wwwroot/nodes.php

   1 <?php
   2 require_once('config/config.inc'); //requiring main config file with path/database etc. constants
   3 if(isset($realm) && isset($users)) require_once(INCLUDE_DIR.'http_auth.php'); //Ask for auth if enabled...
   4 //echo($_SERVER['PATH_INFO']."\n<pre>"); var_dump(preg_split('/\//', $_SERVER['PATH_INFO'])); die(); //PATH_INFO Debug (usefull when messing with mod_rewrite)
   5 // output buffering forcing (mx)
   6 if (!empty($_POST['FORCE_OB']) && $_POST['FORCE_OB'] == 'true') ob_start();
   7
   8 //header("Location: http://web.archive.org/web/20020925021139/http://kyberia.sk");
   9 //echo "je to uz uplne v pici. vsetky data su stratene, prajem pekny den :)";
  10 //exit;
  11
  12 //starting timer for benchmarking purposes
  13 $timer_start=Time()+SubStr(MicroTime(),0,8);
  14 //setting PHPSESSID cookie and starting user session
  15 session_start();
  16
  17 error_reporting(1);
  18 //$_SESSION['debugging']=1;
  19 //unset($_SESSION['debugging']); //Well... we should make some event or JavaScript page to turning this on/off...
  20 //exit;
  21
  22
  23 if ($_SESSION['debugging']) {
  24
  25     error_reporting(E_ALL);
  26     echo 'GET VARIABLES::<br/>';
  27     print_r($_GET);
  28     echo 'POST VARIABLES::<br/>';
  29     print_r($_POST);
  30     echo '<b>SESSION VARIABLES::</b><br/>';
  31     print_r($_SESSION);
  32 }
  33
  34 @ini_set('magic_quotes_gpc' , 'off');
  35 if(get_magic_quotes_gpc()) die("Error: magic_quotes_gpc needs to be disabled! F00K!\n");
  36
  37 //Smarty from DB
  38 $smarty_resource = 'kyberia';
  39 //$smarty_resource = ''; //same as 'file' (fallback)
  40 /* I have moved old templates to DB using following lame script:
  41  * for i in *.tpl; do j=$(echo "$i" | cut -d . -f 1); echo UPDATE nodes SET node_content = "'$(php -r "echo mysql_escape_string(file_get_contents('$i'));")'" WHERE node_id = "'$j'" COLLATE utf8_bin LIMIT '1;'; done | mysql --user=kyberia --password=PASSSSSSS kyberia
  42  * In future we should have some mechanism for distributing templates because they are very important part of kyberia source...
  43  */
  44
  45 //Path info (Experimental - this replaced most of mod_rewrites...)
  46 @$PATH_INFO=trim($_SERVER[PATH_INFO]);
  47 if($PATH_INFO != '') {
  48         $PATH_CHUNKS = preg_split('/\//', $PATH_INFO);
  49         if(isset($PATH_CHUNKS[1])) switch($PATH_CHUNKS[1]) {
  50                 case 'k':
  51                         if(isset($PATH_CHUNKS[2]) && $PATH_CHUNKS[2] != '') $_GET['node_kid'] = $PATH_CHUNKS[2];
  52                         if(isset($PATH_CHUNKS[3]) && $PATH_CHUNKS[3] != '') $_GET['template_kid'] = $PATH_CHUNKS[3];
  53                         break;
  54                 case 'id':
  55                         if(isset($PATH_CHUNKS[2]) && $PATH_CHUNKS[2] != '') $_GET['node_id'] = $PATH_CHUNKS[2];
  56                         if(isset($PATH_CHUNKS[3]) && $PATH_CHUNKS[3] != '') $_GET['template_id'] = $PATH_CHUNKS[3];
  57
  58                         //Base36 fascism redirect
  59                         if($_GET['template_id'] == 'download') break; //Fix ugly download hack...
  60                         if(!count($_POST)) {
  61                                 header('Location: /k/'.base_convert($_GET['node_id'], 10, 36).
  62                                         (isset($_GET['template_id'])?'/'.base_convert($_GET['template_id'], 10, 36):'')
  63                                 );
  64                                 die("Base36 fascism...\n"); //If you want to be a fascist you have to die imediatelly...
  65                         }
  66
  67                         break;
  68                 default:
  69                         if($PATH_CHUNKS[1] != '') $_GET['node_name'] = $PATH_CHUNKS[1];
  70                         if(isset($PATH_CHUNKS[2]) && $PATH_CHUNKS[2] != '') $_GET['template_kid'] = $PATH_CHUNKS[2];
  71                         break;
  72         }
  73 }
  74 if(
  75         (!isset($_GET['node_kid']) || trim($_GET['node_kid']) == '') &&
  76         (!isset($_GET['node_id']) || trim($_GET['node_id']) == '')
  77 ) $_GET['node_kid'] = 1;
  78
  79 //Base36 http://en.wikipedia.org/wiki/Base_36 (Initial support only :-)
  80 if(isset($_GET['node_kid'])) $_GET['node_id'] = base_convert($_GET['node_kid'], 36, 10);
  81 if(isset($_GET['template_kid'])) $_GET['template_id'] = base_convert($_GET['template_kid'], 36, 10);
  82
  83 require_once(INCLUDE_DIR.'senate.inc');
  84
  85 if (isset($_SERVER['HTTP_REFERER'])) {
  86         preg_match('/(k|id)\/([0-9]*)\//',$_SERVER['HTTP_REFERER'],$ref_match);
  87         $referer_id=$ref_match[1];
  88 }
  89
  90 //connecting to database and creating universal $db object
  91 require_once(INCLUDE_DIR.'log.inc');
  92 require_once(INCLUDE_DIR.'ubik.inc');
  93 require_once(INCLUDE_DIR.'nodes.inc');
  94 require_once(INCLUDE_DIR.'error_messages.inc');
  95 require_once(INCLUDE_DIR.'database.inc');
  96 require_once(INCLUDE_DIR.'transports.inc');
  97
  98 $db = new CLASS_DATABASE();
  99
 100 if (!empty($_GET['template_id'])) {
 101         $template_id=$_GET['template_id'];
 102 } else {
 103         $template_id=false;
 104 }
 105
 106 //initializing node methods
 107 if (!empty($_GET['node_name'])) {
 108         $node  = nodes::redirByName($_GET['node_name']);
 109 } elseif (!empty($_GET['node_id'])) {
 110         $node = nodes::getNodeById($_GET['node_id'],
 111                 (isset($_SESSION['user_id']))?$_SESSION['user_id']:'');
 112 }
 113
 114 //XXX Paths are wrong (!)
 115 //loading smarty template engine and setting main parameters
 116 require(SMARTY_DIR.'Smarty.class.php');
 117 $smarty = new Smarty;
 118 require(INCLUDE_DIR.'smarty/resource.kyberia.php');
 119 $smarty->default_resource_type=$smarty_resource;
 120
 121 //$smarty->php_handling = SMARTY_PHP_REMOVE; //XXX
 122 $smarty->template_dir = TEMPLATE_DIR;
 123 //echo TEMPLATE_DIR.TEMPLATE_SET;
 124 //echo $smarty->template_dir;
 125 $smarty->compile_dir = SYSTEM_DATA.'templates_c/';
 126 $smarty->config_dir = SMARTY_DIR.'configs/'; //XXX neexistuje
 127 $smarty->cache_dir = SMARTY_DIR.'cache/';
 128 $smarty->plugins_dir = SMARTY_PLUGIN_DIR ;
 129 if ($_SESSION['debugging']) $smarty->debugging=true;
 130
 131 // initializing variables
 132 // preg_replace prevents LFI
 133 if (empty($_POST['event'])) $event='display';
 134 else $event= preg_replace( "![^a-zA-Z0-9_]+!", "", $_POST['event']);
 135
 136
 137 if ($_SESSION['debugging']) {
 138         echo "<pre><b>NODE::";
 139         print_r($node);
 140         echo "</pre>";
 141 }
 142
 143 if ((isset($_SESSION['user_id']) && ($node['node_creator']==$_SESSION['user_id']))) {
 144         $node['node_permission']='owner';
 145 }
 146
 147 if (isset($_SESSION['cube_vector']) && ($_SESSION['cube_vector'])) {
 148         if (strpos($node['node_vector'],$_SESSION['cube_vector'])===false) {
 149                 echo "node::".$node['node_vector'];
 150                 echo "cube_Vector::".$_SESSION['cube_vector'];
 151                 echo "you are out of allowed cwbe. access forbidden";
 152                 die();
 153         }
 154 }
 155
 156 //if not existent node show our own 404
 157 if (empty($node)) {
 158         $nodes= nodes::getNodesByName($_GET['node_name']);
 159         if ($nodes) {
 160                 $smarty->assign('nodes',$nodes);
 161                 $content=$smarty->display('404.tpl');
 162                 die();
 163         }
 164         elseif ($_SESSION['user_id']) {
 165                 $smarty->assign('node_name',$_GET['node_name']);
 166                 $content=$smarty->display("modules/addnode.tpl");
 167         }
 168 }
 169
 170 //modifying node glass pearl //XXX WTF
 171 //if (is_array($children_types[$node['node_type']])) {
 172 //      $smarty->assign('children_types',$children_types[$node['node_type']]);
 173 //}
 174
 175 //smarty->assign('types',$types);
 176
 177
 178 //$node['node_type']=$types[$node['node_type']];
 179 /* This should NOT BE HANDLED HERE! This breaks things...
 180 $node['node_content']= StripSlashes($node['node_content']);
 181 $node['node_name']= StripSlashes($node['node_name']);
 182 */
 183
 184 //checking permissions
 185 function _checkPermissions()
 186 {
 187         global $permissions, $node;
 188
 189         require(INCLUDE_DIR.'permissions.inc');
 190         $permissions=permissions::checkPermissions($node);
 191         $permissions['h']=permissions::isHierarch($node);
 192 }
 193
 194 // mail rss
 195 if ($template_id=='rss') //XXX WHAT?
 196 {
 197         $_feedType = "RSS0.91";
 198         if (!is_numeric($_SESSION['user_id']))
 199         {
 200                 if (!isset($_SERVER['PHP_AUTH_USER'])) {
 201                         header('WWW-Authenticate: Basic realm="Kyberia"');
 202                         header('HTTP/1.0 401 Unauthorized');
 203                         echo 'Cancel button';
 204                         exit;
 205                 }
 206                 else
 207                 {
 208                         require_once(EVENT_DIR.'/login.inc');
 209                         $_POST['login'] = $_SERVER['PHP_AUTH_USER'];
 210                         $_POST['password'] = $_SERVER['PHP_AUTH_PW'];
 211                         $_POST['login_type'] = "name";
 212                         if (!login())
 213                         {
 214                                 echo "Zle meno/heslo.";
 215                                 exit();
 216                         }
 217                 }
 218         }
 219
 220         _checkPermissions();
 221
 222         // Mail
 223         if ($_GET['node_id']==='24' && $permissions['r'])
 224         {
 225            require_once(INCLUDE_DIR.'/feedcreator.class.php');
 226
 227            $rss = new UniversalFeedCreator();
 228            $rss->title = "Kyberia mail";
 229            $rss->description = "";
 230            $rss->link = "https://". SYSTEM_URL . "/id/24";
 231
 232                 //XXX into function
 233            $query = "select date_format(mail.mail_timestamp,\"%e.%c. %k:%i:%s\") as cas,
 234    userfrom.user_action as locationfrom_action,
 235    userfrom.user_action_id as locationfrom_action_id,
 236    userto.user_action as locationto_action,
 237    userto.user_action_id as locationto_action_id,
 238    userto.login as mail_to_name, userfrom.login as mail_from_name,
 239    mail.* from mail left join users as userfrom on
 240    mail_from=userfrom.user_id left join users as userto on mail_to=userto.user_id
 241    where mail_user='$_SESSION[user_id]' and mail_to='$_SESSION[user_id]' order by mail_id desc limit 0,10";
 242
 243            $set = $db->query($query);
 244
 245            while($set->next()) {
 246                    $m = $set->getRecord();
 247                    if ($m['mail_to'] != $_SESSION['user_id'])
 248                            continue;
 249                    $item = new FeedItem();
 250                    $item->title = $m['mail_from_name'];
 251                    $item->link = "https://".SYSTEM_URL."/id/24";
 252                    $item->description = $m['mail_text'];
 253                    $rss->addItem($item);
 254            }
 255         }
 256         // bookmarks
 257         elseif ($_GET['node_id']=='19' && $permissions['r'])
 258         {
 259                 require_once(INCLUDE_DIR.'/feedcreator.class.php');
 260
 261                 $rss = new UniversalFeedCreator();
 262                 $rss->title = "Kyberia bookmarks";
 263                 $rss->link = "http://".SYSTEM_URL."/id/19"; //XXX https ?
 264
 265                 require_once(SMARTY_PLUGIN_DIR.'/function.get_bookmarks.php');
 266                 smarty_function_get_bookmarks(array(), $smarty);
 267                 $_items = $smarty->get_template_vars('get_bookmarks');
 268                 foreach ($_items as $_item)
 269                 {
 270                         if (is_array($_item['children']))
 271                                 foreach ($_item['children'] as $_b)
 272                                 {
 273                                         $item = new FeedItem();
 274                                         $item->title = $_b['node_name'];
 275                                         $item->link = "http://".SYSTEM_URL."/id/".$_b['node_id']."/rss";
 276                                         $rss->addItem($item);
 277                                 }
 278                 }
 279                 $_feedType = 'OPML';
 280         }
 281         elseif ($permissions['r'])
 282         {
 283                 require_once(INCLUDE_DIR.'/feedcreator.class.php');
 284
 285                 $rss = new UniversalFeedCreator();
 286                 $rss->title = $node['node_name'];
 287                 $rss->description = "";
 288                 $rss->link = "http://".SYSTEM_URL."/id/".$node['node_id'];
 289
 290                 // K list
 291                 if ($_GET['node_id']=='15')
 292                 {
 293                         require_once(SMARTY_PLUGIN_DIR.'/function.get_k.php');
 294                         smarty_function_get_k(array(), $smarty);
 295                         $_items = $smarty->get_template_vars('get_k');
 296                 }
 297                 else
 298                 {
 299                         require_once(SMARTY_PLUGIN_DIR.'/function.get_children.php');
 300                         smarty_function_get_children(
 301                                 array('orderby' => 'desc', 'orderby_type' => 'time'), $smarty);
 302                         $_items = $smarty->get_template_vars('get_children');
 303                 }
 304
 305                 foreach ($_items as $_item)
 306                 {
 307                         $item = new FeedItem();
 308                         $item->title = $_item['node_name'];
 309                         $item->link = "http://".SYSTEM_URL."/id/".$_item['node_id'];
 310                         $item->description = $_item['node_content'];
 311                         $rss->addItem($item);
 312                 }
 313         }
 314
 315         if ($permissions['r']) $rss->showFeed($_feedType);
 316         exit();
 317 }
 318
 319
 320 _checkPermissions();
 321
 322 //entering the node
 323
 324 if (($permissions['r']) || ($event != 'register')) {
 325
 326         //performing node_events (based on update/insert/delete db queries)
 327         if ($event) {
 328                 require(INCLUDE_DIR.'eventz.inc');
 329         }
 330
 331         //end of performing node events
 332 }
 333
 334
 335 // output buffering forcing (mx)
 336 if (!empty($_POST['FORCE_OB']) && $_POST['FORCE_OB'] == 'true') ob_end_flush();
 337
 338 ?>