SimpleMachines /
SMF2.1
| Conditions | 89 |
| Paths | > 20000 |
| Total Lines | 331 |
| Code Lines | 156 |
| Lines | 0 |
| Ratio | 0 % |
| Changes | 0 | ||
Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.
For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.
Commonly applied refactorings include:
If many parameters/temporary variables are present:
| 1 | <?php |
||
| 32 | function cleanRequest() |
||
| 33 | { |
||
| 34 | global $board, $topic, $boardurl, $scripturl, $modSettings, $smcFunc; |
||
| 35 | |||
| 36 | // Makes it easier to refer to things this way. |
||
| 37 | $scripturl = $boardurl . '/index.php'; |
||
| 38 | |||
| 39 | // What function to use to reverse magic quotes - if sybase is on we assume that the database sensibly has the right unescape function! |
||
| 40 | $removeMagicQuoteFunction = ini_get('magic_quotes_sybase') || strtolower(ini_get('magic_quotes_sybase')) == 'on' ? 'unescapestring__recursive' : 'stripslashes__recursive'; |
||
| 41 | $magicQuotesEnabled = version_compare(PHP_VERSION, '7.4.0') == -1 && function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc() != 0 && empty($modSettings['integrate_magic_quotes']); |
||
| 42 | |||
| 43 | // Save some memory.. (since we don't use these anyway.) |
||
| 44 | unset($GLOBALS['HTTP_POST_VARS'], $GLOBALS['HTTP_POST_VARS']); |
||
| 45 | unset($GLOBALS['HTTP_POST_FILES'], $GLOBALS['HTTP_POST_FILES']); |
||
| 46 | |||
| 47 | // These keys shouldn't be set...ever. |
||
| 48 | if (isset($_REQUEST['GLOBALS']) || isset($_COOKIE['GLOBALS'])) |
||
| 49 | die('Invalid request variable.'); |
||
|
|
|||
| 50 | |||
| 51 | // Same goes for numeric keys. |
||
| 52 | foreach (array_merge(array_keys($_POST), array_keys($_GET), array_keys($_FILES)) as $key) |
||
| 53 | if (is_numeric($key)) |
||
| 54 | die('Numeric request keys are invalid.'); |
||
| 55 | |||
| 56 | // Numeric keys in cookies are less of a problem. Just unset those. |
||
| 57 | foreach ($_COOKIE as $key => $value) |
||
| 58 | if (is_numeric($key)) |
||
| 59 | unset($_COOKIE[$key]); |
||
| 60 | |||
| 61 | // Get the correct query string. It may be in an environment variable... |
||
| 62 | if (!isset($_SERVER['QUERY_STRING'])) |
||
| 63 | $_SERVER['QUERY_STRING'] = getenv('QUERY_STRING'); |
||
| 64 | |||
| 65 | // It seems that sticking a URL after the query string is mighty common, well, it's evil - don't. |
||
| 66 | if (strpos($_SERVER['QUERY_STRING'], 'http') === 0) |
||
| 67 | { |
||
| 68 | send_http_status(400); |
||
| 69 | die; |
||
| 70 | } |
||
| 71 | |||
| 72 | // Are we going to need to parse the ; out? |
||
| 73 | if (strpos(ini_get('arg_separator.input'), ';') === false && !empty($_SERVER['QUERY_STRING'])) |
||
| 74 | { |
||
| 75 | // Get rid of the old one! You don't know where it's been! |
||
| 76 | $_GET = array(); |
||
| 77 | |||
| 78 | // Was this redirected? If so, get the REDIRECT_QUERY_STRING. |
||
| 79 | // Do not urldecode() the querystring. |
||
| 80 | $_SERVER['QUERY_STRING'] = substr($_SERVER['QUERY_STRING'], 0, 5) === 'url=/' ? $_SERVER['REDIRECT_QUERY_STRING'] : $_SERVER['QUERY_STRING']; |
||
| 81 | |||
| 82 | // Replace ';' with '&' and '&something&' with '&something=&'. (this is done for compatibility...) |
||
| 83 | // @todo smflib |
||
| 84 | parse_str(preg_replace('/&(\w+)(?=&|$)/', '&$1=', strtr($_SERVER['QUERY_STRING'], array(';?' => '&', ';' => '&', '%00' => '', "\0" => ''))), $_GET); |
||
| 85 | |||
| 86 | // Magic quotes still applies with parse_str - so clean it up. |
||
| 87 | if ($magicQuotesEnabled) |
||
| 88 | $_GET = $removeMagicQuoteFunction($_GET); |
||
| 89 | } |
||
| 90 | elseif (strpos(ini_get('arg_separator.input'), ';') !== false) |
||
| 91 | { |
||
| 92 | if ($magicQuotesEnabled) |
||
| 93 | $_GET = $removeMagicQuoteFunction($_GET); |
||
| 94 | |||
| 95 | // Search engines will send action=profile%3Bu=1, which confuses PHP. |
||
| 96 | foreach ($_GET as $k => $v) |
||
| 97 | { |
||
| 98 | if ((string) $v === $v && strpos($k, ';') !== false) |
||
| 99 | { |
||
| 100 | $temp = explode(';', $v); |
||
| 101 | $_GET[$k] = $temp[0]; |
||
| 102 | |||
| 103 | for ($i = 1, $n = count($temp); $i < $n; $i++) |
||
| 104 | { |
||
| 105 | @list ($key, $val) = @explode('=', $temp[$i], 2); |
||
| 106 | if (!isset($_GET[$key])) |
||
| 107 | $_GET[$key] = $val; |
||
| 108 | } |
||
| 109 | } |
||
| 110 | |||
| 111 | // This helps a lot with integration! |
||
| 112 | if (strpos($k, '?') === 0) |
||
| 113 | { |
||
| 114 | $_GET[substr($k, 1)] = $v; |
||
| 115 | unset($_GET[$k]); |
||
| 116 | } |
||
| 117 | } |
||
| 118 | } |
||
| 119 | |||
| 120 | // There's no query string, but there is a URL... try to get the data from there. |
||
| 121 | if (!empty($_SERVER['REQUEST_URI'])) |
||
| 122 | { |
||
| 123 | // Remove the .html, assuming there is one. |
||
| 124 | if (substr($_SERVER['REQUEST_URI'], strrpos($_SERVER['REQUEST_URI'], '.'), 4) == '.htm') |
||
| 125 | $request = substr($_SERVER['REQUEST_URI'], 0, strrpos($_SERVER['REQUEST_URI'], '.')); |
||
| 126 | else |
||
| 127 | $request = $_SERVER['REQUEST_URI']; |
||
| 128 | |||
| 129 | // @todo smflib. |
||
| 130 | // Replace 'index.php/a,b,c/d/e,f' with 'a=b,c&d=&e=f' and parse it into $_GET. |
||
| 131 | if (strpos($request, basename($scripturl) . '/') !== false) |
||
| 132 | { |
||
| 133 | parse_str(substr(preg_replace('/&(\w+)(?=&|$)/', '&$1=', strtr(preg_replace('~/([^,/]+),~', '/$1=', substr($request, strpos($request, basename($scripturl)) + strlen(basename($scripturl)))), '/', '&')), 1), $temp); |
||
| 134 | if (function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc() != 0 && empty($modSettings['integrate_magic_quotes'])) |
||
| 135 | $temp = $removeMagicQuoteFunction($temp); |
||
| 136 | $_GET += $temp; |
||
| 137 | } |
||
| 138 | } |
||
| 139 | |||
| 140 | // If magic quotes is on we have some work... |
||
| 141 | if ($magicQuotesEnabled) |
||
| 142 | { |
||
| 143 | $_ENV = $removeMagicQuoteFunction($_ENV); |
||
| 144 | $_POST = $removeMagicQuoteFunction($_POST); |
||
| 145 | $_COOKIE = $removeMagicQuoteFunction($_COOKIE); |
||
| 146 | foreach ($_FILES as $k => $dummy) |
||
| 147 | if (isset($_FILES[$k]['name'])) |
||
| 148 | $_FILES[$k]['name'] = $removeMagicQuoteFunction($_FILES[$k]['name']); |
||
| 149 | } |
||
| 150 | |||
| 151 | // Add entities to GET. This is kinda like the slashes on everything else. |
||
| 152 | $_GET = htmlspecialchars__recursive($_GET); |
||
| 153 | |||
| 154 | // Let's not depend on the ini settings... why even have COOKIE in there, anyway? |
||
| 155 | $_REQUEST = $_POST + $_GET; |
||
| 156 | |||
| 157 | // Make sure $board and $topic are numbers. |
||
| 158 | if (isset($_REQUEST['board'])) |
||
| 159 | { |
||
| 160 | // Make sure its a string and not something else like an array |
||
| 161 | $_REQUEST['board'] = (string) $_REQUEST['board']; |
||
| 162 | |||
| 163 | // If there's a slash in it, we've got a start value! (old, compatible links.) |
||
| 164 | if (strpos($_REQUEST['board'], '/') !== false) |
||
| 165 | list ($_REQUEST['board'], $_REQUEST['start']) = explode('/', $_REQUEST['board']); |
||
| 166 | // Same idea, but dots. This is the currently used format - ?board=1.0... |
||
| 167 | elseif (strpos($_REQUEST['board'], '.') !== false) |
||
| 168 | list ($_REQUEST['board'], $_REQUEST['start']) = explode('.', $_REQUEST['board']); |
||
| 169 | // Now make absolutely sure it's a number. |
||
| 170 | $board = (int) $_REQUEST['board']; |
||
| 171 | $_REQUEST['start'] = isset($_REQUEST['start']) ? (int) $_REQUEST['start'] : 0; |
||
| 172 | |||
| 173 | // This is for "Who's Online" because it might come via POST - and it should be an int here. |
||
| 174 | $_GET['board'] = $board; |
||
| 175 | } |
||
| 176 | // Well, $board is going to be a number no matter what. |
||
| 177 | else |
||
| 178 | $board = 0; |
||
| 179 | |||
| 180 | // If there's a threadid, it's probably an old YaBB SE link. Flow with it. |
||
| 181 | if (isset($_REQUEST['threadid']) && !isset($_REQUEST['topic'])) |
||
| 182 | $_REQUEST['topic'] = $_REQUEST['threadid']; |
||
| 183 | |||
| 184 | // We've got topic! |
||
| 185 | if (isset($_REQUEST['topic'])) |
||
| 186 | { |
||
| 187 | // Make sure its a string and not something else like an array |
||
| 188 | $_REQUEST['topic'] = (string) $_REQUEST['topic']; |
||
| 189 | |||
| 190 | // Slash means old, beta style, formatting. That's okay though, the link should still work. |
||
| 191 | if (strpos($_REQUEST['topic'], '/') !== false) |
||
| 192 | list ($_REQUEST['topic'], $_REQUEST['start']) = explode('/', $_REQUEST['topic']); |
||
| 193 | // Dots are useful and fun ;). This is ?topic=1.15. |
||
| 194 | elseif (strpos($_REQUEST['topic'], '.') !== false) |
||
| 195 | list ($_REQUEST['topic'], $_REQUEST['start']) = explode('.', $_REQUEST['topic']); |
||
| 196 | |||
| 197 | // Topic should always be an integer |
||
| 198 | $topic = $_GET['topic'] = $_REQUEST['topic'] = (int) $_REQUEST['topic']; |
||
| 199 | |||
| 200 | // Start could be a lot of things... |
||
| 201 | // ... empty ... |
||
| 202 | if (empty($_REQUEST['start'])) |
||
| 203 | { |
||
| 204 | $_REQUEST['start'] = 0; |
||
| 205 | } |
||
| 206 | // ... a simple number ... |
||
| 207 | elseif (is_numeric($_REQUEST['start'])) |
||
| 208 | { |
||
| 209 | $_REQUEST['start'] = (int) $_REQUEST['start']; |
||
| 210 | } |
||
| 211 | // ... or a specific message ... |
||
| 212 | elseif (strpos($_REQUEST['start'], 'msg') === 0) |
||
| 213 | { |
||
| 214 | $virtual_msg = (int) substr($_REQUEST['start'], 3); |
||
| 215 | $_REQUEST['start'] = $virtual_msg === 0 ? 0 : 'msg' . $virtual_msg; |
||
| 216 | } |
||
| 217 | // ... or whatever is new ... |
||
| 218 | elseif (strpos($_REQUEST['start'], 'new') === 0) |
||
| 219 | { |
||
| 220 | $_REQUEST['start'] = 'new'; |
||
| 221 | } |
||
| 222 | // ... or since a certain time ... |
||
| 223 | elseif (strpos($_REQUEST['start'], 'from') === 0) |
||
| 224 | { |
||
| 225 | $timestamp = (int) substr($_REQUEST['start'], 4); |
||
| 226 | $_REQUEST['start'] = $timestamp === 0 ? 0 : 'from' . $timestamp; |
||
| 227 | } |
||
| 228 | // ... or something invalid, in which case we reset it to 0. |
||
| 229 | else |
||
| 230 | $_REQUEST['start'] = 0; |
||
| 231 | } |
||
| 232 | else |
||
| 233 | $topic = 0; |
||
| 234 | |||
| 235 | // There should be a $_REQUEST['start'], some at least. If you need to default to other than 0, use $_GET['start']. |
||
| 236 | if (empty($_REQUEST['start']) || $_REQUEST['start'] < 0 || (int) $_REQUEST['start'] > 2147473647) |
||
| 237 | $_REQUEST['start'] = 0; |
||
| 238 | |||
| 239 | // The action needs to be a string and not an array or anything else |
||
| 240 | if (isset($_REQUEST['action'])) |
||
| 241 | $_REQUEST['action'] = (string) $_REQUEST['action']; |
||
| 242 | if (isset($_GET['action'])) |
||
| 243 | $_GET['action'] = (string) $_GET['action']; |
||
| 244 | |||
| 245 | // Some mail providers like to encode semicolons in activation URLs... |
||
| 246 | if (!empty($_REQUEST['action']) && substr($_SERVER['QUERY_STRING'], 0, 18) == 'action=activate%3b') |
||
| 247 | { |
||
| 248 | header('location: ' . $scripturl . '?' . str_replace('%3b', ';', $_SERVER['QUERY_STRING'])); |
||
| 249 | exit; |
||
| 250 | } |
||
| 251 | |||
| 252 | // Make sure we have a valid REMOTE_ADDR. |
||
| 253 | if (!isset($_SERVER['REMOTE_ADDR'])) |
||
| 254 | { |
||
| 255 | $_SERVER['REMOTE_ADDR'] = ''; |
||
| 256 | // A new magic variable to indicate we think this is command line. |
||
| 257 | $_SERVER['is_cli'] = true; |
||
| 258 | } |
||
| 259 | // Perhaps we have a IPv6 address. |
||
| 260 | elseif (isValidIP($_SERVER['REMOTE_ADDR'])) |
||
| 261 | { |
||
| 262 | $_SERVER['REMOTE_ADDR'] = preg_replace('~^::ffff:(\d+\.\d+\.\d+\.\d+)~', '\1', $_SERVER['REMOTE_ADDR']); |
||
| 263 | } |
||
| 264 | |||
| 265 | // Try to calculate their most likely IP for those people behind proxies (And the like). |
||
| 266 | $_SERVER['BAN_CHECK_IP'] = $_SERVER['REMOTE_ADDR']; |
||
| 267 | |||
| 268 | // If we haven't specified how to handle Reverse Proxy IP headers, lets do what we always used to do. |
||
| 269 | if (!isset($modSettings['proxy_ip_header'])) |
||
| 270 | $modSettings['proxy_ip_header'] = 'autodetect'; |
||
| 271 | |||
| 272 | // Which headers are we going to check for Reverse Proxy IP headers? |
||
| 273 | if ($modSettings['proxy_ip_header'] == 'disabled') |
||
| 274 | $reverseIPheaders = array(); |
||
| 275 | elseif ($modSettings['proxy_ip_header'] == 'autodetect') |
||
| 276 | $reverseIPheaders = array('HTTP_X_FORWARDED_FOR', 'HTTP_CLIENT_IP', 'HTTP_X_REAL_IP', 'HTTP_CF_CONNECTING_IP'); |
||
| 277 | else |
||
| 278 | $reverseIPheaders = array($modSettings['proxy_ip_header']); |
||
| 279 | |||
| 280 | // Find the user's IP address. (but don't let it give you 'unknown'!) |
||
| 281 | foreach ($reverseIPheaders as $proxyIPheader) |
||
| 282 | { |
||
| 283 | // Ignore if this is not set. |
||
| 284 | if (!isset($_SERVER[$proxyIPheader])) |
||
| 285 | continue; |
||
| 286 | |||
| 287 | if (!empty($modSettings['proxy_ip_servers'])) |
||
| 288 | { |
||
| 289 | $valid_sender = false; |
||
| 290 | |||
| 291 | foreach (explode(',', $modSettings['proxy_ip_servers']) as $proxy) |
||
| 292 | { |
||
| 293 | if ($proxy == $_SERVER['REMOTE_ADDR'] || matchIPtoCIDR($_SERVER['REMOTE_ADDR'], $proxy)) |
||
| 294 | { |
||
| 295 | $valid_sender = true; |
||
| 296 | break; |
||
| 297 | } |
||
| 298 | } |
||
| 299 | |||
| 300 | if (!$valid_sender) |
||
| 301 | continue; |
||
| 302 | } |
||
| 303 | |||
| 304 | // If there are commas, get the last one.. probably. |
||
| 305 | if (strpos($_SERVER[$proxyIPheader], ',') !== false) |
||
| 306 | { |
||
| 307 | $ips = array_reverse(explode(', ', $_SERVER[$proxyIPheader])); |
||
| 308 | |||
| 309 | // Go through each IP... |
||
| 310 | foreach ($ips as $i => $ip) |
||
| 311 | { |
||
| 312 | // Make sure it's in a valid range... |
||
| 313 | if (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown|::1|fe80::|fc00::)~', $ip) != 0 && preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown|::1|fe80::|fc00::)~', $_SERVER['REMOTE_ADDR']) == 0) |
||
| 314 | { |
||
| 315 | if (!isValidIPv6($_SERVER[$proxyIPheader]) || preg_match('~::ffff:\d+\.\d+\.\d+\.\d+~', $_SERVER[$proxyIPheader]) !== 0) |
||
| 316 | { |
||
| 317 | $_SERVER[$proxyIPheader] = preg_replace('~^::ffff:(\d+\.\d+\.\d+\.\d+)~', '\1', $_SERVER[$proxyIPheader]); |
||
| 318 | |||
| 319 | // Just incase we have a legacy IPv4 address. |
||
| 320 | // @ TODO: Convert to IPv6. |
||
| 321 | if (preg_match('~^((([1]?\d)?\d|2[0-4]\d|25[0-5])\.){3}(([1]?\d)?\d|2[0-4]\d|25[0-5])$~', $_SERVER[$proxyIPheader]) === 0) |
||
| 322 | continue; |
||
| 323 | } |
||
| 324 | |||
| 325 | continue; |
||
| 326 | } |
||
| 327 | |||
| 328 | // Otherwise, we've got an IP! |
||
| 329 | $_SERVER['BAN_CHECK_IP'] = trim($ip); |
||
| 330 | break; |
||
| 331 | } |
||
| 332 | } |
||
| 333 | // Otherwise just use the only one. |
||
| 334 | elseif (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown|::1|fe80::|fc00::)~', $_SERVER[$proxyIPheader]) == 0 || preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown|::1|fe80::|fc00::)~', $_SERVER['REMOTE_ADDR']) != 0) |
||
| 335 | $_SERVER['BAN_CHECK_IP'] = $_SERVER[$proxyIPheader]; |
||
| 336 | elseif (!isValidIPv6($_SERVER[$proxyIPheader]) || preg_match('~::ffff:\d+\.\d+\.\d+\.\d+~', $_SERVER[$proxyIPheader]) !== 0) |
||
| 337 | { |
||
| 338 | $_SERVER[$proxyIPheader] = preg_replace('~^::ffff:(\d+\.\d+\.\d+\.\d+)~', '\1', $_SERVER[$proxyIPheader]); |
||
| 339 | |||
| 340 | // Just incase we have a legacy IPv4 address. |
||
| 341 | // @ TODO: Convert to IPv6. |
||
| 342 | if (preg_match('~^((([1]?\d)?\d|2[0-4]\d|25[0-5])\.){3}(([1]?\d)?\d|2[0-4]\d|25[0-5])$~', $_SERVER[$proxyIPheader]) === 0) |
||
| 343 | continue; |
||
| 344 | } |
||
| 345 | } |
||
| 346 | |||
| 347 | // Make sure we know the URL of the current request. |
||
| 348 | if (empty($_SERVER['REQUEST_URI'])) |
||
| 349 | $_SERVER['REQUEST_URL'] = $scripturl . (!empty($_SERVER['QUERY_STRING']) ? '?' . $_SERVER['QUERY_STRING'] : ''); |
||
| 350 | elseif (preg_match('~^([^/]+//[^/]+)~', $scripturl, $match) == 1) |
||
| 351 | $_SERVER['REQUEST_URL'] = $match[1] . $_SERVER['REQUEST_URI']; |
||
| 352 | else |
||
| 353 | $_SERVER['REQUEST_URL'] = $_SERVER['REQUEST_URI']; |
||
| 354 | |||
| 355 | // And make sure HTTP_USER_AGENT is set. |
||
| 356 | $_SERVER['HTTP_USER_AGENT'] = isset($_SERVER['HTTP_USER_AGENT']) ? (isset($smcFunc['htmlspecialchars']) ? $smcFunc['htmlspecialchars']($smcFunc['db_unescape_string']($_SERVER['HTTP_USER_AGENT']), ENT_QUOTES) : htmlspecialchars($smcFunc['db_unescape_string']($_SERVER['HTTP_USER_AGENT']), ENT_QUOTES)) : ''; |
||
| 357 | |||
| 358 | // Some final checking. |
||
| 359 | if (!isValidIP($_SERVER['BAN_CHECK_IP'])) |
||
| 360 | $_SERVER['BAN_CHECK_IP'] = ''; |
||
| 361 | if ($_SERVER['REMOTE_ADDR'] == 'unknown') |
||
| 362 | $_SERVER['REMOTE_ADDR'] = ''; |
||
| 363 | } |
||
| 695 | ?> |
Loading history...
In general, usage of exit should be done with care and only when running in a scripting context like a CLI script.