gctools-outilsgc /
gcconnex
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | /** |
||
| 4 | * Elgg RewriteTester. |
||
| 5 | * Test if URL rewriting is working. |
||
| 6 | * |
||
| 7 | * @package Elgg.Core |
||
| 8 | * @subpackage Installer |
||
| 9 | */ |
||
| 10 | class ElggRewriteTester { |
||
| 11 | protected $webserver; |
||
| 12 | protected $serverSupportsRemoteRead; |
||
| 13 | protected $rewriteTestPassed; |
||
| 14 | protected $htaccessIssue; |
||
| 15 | |||
| 16 | /** |
||
| 17 | * Set the webserver as unknown. |
||
| 18 | */ |
||
| 19 | public function __construct() { |
||
| 20 | $this->webserver = 'unknown'; |
||
| 21 | } |
||
| 22 | |||
| 23 | /** |
||
| 24 | * Run the rewrite test and return a status array |
||
| 25 | * |
||
| 26 | * @param string $url URL of rewrite test |
||
| 27 | * @param string $path Root directory of Elgg with trailing slash |
||
| 28 | * |
||
| 29 | * @return array |
||
| 30 | */ |
||
| 31 | public function run($url, $path) { |
||
| 32 | |||
| 33 | $this->webserver = \ElggRewriteTester::guessWebServer(); |
||
| 34 | |||
| 35 | $this->rewriteTestPassed = $this->runRewriteTest($url); |
||
| 36 | |||
| 37 | if ($this->rewriteTestPassed == FALSE) { |
||
|
0 ignored issues
–
show
|
|||
| 38 | if ($this->webserver == 'apache' || $this->webserver == 'unknown') { |
||
| 39 | if ($this->createHtaccess($url, $path)) { |
||
| 40 | $this->rewriteTestPassed = $this->runRewriteTest($url); |
||
| 41 | } |
||
| 42 | } |
||
| 43 | } |
||
| 44 | |||
| 45 | return $this->returnStatus($url); |
||
| 46 | } |
||
| 47 | |||
| 48 | /** |
||
| 49 | * Guess the web server from $_SERVER['SERVER_SOFTWARE'] |
||
| 50 | * |
||
| 51 | * @return string |
||
| 52 | */ |
||
| 53 | public static function guessWebServer() { |
||
| 54 | $serverString = strtolower($_SERVER['SERVER_SOFTWARE']); |
||
| 55 | $possibleServers = array('apache', 'nginx', 'lighttpd', 'iis'); |
||
| 56 | foreach ($possibleServers as $server) { |
||
| 57 | if (strpos($serverString, $server) !== FALSE) { |
||
| 58 | return $server; |
||
| 59 | } |
||
| 60 | } |
||
| 61 | return 'unknown'; |
||
| 62 | } |
||
| 63 | |||
| 64 | /** |
||
| 65 | * Guess if url contains subdirectory or not. |
||
| 66 | * |
||
| 67 | * @param string $url Rewrite test URL |
||
| 68 | * |
||
| 69 | * @return string|bool Subdirectory string with beginning and trailing slash or false if were unable to determine subdirectory |
||
| 70 | * or pointing at root of domain already |
||
| 71 | */ |
||
| 72 | public function guessSubdirectory($url) { |
||
| 73 | $elements = parse_url($url); |
||
| 74 | if (!$elements || !isset($elements['path'])) { |
||
| 75 | return false; |
||
| 76 | } |
||
| 77 | $subdir = trim(dirname($elements['path']), '/'); |
||
| 78 | if (!$subdir) { |
||
| 79 | return false; |
||
| 80 | } else { |
||
| 81 | return "/$subdir/"; |
||
| 82 | } |
||
| 83 | } |
||
| 84 | |||
| 85 | /** |
||
| 86 | * Hit the rewrite test URL to determine if the rewrite rules are working |
||
| 87 | * |
||
| 88 | * @param string $url Rewrite test URL |
||
| 89 | * |
||
| 90 | * @return bool |
||
| 91 | */ |
||
| 92 | public function runRewriteTest($url) { |
||
| 93 | $this->serverSupportsRemoteRead = ($this->fetchUrl($url) === 'success'); |
||
| 94 | return $this->serverSupportsRemoteRead; |
||
| 95 | } |
||
| 96 | |||
| 97 | /** |
||
| 98 | * Check whether the site homepage can be fetched via curl |
||
| 99 | * |
||
| 100 | * @return boolean |
||
| 101 | */ |
||
| 102 | public function runLocalhostAccessTest() { |
||
| 103 | $url = _elgg_services()->config->getSiteUrl(); |
||
| 104 | return (bool)$this->fetchUrl($url); |
||
| 105 | } |
||
| 106 | |||
| 107 | /** |
||
| 108 | * Fetch a URL |
||
| 109 | * |
||
| 110 | * @param string $url The URL |
||
| 111 | * |
||
| 112 | * @return string Note that empty string may imply failure in fetching or empty response |
||
| 113 | */ |
||
| 114 | private function fetchUrl($url) { |
||
| 115 | $response = ''; |
||
| 116 | |||
| 117 | if (ini_get('allow_url_fopen')) { |
||
| 118 | $ctx = stream_context_create(array( |
||
| 119 | 'http' => array( |
||
| 120 | 'follow_location' => 0, |
||
| 121 | 'timeout' => 5, |
||
| 122 | ), |
||
| 123 | )); |
||
| 124 | $response = @file_get_contents($url, null, $ctx); |
||
| 125 | } |
||
| 126 | |||
| 127 | if (!$response && function_exists('curl_init')) { |
||
| 128 | $ch = curl_init(); |
||
| 129 | curl_setopt($ch, CURLOPT_URL, $url); |
||
| 130 | curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); |
||
| 131 | curl_setopt($ch, CURLOPT_TIMEOUT, 5); |
||
| 132 | curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); |
||
| 133 | $response = curl_exec($ch); |
||
| 134 | curl_close($ch); |
||
| 135 | } |
||
| 136 | |||
| 137 | return (string)$response; |
||
| 138 | } |
||
| 139 | |||
| 140 | /** |
||
| 141 | * Create Elgg's .htaccess file or confirm that it exists |
||
| 142 | * |
||
| 143 | * @param string $url URL of rewrite test |
||
| 144 | * @param string $path Elgg's root directory with trailing slash |
||
| 145 | * |
||
| 146 | * @return bool |
||
| 147 | */ |
||
| 148 | public function createHtaccess($url, $path) { |
||
| 149 | $filename = "{$path}.htaccess"; |
||
| 150 | if (file_exists($filename)) { |
||
| 151 | // check that this is the Elgg .htaccess |
||
| 152 | $data = file_get_contents($filename); |
||
| 153 | if ($data === FALSE) { |
||
| 154 | // don't have permission to read the file |
||
| 155 | $this->htaccessIssue = 'read_permission'; |
||
| 156 | return FALSE; |
||
| 157 | } |
||
| 158 | if (strpos($data, 'Elgg') === FALSE) { |
||
| 159 | $this->htaccessIssue = 'non_elgg_htaccess'; |
||
| 160 | return FALSE; |
||
| 161 | } else { |
||
| 162 | // check if this is an old Elgg htaccess |
||
| 163 | if (strpos($data, 'RewriteRule ^rewrite.php$ install.php') == FALSE) { |
||
|
0 ignored issues
–
show
|
|||
| 164 | $this->htaccessIssue = 'old_elgg_htaccess'; |
||
| 165 | return FALSE; |
||
| 166 | } |
||
| 167 | return TRUE; |
||
| 168 | } |
||
| 169 | } |
||
| 170 | |||
| 171 | if (!is_writable($path)) { |
||
| 172 | $this->htaccessIssue = 'write_permission'; |
||
| 173 | return FALSE; |
||
| 174 | } |
||
| 175 | |||
| 176 | // create the .htaccess file |
||
| 177 | $result = copy("{$path}install/config/htaccess.dist", $filename); |
||
| 178 | if (!$result) { |
||
| 179 | $this->htaccessIssue = 'cannot_copy'; |
||
| 180 | return FALSE; |
||
| 181 | } |
||
| 182 | |||
| 183 | // does default RewriteBase work already? |
||
| 184 | if (!$this->runRewriteTest($url)) { |
||
| 185 | //try to rewrite to guessed subdirectory |
||
| 186 | if ($subdir = $this->guessSubdirectory($url)) { |
||
| 187 | $contents = file_get_contents($filename); |
||
| 188 | $contents = preg_replace("/#RewriteBase \/(\r?\n)/", "RewriteBase $subdir\$1", $contents); |
||
| 189 | if ($contents) { |
||
| 190 | file_put_contents($filename, $contents); |
||
| 191 | } |
||
| 192 | } |
||
| 193 | } |
||
| 194 | |||
| 195 | return TRUE; |
||
| 196 | } |
||
| 197 | |||
| 198 | /** |
||
| 199 | * Create the status array required by the ElggInstaller |
||
| 200 | * |
||
| 201 | * @param string $url Rewrite test URL |
||
| 202 | * |
||
| 203 | * @return array |
||
| 204 | */ |
||
| 205 | protected function returnStatus($url) { |
||
| 206 | if ($this->rewriteTestPassed) { |
||
| 207 | return array( |
||
| 208 | 'severity' => 'pass', |
||
| 209 | 'message' => _elgg_services()->translator->translate('install:check:rewrite:success'), |
||
| 210 | ); |
||
| 211 | } |
||
| 212 | |||
| 213 | if ($this->serverSupportsRemoteRead == FALSE) { |
||
|
0 ignored issues
–
show
|
|||
| 214 | $msg = _elgg_services()->translator->translate('install:warning:rewrite:unknown', array($url)); |
||
| 215 | $msg .= elgg_view('install/js_rewrite_check', array('url' => $url)); |
||
| 216 | |||
| 217 | return array( |
||
| 218 | 'severity' => 'warning', |
||
| 219 | 'message' => $msg, |
||
| 220 | ); |
||
| 221 | } |
||
| 222 | |||
| 223 | if ($this->webserver == 'apache') { |
||
| 224 | $serverString = _elgg_services()->translator->translate('install:error:rewrite:apache'); |
||
| 225 | $msg = "$serverString\n\n"; |
||
| 226 | if (!isset($this->htaccessIssue)) { |
||
| 227 | $msg .= _elgg_services()->translator->translate('install:error:rewrite:allowoverride'); |
||
| 228 | $msg .= elgg_view('install/js_rewrite_check', array('url' => $url)); |
||
| 229 | |||
| 230 | return array( |
||
| 231 | 'severity' => 'failure', |
||
| 232 | 'message' => $msg, |
||
| 233 | ); |
||
| 234 | } |
||
| 235 | $msg .= _elgg_services()->translator->translate("install:error:rewrite:htaccess:{$this->htaccessIssue}"); |
||
| 236 | return array( |
||
| 237 | 'severity' => 'failure', |
||
| 238 | 'message' => $msg, |
||
| 239 | ); |
||
| 240 | } |
||
| 241 | |||
| 242 | if ($this->webserver != 'unknown') { |
||
| 243 | $serverString = _elgg_services()->translator->translate("install:error:rewrite:{$this->webserver}"); |
||
| 244 | $msg = "$serverString\n\n"; |
||
| 245 | $msg .= _elgg_services()->translator->translate("install:error:rewrite:altserver"); |
||
| 246 | return array( |
||
| 247 | 'severity' => 'failure', |
||
| 248 | 'message' => $msg, |
||
| 249 | ); |
||
| 250 | } |
||
| 251 | |||
| 252 | return array( |
||
| 253 | 'severity' => 'failure', |
||
| 254 | 'message' => _elgg_services()->translator->translate('install:error:rewrite:unknown'), |
||
| 255 | ); |
||
| 256 | } |
||
| 257 | } |
When comparing two booleans, it is generally considered safer to use the strict comparison operator.