SimpleMachines /
SMF2.1
| Conditions | 90 |
| Paths | > 20000 |
| Total Lines | 321 |
| Code Lines | 152 |
| Lines | 34 |
| Ratio | 10.59 % |
| Changes | 0 | ||
Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.
For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.
Commonly applied refactorings include:
If many parameters/temporary variables are present:
| 1 | <?php |
||
| 32 | function cleanRequest() |
||
| 33 | { |
||
| 34 | global $board, $topic, $boardurl, $scripturl, $modSettings, $smcFunc; |
||
|
|
|||
| 35 | |||
| 36 | // Makes it easier to refer to things this way. |
||
| 37 | $scripturl = $boardurl . '/index.php'; |
||
| 38 | |||
| 39 | // What function to use to reverse magic quotes - if sybase is on we assume that the database sensibly has the right unescape function! |
||
| 40 | $removeMagicQuoteFunction = ini_get('magic_quotes_sybase') || strtolower(ini_get('magic_quotes_sybase')) == 'on' ? 'unescapestring__recursive' : 'stripslashes__recursive'; |
||
| 41 | |||
| 42 | // Save some memory.. (since we don't use these anyway.) |
||
| 43 | unset($GLOBALS['HTTP_POST_VARS'], $GLOBALS['HTTP_POST_VARS']); |
||
| 44 | unset($GLOBALS['HTTP_POST_FILES'], $GLOBALS['HTTP_POST_FILES']); |
||
| 45 | |||
| 46 | // These keys shouldn't be set...ever. |
||
| 47 | if (isset($_REQUEST['GLOBALS']) || isset($_COOKIE['GLOBALS'])) |
||
| 48 | die('Invalid request variable.'); |
||
| 49 | |||
| 50 | // Same goes for numeric keys. |
||
| 51 | foreach (array_merge(array_keys($_POST), array_keys($_GET), array_keys($_FILES)) as $key) |
||
| 52 | if (is_numeric($key)) |
||
| 53 | die('Numeric request keys are invalid.'); |
||
| 54 | |||
| 55 | // Numeric keys in cookies are less of a problem. Just unset those. |
||
| 56 | foreach ($_COOKIE as $key => $value) |
||
| 57 | if (is_numeric($key)) |
||
| 58 | unset($_COOKIE[$key]); |
||
| 59 | |||
| 60 | // Get the correct query string. It may be in an environment variable... |
||
| 61 | if (!isset($_SERVER['QUERY_STRING'])) |
||
| 62 | $_SERVER['QUERY_STRING'] = getenv('QUERY_STRING'); |
||
| 63 | |||
| 64 | // It seems that sticking a URL after the query string is mighty common, well, it's evil - don't. |
||
| 65 | if (strpos($_SERVER['QUERY_STRING'], 'http') === 0) |
||
| 66 | { |
||
| 67 | header('HTTP/1.1 400 Bad Request'); |
||
| 68 | die; |
||
| 69 | } |
||
| 70 | |||
| 71 | // Are we going to need to parse the ; out? |
||
| 72 | if (strpos(ini_get('arg_separator.input'), ';') === false && !empty($_SERVER['QUERY_STRING'])) |
||
| 73 | { |
||
| 74 | // Get rid of the old one! You don't know where it's been! |
||
| 75 | $_GET = array(); |
||
| 76 | |||
| 77 | // Was this redirected? If so, get the REDIRECT_QUERY_STRING. |
||
| 78 | // Do not urldecode() the querystring. |
||
| 79 | $_SERVER['QUERY_STRING'] = substr($_SERVER['QUERY_STRING'], 0, 5) === 'url=/' ? $_SERVER['REDIRECT_QUERY_STRING'] : $_SERVER['QUERY_STRING']; |
||
| 80 | |||
| 81 | // Replace ';' with '&' and '&something&' with '&something=&'. (this is done for compatibility...) |
||
| 82 | // @todo smflib |
||
| 83 | parse_str(preg_replace('/&(\w+)(?=&|$)/', '&$1=', strtr($_SERVER['QUERY_STRING'], array(';?' => '&', ';' => '&', '%00' => '', "\0" => ''))), $_GET); |
||
| 84 | |||
| 85 | // Magic quotes still applies with parse_str - so clean it up. |
||
| 86 | View Code Duplication | if (function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc() != 0 && empty($modSettings['integrate_magic_quotes'])) |
|
| 87 | $_GET = $removeMagicQuoteFunction($_GET); |
||
| 88 | } |
||
| 89 | elseif (strpos(ini_get('arg_separator.input'), ';') !== false) |
||
| 90 | { |
||
| 91 | View Code Duplication | if (function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc() != 0 && empty($modSettings['integrate_magic_quotes'])) |
|
| 92 | $_GET = $removeMagicQuoteFunction($_GET); |
||
| 93 | |||
| 94 | // Search engines will send action=profile%3Bu=1, which confuses PHP. |
||
| 95 | foreach ($_GET as $k => $v) |
||
| 96 | { |
||
| 97 | if ((string) $v === $v && strpos($k, ';') !== false) |
||
| 98 | { |
||
| 99 | $temp = explode(';', $v); |
||
| 100 | $_GET[$k] = $temp[0]; |
||
| 101 | |||
| 102 | for ($i = 1, $n = count($temp); $i < $n; $i++) |
||
| 103 | { |
||
| 104 | @list ($key, $val) = @explode('=', $temp[$i], 2); |
||
| 105 | if (!isset($_GET[$key])) |
||
| 106 | $_GET[$key] = $val; |
||
| 107 | } |
||
| 108 | } |
||
| 109 | |||
| 110 | // This helps a lot with integration! |
||
| 111 | if (strpos($k, '?') === 0) |
||
| 112 | { |
||
| 113 | $_GET[substr($k, 1)] = $v; |
||
| 114 | unset($_GET[$k]); |
||
| 115 | } |
||
| 116 | } |
||
| 117 | } |
||
| 118 | |||
| 119 | // There's no query string, but there is a URL... try to get the data from there. |
||
| 120 | if (!empty($_SERVER['REQUEST_URI'])) |
||
| 121 | { |
||
| 122 | // Remove the .html, assuming there is one. |
||
| 123 | if (substr($_SERVER['REQUEST_URI'], strrpos($_SERVER['REQUEST_URI'], '.'), 4) == '.htm') |
||
| 124 | $request = substr($_SERVER['REQUEST_URI'], 0, strrpos($_SERVER['REQUEST_URI'], '.')); |
||
| 125 | else |
||
| 126 | $request = $_SERVER['REQUEST_URI']; |
||
| 127 | |||
| 128 | // @todo smflib. |
||
| 129 | // Replace 'index.php/a,b,c/d/e,f' with 'a=b,c&d=&e=f' and parse it into $_GET. |
||
| 130 | if (strpos($request, basename($scripturl) . '/') !== false) |
||
| 131 | { |
||
| 132 | parse_str(substr(preg_replace('/&(\w+)(?=&|$)/', '&$1=', strtr(preg_replace('~/([^,/]+),~', '/$1=', substr($request, strpos($request, basename($scripturl)) + strlen(basename($scripturl)))), '/', '&')), 1), $temp); |
||
| 133 | View Code Duplication | if (function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc() != 0 && empty($modSettings['integrate_magic_quotes'])) |
|
| 134 | $temp = $removeMagicQuoteFunction($temp); |
||
| 135 | $_GET += $temp; |
||
| 136 | } |
||
| 137 | } |
||
| 138 | |||
| 139 | // If magic quotes is on we have some work... |
||
| 140 | if (function_exists('get_magic_quotes_gpc') && @get_magic_quotes_gpc() != 0) |
||
| 141 | { |
||
| 142 | $_ENV = $removeMagicQuoteFunction($_ENV); |
||
| 143 | $_POST = $removeMagicQuoteFunction($_POST); |
||
| 144 | $_COOKIE = $removeMagicQuoteFunction($_COOKIE); |
||
| 145 | foreach ($_FILES as $k => $dummy) |
||
| 146 | if (isset($_FILES[$k]['name'])) |
||
| 147 | $_FILES[$k]['name'] = $removeMagicQuoteFunction($_FILES[$k]['name']); |
||
| 148 | } |
||
| 149 | |||
| 150 | // Add entities to GET. This is kinda like the slashes on everything else. |
||
| 151 | $_GET = htmlspecialchars__recursive($_GET); |
||
| 152 | |||
| 153 | // Let's not depend on the ini settings... why even have COOKIE in there, anyway? |
||
| 154 | $_REQUEST = $_POST + $_GET; |
||
| 155 | |||
| 156 | // Make sure $board and $topic are numbers. |
||
| 157 | if (isset($_REQUEST['board'])) |
||
| 158 | { |
||
| 159 | // Make sure its a string and not something else like an array |
||
| 160 | $_REQUEST['board'] = (string) $_REQUEST['board']; |
||
| 161 | |||
| 162 | // If there's a slash in it, we've got a start value! (old, compatible links.) |
||
| 163 | if (strpos($_REQUEST['board'], '/') !== false) |
||
| 164 | list ($_REQUEST['board'], $_REQUEST['start']) = explode('/', $_REQUEST['board']); |
||
| 165 | // Same idea, but dots. This is the currently used format - ?board=1.0... |
||
| 166 | elseif (strpos($_REQUEST['board'], '.') !== false) |
||
| 167 | list ($_REQUEST['board'], $_REQUEST['start']) = explode('.', $_REQUEST['board']); |
||
| 168 | // Now make absolutely sure it's a number. |
||
| 169 | $board = (int) $_REQUEST['board']; |
||
| 170 | $_REQUEST['start'] = isset($_REQUEST['start']) ? (int) $_REQUEST['start'] : 0; |
||
| 171 | |||
| 172 | // This is for "Who's Online" because it might come via POST - and it should be an int here. |
||
| 173 | $_GET['board'] = $board; |
||
| 174 | } |
||
| 175 | // Well, $board is going to be a number no matter what. |
||
| 176 | else |
||
| 177 | $board = 0; |
||
| 178 | |||
| 179 | // If there's a threadid, it's probably an old YaBB SE link. Flow with it. |
||
| 180 | if (isset($_REQUEST['threadid']) && !isset($_REQUEST['topic'])) |
||
| 181 | $_REQUEST['topic'] = $_REQUEST['threadid']; |
||
| 182 | |||
| 183 | // We've got topic! |
||
| 184 | if (isset($_REQUEST['topic'])) |
||
| 185 | { |
||
| 186 | // Make sure its a string and not something else like an array |
||
| 187 | $_REQUEST['topic'] = (string) $_REQUEST['topic']; |
||
| 188 | |||
| 189 | // Slash means old, beta style, formatting. That's okay though, the link should still work. |
||
| 190 | if (strpos($_REQUEST['topic'], '/') !== false) |
||
| 191 | list ($_REQUEST['topic'], $_REQUEST['start']) = explode('/', $_REQUEST['topic']); |
||
| 192 | // Dots are useful and fun ;). This is ?topic=1.15. |
||
| 193 | elseif (strpos($_REQUEST['topic'], '.') !== false) |
||
| 194 | list ($_REQUEST['topic'], $_REQUEST['start']) = explode('.', $_REQUEST['topic']); |
||
| 195 | |||
| 196 | // Topic should always be an integer |
||
| 197 | $topic = $_GET['topic'] = $_REQUEST['topic'] = (int) $_REQUEST['topic']; |
||
| 198 | |||
| 199 | // Start could be a lot of things... |
||
| 200 | // ... empty ... |
||
| 201 | if (empty($_REQUEST['start'])) |
||
| 202 | { |
||
| 203 | $_REQUEST['start'] = 0; |
||
| 204 | } |
||
| 205 | // ... a simple number ... |
||
| 206 | elseif (is_numeric($_REQUEST['start'])) |
||
| 207 | { |
||
| 208 | $_REQUEST['start'] = (int) $_REQUEST['start']; |
||
| 209 | } |
||
| 210 | // ... or a specific message ... |
||
| 211 | View Code Duplication | elseif (strpos($_REQUEST['start'], 'msg') === 0) |
|
| 212 | { |
||
| 213 | $virtual_msg = (int) substr($_REQUEST['start'], 3); |
||
| 214 | $_REQUEST['start'] = $virtual_msg === 0 ? 0 : 'msg' . $virtual_msg; |
||
| 215 | } |
||
| 216 | // ... or whatever is new ... |
||
| 217 | elseif (strpos($_REQUEST['start'], 'new') === 0) |
||
| 218 | { |
||
| 219 | $_REQUEST['start'] = 'new'; |
||
| 220 | } |
||
| 221 | // ... or since a certain time ... |
||
| 222 | View Code Duplication | elseif (strpos($_REQUEST['start'], 'from') === 0) |
|
| 223 | { |
||
| 224 | $timestamp = (int) substr($_REQUEST['start'], 4); |
||
| 225 | $_REQUEST['start'] = $timestamp === 0 ? 0 : 'from' . $timestamp; |
||
| 226 | } |
||
| 227 | // ... or something invalid, in which case we reset it to 0. |
||
| 228 | else |
||
| 229 | $_REQUEST['start'] = 0; |
||
| 230 | } |
||
| 231 | else |
||
| 232 | $topic = 0; |
||
| 233 | |||
| 234 | // There should be a $_REQUEST['start'], some at least. If you need to default to other than 0, use $_GET['start']. |
||
| 235 | if (empty($_REQUEST['start']) || $_REQUEST['start'] < 0 || (int) $_REQUEST['start'] > 2147473647) |
||
| 236 | $_REQUEST['start'] = 0; |
||
| 237 | |||
| 238 | // The action needs to be a string and not an array or anything else |
||
| 239 | if (isset($_REQUEST['action'])) |
||
| 240 | $_REQUEST['action'] = (string) $_REQUEST['action']; |
||
| 241 | if (isset($_GET['action'])) |
||
| 242 | $_GET['action'] = (string) $_GET['action']; |
||
| 243 | |||
| 244 | // Some mail providers like to encode semicolons in activation URLs... |
||
| 245 | if (!empty($_REQUEST['action']) && substr($_SERVER['QUERY_STRING'], 0, 18) == 'action=activate%3b') |
||
| 246 | { |
||
| 247 | header('location: ' . $scripturl . '?' . str_replace('%3b', ';', $_SERVER['QUERY_STRING'])); |
||
| 248 | exit; |
||
| 249 | } |
||
| 250 | |||
| 251 | // Make sure we have a valid REMOTE_ADDR. |
||
| 252 | if (!isset($_SERVER['REMOTE_ADDR'])) |
||
| 253 | { |
||
| 254 | $_SERVER['REMOTE_ADDR'] = ''; |
||
| 255 | // A new magic variable to indicate we think this is command line. |
||
| 256 | $_SERVER['is_cli'] = true; |
||
| 257 | } |
||
| 258 | // Perhaps we have a IPv6 address. |
||
| 259 | elseif (isValidIP($_SERVER['REMOTE_ADDR'])) |
||
| 260 | { |
||
| 261 | $_SERVER['REMOTE_ADDR'] = preg_replace('~^::ffff:(\d+\.\d+\.\d+\.\d+)~', '\1', $_SERVER['REMOTE_ADDR']); |
||
| 262 | } |
||
| 263 | |||
| 264 | // Try to calculate their most likely IP for those people behind proxies (And the like). |
||
| 265 | $_SERVER['BAN_CHECK_IP'] = $_SERVER['REMOTE_ADDR']; |
||
| 266 | |||
| 267 | // If we haven't specified how to handle Reverse Proxy IP headers, lets do what we always used to do. |
||
| 268 | if (!isset($modSettings['proxy_ip_header'])) |
||
| 269 | $modSettings['proxy_ip_header'] = 'autodetect'; |
||
| 270 | |||
| 271 | // Which headers are we going to check for Reverse Proxy IP headers? |
||
| 272 | if ($modSettings['proxy_ip_header'] == 'disabled') |
||
| 273 | $reverseIPheaders = array(); |
||
| 274 | elseif ($modSettings['proxy_ip_header'] == 'autodetect') |
||
| 275 | $reverseIPheaders = array('HTTP_X_FORWARDED_FOR', 'HTTP_CLIENT_IP'); |
||
| 276 | else |
||
| 277 | $reverseIPheaders = array($modSettings['proxy_ip_header']); |
||
| 278 | |||
| 279 | // Find the user's IP address. (but don't let it give you 'unknown'!) |
||
| 280 | foreach ($reverseIPheaders as $proxyIPheader) |
||
| 281 | { |
||
| 282 | // Ignore if this is not set. |
||
| 283 | if (!isset($_SERVER[$proxyIPheader])) |
||
| 284 | continue; |
||
| 285 | |||
| 286 | if (!empty($modSettings['proxy_ip_servers'])) |
||
| 287 | { |
||
| 288 | foreach (explode(',', $modSettings['proxy_ip_servers']) as $proxy) |
||
| 289 | if ($proxy == $_SERVER['REMOTE_ADDR'] || matchIPtoCIDR($_SERVER['REMOTE_ADDR'], $proxy)) |
||
| 290 | continue; |
||
| 291 | } |
||
| 292 | |||
| 293 | // If there are commas, get the last one.. probably. |
||
| 294 | if (strpos($_SERVER[$proxyIPheader], ',') !== false) |
||
| 295 | { |
||
| 296 | $ips = array_reverse(explode(', ', $_SERVER[$proxyIPheader])); |
||
| 297 | |||
| 298 | // Go through each IP... |
||
| 299 | foreach ($ips as $i => $ip) |
||
| 300 | { |
||
| 301 | // Make sure it's in a valid range... |
||
| 302 | if (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown|::1|fe80::|fc00::)~', $ip) != 0 && preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown|::1|fe80::|fc00::)~', $_SERVER['REMOTE_ADDR']) == 0) |
||
| 303 | { |
||
| 304 | View Code Duplication | if (!isValidIPv6($_SERVER[$proxyIPheader]) || preg_match('~::ffff:\d+\.\d+\.\d+\.\d+~', $_SERVER[$proxyIPheader]) !== 0) |
|
| 305 | { |
||
| 306 | $_SERVER[$proxyIPheader] = preg_replace('~^::ffff:(\d+\.\d+\.\d+\.\d+)~', '\1', $_SERVER[$proxyIPheader]); |
||
| 307 | |||
| 308 | // Just incase we have a legacy IPv4 address. |
||
| 309 | // @ TODO: Convert to IPv6. |
||
| 310 | if (preg_match('~^((([1]?\d)?\d|2[0-4]\d|25[0-5])\.){3}(([1]?\d)?\d|2[0-4]\d|25[0-5])$~', $_SERVER[$proxyIPheader]) === 0) |
||
| 311 | continue; |
||
| 312 | } |
||
| 313 | |||
| 314 | continue; |
||
| 315 | } |
||
| 316 | |||
| 317 | // Otherwise, we've got an IP! |
||
| 318 | $_SERVER['BAN_CHECK_IP'] = trim($ip); |
||
| 319 | break; |
||
| 320 | } |
||
| 321 | } |
||
| 322 | // Otherwise just use the only one. |
||
| 323 | elseif (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown|::1|fe80::|fc00::)~', $_SERVER[$proxyIPheader]) == 0 || preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown|::1|fe80::|fc00::)~', $_SERVER['REMOTE_ADDR']) != 0) |
||
| 324 | $_SERVER['BAN_CHECK_IP'] = $_SERVER[$proxyIPheader]; |
||
| 325 | View Code Duplication | elseif (!isValidIPv6($_SERVER[$proxyIPheader]) || preg_match('~::ffff:\d+\.\d+\.\d+\.\d+~', $_SERVER[$proxyIPheader]) !== 0) |
|
| 326 | { |
||
| 327 | $_SERVER[$proxyIPheader] = preg_replace('~^::ffff:(\d+\.\d+\.\d+\.\d+)~', '\1', $_SERVER[$proxyIPheader]); |
||
| 328 | |||
| 329 | // Just incase we have a legacy IPv4 address. |
||
| 330 | // @ TODO: Convert to IPv6. |
||
| 331 | if (preg_match('~^((([1]?\d)?\d|2[0-4]\d|25[0-5])\.){3}(([1]?\d)?\d|2[0-4]\d|25[0-5])$~', $_SERVER[$proxyIPheader]) === 0) |
||
| 332 | continue; |
||
| 333 | } |
||
| 334 | } |
||
| 335 | |||
| 336 | // Make sure we know the URL of the current request. |
||
| 337 | if (empty($_SERVER['REQUEST_URI'])) |
||
| 338 | $_SERVER['REQUEST_URL'] = $scripturl . (!empty($_SERVER['QUERY_STRING']) ? '?' . $_SERVER['QUERY_STRING'] : ''); |
||
| 339 | elseif (preg_match('~^([^/]+//[^/]+)~', $scripturl, $match) == 1) |
||
| 340 | $_SERVER['REQUEST_URL'] = $match[1] . $_SERVER['REQUEST_URI']; |
||
| 341 | else |
||
| 342 | $_SERVER['REQUEST_URL'] = $_SERVER['REQUEST_URI']; |
||
| 343 | |||
| 344 | // And make sure HTTP_USER_AGENT is set. |
||
| 345 | $_SERVER['HTTP_USER_AGENT'] = isset($_SERVER['HTTP_USER_AGENT']) ? (isset($smcFunc['htmlspecialchars']) ? $smcFunc['htmlspecialchars']($smcFunc['db_unescape_string']($_SERVER['HTTP_USER_AGENT']), ENT_QUOTES) : htmlspecialchars($smcFunc['db_unescape_string']($_SERVER['HTTP_USER_AGENT']), ENT_QUOTES)) : ''; |
||
| 346 | |||
| 347 | // Some final checking. |
||
| 348 | if (!isValidIP($_SERVER['BAN_CHECK_IP'])) |
||
| 349 | $_SERVER['BAN_CHECK_IP'] = ''; |
||
| 350 | if ($_SERVER['REMOTE_ADDR'] == 'unknown') |
||
| 351 | $_SERVER['REMOTE_ADDR'] = ''; |
||
| 352 | } |
||
| 353 | |||
| 710 | ?> |
Loading history...
Instead of relying on
globalstate, we recommend one of these alternatives:1. Pass all data via parameters
2. Create a class that maintains your state