X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=inc%2Ffunctions.php;h=c3ea1635583126c636c35c8f605add977016a2c4;hb=47607f04e6e726290ba784ce3338892c4acc1b2d;hp=c68f9cb293ddd99be3a2435097d0a82d347cd4a4;hpb=655f1bea8cda9a62fda703428f8693d8c025ff50;p=mailer.git diff --git a/inc/functions.php b/inc/functions.php index c68f9cb293..c3ea163558 100644 --- a/inc/functions.php +++ b/inc/functions.php @@ -163,7 +163,7 @@ function compileFinalOutput () { $newContent = ''; // Compile it - $eval = "\$newContent = \"".compileCode(addslashes($GLOBALS['output']))."\";"; + $eval = "\$newContent = \"".compileCode(escapeQuotes($GLOBALS['output']))."\";"; eval($eval); // Was that eval okay? @@ -184,7 +184,7 @@ function compileFinalOutput () { // Output the raw HTML code function outputRawCode ($htmlCode) { // Output stripped HTML code to avoid broken JavaScript code, etc. - print($htmlCode); + print(str_replace('{BACK}', "\\", $htmlCode)); // Flush the output if only getPhpCaching() is not 'on' if (getPhpCaching() != 'on') { @@ -204,7 +204,7 @@ function getFatalArray () { } // Add a fatal error message to the queue array -function addFatalMessage ($F, $L, $message, $extra='') { +function addFatalMessage ($F, $L, $message, $extra = '') { if (is_array($extra)) { // Multiple extras for a message with masks $message = call_user_func_array('sprintf', $extra); @@ -218,7 +218,7 @@ function addFatalMessage ($F, $L, $message, $extra='') { // Log fatal messages away debug_report_bug($message); - logDebugMessage($F, $L, " message={$message}"); + logDebugMessage($F, $L, 'Fatal error message: ' . $message); } // Getter for total fatal message count @@ -237,7 +237,7 @@ function getTotalFatalErrors () { } // Load a template file and return it's content (only it's name; do not use ' or ") -function loadTemplate ($template, $return=false, $content=array()) { +function loadTemplate ($template, $return = false, $content = array()) { // @TODO Remove this sanity-check if all is fine if (!is_bool($return)) debug_report_bug('return is not bool (' . gettype($return) . ')'); @@ -255,73 +255,18 @@ function loadTemplate ($template, $return=false, $content=array()) { // Make all template names lowercase $template = strtolower($template); - // Count the template load - incrementConfigEntry('num_templates'); - // Init some data $ret = ''; if (empty($GLOBALS['refid'])) $GLOBALS['refid'] = '0'; // Base directory $basePath = sprintf("%stemplates/%s/html/", getConfig('PATH'), getLanguage()); - $mode = ''; - - // Check for admin/guest/member templates - if (substr($template, 0, 6) == 'admin_') { - // Admin template found - $mode = 'admin/'; - } elseif (substr($template, 0, 6) == 'guest_') { - // Guest template found - $mode = 'guest/'; - } elseif (substr($template, 0, 7) == 'member_') { - // Member template found - $mode = 'member/'; - } elseif (substr($template, 0, 8) == 'install_') { - // Installation template found - $mode = 'install/'; - } elseif (substr($template, 0, 4) == 'ext_') { - // Extension template found - $mode = 'ext/'; - } elseif (substr($template, 0, 3) == 'la_') { - // 'Logical-area' template found - $mode = 'la/'; - } elseif (substr($template, 0, 3) == 'js_') { - // JavaScript template found - $mode = 'js/'; - } elseif (substr($template, 0, 5) == 'menu_') { - // Menu template found - $mode = 'menu/'; - } else { - // Test for extension - $test = substr($template, 0, strpos($template, '_')); - - // Probe for valid extension name - if (isExtensionNameValid($test)) { - // Set extra path to extension's name - $mode = $test . '/'; - } // END - if - } + $extraPath = detectExtraTemplatePath($template);; //////////////////////// // Generate file name // //////////////////////// - $FQFN = $basePath . $mode . $template . '.tpl'; - - if ((isWhatSet()) && ((strpos($template, '_header') > 0) || (strpos($template, '_footer') > 0)) && (($mode == 'guest/') || ($mode == 'member/') || ($mode == 'admin/'))) { - // Select what depended header/footer template file for admin/guest/member area - $file2 = sprintf("%s%s%s_%s.tpl", - $basePath, - $mode, - $template, - getWhat() - ); - - // Probe for it... - if (isFileReadable($file2)) $FQFN = $file2; - - // Remove variable from memory - unset($file2); - } // END - if + $FQFN = $basePath . $extraPath . $template . '.tpl'; // Does the special template exists? if (!isFileReadable($FQFN)) { @@ -331,6 +276,9 @@ function loadTemplate ($template, $return=false, $content=array()) { // Now does the final template exists? if (isFileReadable($FQFN)) { + // Count the template load + incrementConfigEntry('num_templates'); + // The local file does exists so we load it. :) $GLOBALS['tpl_content'] = readFromFile($FQFN); @@ -340,21 +288,21 @@ function loadTemplate ($template, $return=false, $content=array()) { // Normal HTML output? if (getOutputMode() == '0') { // Add surrounding HTML comments to help finding bugs faster - $ret = "\n" . $GLOBALS['tpl_content'] . "\n"; + $ret = '\n" . $GLOBALS['tpl_content'] . '\n"; // Prepare eval() command - $eval = '$ret = "' . compileCode(addslashes($ret)) . '";'; + $eval = '$ret = "' . compileCode(escapeQuotes($ret)) . '";'; } elseif (substr($template, 0, 3) == 'js_') { // JavaScripts don't like entities and timings - $eval = '$ret = decodeEntities("' . compileRawCode(addslashes($GLOBALS['tpl_content'])) . '");'; + $eval = '$ret = decodeEntities("' . compileRawCode(escapeJavaScriptQuotes($GLOBALS['tpl_content'])) . '");'; } else { - // Prepare eval() command - $eval = '$ret = "' . compileCode(addslashes($GLOBALS['tpl_content'])) . '";'; + // Prepare eval() command, other output doesn't like entities, maybe + $eval = '$ret = decodeEntities("' . compileRawCode(escapeQuotes($GLOBALS['tpl_content'])) . '");'; } } else { // Add surrounding HTML comments to help finding bugs faster - $ret = "\n" . $GLOBALS['tpl_content'] . "\n"; - $eval = '$ret = "' . addslashes($ret) . '";'; + $ret = '\n" . $GLOBALS['tpl_content'] . '\n"; + $eval = '$ret = "' . escapeQuotes($ret) . '";'; } // END - if // Cache the eval() command here @@ -397,6 +345,51 @@ function loadTemplate ($template, $return=false, $content=array()) { } } +// Detects the extra template path from given template name +function detectExtraTemplatePath ($template) { + // Default is empty + $extraPath = ''; + + // Check for admin/guest/member templates + if (substr($template, 0, 6) == 'admin_') { + // Admin template found + $extraPath = 'admin/'; + } elseif (substr($template, 0, 6) == 'guest_') { + // Guest template found + $extraPath = 'guest/'; + } elseif (substr($template, 0, 7) == 'member_') { + // Member template found + $extraPath = 'member/'; + } elseif (substr($template, 0, 8) == 'install_') { + // Installation template found + $extraPath = 'install/'; + } elseif (substr($template, 0, 4) == 'ext_') { + // Extension template found + $extraPath = 'ext/'; + } elseif (substr($template, 0, 3) == 'la_') { + // 'Logical-area' template found + $extraPath = 'la/'; + } elseif (substr($template, 0, 3) == 'js_') { + // JavaScript template found + $extraPath = 'js/'; + } elseif (substr($template, 0, 5) == 'menu_') { + // Menu template found + $extraPath = 'menu/'; + } else { + // Test for extension + $test = substr($template, 0, strpos($template, '_')); + + // Probe for valid extension name + if (isExtensionNameValid($test)) { + // Set extra path to extension's name + $extraPath = $test . '/'; + } // END - if + } + + // Return result + return $extraPath; +} + // Loads an email template and compiles it function loadEmailTemplate ($template, $content = array(), $UID = '0') { global $DATA; @@ -471,37 +464,22 @@ function loadEmailTemplate ($template, $content = array(), $UID = '0') { if (isset($content['email'])) $email = $content['email']; // Store email for some functions in global data array + // @TODO Do only use $contentn, not $DATA or raw variables $DATA['email'] = $email; // Base directory $basePath = sprintf("%stemplates/%s/emails/", getConfig('PATH'), getLanguage()); - // Check for admin/guest/member templates - if (substr($template, 0, 6) == 'admin_') { - // Admin template found - $FQFN = $basePath.'admin/' . $template.'.tpl'; - } elseif (substr($template, 0, 6) == 'guest_') { - // Guest template found - $FQFN = $basePath.'guest/' . $template.'.tpl'; - } elseif (substr($template, 0, 7) == 'member_') { - // Member template found - $FQFN = $basePath.'member/' . $template.'.tpl'; - } else { - // Test for extension - $test = substr($template, 0, strpos($template, '_')); - if (isExtensionNameValid($test)) { - // Set extra path to extension's name - $FQFN = $basePath . $test.'/' . $template.'.tpl'; - } else { - // No special filename - $FQFN = $basePath . $template.'.tpl'; - } - } + // Detect extra path + $extraPath = detectExtraTemplatePath($template); + + // Generate full FQFN + $FQFN = $basePath . $extraPath . $template . '.tpl'; // Does the special template exists? if (!isFileReadable($FQFN)) { // Reset to default template - $FQFN = $basePath . $template.'.tpl'; + $FQFN = $basePath . $template . '.tpl'; } // END - if // Now does the final template exists? @@ -511,16 +489,16 @@ function loadEmailTemplate ($template, $content = array(), $UID = '0') { $GLOBALS['tpl_content'] = readFromFile($FQFN); // Run code - $GLOBALS['tpl_content'] = "\$newContent = decodeEntities(\"".compileRawCode(addslashes($GLOBALS['tpl_content']))."\");"; + $GLOBALS['tpl_content'] = "\$newContent = decodeEntities(\"".compileRawCode(escapeQuotes($GLOBALS['tpl_content']))."\");"; eval($GLOBALS['tpl_content']); } elseif (!empty($template)) { // Template file not found! - $newContent = "{--TEMPLATE_404--}: " . $template."
+ $newContent = '{--TEMPLATE_404--}: ' . $template . '
{--TEMPLATE_CONTENT--} -
".print_r($content, true)."
+
' . print_r($content, true) . '
{--TEMPLATE_DATA--} -
".print_r($DATA, true)."
-

"; +
' . print_r($DATA, true) . '
+

'; // Debug mode not active? Then remove the HTML tags if (!isDebugModeEnabled()) $newContent = secureString($newContent); @@ -533,6 +511,7 @@ function loadEmailTemplate ($template, $content = array(), $UID = '0') { if (empty($newContent)) { // Compiling failed $newContent = "Compiler error for template {$template}!\nUncompiled content:\n" . $GLOBALS['tpl_content']; + // Add last error if the required function exists if (function_exists('error_get_last')) $newContent .= "\n--------------------------------------\nDebug:\n".print_r(error_get_last(), true)."--------------------------------------\nPlease don't alter these informations!\nThanx."; } // END - if @@ -541,10 +520,6 @@ function loadEmailTemplate ($template, $content = array(), $UID = '0') { unset($content); unset($DATA); - // Compile the code and eval it - $eval = '$newContent = "' . compileRawCode(addslashes($newContent)) . '";'; - eval($eval); - // Return content return $newContent; } @@ -554,7 +529,7 @@ function sendEmail ($toEmail, $subject, $message, $isHtml = 'N', $mailHeader = ' //* DEBUG: */ outputHtml(__FUNCTION__."(".__LINE__."):TO={$toEmail},SUBJECT={$subject}
"); // Compile subject line (for POINTS constant etc.) - eval("\$subject = decodeEntities(\"".compileRawCode(addslashes($subject))."\");"); + eval("\$subject = decodeEntities(\"".compileRawCode(escapeQuotes($subject))."\");"); // Set from header if ((!eregi('@', $toEmail)) && ($toEmail > 0)) { @@ -600,17 +575,17 @@ function sendEmail ($toEmail, $subject, $message, $isHtml = 'N', $mailHeader = ' } // Compile "TO" - eval("\$toEmail = \"".compileRawCode(addslashes($toEmail))."\";"); + eval("\$toEmail = \"".compileRawCode(escapeQuotes($toEmail))."\";"); // Compile "MSG" - eval("\$message = \"".compileRawCode(addslashes($message))."\";"); + eval("\$message = \"".compileRawCode(escapeQuotes($message))."\";"); // Fix HTML parameter (default is no!) if (empty($isHtml)) $isHtml = 'N'; if (isDebugModeEnabled()) { // In debug mode we want to display the mail instead of sending it away so we can debug this part outputHtml('
-Headers : ' . str_replace('<', '<', str_replace('>', '>', htmlentities(trim($mailHeader)))) . '
+Headers : ' . str_replace('<', '<', str_replace('>', '>', secureString(trim($mailHeader)))) . '
 To      : ' . $toEmail . '
 Subject : ' . $subject . '
 Message : ' . $message . '
@@ -627,7 +602,7 @@ Message : ' . $message . '
 	}
 }
 
-// Check if legacy or PHPMailer command
+// Check to use wether legacy mail() command or PHPMailer class
 // @TODO Rewrite this to an extension 'smtp'
 // @private
 function checkPhpMailerUsage() {
@@ -636,6 +611,12 @@ function checkPhpMailerUsage() {
 
 // Send out a raw email with PHPMailer class or legacy mail() command
 function sendRawEmail ($toEmail, $subject, $message, $from) {
+	// Just compile all again, to put out all configs, etc.
+	eval('$toEmail = decodeEntities("' . compileRawCode(escapeQuotes($toEmail)) . '");');
+	eval('$subject = decodeEntities("' . compileRawCode(escapeQuotes($subject)) . '");');
+	eval('$message = decodeEntities("' . compileRawCode(escapeQuotes($message)) . '");');
+	eval('$from    = decodeEntities("' . compileRawCode(escapeQuotes($from))    . '");');
+
 	// Shall we use PHPMailer class or legacy mode?
 	if (checkPhpMailerUsage()) {
 		// Use PHPMailer class with SMTP enabled
@@ -1040,11 +1021,11 @@ function compileRawCode ($code, $simple = false, $constants = true, $full = true
 		return $code;
 	} // END - if
 
-	// Init replacement-array with full security characters
-	$secChars = $GLOBALS['security_chars'];
+	// Init replacement-array with smaller set of security characters
+	$secChars = $GLOBALS['url_chars'];
 
-	// Select smaller set of chars to replace when we e.g. want to compile URLs
-	if ($full === false) $secChars = $GLOBALS['url_chars'];
+	// Select full set of chars to replace when we e.g. want to compile URLs
+	if ($full === true) $secChars = $GLOBALS['security_chars'];
 
 	// Compile more through a filter
 	$code = runFilterChain('compile_code', $code);
@@ -1067,6 +1048,7 @@ function compileRawCode ($code, $simple = false, $constants = true, $full = true
 	} // END - foreach
 
 	// Find $content[bla][blub] entries
+	// @TODO Do only use $content and deprecate $GLOBALS and $DATA in templates
 	preg_match_all('/\$(content|GLOBALS|DATA)((\[([a-zA-Z0-9-_]+)\])*)/', $code, $matches);
 
 	// Are some matches found?
@@ -1100,13 +1082,13 @@ function compileRawCode ($code, $simple = false, $constants = true, $full = true
 				// Replace it in the code
 				//* DEBUG: */ outputHtml(__FUNCTION__."(".__LINE__."):key={$key},match={$match}
"); $newMatch = str_replace('[', "['", str_replace(']', "']", $match)); - $code = str_replace($match, "\"." . $newMatch.".\"", $code); + $code = str_replace($match, '".' . $newMatch . '."', $code); $matchesFound[$key . '_' . $matches[4][$key]] = 1; $matchesFound[$match] = 1; } elseif (!isset($matchesFound[$match])) { // Not yet replaced! //* DEBUG: */ outputHtml(__FUNCTION__."(".__LINE__."):match={$match}
"); - $code = str_replace($match, "\"." . $match.".\"", $code); + $code = str_replace($match, '".' . $match . '."', $code); $matchesFound[$match] = 1; } } // END - foreach @@ -1359,7 +1341,7 @@ function bigintval ($num, $castValue = true) { function generateImageOrCode ($img_code, $headerSent = true) { // Is the code size oversized or shouldn't we display it? if ((strlen($img_code) > 6) || (empty($img_code)) || (getConfig('code_length') == '0')) { - // Stop execution of function here because of over-sized code length + // Stop2 execution of function here because of over-sized code length debug_report_bug('img_code ' . $img_code .' has invalid length. img_code()=' . strlen($img_code) . ' code_length=' . getConfig('code_length')); } elseif ($headerSent === false) { // Return an HTML code here @@ -1472,35 +1454,35 @@ function createTimeSelections ($timestamp, $prefix = '', $display = '', $align = } else { // Generate table $OUT = "
\n"; - $OUT .= "\n"; + $OUT .= "
\n"; $OUT .= "\n"; if (ereg('Y', $display) || (empty($display))) { - $OUT .= " \n"; + $OUT .= " \n"; } if (ereg('M', $display) || (empty($display))) { - $OUT .= " \n"; + $OUT .= " \n"; } - if (ereg("W", $display) || (empty($display))) { - $OUT .= " \n"; + if (ereg('W', $display) || (empty($display))) { + $OUT .= " \n"; } - if (ereg("D", $display) || (empty($display))) { - $OUT .= " \n"; + if (ereg('D', $display) || (empty($display))) { + $OUT .= " \n"; } - if (ereg("h", $display) || (empty($display))) { - $OUT .= " \n"; + if (ereg('h', $display) || (empty($display))) { + $OUT .= " \n"; } if (ereg('m', $display) || (empty($display))) { - $OUT .= " \n"; + $OUT .= " \n"; } - if (ereg("s", $display) || (empty($display))) { - $OUT .= " \n"; + if (ereg('s', $display) || (empty($display))) { + $OUT .= " \n"; } $OUT .= "\n"; @@ -1516,7 +1498,7 @@ function createTimeSelections ($timestamp, $prefix = '', $display = '', $align = } $OUT .= " \n"; } else { - $OUT .= "\n"; + $OUT .= "\n"; } if (ereg('M', $display) || (empty($display))) { @@ -1530,10 +1512,10 @@ function createTimeSelections ($timestamp, $prefix = '', $display = '', $align = } $OUT .= " \n"; } else { - $OUT .= "\n"; + $OUT .= "\n"; } - if (ereg("W", $display) || (empty($display))) { + if (ereg('W', $display) || (empty($display))) { // Generate week selection $OUT .= " \n"; } else { - $OUT .= "\n"; + $OUT .= "\n"; } - if (ereg("D", $display) || (empty($display))) { + if (ereg('D', $display) || (empty($display))) { // Generate day selection $OUT .= " \n"; } else { - $OUT .= "\n"; + $OUT .= "\n"; } - if (ereg("h", $display) || (empty($display))) { + if (ereg('h', $display) || (empty($display))) { // Generate hour selection $OUT .= " \n"; } else { - $OUT .= "\n"; + $OUT .= "\n"; } if (ereg('m', $display) || (empty($display))) { @@ -1582,10 +1564,10 @@ function createTimeSelections ($timestamp, $prefix = '', $display = '', $align = } $OUT .= " \n"; } else { - $OUT .= "\n"; + $OUT .= "\n"; } - if (ereg("s", $display) || (empty($display))) { + if (ereg('s', $display) || (empty($display))) { // Generate second selection $OUT .= " \n"; } else { - $OUT .= "\n"; + $OUT .= "\n"; } $OUT .= "\n"; $OUT .= "
{--_YEARS--}
{--_YEARS--}
{--_MONTHS--}
{--_MONTHS--}
{--_WEEKS--}
{--_WEEKS--}
{--_DAYS--}
{--_DAYS--}
{--_HOURS--}
{--_HOURS--}
{--_MINUTES--}
{--_MINUTES--}
{--_SECONDS--}
{--_SECONDS--}
\n"; @@ -2046,7 +2028,7 @@ function generateHash ($plainText, $salt = '') { // Do we miss an arry element here? if (!isConfigEntrySet('file_hash')) { - // Stop here + // Stop2 here debug_report_bug('Missing file_hash in ' . __FUNCTION__ . '.'); } // END - if @@ -2344,9 +2326,9 @@ function getCurrentTheme () { if ((isGetRequestElementSet('theme')) && (isFileReadable($theme))) { // Set cookie from URL data setTheme(getRequestElement('theme')); - } elseif (isFileReadable(sprintf("%stheme/%s/theme.php", getConfig('PATH'), SQL_ESCAPE(postRequestElement('theme'))))) { + } elseif (isFileReadable(sprintf("%stheme/%s/theme.php", getConfig('PATH'), secureString(postRequestElement('theme'))))) { // Set cookie from posted data - setTheme(SQL_ESCAPE(postRequestElement('theme'))); + setTheme(secureString(postRequestElement('theme'))); } // Set return value @@ -2384,7 +2366,7 @@ function getThemeId ($name) { // Count up incrementStatsEntry('cache_hits'); - } elseif (getExtensionVersion('cache') != '0.1.8') { + } elseif (isExtensionInstalledAndNewer('cache', '0.1.8')) { // Check if current theme is already imported or not $result = SQL_QUERY_ESC("SELECT `id` FROM `{?_MYSQL_PREFIX?}_themes` WHERE `theme_path`='%s' LIMIT 1", array($name), __FUNCTION__, __LINE__); @@ -3210,7 +3192,7 @@ function determineReferalId () { } // Is the record valid? - if (($found === false) || (!isUserDataValid())) { + if ((($found === false) || (!isUserDataValid())) && (isConfigEntrySet('def_refid'))) { // No, then reset referal id $GLOBALS['refid'] = getConfig('def_refid'); } // END - if @@ -3245,7 +3227,7 @@ function shutdown () { addFatalMessage(__FILE__, __LINE__, getMessage('NO_DB_LINK_SHUTDOWN')); } - // Stop executing here + // Stop2 executing here exit; } @@ -3674,7 +3656,7 @@ function isTemplateCached ($template) { // Flushes non-flushed template cache to disk function flushTemplateCache ($template, $eval) { // Is this cache flushed? - if ((!isTemplateCached($template)) && ($eval != '404')) { + if ((isDebuggingTemplateCache() === false) && (isTemplateCached($template) === false) && ($eval != '404')) { // Generate FQFN $FQFN = sprintf("%s_compiled/templates/%s.tpl.cache", getConfig('CACHE_PATH'), $template); @@ -3689,7 +3671,7 @@ function flushTemplateCache ($template, $eval) { // Reads a template cache function readTemplateCache ($template) { // Check it again - if (isTemplateCached($template)) { + if ((isDebuggingTemplateCache() === false) && (isTemplateCached($template))) { // Generate FQFN $FQFN = sprintf("%s_compiled/templates/%s.tpl.cache", getConfig('CACHE_PATH'), $template); @@ -3701,6 +3683,30 @@ function readTemplateCache ($template) { return $GLOBALS['template_eval'][$template]; } +// Escapes quotes (default is only double-quotes) +function escapeQuotes ($str, $single = false) { + // Should we escape all? + if ($single === true) { + // Escape all (including null) + $str = addslashes($str); + } else { + // Escape only double-quotes but prevent double-quoting + $str = str_replace("\\\\", "\\", str_replace('"', "\\\"", $str)); + } + + // Return the escaped string + return $str; +} + +// Escapes the JavaScript code, prevents \r and \n becoming char 10/13 +function escapeJavaScriptQuotes ($str) { + // Replace all double-quotes and secure back-ticks + $str = str_replace('"', '\"', str_replace("\\", '{BACK}', $str)); + + // Return it + return $str; +} + ////////////////////////////////////////////////// // AUTOMATICALLY RE-GENERATED MISSING FUNCTIONS // ////////////////////////////////////////////////// @@ -3716,7 +3722,7 @@ if (!function_exists('html_entity_decode')) { if (!function_exists('http_build_query')) { // Taken from documentation on www.php.net, credits to Marco K. (Germany) - function http_build_query($data, $prefix='', $sep='', $key='') { + function http_build_query($data, $prefix = '', $sep = '', $key = '') { $ret = array(); foreach ((array)$data as $k => $v) { if (is_int($k) && $prefix != null) { @@ -3736,7 +3742,7 @@ if (!function_exists('http_build_query')) { return implode($sep, $ret); } -}// // END - if +} // END - if // [EOF] ?>