Changeset 2851

Timestamp:

11/24/08 01:06:07 (7 weeks ago)

Author:

ringmaster

Message:

Replace the $_GET, $_POST, $_COOKIE, and $_SERVER superglobals with an instance of the new SuperGlobal class. Requesting array values via the SuperGlobal class returns an InputFilter'ed version of the value. To obtain the raw value, use the ->get() method. For example:
// $_GETfoo? submitted as 'one <script>two</script> three'
echo $_GETfoo?; // Outputs 'one three'
echo $_GET->raw('foo'); // Outputs 'one <script>two</script> three'
Yes, this may break previously working features.

Files:

• makaanga/0.x/htdocs/index.php (modified) (5 diffs)
• trunk/htdocs/system/admin/css/admin.css (modified) (1 diff)
• trunk/htdocs/system/classes/actionhandler.php (modified) (4 diffs)
• trunk/htdocs/system/classes/adminhandler.php (modified) (11 diffs)
• trunk/htdocs/system/classes/controller.php (modified) (2 diffs)
• trunk/htdocs/system/classes/formui.php (modified) (8 diffs)
• trunk/htdocs/system/classes/hiengine.php (modified) (1 diff)
• trunk/htdocs/system/classes/installhandler.php (modified) (19 diffs)
• trunk/htdocs/system/classes/post.php (modified) (4 diffs)
• trunk/htdocs/system/classes/posts.php (modified) (9 diffs)
• trunk/htdocs/system/classes/theme.php (modified) (3 diffs)
• trunk/htdocs/system/classes/utils.php (modified) (3 diffs)

makaanga/0.x/htdocs/index.php

@@ -22 +22 @@
  * Start the profile time
  */
-$profile_start= microtime(true); 
+$profile_start= microtime(true);
 
 /**
@@ -43 +43 @@
 // as well as the ability to dynamically change HTTP headers after output has started.
 ob_start();
+
+// Replace all of the $_GET, $_POST and $_SERVER superglobals with object
+// representations of each.  Unset $_REQUEST, which is evil.
+// $_COOKIE must be set after sessions start
+SuperGlobal::process_gps();
 
 /**
@@ -122 +127 @@
 if ( file_exists( $config ) ) {
     require_once $config;
-    
+
     // Set the default locale.
     Locale::set( isset($locale) ? $locale : 'en-us' );
-    
+
     if ( !defined( 'DEBUG' ) ) define( 'DEBUG', false );
 
@@ -191 +196 @@
  * Include all the active plugins.
  * By loading them here they'll have global scope.
- * 
+ *
  * We loop through them twice so we can cache all plugin classes on the first load() call.
  * This gives about 60% improvement.
@@ -208 +213 @@
 // Start the session.
 Session::init();
+
+// Replace the $_COOKIE superglobal with an object representation
+SuperGlobal::process_c();
 
 // Initiating request handling, tell the plugins.

trunk/htdocs/system/admin/css/admin.css

@@ -1821 +1821 @@
 
 body.page-tags .container span {
-    white-space: nowrap;
+    display: inline-block;
 }
 

trunk/htdocs/system/classes/actionhandler.php

@@ -2 +2 @@
 
 /**
- * A base class handler for URL-based actions. All ActionHandlers must 
+ * A base class handler for URL-based actions. All ActionHandlers must
  * extend this class for the Controller to call their actions.
- *  
+ *
  * @package Habari
- */  
+ */
 class ActionHandler
 {
     /**
      * Name of action to trigger
-     * 
+     *
      * @var string
      * @see act()
      */
     public $action = '';
-    
+
     /**
      * Internal array of handler variables (state info)
-     * 
+     *
      * @var array
      */
@@ -31 +31 @@
      *
      * @param string $action the action that was in the URL rule
-     */              
+     */
     public function act($action) {
         $this->action = $action;
-        
+
         $action_method = 'act_' . $action;
         $before_action_method = 'before_' . $action_method;
         $after_action_method = 'after_' . $action_method;
-        
+
         if (method_exists($this, $action_method)) {
             if (method_exists($this, $before_action_method)) {
@@ -46 +46 @@
              * Plugin action to allow plugins to execute before a certain
              * action is triggered
-             * 
+             *
              * @see ActionHandler::$action
              * @action before_act_{$action}
              */
             Plugins::act( $before_action_method, $this );
-            
+
             $this->$action_method();
-            
+
             /**
              * Plugin action to allow plugins to execute after a certain
              * action is triggered
-             * 
+             *
              * @see ActionHandler::$action
              * @action before_act_{$action}
@@ -71 +71 @@
      * Helper method to convert calls to $handler->my_action()
      * to $handler->act('my_action');
-     * 
+     *
      * @param string $function function name
      * @param array $args function arguments
      */
     public function __call($function, $args) {
-        $this->handler_vars = array_merge($this->handler_vars, $args);
         return $this->act($function);
     }
-    
+
     /**
-     * Helper method to allow RewriteRules to send a redirect. The method will 
+     * Helper method to allow RewriteRules to send a redirect. The method will
      * redirect to the build_str of the RewriteRule if matched.
      */

trunk/htdocs/system/classes/adminhandler.php

@@ -47 +47 @@
         /* At this point, Controller has not created handler_vars, so we have to modify $_POST/$_GET. */
         if ( isset( $last_form_data['post'] ) ) {
-            $_POST = array_merge( $_POST, $last_form_data['post'] );
+            $_POST = $_POST->merge( $last_form_data['post'] );
             $_SERVER['REQUEST_METHOD']= 'POST'; // This will trigger the proper act_admin switches.
             Session::remove_error( 'expired_form_submission' );
         }
         if ( isset( $last_form_data['get'] ) ) {
-            $_GET = array_merge( $_GET, $last_form_data['get'] );
+            $_GET = $_GET->merge( $last_form_data['get'] );
             Session::remove_error( 'expired_form_submission' );
             // No need to change REQUEST_METHOD since GET is the default.
@@ -420 +420 @@
     public function post_publish()
     {
-        extract( $this->handler_vars );
-
         $form = $this->form_publish( new Post(), false );
 
@@ -486 +484 @@
     public function get_publish( $template = 'publish')
     {
-        extract( $this->handler_vars );
+        $extract = $this->handler_vars->filter_keys('id', 'content_type');
+        foreach($extract as $key => $value) {
+            $$key = $value;
+        }
+
         if ( isset( $id ) ) {
             $post = Post::get( array( 'id' => $id, 'status' => Post::status( 'any' ) ) );
@@ -540 +542 @@
         $form->content->tabindex = 2;
         $form->content->value = $post->content;
+        $form->content->raw = true;
 
         // Create the tags field
@@ -616 +619 @@
     public function post_delete_post()
     {
-        extract( $this->handler_vars );
+        $extract = $this->handler_vars->filter_keys('id', 'nonce', 'timestamp', 'PasswordDigest');
+        foreach($extract as $key => $value) {
+            $$key = $value;
+        }
+
         $okay = TRUE;
         if ( empty( $id ) || empty( $nonce ) || empty( $timestamp ) || empty( $PasswordDigest ) ) {
@@ -657 +664 @@
     public function post_user()
     {
-        extract( $this->handler_vars );
+        $extract = $this->handler_vars->filter_keys('nonce', 'timestamp', 'PasswordDigest');
+        foreach($extract as $key => $value) {
+            $$key = $value;
+        }
 
         $wsse = Utils::WSSE( $nonce, $timestamp );
@@ -671 +681 @@
         $fields = array( 'user_id' => 'id', 'delete' => NULL, 'username' => 'username', 'displayname' => 'displayname', 'email' => 'email', 'imageurl' => 'imageurl', 'pass1' => NULL, 'locale_tz' => 'locale_tz', 'locale_date_format' => 'locale_date_format', 'locale_time_format' => 'locale_time_format' );
         $fields = Plugins::filter( 'adminhandler_post_user_fields', $fields );
-        $posted_fields = array_intersect_key( $this->handler_vars, $fields );
+        $posted_fields = $this->handler_vars->filter_keys( array_keys( $fields ) );
 
         // Editing someone else's profile? If so, load that user's profile
@@ -743 +753 @@
                     break;
                 default:
-                    if ( isset( ${$fields[$posted_field]} ) && ( $user->info->$fields[$posted_field] != ${$fields[$posted_field]} ) ) {
-                        $user->info->$fields[$posted_field]= ${$fields[$posted_field]};
+                    if ( isset( $this->handler_vars[$fields[$posted_field]] ) && ( $user->info->$fields[$posted_field] != $this->handler_vars[$fields[$posted_field]] ) ) {
+                        $user->info->$fields[$posted_field]= $this->handler_vars[$fields[$posted_field]];
                         Session::notice( _t( 'Userinfo updated!' ) );
                         $update = TRUE;
@@ -875 +885 @@
         $this->fetch_users();
 
-        extract( $this->handler_vars );
+        $extract = $this->handler_vars->filter_keys('newuser', 'delete', 'new_pass1', 'new_pass2', 'new_email', 'new_username');
+        foreach($extract as $key => $value) {
+            $$key = $value;
+        }
 
         if(isset($newuser)) {
             $action = 'newuser';
-        } elseif(isset($delete)) {
+        }
+        elseif(isset($delete)) {
             $action = 'delete';
         }
@@ -936 +950 @@
     public function get_plugin_toggle()
     {
-        extract( $this->handler_vars );
+        $extract = $this->handler_vars->filter_keys('plugin_id', 'action');
+        foreach($extract as $key => $value) {
+            $$key = $value;
+        }
+
         $plugins = Plugins::list_all();
         foreach($plugins as $file) {
@@ -1020 +1038 @@
     public function get_activate_theme()
     {
-        extract( $this->handler_vars );
+        $theme_name = $this->handler_vars['theme_name'];
+        $theme_dir = $this->handler_vars['theme_dir'];
         if ( isset($theme_name)  && isset($theme_dir) ) {
             Themes::activate_theme( $theme_name,  $theme_dir );

trunk/htdocs/system/classes/controller.php

@@ -119 +119 @@
         $start_url = trim($start_url, '/');
 
-        /* Remove the querystring from the URL */
-        if ( strpos($start_url, '?') !== FALSE ) {
-            list($start_url, $query_string)= explode('?', $start_url);
-        }
-
-        /* Return $_GET values to their proper place */
-        if( !empty($query_string) ) {
-            parse_str($query_string, $_GET);
-        }
-
-        /* Undo what magic_quotes_gpc might have wrought */
-        Utils::revert_magic_quotes_gpc();
-
         /* Allow plugins to rewrite the stub before it's passed through the rules */
         $start_url = Plugins::filter('rewrite_request', $start_url);
@@ -154 +141 @@
 
         /* Also, we musn't forget to add the GET and POST vars into the action's settings array */
-        $controller->handler->handler_vars = array_merge($controller->handler->handler_vars, $_GET, $_POST);
+        $handler_vars = new SuperGlobal($controller->handler->handler_vars);
+        $handler_vars = $handler_vars->merge($_GET, $_POST);
+        $controller->handler->handler_vars = $handler_vars;
         return true;
     }

trunk/htdocs/system/classes/formui.php

@@ -699 +699 @@
     protected $properties = array();
     protected $template = null;
+    protected $raw = false;
 
     /**
@@ -922 +923 @@
             case 'value':
                 if(isset($_POST[$this->field])) {
-                    return $_POST[$this->field];
+                    return $this->raw ? $_POST->raw($this->field) : $_POST[$this->field];
                 }
                 else {
@@ -995 +996 @@
                 $this->template = $value;
                 break;
+            case 'raw':
+                $this->raw = $value;
+                break;
             default:
                 $this->properties[$name] = $value;
@@ -1075 +1079 @@
         $this->container->move_after( $this, $target );
     }
-    
+
     /**
      * Remove this controls from the form
@@ -1182 +1186 @@
         $theme = $this->get_theme($forvalidation, $this);
         $max = Tags::max_count();
-        
+
         $tag = $this->tag;
-        
+
         $theme->class = 'tag_'.$tag->slug;
         $theme->id = $tag->id;
@@ -1190 +1194 @@
         $theme->caption = $tag->tag;
         $theme->count = $tag->count;
-                
+
         return $theme->fetch( 'tabcontrol_tag' );
     }
@@ -1353 +1357 @@
         return $theme->fetch( $this->get_template() );
     }
-    
+
     /**
      * Magic __get method for returning property values
@@ -1379 +1383 @@
         return parent::__get($name);
     }
-    
+
 }
 

trunk/htdocs/system/classes/hiengine.php

@@ -237 +237 @@
                 case 'url':
                     return '<?php URL::out( \'' . $cmd_matches[2] . '\' ); ?>';
+                case 'session':
+                    switch($cmd_matches[2]) {
+                        case 'messages':
+                            return '<?php if(Session::has_messages()){Session::messages_out();} ?>';
+                        case 'errors':
+                            return '<?php if(Session::has_errors()){Session::messages_out();} ?>';
+                    }
             }
         }

trunk/htdocs/system/classes/installhandler.php

@@ -14 +14 @@
     public function act_begin_install()
     {
-        // Revert magic quotes, normally Controller calls this.
-        Utils::revert_magic_quotes_gpc();
-
         // Create a new theme to handle the display of the installer
         $this->theme = Themes::create('installer', 'RawPHPEngine', HABARI_PATH . '/system/installer/');
-        
+
         /**
          * Set user selected Locale or default
@@ -119 +116 @@
         // now merge in any HTTP POST values that might have been sent
         // these will override the defaults and the config.php values
-        $this->handler_vars = array_merge($this->handler_vars, $_POST);
+        $this->handler_vars = $this->handler_vars->merge($_POST);
 
         // we need details for the admin user to install
@@ -165 +162 @@
         }
 
-        
+
 
         // Installation complete. Secure sqlite if it was chosen as the database type to use
@@ -178 +175 @@
         return true;
     }
-    
+
     /*
      * Helper function to grab list of plugins
@@ -217 +214 @@
                 $plugin['active']= false;
             }
-            
+
             $plugins[$plugin_id]= $plugin;
         }
-        
+
         return $plugins;
     }
-    
+
     /**
      * Helper function to remove code repetition
@@ -234 +231 @@
             $this->theme->assign($key, $value);
         }
-        
+
         $this->theme->assign('plugins', $this->get_plugins());
-        
+
         $this->theme->display($template_name);
         exit;
@@ -305 +302 @@
         }
         $this->theme->assign('missing_extensions',  $missing_extensions);
-        
+
         if ( extension_loaded('pdo') ) {
             /* Check for PDO drivers */
@@ -333 +330 @@
             }
         }
-        
+
         /**
          * $local_writable is used in the template, but never set in Habari
@@ -341 +338 @@
          */
         $this->theme->assign( 'local_writable', true );
-        
+
         return $requirements_met;
     }
@@ -449 +446 @@
             DB::begin_transaction();
         }
-        
+
         /* Store current DB version so we don't immediately run dbdelta. */
         Version::save_dbversion();
@@ -824 +821 @@
             'rewrite_base' => '#RewriteBase /',
             'rewrite_rule' => 'RewriteRule . index.php [PT]',
+            'hide_habari' => 'RewriteRule ^(system/(classes|locale|schema|$)) index.php [PT]',
             'close_block' => '### HABARI END',
         );
@@ -956 +954 @@
 
     /**
-     * attempts to write the Files clause to the .htaccess file 
+     * attempts to write the Files clause to the .htaccess file
      * if the clause for this sqlite doesn't exist.
      * @return bool success or failure
@@ -998 +996 @@
         return true;
     }
-    
+
     private function upgrade_db_pre ( $current_version ) {
-        
+
         // this is actually a stripped-down version of DatabaseConnection::upgrade() - it doesn't support files
-        
+
         $upgrade_functions = get_class_methods( $this );
-        
+
         $upgrades = array();
-        
+
         foreach ( $upgrade_functions as $fn ) {
-            
+
             // match all methods named "upgrade_db_pre_<rev#>"
             if ( preg_match( '%^upgrade_db_pre_([0-9]+)$%i', $fn, $matches ) ) {
-                
+
                 $upgrade_version = intval( $matches[1] );
-                
+
                 if ( $upgrade_version > $current_version ) {
-                    
+
                     $upgrades[ sprintf( '%010s_1', $upgrade_version ) ] = $fn;
-                    
-                }
-                
-            }
-            
-        }
-        
+
+                }
+
+            }
+
+        }
+
         // sort the upgrades by revision, ascending
         ksort( $upgrades );
-                
-        
+
+
         foreach ( $upgrades as $upgrade ) {
-            
+
             $result =& call_user_func( array( $this, $upgrade ) );
-            
+
             // if we failed, abort
             if ( $result === false ) {
                 break;
             }
-            
-        }
-        
-    }
-    
+
+        }
+
+    }
+
     private function upgrade_db_post ( $current_version ) {
-        
+
         // this is actually a stripped-down version of DatabaseConnection::upgrade() - it doesn't support files
-        
+
         $upgrade_functions = get_class_methods( $this );
-        
+
         $upgrades = array();
-        
+
         foreach ( $upgrade_functions as $fn ) {
-            
+
             // match all methods named "upgrade_db_post_<rev#>"
             if ( preg_match( '%^upgrade_db_post_([0-9]+)$%i', $fn, $matches ) ) {
-                
+