only enable ob_gzhandler if it exists

[tt-rss.git] / backend.php

diff --git a/backend.php b/backend.php
index 8f197ee3074249b49ed5abb96581d6cd7474d57e..efc3793d303213ff0c0ef349392f988b52383653 100644 (file)
--- a/backend.php
+++ b/backend.php
@@ -1,5 +1,6 @@
 <?php
-       set_include_path(get_include_path() . PATH_SEPARATOR . "include");
+       set_include_path(get_include_path() . PATH_SEPARATOR .
+               dirname(__FILE__) . "/include");
 
        /* remove ill effects of magic quotes */
 
@@ -16,17 +17,28 @@
                $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
        }
 
-       function __autoload($class) {
-               $file = "classes/".strtolower(basename($class)).".php";
-               if (file_exists($file)) {
-                       require $file;
-               }
+       $op = $_REQUEST["op"];
+       @$method = $_REQUEST['subop'] ? $_REQUEST['subop'] : $_REQUEST["method"];
+
+       if (!$method)
+               $method = 'index';
+       else
+               $method = strtolower($method);
+
+       /* Public calls compatibility shim */
+
+       $public_calls = array("globalUpdateFeeds", "rss", "getUnread", "getProfiles", "share",
+               "fbexport", "logout", "pubsub");
+
+       if (array_search($op, $public_calls) !== false) {
+               header("Location: public.php?" . $_SERVER['QUERY_STRING']);
+               return;
        }
 
-       $op = $_REQUEST["op"];
+       @$csrf_token = $_REQUEST['csrf_token'];
 
        require_once "functions.php";
-       if ($op != "share") require_once "sessions.php";
+       require_once "sessions.php";
        require_once "sanity_check.php";
        require_once "config.php";
        require_once "db.php";
@@ -40,21 +52,11 @@
 
        $link = db_connect(DB_HOST, DB_USER, DB_PASS, DB_NAME);
 
-       if (!$link) {
-               if (DB_TYPE == "mysql") {
-                       print mysql_error();
-               }
-               // PG seems to display its own errors just fine by default.
-               return;
-       }
-
-       init_connection($link);
-
-       $method = $_REQUEST['subop'] ? $_REQUEST['subop'] : $_REQUEST["method"];
+       if (!init_connection($link)) return;
 
        header("Content-Type: text/plain; charset=utf-8");
 
-       if (ENABLE_GZIP_OUTPUT) {
+       if (ENABLE_GZIP_OUTPUT && function_exists("ob_gzhandler")) {
                ob_start("ob_gzhandler");
        }
 
@@ -62,15 +64,9 @@
                authenticate_user($link, "admin", null);
        }
 
-       $public_calls = array("globalUpdateFeeds", "rss", "getUnread", "getProfiles", "share",
-               "fbexport", "logout", "pubsub");
-
-       if (array_search($op, $public_calls) !== false) {
-
-               handle_public_request($link, $op);
-               return;
+       // TODO remove and handle within Handlers
 
-       } else if (!($_SESSION["uid"] && validate_session($link))) {
+       if (!($_SESSION["uid"] && validate_session($link))) {
                if ($op == 'pref-feeds' && $method == 'add') {
                        header("Content-Type: text/html");
                        login_sequence($link);
@@ -136,51 +132,37 @@
                return;
        }
 
+       function __autoload($class) {
+               $file = "classes/".strtolower(basename($class)).".php";
+               if (file_exists($file)) {
+                       require $file;
+               }
+       }
+
        $op = str_replace("-", "_", $op);
 
        if (class_exists($op)) {
                $handler = new $op($link, $_REQUEST);
 
                if ($handler) {
-                       if ($handler->before()) {
-                               if ($method && method_exists($handler, $method)) {
-                                       $handler->$method();
-                               } else if (method_exists($handler, 'index')) {
-                                       $handler->index();
+                       if (validate_csrf($csrf_token) || $handler->csrf_ignore($method)) {
+                               if ($handler->before($method)) {
+                                       if ($method && method_exists($handler, $method)) {
+                                               $handler->$method();
+                                       }
+                                       $handler->after();
+                                       return;
                                }
-                               $handler->after();
+                       } else {
+                               header("Content-Type: text/plain");
+                               print json_encode(array("error" => array("code" => 6)));
                                return;
                        }
                }
        }
 
-       switch($op) { // Select action according to $op value.
-
-               case "pref-filters":
-                       require_once "modules/pref-filters.php";
-                       module_pref_filters($link);
-               break; // pref-filters
-
-               case "pref-labels":
-                       require_once "modules/pref-labels.php";
-                       module_pref_labels($link);
-               break; // pref-labels
-
-               case "pref-users":
-                       require_once "modules/pref-users.php";
-                       module_pref_users($link);
-               break; // prefs-users
-
-               case "pref-instances":
-                       require_once "modules/pref-instances.php";
-                       module_pref_instances($link);
-               break; // pref-instances
-
-               default:
-                       header("Content-Type: text/plain");
-                       print json_encode(array("error" => array("code" => 7)));
-               break; // fallback
-       } // Select action according to $op value.
+       header("Content-Type: text/plain");
+       print json_encode(array("error" => array("code" => 7)));
 
        // We close the connection to database.
        db_close($link);