Installation, compatibility, security fixlets:

[lhc/web/wiklou.git] / index.php

diff --git a/index.php b/index.php
index 45c8bc6..a2f1782 100644 (file)
--- a/index.php
+++ b/index.php
@@ -3,42 +3,6 @@
 #
 $wgRequestTime = microtime();
 
-## Enable this to debug total elimination of register_globals
-#define( "DEBUG_GLOBALS", 1 );
-
-if( defined('DEBUG_GLOBALS') ) error_reporting(E_ALL);
-
-function &fix_magic_quotes( &$arr ) {
-       foreach( $arr as $key => $val ) {
-               if( is_array( $val ) ) {
-                       fix_magic_quotes( $arr[$key] );
-               } else {
-                       $arr[$key] = stripslashes( $val );
-               }
-       }
-       return $arr;
-}
-
-if ( get_magic_quotes_gpc() ) {
-       fix_magic_quotes( $_COOKIE );
-       fix_magic_quotes( $_ENV );
-       fix_magic_quotes( $_GET );
-       fix_magic_quotes( $_POST );
-       fix_magic_quotes( $_REQUEST );
-       fix_magic_quotes( $_SERVER );
-} elseif( defined('DEBUG_GLOBALS') ) {
-       die("DEBUG_GLOBALS: turn on magic_quotes_gpc" );
-}
-
-if( defined('DEBUG_GLOBALS') ) {
-       if( ini_get( "register_globals" ) ) {
-               die( "DEBUG_GLOBALS: turn off register_globals" );
-       }
-} elseif( !ini_get( "register_globals" ) ) {
-       # Insecure, but at least it'll run
-       import_request_variables( "GPC" );
-}
-
 unset( $IP );
 ini_set( "allow_url_fopen", 0 ); # For security...
 if(!file_exists("LocalSettings.php")) {
@@ -60,18 +24,12 @@ wfProfileIn( "main-misc-setup" );
 OutputPage::setEncodings(); # Not really used yet
 
 # Query string fields
-if( empty( $_REQUEST['action'] ) ) {
-       $action = "view";
-} else {
-       $action = $_REQUEST['action'];
-}
+$action = $wgRequest->getVal( "action", "view" );
 
-if( isset( $_SERVER['PATH_INFO'] ) ) {
+if( isset( $_SERVER['PATH_INFO'] ) && $wgUsePathInfo ) {
        $title = substr( $_SERVER['PATH_INFO'], 1 );
-} elseif( !empty( $_REQUEST['title'] ) ) {
-       $title = $_REQUEST['title'];
 } else {
-       $title = "";
+       $title = $wgRequest->getVal( "title" );
 }
 
 # Placeholders in case of DB error
@@ -80,15 +38,15 @@ $wgArticle = new Article($wgTitle);
 
 $action = strtolower( trim( $action ) );
 if ( "" == $action ) { $action = "view"; }
-if ( !empty( $_REQUEST['printable'] ) && $_REQUEST['printable'] == "yes") {
+if ($wgRequest->getVal( "printable" ) == "yes") {
        $wgOut->setPrintable();
 }
 
 if ( "" == $title && "delete" != $action ) {
        $wgTitle = Title::newFromText( wfMsg( "mainpage" ) );
-} elseif ( !empty( $_REQUEST['curid'] ) ) {
+} elseif ( $curid = $wgRequest->getInt( 'curid' ) ) {
        # URLs like this are generated by RC, because rc_title isn't always accurate
-       $wgTitle = Title::newFromID( $_REQUEST['curid'] );
+       $wgTitle = Title::newFromID( $curid );
 } else {
        $wgTitle = Title::newFromURL( $title );
 }
@@ -104,27 +62,27 @@ if ( !$wgUser->getID() && is_array( $wgWhitelistRead ) && $wgTitle) {
        }
 }
 
-if ( !empty( $_REQUEST['search'] ) ) {
-       if( isset($_REQUEST['fulltext']) ) {
-               wfSearch( $_REQUEST['search'] );
+if ( $search = $wgRequest->getText( 'search' ) ) {
+       if( $wgRequest->getVal( 'fulltext' ) ) {
+               wfSearch( $search );
        } else {
-               wfGo( $_REQUEST['search'] );
+               wfGo( $search );
        }
 } else if( !$wgTitle or $wgTitle->getInterwiki() != "" or $wgTitle->getDBkey() == "" ) {
        $wgTitle = Title::newFromText( wfMsg( "badtitle" ) );
        $wgOut->errorpage( "badtitle", "badtitletext" );
 } else if ( ( $action == "view" ) && $wgTitle->getPrefixedDBKey() != $title ) {
        /* redirect to canonical url, make it a 301 to allow caching */
-       $wgOut->redirect( wfLocalUrl( $wgTitle->getPrefixedURL() ), '301');
+       $wgOut->redirect( $wgTitle->getFullURL(), '301');
 } else if ( Namespace::getSpecial() == $wgTitle->getNamespace() ) {
        wfSpecialPage();
 } else {
        if ( Namespace::getMedia() == $wgTitle->getNamespace() ) {
                $wgTitle = Title::makeTitle( Namespace::getImage(), $wgTitle->getDBkey() );
-       }       
+       }
        
        switch( $wgTitle->getNamespace() ) {
-       case 6:
+       case NS_IMAGE:
                include_once( "ImagePage.php" );
                $wgArticle = new ImagePage( $wgTitle );
                break;
@@ -135,6 +93,9 @@ if ( !empty( $_REQUEST['search'] ) ) {
        wfQuery("BEGIN", DB_WRITE);
        switch( $action ) {
                case "view":
+                       $wgOut->setSquidMaxage( $wgSquidMaxage );
+                       $wgArticle->$action();
+                       break;
                case "watch":
                case "unwatch":
                case "delete":
@@ -149,7 +110,7 @@ if ( !empty( $_REQUEST['search'] ) ) {
                        break;
                case "edit":
                case "submit":
-                       if( !$wgCommandLineMode && !isset( $_COOKIE[ini_get("session.name")] ) ) {
+                       if( !$wgCommandLineMode && !$wgRequest->checkSessionCookie() ) {
                                User::SetupSession();
                        }
                        include_once( "EditPage.php" );
@@ -157,10 +118,18 @@ if ( !empty( $_REQUEST['search'] ) ) {
                        $editor->$action();
                        break;
                case "history":
+                       if ($_SERVER["REQUEST_URI"] == $wgTitle->getInternalURL('action=history')) {
+                               $wgOut->setSquidMaxage( $wgSquidMaxage );
+                       }
                        include_once( "PageHistory.php" );
                        $history = new PageHistory( $wgArticle );
                        $history->history();
                        break;
+               case "purge":
+                       wfPurgeSquidServers(array($wgTitle->getInternalURL()));
+                       $wgOut->setSquidMaxage( $wgSquidMaxage );
+                       $wgArticle->view();
+                       break;
                default:
                        $wgOut->errorpage( "nosuchaction", "nosuchactiontext" );
        }
@@ -168,6 +137,7 @@ if ( !empty( $_REQUEST['search'] ) ) {
 }
 
 $wgOut->output();
+
 foreach ( $wgDeferredUpdateList as $up ) { $up->doUpdate(); }
 logProfilingData();
 wfDebug( "Request ended normally\n" );