Security fix: include path
[lhc/web/wiklou.git] / wiki.phtml
1 <?
2 # Main wiki script; see design.doc
3 #
4 $wgRequestTime = microtime();
5
6 session_cache_limiter( "private, must-revalidate" );
7 session_start();
8 session_register( "wsUserID" );
9 session_register( "wsUserName" );
10 session_register( "wsUserPassword" );
11 session_register( "wsUploadFiles" );
12
13 unset( $IP );
14 ini_set( "allow_url_fopen", 0 ); # For security...
15 include_once( "./LocalSettings.php" );
16
17 $include_path = ini_get( "include_path" );
18 # Windows requires ';' as separator, ':' for Unix
19 if( strchr( $include_path, ";" ) ) $sep = ";"; else $sep = ":";
20 ini_set( "include_path", $IP . $sep . ini_get( "include_path" ) );
21
22 include_once( "Setup.php" );
23
24 wfProfileIn( "main-misc-setup" );
25 OutputPage::setEncodings(); # Not really used yet
26
27 # Useful debug output
28 wfDebug( "\nStart request\n" );
29 wfDebug( "$REQUEST_METHOD $REQUEST_URI\n" );
30 $headers = getallheaders();
31 foreach ($headers as $name => $value) {
32 wfDebug( "$name: $value\n" );
33 }
34 wfDebug( "\n" );
35
36 # Query string fields
37 #
38 global $action, $title, $search, $go, $target, $printable;
39 global $returnto, $diff, $oldid;
40
41 $action = strtolower( trim( $action ) );
42 if ( "" == $action ) { $action = "view"; }
43 if ( "yes" == $printable ) { $wgOut->setPrintable(); }
44
45 if ( "" == $title && "delete" != $action ) {
46 $wgTitle = Title::newFromText( wfMsg( "mainpage" ) );
47 } else {
48 $wgTitle = Title::newFromURL( $title );
49 # if( $wgTitle->getInterwiki() != "" or $wgTitle->getDBkey() == "" or strncmp($wgTitle->getDBkey(),"_",1) == 0 ) {
50 if( !$wgTitle or $wgTitle->getInterwiki() != "" or $wgTitle->getDBkey() == "" ) {
51 $wgTitle = Title::newFromText( wfMsg( "badtitle" ) );
52 $wgOut->errorpage( "badtitle", "badtitletext" );
53 $wgOut->output();
54 exit;
55 }
56 }
57 wfProfileOut( "main-misc-setup" );
58
59 if ( Namespace::getSpecial() == $wgTitle->getNamespace() ) {
60 wfSpecialPage();
61 } else if ( "" != $search ) {
62 if($go) {
63 wfGo( $search );
64 } else {
65 wfSearch( $search );
66 }
67 } else {
68 if ( Namespace::getMedia() == $wgTitle->getNamespace() ) {
69 $wgTitle = Title::makeTitle( Namespace::getImage(), $wgTitle->getDBkey() );
70 }
71
72 switch( $wgTitle->getNamespace() ) {
73 case 6:
74 include_once( "ImagePage.php" );
75 $wgArticle = new ImagePage( $wgTitle );
76 break;
77 default:
78 $wgArticle = new Article( $wgTitle );
79 }
80
81 switch( $action ) {
82 case "view":
83 case "watch":
84 case "unwatch":
85 case "history":
86 case "delete":
87 case "revert":
88 case "rollback":
89 case "protect":
90 case "unprotect":
91 $wgArticle->$action();
92 break;
93 case "print":
94 $wgArticle->view();
95 break;
96 case "edit":
97 case "submit":
98 include_once( "EditPage.php" );
99 $editor = new EditPage( $wgArticle );
100 $editor->$action();
101 break;
102 default:
103 $wgOut->errorpage( "nosuchaction", "nosuchactiontext" );
104 }
105 }
106
107 $wgOut->output();
108 foreach ( $wgDeferredUpdateList as $up ) { $up->doUpdate(); }
109
110 ?>