YetiForceCompany / YetiForceCRM

include/Webservices/Query.php

Doc Comments +3 added lines

@@ -10,6 +10,9 @@
 
 require_once("include/Webservices/QueryParser.php");
 
+/**
+ * @param string $q
+ */
 function vtws_query($q, $user)
 {
 

Braces +3 added lines, -2 removed lines

@@ -21,8 +21,9 @@
 	// Cache the instance for re-use		
 	$moduleRegex = "/[fF][rR][Oo][Mm]\s+([^\s;]+)/";
 	$moduleName = '';
-	if (preg_match($moduleRegex, $q, $m))
-		$moduleName = trim($m[1]);
+	if (preg_match($moduleRegex, $q, $m)) {
+			$moduleName = trim($m[1]);
+	}
 
 	if (!isset($vtws_create_cache[$moduleName]['webserviceobject'])) {
 		$webserviceObject = VtigerWebserviceObject::fromQuery($adb, $q);

include/Webservices/QueryRelated.php

Doc Comments +3 added lines

@@ -12,6 +12,9 @@
 include_once 'include/Webservices/Query.php';
 include_once 'include/Webservices/RelatedTypes.php';
 
+/**
+ * @param string $query
+ */
 function vtws_query_related($query, $id, $relatedLabel, $user, $filterClause = null)
 {
 

Spacing +1 added lines, -1 removed lines

@@ -71,7 +71,7 @@
 		if (!empty($filterClause)) {
 			$query .= " " . $filterClause;
 		}
-		$query.=";";
+		$query .= ";";
 		$relatedRecords = vtws_query($query, $user);
 	}
 

include/Webservices/RelatedModuleMeta.php

Doc Comments +3 added lines

@@ -46,6 +46,9 @@
 		}
 	}
 
+	/**
+	 * @param integer $relationId
+	 */
 	private function getRelationMetaInfo($relationId)
 	{
 		return [

include/Webservices/SessionManager.php

Doc Comments +6 added lines

@@ -112,6 +112,9 @@ 
 		return HTTP_Session::id();
 	}
 
+	/**
+	 * @param string $var_name
+	 */
 	public function set($var_name, $var_value)
 	{
 		//TODO test setRef and getRef combination
@@ -119,6 +122,9 @@ 
 		HTTP_Session::set($var_name, $var_value);
 	}
 
+	/**
+	 * @param string $name
+	 */
 	public function get($name)
 	{
 		//echo "<br> getting for: ",$name," :value: ",HTTP_Session::get($name);

include/Webservices/VTQL_Lexer.php

Doc Comments +9 added lines

@@ -5,6 +5,9 @@ 
 $in_started = false;
 $count = false;
 
+/**
+ * @param integer $count
+ */
 function incrementN($lexer, $count)
 {
 	$i = 0;
@@ -160,6 +163,9 @@ 
 	}
 }
 
+/**
+ * @param VTQL_Lexer $lexer
+ */
 function handleend($lexer, $val)
 {
 	return VTQL_Parser::SEMICOLON;
@@ -179,6 +185,9 @@ 
 	public $mandatory;
 	public $current_state;
 
+	/**
+	 * @param string $data
+	 */
 	public function __construct($data)
 	{
 		$this->index = 0;

include/Webservices/VTQL_Parser.php

Doc Comments +3 added lines

@@ -159,6 +159,9 @@
 	private $syntax_error;
 	private $user;
 
+	/**
+	 * @param VTQL_Lexer $lex
+	 */
 	public function __construct($user, $lex, $out)
 	{
 		if (!is_array($out)) {

Spacing +6 added lines, -6 removed lines

@@ -89,7 +89,7 @@ 
 {
 
 	public $stateno; /* The state-number */
-	public $major;   /* The major token value.  This is the code
+	public $major; /* The major token value.  This is the code
 	 * * number for the token at this stack level */
 	public $minor; /* The user-supplied minor token value.  This
 	 * * is the value of the token  */
@@ -663,17 +663,17 @@ 
 	/**
 	 * @var int
 	 */
-	public $yyidx;  /* Index of top element in stack */
+	public $yyidx; /* Index of top element in stack */
 
 	/**
 	 * @var int
 	 */
-	public $yyerrcnt;  /* Shifts left before out of the error */
+	public $yyerrcnt; /* Shifts left before out of the error */
 
 	/**
 	 * @var array
 	 */
-	public $yystack = [];  /* The parser's stack */
+	public $yystack = []; /* The parser's stack */
 
 	/**
 	 * For tracing shifts, the names of all terminals and nonterminals
@@ -782,7 +782,7 @@ 
 			 * * which appear on the RHS of the rule, but which are not used
 			 * * inside the C code.
 			 */
-			default: break;   /* If no destructor action specified: do nothing */
+			default: break; /* If no destructor action specified: do nothing */
 		}
 	}
 
@@ -1608,7 +1608,7 @@ 
 	{
 //        $yyact;            /* The parser action. */
 //        $yyendofinput;     /* True if we are at the end of input */
-		$yyerrorhit = 0;   /* True if yymajor has invoked an error */
+		$yyerrorhit = 0; /* True if yymajor has invoked an error */
 
 		/* (re)initialize the parser, if necessary */
 		if ($this->yyidx === null || $this->yyidx < 0) {

include/Webservices/WebserviceField.php

Doc Comments +9 added lines

@@ -84,6 +84,9 @@ 
 		}
 	}
 
+	/**
+	 * @param integer $rowNumber
+	 */
 	public static function fromQueryResult($adb, $result, $rowNumber)
 	{
 		return new WebserviceField($adb, $adb->query_result_rowdata($result, $rowNumber));
@@ -147,6 +150,9 @@ 
 		return $this->default;
 	}
 
+	/**
+	 * @return string
+	 */
 	public function getColumnName()
 	{
 		return $this->columnName;
@@ -203,6 +209,9 @@ 
 		return false;
 	}
 
+	/**
+	 * @param boolean $nullable
+	 */
 	private function setNullable($nullable)
 	{
 		$this->nullable = $nullable;

Braces +13 added lines, -9 removed lines

@@ -198,8 +198,9 @@ 
 
 	public function isReadOnly()
 	{
-		if ($this->readOnly == 1)
-			return true;
+		if ($this->readOnly == 1) {
+					return true;
+		}
 		return false;
 	}
 
@@ -307,8 +308,9 @@ 
 				$numRows = $this->pearDB->num_rows($result);
 				for ($i = 0; $i < $numRows; ++$i) {
 					$referenceType = $this->pearDB->query_result($result, $i, "type");
-					if (in_array($referenceType, $accessibleTypes))
-						array_push($referenceTypes, $referenceType);
+					if (in_array($referenceType, $accessibleTypes)) {
+											array_push($referenceTypes, $referenceType);
+					}
 				}
 			} else {
 				$fieldModel = Vtiger_Field_Model::getInstanceFromFieldId($this->getFieldId());
@@ -425,21 +427,23 @@ 
 				$picklistValue = $this->pearDB->query_result($result, $i, $fieldName);
 				$picklistValue = decode_html($picklistValue);
 				$moduleName = getTabModuleName($this->getTabId());
-				if ($moduleName == 'Events')
-					$moduleName = 'Calendar';
+				if ($moduleName == 'Events') {
+									$moduleName = 'Calendar';
+				}
 				$elem["label"] = \includes\Language::translate($picklistValue, $moduleName);
 				$elem["value"] = $picklistValue;
 				array_push($options, $elem);
 			}
-		}else {
+		} else {
 			$user = VTWS_PreserveGlobal::getGlobal('current_user');
 			$details = \includes\fields\Picklist::getRoleBasedPicklistValues($fieldName, $user->roleid);
 			for ($i = 0; $i < sizeof($details); ++$i) {
 				$elem = [];
 				$picklistValue = decode_html($details[$i]);
 				$moduleName = getTabModuleName($this->getTabId());
-				if ($moduleName == 'Events')
-					$moduleName = 'Calendar';
+				if ($moduleName == 'Events') {
+									$moduleName = 'Calendar';
+				}
 				$elem["label"] = \includes\Language::translate($picklistValue, $moduleName);
 				$elem["value"] = $picklistValue;
 				array_push($options, $elem);

Spacing +1 added lines, -1 removed lines

@@ -41,7 +41,7 @@
 								module_name=?, summary=?, test=?, execution_condition=?, defaultworkflow=?, filtersavedinnew=?,
 								schtypeid=?, schtime=?, schdayofmonth=?, schdayofweek=?, schannualdates=?, nexttrigger_time=? where workflow_id=?", array($wf->moduleName, $wf->description, $wf->test, $wf->executionCondition, $wf->defaultworkflow, $wf->filtersavedinnew,
 				$wf->schtypeid, $wf->schtime, $wf->schdayofmonth, $wf->schdayofweek, $wf->schannualdates, $wf->nexttrigger_time, $wf->id));
-		}else {
+		} else {
 			$workflowId = $adb->getUniqueID("com_vtiger_workflows");
 			$workflow->id = $workflowId;
 			$wf = $workflow;

install/views/Index.php

Doc Comments +5 added lines

@@ -19,6 +19,11 @@
 		return false;
 	}
 
+	/**
+	 * @param Vtiger_Request $request
+	 *
+	 * @return Vtiger_Request
+	 */
 	public function setLanguage($request)
 	{
 		if (!$request->get('lang')) {

Braces +3 added lines, -2 removed lines

@@ -87,8 +87,9 @@
 	public function process(Vtiger_Request $request)
 	{
 		$default_charset = AppConfig::main('default_charset');
-		if (empty($default_charset))
-			$default_charset = 'UTF-8';
+		if (empty($default_charset)) {
+					$default_charset = 'UTF-8';
+		}
 		$mode = $request->getMode();
 		if (!empty($mode) && $this->isMethodExposed($mode)) {
 			return $this->$mode($request);

libraries/csrf-magic/csrf-magic.php

Doc Comments +4 added lines, -1 removed lines

@@ -211,7 +211,7 @@ 
 /**
  * Checks if this is a post request, and if it is, checks if the nonce is valid.
  * @param bool $fatal Whether or not to fatally error out if there is a problem.
- * @return True if check passes or is not necessary, false if failure.
+ * @return boolean|null if check passes or is not necessary, false if failure.
  */
 function csrf_check($fatal = true) {
     if ($_SERVER['REQUEST_METHOD'] !== 'POST') return true;
@@ -281,6 +281,9 @@ 
     }
     return $ret;
 }
+/**
+ * @param integer $level
+ */
 function csrf_flattenpost2($level, $key, $data) {
     if(!is_array($data)) return array($key => $data);
     $ret = array();

Spacing +19 added lines, -19 removed lines

@@ -166,35 +166,35 @@ 
 			if (!$is_html) return $buffer;
         }
     }
-    $count=1;
+    $count = 1;
     $tokens = csrf_get_tokens();
     $name = $GLOBALS['csrf']['input-name'];
     $endslash = $GLOBALS['csrf']['xhtml'] ? ' /' : '';
     $input = "<input type='hidden' name='$name' value=\"$tokens\"$endslash>";
     $buffer = preg_replace('#(<form[^>]*method\s*=\s*["\']post["\'][^>]*>)#i', '$1' . $input, $buffer);
     if ($GLOBALS['csrf']['frame-breaker'] && !$is_partial) {
-        $buffer = preg_replace('/<\/head>/', '<script type="text/javascript">if (top != self) {top.location.href = self.location.href;}</script></head>', $buffer,$count);
+        $buffer = preg_replace('/<\/head>/', '<script type="text/javascript">if (top != self) {top.location.href = self.location.href;}</script></head>', $buffer, $count);
     }
     if (($js = $GLOBALS['csrf']['rewrite-js']) && !$is_partial) {
 		global $dbconfig;
         if (empty($dbconfig) || empty($dbconfig['db_name']) || $dbconfig['db_name'] == '_DBC_TYPE_') {
 		$buffer = preg_replace(
             '/<\/head>/',
-             '<script type="text/javascript">'.
-                'var csrfMagicToken = "'.$tokens.'";'.
-                'var csrfMagicName = "'.$name.'";</script>'.
-            '<script src="../'.$js.'" type="text/javascript"></script></head>',
-            $buffer,$count
+             '<script type="text/javascript">' .
+                'var csrfMagicToken = "' . $tokens . '";' .
+                'var csrfMagicName = "' . $name . '";</script>' .
+            '<script src="../' . $js . '" type="text/javascript"></script></head>',
+            $buffer, $count
 		);
 			
 		} else {
 		$buffer = preg_replace(
             '/<\/head>/',
-            '<script type="text/javascript">'.
-                'var csrfMagicToken = "'.$tokens.'";'.
-                'var csrfMagicName = "'.$name.'";</script>'.
-            '<script src="'.$js.'" type="text/javascript"></script></head>',
-            $buffer,$count
+            '<script type="text/javascript">' .
+                'var csrfMagicToken = "' . $tokens . '";' .
+                'var csrfMagicName = "' . $name . '";</script>' .
+            '<script src="' . $js . '" type="text/javascript"></script></head>',
+            $buffer, $count
 		);
 		}
 		
@@ -276,17 +276,17 @@ 
 
 function csrf_flattenpost($data) {
     $ret = array();
-    foreach($data as $n => $v) {
+    foreach ($data as $n => $v) {
         $ret = array_merge($ret, csrf_flattenpost2(1, $n, $v));
     }
     return $ret;
 }
 function csrf_flattenpost2($level, $key, $data) {
-    if(!is_array($data)) return array($key => $data);
+    if (!is_array($data)) return array($key => $data);
     $ret = array();
-    foreach($data as $n => $v) {
-        $nk = $level >= 1 ? $key."[$n]" : "[$n]";
-        $ret = array_merge($ret, csrf_flattenpost2($level+1, $nk, $v));
+    foreach ($data as $n => $v) {
+        $nk = $level >= 1 ? $key . "[$n]" : "[$n]";
+        $ret = array_merge($ret, csrf_flattenpost2($level + 1, $nk, $v));
     }
     return $ret;
 }
@@ -300,7 +300,7 @@ 
     $data = '';
     foreach (csrf_flattenpost($_POST) as $key => $value) {
         if ($key == $GLOBALS['csrf']['input-name']) continue;
-        $data .= '<input type="hidden" name="'.htmlspecialchars($key).'" value="'.htmlspecialchars($value).'" />';
+        $data .= '<input type="hidden" name="' . htmlspecialchars($key) . '" value="' . htmlspecialchars($value) . '" />';
     }
     echo "<html><head><title>CSRF check failed</title></head>
         <body>
@@ -408,7 +408,7 @@ 
     if (is_writable($dir)) {
         $secret = csrf_generate_secret();
         $fh = fopen($file, 'w');
-        fwrite($fh, '<?php $secret = "'.$secret.'";' . PHP_EOL);
+        fwrite($fh, '<?php $secret = "' . $secret . '";' . PHP_EOL);
         fclose($fh);
         return $secret;
     }

Braces +90 added lines, -31 removed lines

@@ -157,13 +157,16 @@ 
 			// Determine based on content type.
 			$headers = headers_list();
 			foreach ($headers as $header) {
-				if ($is_html) break;
-				else if (stripos('Content-type', $header) !== false && stripos('/html', $header) === false) {
+				if ($is_html) {
+					break;
+				} else if (stripos('Content-type', $header) !== false && stripos('/html', $header) === false) {
 					$is_html = false;
 				}
 			}
         
-			if (!$is_html) return $buffer;
+			if (!$is_html) {
+				return $buffer;
+			}
         }
     }
     $count=1;
@@ -214,22 +217,30 @@ 
  * @return True if check passes or is not necessary, false if failure.
  */
 function csrf_check($fatal = true) {
-    if ($_SERVER['REQUEST_METHOD'] !== 'POST') return true;
+    if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    	return true;
+    }
     csrf_start();
     $name = $GLOBALS['csrf']['input-name'];
     $ok = false;
     $tokens = '';
     do {
-        if (!isset($_POST[$name])) break;
+        if (!isset($_POST[$name])) {
+        	break;
+        }
         // we don't regenerate a token and check it because some token creation
         // schemes are volatile.
         $tokens = $_POST[$name];
-        if (!csrf_check_tokens($tokens)) break;
+        if (!csrf_check_tokens($tokens)) {
+        	break;
+        }
         $ok = true;
     } while (false);
     if ($fatal && !$ok) {
         $callback = $GLOBALS['csrf']['callback'];
-        if (trim($tokens, 'A..Za..z0..9:;,') !== '') $tokens = 'hidden';
+        if (trim($tokens, 'A..Za..z0..9:;,') !== '') {
+        	$tokens = 'hidden';
+        }
         $callback($tokens);
         exit;
     }
@@ -256,15 +267,21 @@ 
     csrf_start();
 
     // These are "strong" algorithms that don't require per se a secret
-    if (session_id()) return 'sid:' . csrf_hash(session_id()) . $ip;
+    if (session_id()) {
+    	return 'sid:' . csrf_hash(session_id()) . $ip;
+    }
     if ($GLOBALS['csrf']['cookie']) {
         $val = csrf_generate_secret();
         setcookie($GLOBALS['csrf']['cookie'], $val);
         return 'cookie:' . csrf_hash($val) . $ip;
     }
-    if ($GLOBALS['csrf']['key']) return 'key:' . csrf_hash($GLOBALS['csrf']['key']) . $ip;
+    if ($GLOBALS['csrf']['key']) {
+    	return 'key:' . csrf_hash($GLOBALS['csrf']['key']) . $ip;
+    }
     // These further algorithms require a server-side secret
-    if (!$secret) return 'invalid';
+    if (!$secret) {
+    	return 'invalid';
+    }
     if ($GLOBALS['csrf']['user'] !== false) {
         return 'user:' . csrf_hash($GLOBALS['csrf']['user']);
     }
@@ -282,7 +299,9 @@ 
     return $ret;
 }
 function csrf_flattenpost2($level, $key, $data) {
-    if(!is_array($data)) return array($key => $data);
+    if(!is_array($data)) {
+    	return array($key => $data);
+    }
     $ret = array();
     foreach($data as $n => $v) {
         $nk = $level >= 1 ? $key."[$n]" : "[$n]";
@@ -299,7 +318,9 @@ 
     header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');
     $data = '';
     foreach (csrf_flattenpost($_POST) as $key => $value) {
-        if ($key == $GLOBALS['csrf']['input-name']) continue;
+        if ($key == $GLOBALS['csrf']['input-name']) {
+        	continue;
+        }
         $data .= '<input type="hidden" name="'.htmlspecialchars($key).'" value="'.htmlspecialchars($value).'" />';
     }
     echo "<html><head><title>CSRF check failed</title></head>
@@ -325,9 +346,13 @@ 
  * instead of csrf_check_token()
  */
 function csrf_check_tokens($tokens) {
-    if (is_string($tokens)) $tokens = explode(';', $tokens);
+    if (is_string($tokens)) {
+    	$tokens = explode(';', $tokens);
+    }
     foreach ($tokens as $token) {
-        if (csrf_check_token($token)) return true;
+        if (csrf_check_token($token)) {
+        	return true;
+        }
     }
     return false;
 }
@@ -336,38 +361,62 @@ 
  * Checks if a token is valid.
  */
 function csrf_check_token($token) {
-    if (strpos($token, ':') === false) return false;
+    if (strpos($token, ':') === false) {
+    	return false;
+    }
     list($type, $value) = explode(':', $token, 2);
-    if (strpos($value, ',') === false) return false;
+    if (strpos($value, ',') === false) {
+    	return false;
+    }
     list($x, $time) = explode(',', $token, 2);
     if ($GLOBALS['csrf']['expires']) {
-        if (time() > $time + $GLOBALS['csrf']['expires']) return false;
+        if (time() > $time + $GLOBALS['csrf']['expires']) {
+        	return false;
+        }
     }
     switch ($type) {
         case 'sid':
             return $value === csrf_hash(session_id(), $time);
         case 'cookie':
             $n = $GLOBALS['csrf']['cookie'];
-            if (!$n) return false;
-            if (!isset($_COOKIE[$n])) return false;
+            if (!$n) {
+            	return false;
+            }
+            if (!isset($_COOKIE[$n])) {
+            	return false;
+            }
             return $value === csrf_hash($_COOKIE[$n], $time);
         case 'key':
-            if (!$GLOBALS['csrf']['key']) return false;
+            if (!$GLOBALS['csrf']['key']) {
+            	return false;
+            }
             return $value === csrf_hash($GLOBALS['csrf']['key'], $time);
         // We could disable these 'weaker' checks if 'key' was set, but
         // that doesn't make me feel good then about the cookie-based
         // implementation.
         case 'user':
-            if (!csrf_get_secret()) return false;
-            if ($GLOBALS['csrf']['user'] === false) return false;
+            if (!csrf_get_secret()) {
+            	return false;
+            }
+            if ($GLOBALS['csrf']['user'] === false) {
+            	return false;
+            }
             return $value === csrf_hash($GLOBALS['csrf']['user'], $time);
         case 'ip':
-            if (!csrf_get_secret()) return false;
+            if (!csrf_get_secret()) {
+            	return false;
+            }
             // do not allow IP-based checks if the username is set, or if
             // the browser sent cookies
-            if ($GLOBALS['csrf']['user'] !== false) return false;
-            if (!empty($_COOKIE)) return false;
-            if (!$GLOBALS['csrf']['allow-ip']) return false;
+            if ($GLOBALS['csrf']['user'] !== false) {
+            	return false;
+            }
+            if (!empty($_COOKIE)) {
+            	return false;
+            }
+            if (!$GLOBALS['csrf']['allow-ip']) {
+            	return false;
+            }
             return $value === csrf_hash($_SERVER['IP_ADDRESS'], $time);
     }
     return false;
@@ -397,7 +446,9 @@ 
  * Retrieves the secret, and generates one if necessary.
  */
 function csrf_get_secret() {
-    if ($GLOBALS['csrf']['secret']) return $GLOBALS['csrf']['secret'];
+    if ($GLOBALS['csrf']['secret']) {
+    	return $GLOBALS['csrf']['secret'];
+    }
     $dir = dirname(__FILE__);
     $file = $dir . '/../../config/csrf_secret.php';
     $secret = '';
@@ -432,13 +483,21 @@ 
  * from the current time.
  */
 function csrf_hash($value, $time = null) {
-    if (!$time) $time = time();
+    if (!$time) {
+    	$time = time();
+    }
     return sha1(csrf_get_secret() . $value . $time) . ',' . $time;
 }
 
 // Load user configuration
-if (function_exists('csrf_startup')) csrf_startup();
+if (function_exists('csrf_startup')) {
+	csrf_startup();
+}
 // Initialize our handler
-if ($GLOBALS['csrf']['rewrite'])     ob_start('csrf_ob_handler');
+if ($GLOBALS['csrf']['rewrite']) {
+	ob_start('csrf_ob_handler');
+}
 // Perform check
-if (!$GLOBALS['csrf']['defer'])      csrf_check();
+if (!$GLOBALS['csrf']['defer']) {
+	csrf_check();
+}

Indentation +185 added lines, -185 removed lines

@@ -138,17 +138,17 @@ 
  * inject our JavaScript library.
  */
 function csrf_ob_handler($buffer, $flags) {
-    // Even though the user told us to rewrite, we should do a quick heuristic
-    // to check if the page is *actually* HTML. We don't begin rewriting until
-    // we hit the first <html tag.
-    static $is_html = false;
-    static $is_partial = false;
+	// Even though the user told us to rewrite, we should do a quick heuristic
+	// to check if the page is *actually* HTML. We don't begin rewriting until
+	// we hit the first <html tag.
+	static $is_html = false;
+	static $is_partial = false;
     
-    if (!$is_html) {
-        // not HTML until proven otherwise
-        if (stripos($buffer, '<html') !== false) {
-            $is_html = true;
-        } else {
+	if (!$is_html) {
+		// not HTML until proven otherwise
+		if (stripos($buffer, '<html') !== false) {
+			$is_html = true;
+		} else {
 
 			// Customized to take the partial HTML with form
 			$is_html = true;
@@ -164,48 +164,48 @@ 
 			}
         
 			if (!$is_html) return $buffer;
-        }
-    }
-    $count=1;
-    $tokens = csrf_get_tokens();
-    $name = $GLOBALS['csrf']['input-name'];
-    $endslash = $GLOBALS['csrf']['xhtml'] ? ' /' : '';
-    $input = "<input type='hidden' name='$name' value=\"$tokens\"$endslash>";
-    $buffer = preg_replace('#(<form[^>]*method\s*=\s*["\']post["\'][^>]*>)#i', '$1' . $input, $buffer);
-    if ($GLOBALS['csrf']['frame-breaker'] && !$is_partial) {
-        $buffer = preg_replace('/<\/head>/', '<script type="text/javascript">if (top != self) {top.location.href = self.location.href;}</script></head>', $buffer,$count);
-    }
-    if (($js = $GLOBALS['csrf']['rewrite-js']) && !$is_partial) {
+		}
+	}
+	$count=1;
+	$tokens = csrf_get_tokens();
+	$name = $GLOBALS['csrf']['input-name'];
+	$endslash = $GLOBALS['csrf']['xhtml'] ? ' /' : '';
+	$input = "<input type='hidden' name='$name' value=\"$tokens\"$endslash>";
+	$buffer = preg_replace('#(<form[^>]*method\s*=\s*["\']post["\'][^>]*>)#i', '$1' . $input, $buffer);
+	if ($GLOBALS['csrf']['frame-breaker'] && !$is_partial) {
+		$buffer = preg_replace('/<\/head>/', '<script type="text/javascript">if (top != self) {top.location.href = self.location.href;}</script></head>', $buffer,$count);
+	}
+	if (($js = $GLOBALS['csrf']['rewrite-js']) && !$is_partial) {
 		global $dbconfig;
-        if (empty($dbconfig) || empty($dbconfig['db_name']) || $dbconfig['db_name'] == '_DBC_TYPE_') {
+		if (empty($dbconfig) || empty($dbconfig['db_name']) || $dbconfig['db_name'] == '_DBC_TYPE_') {
 		$buffer = preg_replace(
-            '/<\/head>/',
-             '<script type="text/javascript">'.
-                'var csrfMagicToken = "'.$tokens.'";'.
-                'var csrfMagicName = "'.$name.'";</script>'.
-            '<script src="../'.$js.'" type="text/javascript"></script></head>',
-            $buffer,$count
+			'/<\/head>/',
+			 '<script type="text/javascript">'.
+				'var csrfMagicToken = "'.$tokens.'";'.
+				'var csrfMagicName = "'.$name.'";</script>'.
+			'<script src="../'.$js.'" type="text/javascript"></script></head>',
+			$buffer,$count
 		);
 			
 		} else {
 		$buffer = preg_replace(
-            '/<\/head>/',
-            '<script type="text/javascript">'.
-                'var csrfMagicToken = "'.$tokens.'";'.
-                'var csrfMagicName = "'.$name.'";</script>'.
-            '<script src="'.$js.'" type="text/javascript"></script></head>',
-            $buffer,$count
+			'/<\/head>/',
+			'<script type="text/javascript">'.
+				'var csrfMagicToken = "'.$tokens.'";'.
+				'var csrfMagicName = "'.$name.'";</script>'.
+			'<script src="'.$js.'" type="text/javascript"></script></head>',
+			$buffer,$count
 		);
 		}
 		
-        $script = '<script type="text/javascript">CsrfMagic.end();</script>';
+		$script = '<script type="text/javascript">CsrfMagic.end();</script>';
         
-        $buffer = preg_replace('/<\/body>/', $script . '</body>', $buffer, $count);
-        if (!$count) {
-            $buffer .= $script;
-        }
-    }
-    return $buffer;
+		$buffer = preg_replace('/<\/body>/', $script . '</body>', $buffer, $count);
+		if (!$count) {
+			$buffer .= $script;
+		}
+	}
+	return $buffer;
 }
 
 /**
@@ -214,26 +214,26 @@ 
  * @return True if check passes or is not necessary, false if failure.
  */
 function csrf_check($fatal = true) {
-    if ($_SERVER['REQUEST_METHOD'] !== 'POST') return true;
-    csrf_start();
-    $name = $GLOBALS['csrf']['input-name'];
-    $ok = false;
-    $tokens = '';
-    do {
-        if (!isset($_POST[$name])) break;
-        // we don't regenerate a token and check it because some token creation
-        // schemes are volatile.
-        $tokens = $_POST[$name];
-        if (!csrf_check_tokens($tokens)) break;
-        $ok = true;
-    } while (false);
-    if ($fatal && !$ok) {
-        $callback = $GLOBALS['csrf']['callback'];
-        if (trim($tokens, 'A..Za..z0..9:;,') !== '') $tokens = 'hidden';
-        $callback($tokens);
-        exit;
-    }
-    return $ok;
+	if ($_SERVER['REQUEST_METHOD'] !== 'POST') return true;
+	csrf_start();
+	$name = $GLOBALS['csrf']['input-name'];
+	$ok = false;
+	$tokens = '';
+	do {
+		if (!isset($_POST[$name])) break;
+		// we don't regenerate a token and check it because some token creation
+		// schemes are volatile.
+		$tokens = $_POST[$name];
+		if (!csrf_check_tokens($tokens)) break;
+		$ok = true;
+	} while (false);
+	if ($fatal && !$ok) {
+		$callback = $GLOBALS['csrf']['callback'];
+		if (trim($tokens, 'A..Za..z0..9:;,') !== '') $tokens = 'hidden';
+		$callback($tokens);
+		exit;
+	}
+	return $ok;
 }
 
 /**
@@ -241,67 +241,67 @@ 
  * by semicolons.
  */
 function csrf_get_tokens() {
-    $has_cookies = !empty($_COOKIE);
-
-    // $ip implements a composite key, which is sent if the user hasn't sent
-    // any cookies. It may or may not be used, depending on whether or not
-    // the cookies "stick"
-    $secret = csrf_get_secret();
-    if (!$has_cookies && $secret) {
-        $ip = ';ip:' . csrf_hash($_SERVER['IP_ADDRESS']);
-    } else {
-        $ip = '';
-    }
-    csrf_start();
-
-    // These are "strong" algorithms that don't require per se a secret
-    if (session_id()) return 'sid:' . csrf_hash(session_id()) . $ip;
-    if ($GLOBALS['csrf']['cookie']) {
-        $val = csrf_generate_secret();
-        setcookie($GLOBALS['csrf']['cookie'], $val);
-        return 'cookie:' . csrf_hash($val) . $ip;
-    }
-    if ($GLOBALS['csrf']['key']) return 'key:' . csrf_hash($GLOBALS['csrf']['key']) . $ip;
-    // These further algorithms require a server-side secret
-    if (!$secret) return 'invalid';
-    if ($GLOBALS['csrf']['user'] !== false) {
-        return 'user:' . csrf_hash($GLOBALS['csrf']['user']);
-    }
-    if ($GLOBALS['csrf']['allow-ip']) {
-        return ltrim($ip, ';');
-    }
-    return 'invalid';
+	$has_cookies = !empty($_COOKIE);
+
+	// $ip implements a composite key, which is sent if the user hasn't sent
+	// any cookies. It may or may not be used, depending on whether or not
+	// the cookies "stick"
+	$secret = csrf_get_secret();
+	if (!$has_cookies && $secret) {
+		$ip = ';ip:' . csrf_hash($_SERVER['IP_ADDRESS']);
+	} else {
+		$ip = '';
+	}
+	csrf_start();
+
+	// These are "strong" algorithms that don't require per se a secret
+	if (session_id()) return 'sid:' . csrf_hash(session_id()) . $ip;
+	if ($GLOBALS['csrf']['cookie']) {
+		$val = csrf_generate_secret();
+		setcookie($GLOBALS['csrf']['cookie'], $val);
+		return 'cookie:' . csrf_hash($val) . $ip;
+	}
+	if ($GLOBALS['csrf']['key']) return 'key:' . csrf_hash($GLOBALS['csrf']['key']) . $ip;
+	// These further algorithms require a server-side secret
+	if (!$secret) return 'invalid';
+	if ($GLOBALS['csrf']['user'] !== false) {
+		return 'user:' . csrf_hash($GLOBALS['csrf']['user']);
+	}
+	if ($GLOBALS['csrf']['allow-ip']) {
+		return ltrim($ip, ';');
+	}
+	return 'invalid';
 }
 
 function csrf_flattenpost($data) {
-    $ret = array();
-    foreach($data as $n => $v) {
-        $ret = array_merge($ret, csrf_flattenpost2(1, $n, $v));
-    }
-    return $ret;
+	$ret = array();
+	foreach($data as $n => $v) {
+		$ret = array_merge($ret, csrf_flattenpost2(1, $n, $v));
+	}
+	return $ret;
 }
 function csrf_flattenpost2($level, $key, $data) {
-    if(!is_array($data)) return array($key => $data);
-    $ret = array();
-    foreach($data as $n => $v) {
-        $nk = $level >= 1 ? $key."[$n]" : "[$n]";
-        $ret = array_merge($ret, csrf_flattenpost2($level+1, $nk, $v));
-    }
-    return $ret;
+	if(!is_array($data)) return array($key => $data);
+	$ret = array();
+	foreach($data as $n => $v) {
+		$nk = $level >= 1 ? $key."[$n]" : "[$n]";
+		$ret = array_merge($ret, csrf_flattenpost2($level+1, $nk, $v));
+	}
+	return $ret;
 }
 
 /**
  * @param $tokens is safe for HTML consumption
  */
 function csrf_callback($tokens) {
-    // (yes, $tokens is safe to echo without escaping)
-    header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');
-    $data = '';
-    foreach (csrf_flattenpost($_POST) as $key => $value) {
-        if ($key == $GLOBALS['csrf']['input-name']) continue;
-        $data .= '<input type="hidden" name="'.htmlspecialchars($key).'" value="'.htmlspecialchars($value).'" />';
-    }
-    echo "<html><head><title>CSRF check failed</title></head>
+	// (yes, $tokens is safe to echo without escaping)
+	header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');
+	$data = '';
+	foreach (csrf_flattenpost($_POST) as $key => $value) {
+		if ($key == $GLOBALS['csrf']['input-name']) continue;
+		$data .= '<input type="hidden" name="'.htmlspecialchars($key).'" value="'.htmlspecialchars($value).'" />';
+	}
+	echo "<html><head><title>CSRF check failed</title></head>
         <body>
         <p>CSRF check failed. Your form session may have expired, or you may not have
         cookies enabled.</p>
@@ -316,7 +316,7 @@ 
  * It is configurable by setting $GLOBALS['csrf']['callback'] in this file
  */
 function vtResponseForIllegalAccess() {
-    echo 'Invalid request - Response For Illegal Access';
+	echo 'Invalid request - Response For Illegal Access';
 }
 
 /**
@@ -324,106 +324,106 @@ 
  * instead of csrf_check_token()
  */
 function csrf_check_tokens($tokens) {
-    if (is_string($tokens)) $tokens = explode(';', $tokens);
-    foreach ($tokens as $token) {
-        if (csrf_check_token($token)) return true;
-    }
-    return false;
+	if (is_string($tokens)) $tokens = explode(';', $tokens);
+	foreach ($tokens as $token) {
+		if (csrf_check_token($token)) return true;
+	}
+	return false;
 }
 
 /**
  * Checks if a token is valid.
  */
 function csrf_check_token($token) {
-    if (strpos($token, ':') === false) return false;
-    list($type, $value) = explode(':', $token, 2);
-    if (strpos($value, ',') === false) return false;
-    list($x, $time) = explode(',', $token, 2);
-    if ($GLOBALS['csrf']['expires']) {
-        if (time() > $time + $GLOBALS['csrf']['expires']) return false;
-    }
-    switch ($type) {
-        case 'sid':
-            return $value === csrf_hash(session_id(), $time);
-        case 'cookie':
-            $n = $GLOBALS['csrf']['cookie'];
-            if (!$n) return false;
-            if (!isset($_COOKIE[$n])) return false;
-            return $value === csrf_hash($_COOKIE[$n], $time);
-        case 'key':
-            if (!$GLOBALS['csrf']['key']) return false;
-            return $value === csrf_hash($GLOBALS['csrf']['key'], $time);
-        // We could disable these 'weaker' checks if 'key' was set, but
-        // that doesn't make me feel good then about the cookie-based
-        // implementation.
-        case 'user':
-            if (!csrf_get_secret()) return false;
-            if ($GLOBALS['csrf']['user'] === false) return false;
-            return $value === csrf_hash($GLOBALS['csrf']['user'], $time);
-        case 'ip':
-            if (!csrf_get_secret()) return false;
-            // do not allow IP-based checks if the username is set, or if
-            // the browser sent cookies
-            if ($GLOBALS['csrf']['user'] !== false) return false;
-            if (!empty($_COOKIE)) return false;
-            if (!$GLOBALS['csrf']['allow-ip']) return false;
-            return $value === csrf_hash($_SERVER['IP_ADDRESS'], $time);
-    }
-    return false;
+	if (strpos($token, ':') === false) return false;
+	list($type, $value) = explode(':', $token, 2);
+	if (strpos($value, ',') === false) return false;
+	list($x, $time) = explode(',', $token, 2);
+	if ($GLOBALS['csrf']['expires']) {
+		if (time() > $time + $GLOBALS['csrf']['expires']) return false;
+	}
+	switch ($type) {
+		case 'sid':
+			return $value === csrf_hash(session_id(), $time);
+		case 'cookie':
+			$n = $GLOBALS['csrf']['cookie'];
+			if (!$n) return false;
+			if (!isset($_COOKIE[$n])) return false;
+			return $value === csrf_hash($_COOKIE[$n], $time);
+		case 'key':
+			if (!$GLOBALS['csrf']['key']) return false;
+			return $value === csrf_hash($GLOBALS['csrf']['key'], $time);
+		// We could disable these 'weaker' checks if 'key' was set, but
+		// that doesn't make me feel good then about the cookie-based
+		// implementation.
+		case 'user':
+			if (!csrf_get_secret()) return false;
+			if ($GLOBALS['csrf']['user'] === false) return false;
+			return $value === csrf_hash($GLOBALS['csrf']['user'], $time);
+		case 'ip':
+			if (!csrf_get_secret()) return false;
+			// do not allow IP-based checks if the username is set, or if
+			// the browser sent cookies
+			if ($GLOBALS['csrf']['user'] !== false) return false;
+			if (!empty($_COOKIE)) return false;
+			if (!$GLOBALS['csrf']['allow-ip']) return false;
+			return $value === csrf_hash($_SERVER['IP_ADDRESS'], $time);
+	}
+	return false;
 }
 
 /**
  * Sets a configuration value.
  */
 function csrf_conf($key, $val) {
-    if (!isset($GLOBALS['csrf'][$key])) {
-        trigger_error('No such configuration ' . $key, E_USER_WARNING);
-        return;
-    }
-    $GLOBALS['csrf'][$key] = $val;
+	if (!isset($GLOBALS['csrf'][$key])) {
+		trigger_error('No such configuration ' . $key, E_USER_WARNING);
+		return;
+	}
+	$GLOBALS['csrf'][$key] = $val;
 }
 
 /**
  * Starts a session if we're allowed to.
  */
 function csrf_start() {
-    if ($GLOBALS['csrf']['auto-session'] && !session_id()) {
-        session_start();
-    }
+	if ($GLOBALS['csrf']['auto-session'] && !session_id()) {
+		session_start();
+	}
 }
 
 /**
  * Retrieves the secret, and generates one if necessary.
  */
 function csrf_get_secret() {
-    if ($GLOBALS['csrf']['secret']) return $GLOBALS['csrf']['secret'];
-    $dir = dirname(__FILE__);
-    $file = $dir . '/../../config/csrf_secret.php';
-    $secret = '';
-    if (file_exists($file)) {
-        include $file;
-        return $secret;
-    }
-    if (is_writable($dir)) {
-        $secret = csrf_generate_secret();
-        $fh = fopen($file, 'w');
-        fwrite($fh, '<?php $secret = "'.$secret.'";' . PHP_EOL);
-        fclose($fh);
-        return $secret;
-    }
-    return '';
+	if ($GLOBALS['csrf']['secret']) return $GLOBALS['csrf']['secret'];
+	$dir = dirname(__FILE__);
+	$file = $dir . '/../../config/csrf_secret.php';
+	$secret = '';
+	if (file_exists($file)) {
+		include $file;
+		return $secret;
+	}
+	if (is_writable($dir)) {
+		$secret = csrf_generate_secret();
+		$fh = fopen($file, 'w');
+		fwrite($fh, '<?php $secret = "'.$secret.'";' . PHP_EOL);
+		fclose($fh);
+		return $secret;
+	}
+	return '';
 }
 
 /**
  * Generates a random string as the hash of time, microtime, and mt_rand.
  */
 function csrf_generate_secret($len = 32) {
-    $r = '';
-    for ($i = 0; $i < 32; $i++) {
-        $r .= chr(mt_rand(0, 255));
-    }
-    $r .= time() . microtime();
-    return sha1($r);
+	$r = '';
+	for ($i = 0; $i < 32; $i++) {
+		$r .= chr(mt_rand(0, 255));
+	}
+	$r .= time() . microtime();
+	return sha1($r);
 }
 
 /**
@@ -431,8 +431,8 @@ 
  * from the current time.
  */
 function csrf_hash($value, $time = null) {
-    if (!$time) $time = time();
-    return sha1(csrf_get_secret() . $value . $time) . ',' . $time;
+	if (!$time) $time = time();
+	return sha1(csrf_get_secret() . $value . $time) . ',' . $time;
 }
 
 // Load user configuration