoplesearch'), _('Search'));
        common_menu_item(common_local_url('tags'), _('Tags'));
-       common_menu_item(common_local_url('doc', array('title' => 'help')),
-                                        _('Help'));
        if ($user) {
                common_menu_item(common_local_url('profilesettings'),
                                                 _('Settings'));
@@ -307,6 +318,8 @@ function common_nav_menu() {
 
 function common_foot_menu() {
        common_element_start('ul', array('id' => 'nav_sub'));
+       common_menu_item(common_local_url('doc', array('title' => 'help')),
+                                        _('Help'));
        common_menu_item(common_local_url('doc', array('title' => 'about')),
                                         _('About'));
        common_menu_item(common_local_url('doc', array('title' => 'faq')),
@@ -482,6 +495,10 @@ function common_munge_password($password, $id) {
 
 # check if a username exists and has matching password
 function common_check_user($nickname, $password) {
+       # NEVER allow blank passwords, even if they match the DB
+       if (mb_strlen($password) == 0) {
+               return false;
+       }
        $user = User::staticGet('nickname', $nickname);
        if (is_null($user)) {
                return false;
@@ -977,6 +994,10 @@ function common_date_iso8601($dt) {
        return $d->format('c');
 }
 
+function common_sql_now() {
+       return strftime('%Y-%m-%d %H:%M:%S', time());
+}
+
 function common_redirect($url, $code=307) {
        static $status = array(301 => "Moved Permanently",
                                                   302 => "Found",
@@ -1068,7 +1089,7 @@ function common_dequeue_notice($notice) {
                 $result = $qi->delete();
                if (!$result) {
                    $last_error = &PEAR::getStaticProperty('DB_DataObject','lastError');
-                    common_log(LOG_ERROR, 'DB error deleting queue item: ' . $last_error->message);
+                    common_log(LOG_ERR, 'DB error deleting queue item: ' . $last_error->message);
                     return false;
                 }
                 common_log(LOG_DEBUG, 'complete dequeueing notice ID = ' . $notice->id);
@@ -1455,4 +1476,12 @@ function common_canonical_sms($sms) {
        # strip non-digits
        preg_replace('/\D/', '', $sms);
        return $sms;
-}
\ No newline at end of file
+}
+
+function common_session_token() {
+       common_ensure_session();
+       if (!array_key_exists('token', $_SESSION)) {
+               $_SESSION['token'] = common_good_rand(64);
+       }
+       return $_SESSION['token'];
+}