elkarte /
Elkarte
| Total Complexity | 85 |
| Total Lines | 434 |
| Duplicated Lines | 0 % |
| Changes | 6 | ||
| Bugs | 0 | Features | 0 |
Complex classes like Bootstrap often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
While breaking up the class, it is a good idea to analyze how other classes use Bootstrap, and based on these observations, apply Extract Interface, too.
| 1 | <?php |
||
| 35 | class Bootstrap |
||
| 36 | { |
||
| 37 | /** |
||
| 38 | * What is returned by the function getrusage. |
||
| 39 | * |
||
| 40 | * @var mixed[] |
||
| 41 | */ |
||
| 42 | protected $rusage_start = []; |
||
| 43 | |||
| 44 | /** |
||
| 45 | * Bootstrap constructor. |
||
| 46 | * |
||
| 47 | * @param bool $standalone |
||
| 48 | * - true to boot outside of elkarte |
||
| 49 | * - false to bootstrap the main elkarte site. |
||
| 50 | * @throws \ElkArte\Exceptions\Exception |
||
| 51 | */ |
||
| 52 | public function __construct($standalone = true) |
||
| 53 | { |
||
| 54 | // Bootstrap only once. |
||
| 55 | if (!defined('ELKBOOT')) |
||
| 56 | { |
||
| 57 | // We're going to set a few globals |
||
| 58 | global $time_start, $ssi_error_reporting, $db_show_debug; |
||
| 59 | |||
| 60 | // Your on the clock |
||
| 61 | $time_start = microtime(true); |
||
| 62 | |||
| 63 | // Unless settings.php tells us otherwise |
||
| 64 | $db_show_debug = false; |
||
| 65 | |||
| 66 | // Report errors but not depreciated ones |
||
| 67 | $ssi_error_reporting = error_reporting(E_ALL & ~E_DEPRECATED); |
||
| 68 | |||
| 69 | // Get the things needed for ALL modes |
||
| 70 | $this->bringUpBasics(); |
||
| 71 | |||
| 72 | // Going to run from the side entrance and not directly from inside elkarte |
||
| 73 | if ($standalone) |
||
| 74 | { |
||
| 75 | $this->ssi_main(); |
||
| 76 | } |
||
| 77 | } |
||
| 78 | } |
||
| 79 | |||
| 80 | /** |
||
| 81 | * Calls the various initialization functions in the needed order |
||
| 82 | */ |
||
| 83 | public function bringUpBasics() |
||
| 84 | { |
||
| 85 | $this->setConstants(); |
||
| 86 | $this->setRusage(); |
||
| 87 | $this->clearGlobals(); |
||
| 88 | $this->loadSettingsFile(); |
||
| 89 | $this->validatePaths(); |
||
| 90 | $this->loadDependants(); |
||
| 91 | $this->loadAutoloader(); |
||
| 92 | $this->checkMaintance(); |
||
| 93 | $this->setDebug(); |
||
| 94 | $this->bringUp(); |
||
| 95 | } |
||
| 96 | |||
| 97 | /** |
||
| 98 | * Set the core constants, you know the ones we often forget to |
||
| 99 | * update on new releases. |
||
| 100 | */ |
||
| 101 | private function setConstants() |
||
| 102 | { |
||
| 103 | // First things first, but not necessarily in that order. |
||
| 104 | if (!defined('ELK')) |
||
| 105 | { |
||
| 106 | define('ELK', '1'); |
||
| 107 | } |
||
| 108 | define('ELKBOOT', '1'); |
||
| 109 | |||
| 110 | // The software version |
||
| 111 | define('FORUM_VERSION', 'ElkArte 2.0 dev'); |
||
| 112 | |||
| 113 | // Shortcut for the browser cache stale |
||
| 114 | define('CACHE_STALE', '?20dev'); |
||
| 115 | } |
||
| 116 | |||
| 117 | /** |
||
| 118 | * Get initial resource usage |
||
| 119 | */ |
||
| 120 | private function setRusage() |
||
| 121 | { |
||
| 122 | $this->rusage_start = getrusage(); |
||
| 123 | } |
||
| 124 | |||
| 125 | /** |
||
| 126 | * If they glo, they need to be cleaned. |
||
| 127 | */ |
||
| 128 | private function clearGlobals() |
||
| 129 | { |
||
| 130 | // We don't need no globals. (a bug in "old" versions of PHP) |
||
| 131 | foreach (array('db_character_set', 'cachedir') as $variable) |
||
| 132 | { |
||
| 133 | if (isset($GLOBALS[$variable])) |
||
| 134 | { |
||
| 135 | unset($GLOBALS[$variable], $GLOBALS[$variable]); |
||
| 136 | } |
||
| 137 | } |
||
| 138 | } |
||
| 139 | |||
| 140 | /** |
||
| 141 | * Loads the settings values into the global space |
||
| 142 | */ |
||
| 143 | private function loadSettingsFile() |
||
| 144 | { |
||
| 145 | // All those wonderful things found in settings |
||
| 146 | global $maintenance, $mtitle, $msubject, $mmessage, $mbname, $language, $boardurl, $webmaster_email; |
||
| 147 | global $cookiename, $db_type, $db_server, $db_port, $db_name, $db_user, $db_passwd; |
||
| 148 | global $ssi_db_user, $ssi_db_passwd, $db_prefix, $db_persist, $db_error_send, $cache_accelerator; |
||
| 149 | global $cache_uid, $cache_password, $cache_enable, $cache_memcached, $db_show_debug, $url_format; |
||
| 150 | global $cachedir, $boarddir, $sourcedir, $extdir, $languagedir; |
||
| 151 | |||
| 152 | // Where the Settings.php file is located |
||
| 153 | $settings_loc = __DIR__ . '/Settings.php'; |
||
| 154 | |||
| 155 | // First thing: if the install dir exists, just send anybody there |
||
| 156 | // The IGNORE_INSTALL_DIR constant is for developers only. Do not add it on production sites |
||
| 157 | if (file_exists('install') && (file_exists('install/install.php') || file_exists('install/upgrade.php'))) |
||
| 158 | { |
||
| 159 | if (file_exists($settings_loc)) |
||
| 160 | { |
||
| 161 | require_once($settings_loc); |
||
| 162 | } |
||
| 163 | |||
| 164 | if (defined('IGNORE_INSTALL_DIR')) |
||
| 165 | { |
||
| 166 | if (file_exists($settings_loc) && empty($_SESSION['installing'])) |
||
| 167 | { |
||
| 168 | $redirec_file = 'upgrade.php'; |
||
| 169 | } |
||
| 170 | else |
||
| 171 | { |
||
| 172 | $redirec_file = 'install.php'; |
||
| 173 | } |
||
| 174 | |||
| 175 | header('Location: http' . (!empty($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) === 'on' ? 's' : '') . '://' . (empty($_SERVER['HTTP_HOST']) ? $_SERVER['SERVER_NAME'] . (empty($_SERVER['SERVER_PORT']) || $_SERVER['SERVER_PORT'] === '80' ? '' : ':' . $_SERVER['SERVER_PORT']) : $_SERVER['HTTP_HOST']) . (strtr(dirname($_SERVER['PHP_SELF']), '\\', '/') == '/' ? '' : strtr(dirname($_SERVER['PHP_SELF']), '\\', '/')) . '/install/' . $redirec_file); |
||
|
|
|||
| 176 | die(); |
||
| 177 | } |
||
| 178 | } |
||
| 179 | else |
||
| 180 | { |
||
| 181 | require_once($settings_loc); |
||
| 182 | } |
||
| 183 | } |
||
| 184 | |||
| 185 | /** |
||
| 186 | * Validate the paths set in Settings.php, correct as needed and move |
||
| 187 | * them to constants. |
||
| 188 | */ |
||
| 189 | private function validatePaths() |
||
| 190 | { |
||
| 191 | global $boarddir, $sourcedir, $cachedir, $extdir, $languagedir; |
||
| 192 | |||
| 193 | // Make sure the paths are correct... at least try to fix them. |
||
| 194 | if (!file_exists($boarddir) && file_exists(__DIR__ . '/agreement.txt')) |
||
| 195 | { |
||
| 196 | $boarddir = __DIR__; |
||
| 197 | } |
||
| 198 | |||
| 199 | if (!file_exists($sourcedir . '/SiteDispatcher.class.php') && file_exists($boarddir . '/sources')) |
||
| 200 | { |
||
| 201 | $sourcedir = $boarddir . '/sources'; |
||
| 202 | } |
||
| 203 | |||
| 204 | // Check that directories which didn't exist in past releases are initialized. |
||
| 205 | if ((empty($cachedir) || !file_exists($cachedir)) && file_exists($boarddir . '/cache')) |
||
| 206 | { |
||
| 207 | $cachedir = $boarddir . '/cache'; |
||
| 208 | } |
||
| 209 | |||
| 210 | if ((empty($extdir) || !file_exists($extdir)) && file_exists($sourcedir . '/ext')) |
||
| 211 | { |
||
| 212 | $extdir = $sourcedir . '/ext'; |
||
| 213 | } |
||
| 214 | |||
| 215 | if ((empty($languagedir) || !file_exists($languagedir)) && file_exists($boarddir . '/themes/default/languages')) |
||
| 216 | { |
||
| 217 | $languagedir = $boarddir . '/themes/default/languages'; |
||
| 218 | } |
||
| 219 | |||
| 220 | // Time to forget about variables and go with constants! |
||
| 221 | define('BOARDDIR', $boarddir); |
||
| 222 | define('CACHEDIR', $cachedir); |
||
| 223 | define('EXTDIR', $extdir); |
||
| 224 | define('LANGUAGEDIR', $languagedir); |
||
| 225 | define('SOURCEDIR', $sourcedir); |
||
| 226 | define('ADMINDIR', $sourcedir . '/ElkArte/AdminController'); |
||
| 227 | define('CONTROLLERDIR', $sourcedir . '/ElkArte/Controller'); |
||
| 228 | define('SUBSDIR', $sourcedir . '/subs'); |
||
| 229 | define('ADDONSDIR', $boarddir . '/addons'); |
||
| 230 | unset($boarddir, $cachedir, $sourcedir, $languagedir, $extdir); |
||
| 231 | } |
||
| 232 | |||
| 233 | /** |
||
| 234 | * We require access to several important files, so load them upfront |
||
| 235 | */ |
||
| 236 | private function loadDependants() |
||
| 237 | { |
||
| 238 | // Files we cannot live without. |
||
| 239 | require_once(SOURCEDIR . '/QueryString.php'); |
||
| 240 | require_once(SOURCEDIR . '/Session.php'); |
||
| 241 | require_once(SOURCEDIR . '/Subs.php'); |
||
| 242 | require_once(SOURCEDIR . '/Logging.php'); |
||
| 243 | require_once(SOURCEDIR . '/Load.php'); |
||
| 244 | require_once(SOURCEDIR . '/Security.php'); |
||
| 245 | require_once(SUBSDIR . '/Cache.subs.php'); |
||
| 246 | } |
||
| 247 | |||
| 248 | /** |
||
| 249 | * The autoloader will take care most requests for files |
||
| 250 | */ |
||
| 251 | private function loadAutoloader() |
||
| 252 | { |
||
| 253 | require_once(EXTDIR . '/ClassLoader.php'); |
||
| 254 | |||
| 255 | $loader = new \ElkArte\ext\Composer\Autoload\ClassLoader(); |
||
| 256 | $loader->setPsr4('ElkArte\\', SOURCEDIR . '/ElkArte'); |
||
| 257 | $loader->setPsr4('BBC\\', SOURCEDIR . '/ElkArte/BBC'); |
||
| 258 | $loader->register(); |
||
| 259 | } |
||
| 260 | |||
| 261 | /** |
||
| 262 | * Check if we are in maintance mode, if so end here. |
||
| 263 | */ |
||
| 264 | private function checkMaintance() |
||
| 272 | } |
||
| 273 | } |
||
| 274 | |||
| 275 | /** |
||
| 276 | * If you like lots of debug information in error messages and below the footer |
||
| 277 | * then set $db_show_debug to true in settings. Don't do this on a production site. |
||
| 278 | */ |
||
| 279 | private function setDebug() |
||
| 287 | } |
||
| 288 | } |
||
| 289 | |||
| 290 | /** |
||
| 291 | * Time to see what has been requested, by whom and dispatch it to the proper handler |
||
| 292 | */ |
||
| 293 | private function bringUp() |
||
| 316 | } |
||
| 317 | } |
||
| 318 | |||
| 319 | /** |
||
| 320 | * If you are running SSI standalone, you need to call this function after bootstrap is |
||
| 321 | * initialized. |
||
| 322 | * |
||
| 323 | * @throws \ElkArte\Exceptions\Exception |
||
| 324 | */ |
||
| 325 | public function ssi_main() |
||
| 450 | } |
||
| 451 | } |
||
| 452 | |||
| 453 | /** |
||
| 454 | * Used to ensure SSI requests are valid and not a probing attempt |
||
| 455 | */ |
||
| 456 | private function _validRequestCheck() |
||
| 469 | } |
||
| 470 | } |
||
| 471 | } |
||
| 472 |
Loading history...
'Location: http' . ! emp...stall/' . $redirec_filecan contain request data and is used in response header context(s) leading to a potential security vulnerability.1 path for user data to reach this point
in bootstrap.php on line 175
Response Splitting Attacks
Allowing an attacker to set a response header, opens your application to response splitting attacks; effectively allowing an attacker to send any response, he would like.
General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) { throw new \InvalidArgumentException('This input is not allowed.'); }For numeric data, we recommend to explicitly cast the data: