backend.php

   1 <?php
   2         set_include_path(dirname(__FILE__) ."/include" . PATH_SEPARATOR .
   3                 get_include_path());
   4
   5         /* remove ill effects of magic quotes */
   6
   7         if (get_magic_quotes_gpc()) {
   8                 function stripslashes_deep($value) {
   9                         $value = is_array($value) ?
  10                                 array_map('stripslashes_deep', $value) : stripslashes($value);
  11                                 return $value;
  12                 }
  13
  14                 $_POST = array_map('stripslashes_deep', $_POST);
  15                 $_GET = array_map('stripslashes_deep', $_GET);
  16                 $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
  17                 $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
  18         }
  19
  20         $op = $_REQUEST["op"];
  21         @$method = $_REQUEST['subop'] ? $_REQUEST['subop'] : $_REQUEST["method"];
  22
  23         if (!$method)
  24                 $method = 'index';
  25         else
  26                 $method = strtolower($method);
  27
  28         /* Public calls compatibility shim */
  29
  30         $public_calls = array("globalUpdateFeeds", "rss", "getUnread", "getProfiles", "share",
  31                 "fbexport", "logout", "pubsub");
  32
  33         if (array_search($op, $public_calls) !== false) {
  34                 header("Location: public.php?" . $_SERVER['QUERY_STRING']);
  35                 return;
  36         }
  37
  38         @$csrf_token = $_REQUEST['csrf_token'];
  39
  40         require_once "autoload.php";
  41         require_once "sessions.php";
  42         require_once "functions.php";
  43         require_once "config.php";
  44         require_once "db.php";
  45         require_once "db-prefs.php";
  46
  47         startup_gettext();
  48
  49         $script_started = microtime(true);
  50
  51         if (!init_plugins()) return;
  52
  53         header("Content-Type: text/json; charset=utf-8");
  54
  55         if (ENABLE_GZIP_OUTPUT && function_exists("ob_gzhandler")) {
  56                 ob_start("ob_gzhandler");
  57         }
  58
  59         if (SINGLE_USER_MODE) {
  60                 authenticate_user( "admin", null);
  61         }
  62
  63         if ($_SESSION["uid"]) {
  64                 if (!validate_session()) {
  65                         header("Content-Type: text/json");
  66                         print json_encode(array("error" => array("code" => 6)));
  67                         return;
  68                 }
  69                 load_user_plugins( $_SESSION["uid"]);
  70         }
  71
  72         $purge_intervals = array(
  73                 0  => __("Use default"),
  74                 -1 => __("Never purge"),
  75                 5  => __("1 week old"),
  76                 14 => __("2 weeks old"),
  77                 31 => __("1 month old"),
  78                 60 => __("2 months old"),
  79                 90 => __("3 months old"));
  80
  81         $update_intervals = array(
  82                 0   => __("Default interval"),
  83                 -1  => __("Disable updates"),
  84                 15  => __("Each 15 minutes"),
  85                 30  => __("Each 30 minutes"),
  86                 60  => __("Hourly"),
  87                 240 => __("Each 4 hours"),
  88                 720 => __("Each 12 hours"),
  89                 1440 => __("Daily"),
  90                 10080 => __("Weekly"));
  91
  92         $update_intervals_nodefault = array(
  93                 -1  => __("Disable updates"),
  94                 15  => __("Each 15 minutes"),
  95                 30  => __("Each 30 minutes"),
  96                 60  => __("Hourly"),
  97                 240 => __("Each 4 hours"),
  98                 720 => __("Each 12 hours"),
  99                 1440 => __("Daily"),
 100                 10080 => __("Weekly"));
 101
 102         $access_level_names = array(
 103                 0 => __("User"),
 104                 5 => __("Power User"),
 105                 10 => __("Administrator"));
 106
 107         #$error = sanity_check();
 108
 109         #if ($error['code'] != 0 && $op != "logout") {
 110         #       print json_encode(array("error" => $error));
 111         #       return;
 112         #}
 113
 114         $op = str_replace("-", "_", $op);
 115
 116         $override = PluginHost::getInstance()->lookup_handler($op, $method);
 117
 118         if (class_exists($op) || $override) {
 119
 120                 if ($override) {
 121                         $handler = $override;
 122                 } else {
 123                         $handler = new $op($_REQUEST);
 124                 }
 125
 126                 if ($handler && implements_interface($handler, 'IHandler')) {
 127                         if (validate_csrf($csrf_token) || $handler->csrf_ignore($method)) {
 128                                 if ($handler->before($method)) {
 129                                         if ($method && method_exists($handler, $method)) {
 130                                                 $handler->$method();
 131                                         } else {
 132                                                 if (method_exists($handler, "catchall")) {
 133                                                         $handler->catchall($method);
 134                                                 }
 135                                         }
 136                                         $handler->after();
 137                                         return;
 138                                 } else {
 139                                         header("Content-Type: text/json");
 140                                         print json_encode(array("error" => array("code" => 6)));
 141                                         return;
 142                                 }
 143                         } else {
 144                                 header("Content-Type: text/json");
 145                                 print json_encode(array("error" => array("code" => 6)));
 146                                 return;
 147                         }
 148                 }
 149         }
 150
 151         header("Content-Type: text/json");
 152         print json_encode(array("error" => array("code" => 7)));
 153
 154 ?>