# http://www.mediawiki.org/ # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License along # with this program; if not, write to the Free Software Foundation, Inc., # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. # http://www.gnu.org/copyleft/gpl.html /** * Some entry points may use this file without first enabling the * autoloader. */ if ( !function_exists( '__autoload' ) ) { require_once( dirname(__FILE__) . '/normal/UtfNormal.php' ); } /** * The WebRequest class encapsulates getting at data passed in the * URL or via a POSTed form, handling remove of "magic quotes" slashes, * stripping illegal input characters and normalizing Unicode sequences. * * Usually this is used via a global singleton, $wgRequest. You should * not create a second WebRequest object; make a FauxRequest object if * you want to pass arbitrary data to some function in place of the web * input. * * @ingroup HTTP */ class WebRequest { protected $data, $headers = array(); private $_response; public function __construct() { /// @todo Fixme: this preemptive de-quoting can interfere with other web libraries /// and increases our memory footprint. It would be cleaner to do on /// demand; but currently we have no wrapper for $_SERVER etc. $this->checkMagicQuotes(); // POST overrides GET data // We don't use $_REQUEST here to avoid interference from cookies... $this->data = $_POST + $_GET; } /** * Check for title, action, and/or variant data in the URL * and interpolate it into the GET variables. * This should only be run after $wgContLang is available, * as we may need the list of language variants to determine * available variant URLs. */ public function interpolateTitle() { global $wgUsePathInfo; if ( $wgUsePathInfo ) { // PATH_INFO is mangled due to http://bugs.php.net/bug.php?id=31892 // And also by Apache 2.x, double slashes are converted to single slashes. // So we will use REQUEST_URI if possible. $matches = array(); if ( !empty( $_SERVER['REQUEST_URI'] ) ) { // Slurp out the path portion to examine... $url = $_SERVER['REQUEST_URI']; if ( !preg_match( '!^https?://!', $url ) ) { $url = 'http://unused' . $url; } $a = parse_url( $url ); if( $a ) { $path = isset( $a['path'] ) ? $a['path'] : ''; global $wgScript; if( $path == $wgScript ) { // Script inside a rewrite path? // Abort to keep from breaking... return; } // Raw PATH_INFO style $matches = $this->extractTitle( $path, "$wgScript/$1" ); global $wgArticlePath; if( !$matches && $wgArticlePath ) { $matches = $this->extractTitle( $path, $wgArticlePath ); } global $wgActionPaths; if( !$matches && $wgActionPaths ) { $matches = $this->extractTitle( $path, $wgActionPaths, 'action' ); } global $wgVariantArticlePath, $wgContLang; if( !$matches && $wgVariantArticlePath ) { $variantPaths = array(); foreach( $wgContLang->getVariants() as $variant ) { $variantPaths[$variant] = str_replace( '$2', $variant, $wgVariantArticlePath ); } $matches = $this->extractTitle( $path, $variantPaths, 'variant' ); } } } elseif ( isset( $_SERVER['ORIG_PATH_INFO'] ) && $_SERVER['ORIG_PATH_INFO'] != '' ) { // Mangled PATH_INFO // http://bugs.php.net/bug.php?id=31892 // Also reported when ini_get('cgi.fix_pathinfo')==false $matches['title'] = substr( $_SERVER['ORIG_PATH_INFO'], 1 ); } elseif ( isset( $_SERVER['PATH_INFO'] ) && ($_SERVER['PATH_INFO'] != '') ) { // Regular old PATH_INFO yay $matches['title'] = substr( $_SERVER['PATH_INFO'], 1 ); } foreach( $matches as $key => $val) { $this->data[$key] = $_GET[$key] = $_REQUEST[$key] = $val; } } } /** * Internal URL rewriting function; tries to extract page title and, * optionally, one other fixed parameter value from a URL path. * * @param $path string: the URL path given from the client * @param $bases array: one or more URLs, optionally with $1 at the end * @param $key string: if provided, the matching key in $bases will be * passed on as the value of this URL parameter * @return array of URL variables to interpolate; empty if no match */ private function extractTitle( $path, $bases, $key=false ) { foreach( (array)$bases as $keyValue => $base ) { // Find the part after $wgArticlePath $base = str_replace( '$1', '', $base ); $baseLen = strlen( $base ); if( substr( $path, 0, $baseLen ) == $base ) { $raw = substr( $path, $baseLen ); if( $raw !== '' ) { $matches = array( 'title' => rawurldecode( $raw ) ); if( $key ) { $matches[$key] = $keyValue; } return $matches; } } } return array(); } /** * Recursively strips slashes from the given array; * used for undoing the evil that is magic_quotes_gpc. * @param $arr array: will be modified * @return array the original array */ private function &fix_magic_quotes( &$arr ) { foreach( $arr as $key => $val ) { if( is_array( $val ) ) { $this->fix_magic_quotes( $arr[$key] ); } else { $arr[$key] = stripslashes( $val ); } } return $arr; } /** * If magic_quotes_gpc option is on, run the global arrays * through fix_magic_quotes to strip out the stupid slashes. * WARNING: This should only be done once! Running a second * time could damage the values. */ private function checkMagicQuotes() { $mustFixQuotes = function_exists( 'get_magic_quotes_gpc' ) && get_magic_quotes_gpc(); if( $mustFixQuotes ) { $this->fix_magic_quotes( $_COOKIE ); $this->fix_magic_quotes( $_ENV ); $this->fix_magic_quotes( $_GET ); $this->fix_magic_quotes( $_POST ); $this->fix_magic_quotes( $_REQUEST ); $this->fix_magic_quotes( $_SERVER ); } } /** * Recursively normalizes UTF-8 strings in the given array. * @param $data string or array * @return cleaned-up version of the given * @private */ function normalizeUnicode( $data ) { if( is_array( $data ) ) { foreach( $data as $key => $val ) { $data[$key] = $this->normalizeUnicode( $val ); } } else { global $wgContLang; $data = $wgContLang->normalize( $data ); } return $data; } /** * Fetch a value from the given array or return $default if it's not set. * * @param $arr array * @param $name string * @param $default mixed * @return mixed */ private function getGPCVal( $arr, $name, $default ) { # PHP is so nice to not touch input data, except sometimes: # http://us2.php.net/variables.external#language.variables.external.dot-in-names # Work around PHP *feature* to avoid *bugs* elsewhere. $name = strtr( $name, '.', '_' ); if( isset( $arr[$name] ) ) { global $wgContLang; $data = $arr[$name]; if( isset( $_GET[$name] ) && !is_array( $data ) ) { # Check for alternate/legacy character encoding. if( isset( $wgContLang ) ) { $data = $wgContLang->checkTitleEncoding( $data ); } } $data = $this->normalizeUnicode( $data ); return $data; } else { taint( $default ); return $default; } } /** * Fetch a scalar from the input or return $default if it's not set. * Returns a string. Arrays are discarded. Useful for * non-freeform text inputs (e.g. predefined internal text keys * selected by a drop-down menu). For freeform input, see getText(). * * @param $name string * @param $default string: optional default (or NULL) * @return string */ public function getVal( $name, $default = null ) { $val = $this->getGPCVal( $this->data, $name, $default ); if( is_array( $val ) ) { $val = $default; } if( is_null( $val ) ) { return $val; } else { return (string)$val; } } /** * Set an aribtrary value into our get/post data. * @param $key string Key name to use * @param $value mixed Value to set * @return mixed old value if one was present, null otherwise */ public function setVal( $key, $value ) { $ret = isset( $this->data[$key] ) ? $this->data[$key] : null; $this->data[$key] = $value; return $ret; } /** * Fetch an array from the input or return $default if it's not set. * If source was scalar, will return an array with a single element. * If no source and no default, returns NULL. * * @param $name string * @param $default array: optional default (or NULL) * @return array */ public function getArray( $name, $default = null ) { $val = $this->getGPCVal( $this->data, $name, $default ); if( is_null( $val ) ) { return null; } else { return (array)$val; } } /** * Fetch an array of integers, or return $default if it's not set. * If source was scalar, will return an array with a single element. * If no source and no default, returns NULL. * If an array is returned, contents are guaranteed to be integers. * * @param $name string * @param $default array: option default (or NULL) * @return array of ints */ public function getIntArray( $name, $default = null ) { $val = $this->getArray( $name, $default ); if( is_array( $val ) ) { $val = array_map( 'intval', $val ); } return $val; } /** * Fetch an integer value from the input or return $default if not set. * Guaranteed to return an integer; non-numeric input will typically * return 0. * @param $name string * @param $default int * @return int */ public function getInt( $name, $default = 0 ) { return intval( $this->getVal( $name, $default ) ); } /** * Fetch an integer value from the input or return null if empty. * Guaranteed to return an integer or null; non-numeric input will * typically return null. * @param $name string * @return int */ public function getIntOrNull( $name ) { $val = $this->getVal( $name ); return is_numeric( $val ) ? intval( $val ) : null; } /** * Fetch a boolean value from the input or return $default if not set. * Guaranteed to return true or false, with normal PHP semantics for * boolean interpretation of strings. * @param $name string * @param $default bool * @return bool */ public function getBool( $name, $default = false ) { return $this->getVal( $name, $default ) ? true : false; } /** * Return true if the named value is set in the input, whatever that * value is (even "0"). Return false if the named value is not set. * Example use is checking for the presence of check boxes in forms. * @param $name string * @return bool */ public function getCheck( $name ) { # Checkboxes and buttons are only present when clicked # Presence connotes truth, abscense false $val = $this->getVal( $name, null ); return isset( $val ); } /** * Fetch a text string from the given array or return $default if it's not * set. \r is stripped from the text, and with some language modules there * is an input transliteration applied. This should generally be used for * form