diff --git a/classes/Settings.php b/classes/Settings.php new file mode 100644 index 0000000..05e5a1f --- /dev/null +++ b/classes/Settings.php @@ -0,0 +1,93 @@ + 0,', '"configCreateDate" => ' . $configfilemtime . ',', $settingsContents); + // Now update the config file + if (!$fh = fopen(dirname(__FILE__) . "/../data/" . $settingsFile, 'w')) { + $reqsPassed = false; + $reqsFailures = ["phpUpdateSettings"]; + include dirname(__FILE__) . "/../lib/requirements.php"; + } + fwrite($fh, $settingsContents); + fclose($fh); + // Set the new value in array + $ICEcoderUserSettings['configCreateDate'] = $configfilemtime; + } + + public function updatePasswordCheckUpdates(): void + { + global $settingsFile, $password; + + $settingsContents = getData("../data/" . $settingsFile); + // Replace our empty password with the one submitted by user + $settingsContents = str_replace('"password" => "",','"password" => "' . $password . '",', $settingsContents); + // Also set the update checker preference + $checkUpdates = $_POST['checkUpdates'] == "true" ? "true" : "false"; + // once to cover the true setting, once to cover false + $settingsContents = str_replace('"checkUpdates" => true,','"checkUpdates" => ' . $checkUpdates . ',', $settingsContents); + $settingsContents = str_replace('"checkUpdates" => false,','"checkUpdates" => ' . $checkUpdates . ',', $settingsContents); + // Now update the config file + if (!$fh = fopen(dirname(__FILE__) . "/../data/" . $settingsFile, 'w')) { + $reqsPassed = false; + $reqsFailures = ["phpUpdateSettings"]; + include(dirname(__FILE__) . "/../lib/requirements.php"); + } + fwrite($fh, $settingsContents); + fclose($fh); + } + + public function createIPSettingsFileIfNotExist(): void + { + global $username, $settingsFile; + + // Create a duplicate version for the IP address of the domain if it doesn't exist yet + $serverAddr = $_SERVER['SERVER_ADDR'] ?? "1"; + if ($serverAddr == "1" || $serverAddr == "::1") { + $serverAddr = "127.0.0.1"; + } + $settingsFileAddr = 'config-' . $username . str_replace(".", "_", $serverAddr) . '.php'; + if (true === file_exists(dirname(__FILE__) . "/../data/" . $settingsFileAddr)) { + if (false === copy(dirname(__FILE__) . "/../data/" . $settingsFile, dirname(__FILE__) . "/../data/" . $settingsFileAddr)) { + $reqsPassed = false; + $reqsFailures = ["phpCreateSettingsFileAddr"]; + include dirname(__FILE__) . "/../lib/requirements.php"; + } + } + } + + public function disableFurtherRegistration(): void + { + global $configSettings; + + // Disable the enableRegistration config setting if the user had that option chosen + if (true === isset($_POST['disableFurtherRegistration'])) { + $updatedConfigSettingsFile = getData(dirname(__FILE__) . "/../data/" . $configSettings); + if ($fUConfigSettings = fopen(dirname(__FILE__) . "/../data/" . $configSettings, 'w')) { + $updatedConfigSettingsFile = str_replace('"enableRegistration" => true','"enableRegistration" => false', $updatedConfigSettingsFile); + fwrite($fUConfigSettings, $updatedConfigSettingsFile); + fclose($fUConfigSettings); + } else { + $reqsPassed = false; + $reqsFailures = ["phpUpdateConfig"]; + include dirname(__FILE__)."/../lib/requirements.php"; + } + } + } +} diff --git a/lib/icecoder.php b/lib/icecoder.php index b02f192..92640c2 100644 --- a/lib/icecoder.php +++ b/lib/icecoder.php @@ -4,6 +4,7 @@ require_once "../classes/_ExtraProcesses.php"; require_once "../classes/Backup.php"; require_once "../classes/File.php"; require_once "../classes/FTP.php"; +require_once "../classes/Settings.php"; require_once "../classes/System.php"; require_once "../classes/URL.php"; diff --git a/lib/settings-common.php b/lib/settings-common.php index ccbec6c..c84c619 100644 --- a/lib/settings-common.php +++ b/lib/settings-common.php @@ -1,78 +1,73 @@ - array( - 'timeout' => 60 // secs - ) -)); +$system = new System; +$system->setErrorHandling(); +$system->setTimeZone(); +$context = $system->setStreamContext(); // Start a session if we haven't already -if(!isset($_SESSION)) { - ini_set('session.use_cookies','1'); // Use cookies not URL parameters - ini_set('session.use_only_cookies','1'); // Force use of cookies and nothing else - ini_set('session.name','ICEcoder_Cookie'); // Set a seperate cookie session name - ini_set('session.cookie_lifetime','0'); // Until the browser restarts by default - ini_set('session.cookie_domain',''); // This domain only -// ini_set('session.cookie_path',str_replace($_SERVER['DOCUMENT_ROOT'],'',dirname(dirname(__FILE__)))); // ICEcoder path only, fails ON IE - ini_set('session.use_trans_sid','0'); // Ensure this insecure feature is disabled - ini_set('session.hash_function','sha512'); // Use Sha512 for session - ini_set('session.hash_bits_per_character','6'); // Specify hash scheme of 0-9,a-v,A-Z,-,, -// ini_set('session.use_strict_mode','1'); // Reject any session ID that was user provided and not generated by the session (since PHP 5.5.2) - ini_set('session.httponly','1'); // Only allow http protocol (ie, not JS) access to the cookie (since PHP 5.2.0) - ini_set('session.save_path',dirname(__FILE__).'/../tmp'); // Localise the session files to /tmp +if(false === isset($_SESSION)) { + ini_set('session.use_cookies', '1'); // Use cookies not URL parameters + ini_set('session.use_only_cookies', '1'); // Force use of cookies and nothing else + ini_set('session.name', 'ICEcoder_Cookie'); // Set a seperate cookie session name + ini_set('session.cookie_lifetime', '0'); // Until the browser restarts by default + ini_set('session.cookie_domain', ''); // This domain only +// ini_set('session.cookie_path', str_replace($_SERVER['DOCUMENT_ROOT'], '', dirname(dirname(__FILE__)))); // ICEcoder path only, fails ON IE + ini_set('session.use_trans_sid', '0'); // Ensure this insecure feature is disabled + ini_set('session.hash_function', 'sha512'); // Use Sha512 for session + ini_set('session.hash_bits_per_character', '6'); // Specify hash scheme of 0-9,a-v,A-Z,-,, +// ini_set('session.use_strict_mode', '1'); // Reject any session ID that was user provided and not generated by the session (since PHP 5.5.2) + ini_set('session.httponly', '1'); // Only allow http protocol (ie, not JS) access to the cookie (since PHP 5.2.0) + ini_set('session.save_path', dirname(__FILE__) . '/../tmp'); // Localise the session files to /tmp if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') { - ini_set('session.cookie_secure','1'); // Only allows access to session ID when protocol is HTTPS, switched on under 'if https' condition + ini_set('session.cookie_secure', '1'); // Only allows access to session ID when protocol is HTTPS, switched on under 'if https' condition } - session_start(); // Finally, start the session! - if (!isset($_SESSION['csrf'])){ - session_regenerate_id(true); // Create a new ID to help prevent fixation + session_start(); // Finally, start the session! + if (false === isset($_SESSION['csrf'])){ + session_regenerate_id(true); // Create a new ID to help prevent fixation } } // Set the language file, if now possible -if (isset($_SESSION['text'])) { +if (false === isset($_SESSION['text'])) { $text = $_SESSION['text']; $t = $text['settings-common']; } // Copy over backups if we've just updated to new version (TODO: can be moved to updater.php one day after 7.0 released) -if (isset($_GET['display']) && $_GET['display'] === "updated") { +if (true === isset($_GET['display']) && $_GET['display'] === "updated") { // If the backups dir doesn't exist, or it does but is empty if ( - !file_exists(dirname(__FILE__)."/../data/backups") || - count(array_diff(scandir(dirname(__FILE__)."/../data/backups"), ['.', '..'])) === 0 + false === file_exists(dirname(__FILE__) . "/../data/backups") || + count(array_diff(scandir(dirname(__FILE__) . "/../data/backups"), ['.', '..'])) === 0 ) { // If the old version has some backups to move over - if (count(array_diff(scandir(dirname(__FILE__)."/../tmp/oldVersion/backups"), ['.', '..'])) > 0) { + if (count(array_diff(scandir(dirname(__FILE__) . "/../tmp/oldVersion/backups"), ['.', '..'])) > 0) { // If the data dir is writable - if (is_writable(dirname(__FILE__)."/../data")) { + if (is_writable(dirname(__FILE__) . "/../data")) { // Remove the backups dir if it's there and writable - if (file_exists(dirname(__FILE__)."/../data/backups") && is_writable(dirname(__FILE__)."/../data")) { - rmdir(dirname(__FILE__)."/../data/backups"); + if (file_exists(dirname(__FILE__) . "/../data/backups") && is_writable(dirname(__FILE__) . "/../data")) { + rmdir(dirname(__FILE__) . "/../data/backups"); } // Move backups dir from old version to current version - rename(dirname(__FILE__)."/../tmp/oldVersion/backups", dirname(__FILE__)."/../data/backups"); + rename(dirname(__FILE__) . "/../tmp/oldVersion/backups", dirname(__FILE__) . "/../data/backups"); } } } } // Check requirements meet minimum spec -include(dirname(__FILE__)."/requirements.php"); +include dirname(__FILE__) . "/requirements.php"; // Create a backups dir in the data dir if it doesn't exist yet -if (!file_exists(dirname(__FILE__)."/../data/backups")) { - mkdir(dirname(__FILE__)."/../data/backups"); +if (false === file_exists(dirname(__FILE__) . "/../data/backups")) { + mkdir(dirname(__FILE__) . "/../data/backups"); } // Walk through possibilities in the order we'd like to determine an user IP @@ -87,11 +82,11 @@ function getUserIP() { } // Get data from a fopen or CURL connection -function getData($url,$type='fopen',$dieMessage=false,$timeout=60) { +function getData($url, $type='fopen', $dieMessage = false, $timeout = 60) { global $context; // Request is to connect via CURL - if ($type == "curl" && function_exists('curl_init')) { + if ($type === "curl" && function_exists('curl_init')) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); @@ -111,9 +106,9 @@ function getData($url,$type='fopen',$dieMessage=false,$timeout=60) { 'timeout' => $timeout // secs ) )); - $data = @file_get_contents($url,false,$context); + $data = @file_get_contents($url, false, $context); if (!$data) { - $data = @file_get_contents(str_replace("https:","http:",$url), false, $context); + $data = @file_get_contents(str_replace("https:", "http:", $url), false, $context); } } elseif (file_exists($url)) { $data = file_get_contents($url); @@ -125,7 +120,7 @@ function getData($url,$type='fopen',$dieMessage=false,$timeout=60) { die($dieMessage); exit; } else { - return 'no data'; + return ''; } } @@ -133,9 +128,9 @@ function getData($url,$type='fopen',$dieMessage=false,$timeout=60) { function requireReIndexNextTime() { // If we have a data/index.php file global $docRoot, $ICEcoderDir; - if (file_exists($docRoot.$ICEcoderDir."/data/index.php")) { + if (true === file_exists($docRoot . $ICEcoderDir . "/data/index.php")) { // Get serialized array back out of PHP file inside a comment block as prevIndexData - $prevIndexData = file_get_contents($docRoot.$ICEcoderDir."/data/index.php"); + $prevIndexData = file_get_contents($docRoot . $ICEcoderDir . "/data/index.php"); if (strpos($prevIndexData, "", "", $prevIndexData); @@ -144,22 +139,23 @@ function requireReIndexNextTime() { // Set timestamp back to epoch to force a re-index next time $prevIndexData['timestamps']['indexed'] = 0; - file_put_contents($docRoot.$ICEcoderDir."/data/index.php", ""); + file_put_contents($docRoot . $ICEcoderDir . "/data/index.php", ""); } } } // Logout if that's the action we're taking -if (isset($_GET['logout'])) { - include(dirname(__FILE__)."/../processes/on-user-logout.php"); - $_SESSION['loggedIn']=false; - $_SESSION['username']=false; +if (true === isset($_GET['logout'])) { + $extraProcesses = new ExtraProcesses(); + $extraProcesses->onUserLogout($_SESSION['username']); + $_SESSION['loggedIn'] = false; + $_SESSION['username'] = ""; session_destroy(); header("Location: ."); die("Logging you out..."); } -define('SALT_LENGTH',12); +define('SALT_LENGTH', 12); // Generate hash function generateHash($pw) { // Generate Bcrypt hash @@ -175,8 +171,8 @@ function verifyHash($pw, $orig) { : "NO MATCH"; } // Verify legacy sha1 hash - $origSalt = substr($orig,0,SALT_LENGTH); - return $origSalt.sha1($origSalt.$pw); + $origSalt = substr($orig, 0, SALT_LENGTH); + return $origSalt . sha1($origSalt . $pw); } // returns a number, whole or decimal or null @@ -213,7 +209,7 @@ function xssClean($data,$type) { // === url === if ($type == "url") { - if(preg_match("#^(?:(?:https?|ftp):{1})\/\/[^\"\s\\\\]*.[^\"\s\\\\]*$#iu",(string)$data,$match)) { + if(preg_match("#^(?:(?:https?|ftp):{1})\/\/[^\"\s\\\\]*.[^\"\s\\\\]*$#iu", (string)$data, $match)) { return $match[0]; } else { return 'javascript:void(0)'; @@ -232,7 +228,7 @@ function injClean($data) { } // returns a UTF8 based string with any UFT8 BOM removed -function toUTF8noBOM($string,$message=false) { +function toUTF8noBOM($string, $message = false) { global $text; $t = $text['settings-common']; @@ -245,15 +241,15 @@ function toUTF8noBOM($string,$message=false) { if (0 === strncmp($string, $bom, 3)) { // If there's a BOM followed by a Windows based (2 char) line ending // chop BOM off and prefix returned string with a PHP_EOL - if (0 === strncmp($string, $bom."\r\n", 3)) { - $string = PHP_EOL.substr($string, 3); + if (0 === strncmp($string, $bom . "\r\n", 3)) { + $string = PHP_EOL . substr($string, 3); // Else, simply chop off the BOM } else { $string = substr($string, 3); } } // Remove any other BOMs from view - $string = preg_replace('/'.$bom.'/','',$string); + $string = preg_replace('/' . $bom . '/', '', $string); // Test for any bad characters $teststring = $string; @@ -263,7 +259,7 @@ function toUTF8noBOM($string,$message=false) { if (!$strictUTF8 && strlen($teststringConverted) == strlen($teststringBroken)) { $string = utf8_encode($string); if ($message) { - echo "parent.parent.ICEcoder.message('".$t['Your document does...'].".');"; +// echo "parent.parent.ICEcoder.message('".$t['Your document does...'].".');"; } } } @@ -301,46 +297,46 @@ if (!function_exists('array_replace_recursive')) { } // Get number of versions total for a file -function getVersionsCount($fileLoc,$fileName) { +function getVersionsCount($fileLoc, $fileName) { global $context; $count = 0; $dateCounts = array(); $backupDateDirs = array(); // Establish the base, host and date dirs within... - $backupDirBase = str_replace("\\","/",dirname(__FILE__))."/../data/backups/"; - $backupDirHost = isset($ftpSite) ? parse_url($ftpSite,PHP_URL_HOST) : "localhost"; + $backupDirBase = str_replace("\\", "/", dirname(__FILE__)) . "/../data/backups/"; + $backupDirHost = isset($ftpSite) ? parse_url($ftpSite, PHP_URL_HOST) : "localhost"; // check if folder exists if local before enumerating contents if(!isset($ftpSite)) { - if(is_dir($backupDirBase.$backupDirHost)) { - $backupDateDirs = scandir($backupDirBase.$backupDirHost,1); + if(is_dir($backupDirBase . $backupDirHost)) { + $backupDateDirs = scandir($backupDirBase . $backupDirHost, 1); } } else { - $backupDateDirs = scandir($backupDirBase.$backupDirHost,1); + $backupDateDirs = scandir($backupDirBase . $backupDirHost, 1); } // Get rid of . and .. from date dirs array - for ($i=0; $i"); + file_put_contents($path, "<"."?php\n/*\n\n" . serialize($output) . "\n\n*/\n?" . ">"); } } diff --git a/lib/settings.php b/lib/settings.php index 9db93a4..dd3e40c 100644 --- a/lib/settings.php +++ b/lib/settings.php @@ -4,10 +4,13 @@ $configSettings = 'config-settings.php'; $configUsersTemplate = 'template-users.php'; require_once dirname(__FILE__) . "/../classes/_ExtraProcesses.php"; +require_once dirname(__FILE__) . "/../classes/Settings.php"; require_once dirname(__FILE__) . "/../classes/System.php"; use ICEcoder\ExtraProcesses; +$settingsClass = new \ICEcoder\Settings(); + // Create a new config file if it doesn't exist yet. // The reason we create it, is so it has PHP write permissions, meaning we can update it later if (false === file_exists(dirname(__FILE__) . "/../data/" . $configSettings)) { @@ -64,26 +67,7 @@ $ICEcoderUserSettings['previousFiles'] = $prevFilesAvail; // Replace our config created date with the filemtime? if ("index.php" === basename($_SERVER['SCRIPT_NAME']) && 0 === $ICEcoderUserSettings['configCreateDate']) { - $settingsContents = getData(dirname(__FILE__) . "/../data/" . $settingsFile); - clearstatcache(); - $configfilemtime = filemtime(dirname(__FILE__) . "/../data/" . $settingsFile); - // Make it a number (avoids null, undefined etc) - $configfilemtime = intval($configfilemtime); - // Set it to the epoch time now if we don't have a real value - if (0 === $configfilemtime) { - $configfilemtime = time(); - } - $settingsContents = str_replace('"configCreateDate" => 0,', '"configCreateDate" => ' . $configfilemtime . ',', $settingsContents); - // Now update the config file - if (!$fh = fopen(dirname(__FILE__) . "/../data/" . $settingsFile, 'w')) { - $reqsPassed = false; - $reqsFailures = ["phpUpdateSettings"]; - include dirname(__FILE__) . "/requirements.php"; - } - fwrite($fh, $settingsContents); - fclose($fh); - // Set the new value in array - $ICEcoderUserSettings['configCreateDate'] = $configfilemtime; + $settingsClass->updateConfigCreateDate(); } // On mismatch of settings file to system, rename to .old and reload @@ -208,48 +192,9 @@ if (false === isset($_POST['password']) && (!$_SESSION['loggedIn'] || "" === $IC // If the password hasn't been set and we're setting it if ("" === $ICEcoder["password"] && true === isset($_POST['submit']) && -1 < strpos($_POST['submit'],"set password")) { $password = str_replace("\$", "\\$", generateHash($_POST['password'])); - $settingsContents = getData("../data/" . $settingsFile); - // Replace our empty password with the one submitted by user - $settingsContents = str_replace('"password" => "",','"password" => "' . $password . '",', $settingsContents); - // Also set the update checker preference - $checkUpdates = $_POST['checkUpdates']=="true" ? "true" : "false"; - // once to cover the true setting, once to cover false - $settingsContents = str_replace('"checkUpdates" => true,','"checkUpdates" => ' . $checkUpdates . ',', $settingsContents); - $settingsContents = str_replace('"checkUpdates" => false,','"checkUpdates" => ' . $checkUpdates . ',', $settingsContents); - // Now update the config file - if (!$fh = fopen(dirname(__FILE__) . "/../data/" . $settingsFile, 'w')) { - $reqsPassed = false; - $reqsFailures = ["phpUpdateSettings"]; - include(dirname(__FILE__) . "/requirements.php"); - } - fwrite($fh, $settingsContents); - fclose($fh); - // Create a duplicate version for the IP address of the domain if it doesn't exist yet - $serverAddr = $_SERVER['SERVER_ADDR'] ?? "1"; - if ($serverAddr == "1" || $serverAddr == "::1") { - $serverAddr = "127.0.0.1"; - } - $settingsFileAddr = 'config-' . $username . str_replace(".", "_", $serverAddr) . '.php'; - if (true === file_exists(dirname(__FILE__) . "/../data/" . $settingsFileAddr)) { - if (false === copy(dirname(__FILE__) . "/../data/" . $settingsFile, dirname(__FILE__) . "/../data/" . $settingsFileAddr)) { - $reqsPassed = false; - $reqsFailures = ["phpCreateSettingsFileAddr"]; - include dirname(__FILE__) . "/requirements.php"; - } - } - // Disable the enableRegistration config setting if the user had that option chosen - if (true === isset($_POST['disableFurtherRegistration'])) { - $updatedConfigSettingsFile = getData(dirname(__FILE__) . "/../data/" . $configSettings); - if ($fUConfigSettings = fopen(dirname(__FILE__) . "/../data/" . $configSettings, 'w')) { - $updatedConfigSettingsFile = str_replace('"enableRegistration" => true','"enableRegistration" => false', $updatedConfigSettingsFile); - fwrite($fUConfigSettings, $updatedConfigSettingsFile); - fclose($fUConfigSettings); - } else { - $reqsPassed = false; - $reqsFailures = ["phpUpdateConfig"]; - include dirname(__FILE__)."/requirements.php"; - } - } + $settingsClass->updatePasswordCheckUpdates(); + $settingsClass->createIPSettingsFileIfNotExist(); + $settingsClass->disableFurtherRegistration(); // Set the session user level if ($ICEcoder["multiUser"]) { $_SESSION['username'] = $_POST['username'];