backend.php

   1 <?php
   2         set_include_path(get_include_path() . PATH_SEPARATOR .
   3                 dirname(__FILE__) . "/include");
   4
   5         /* remove ill effects of magic quotes */
   6
   7         if (get_magic_quotes_gpc()) {
   8                 function stripslashes_deep($value) {
   9                         $value = is_array($value) ?
  10                                 array_map('stripslashes_deep', $value) : stripslashes($value);
  11                                 return $value;
  12                 }
  13
  14                 $_POST = array_map('stripslashes_deep', $_POST);
  15                 $_GET = array_map('stripslashes_deep', $_GET);
  16                 $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
  17                 $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
  18         }
  19
  20         $op = $_REQUEST["op"];
  21         @$method = $_REQUEST['subop'] ? $_REQUEST['subop'] : $_REQUEST["method"];
  22
  23         if (!$method)
  24                 $method = 'index';
  25         else
  26                 $method = strtolower($method);
  27
  28         /* Public calls compatibility shim */
  29
  30         $public_calls = array("globalUpdateFeeds", "rss", "getUnread", "getProfiles", "share",
  31                 "fbexport", "logout", "pubsub");
  32
  33         if (array_search($op, $public_calls) !== false) {
  34                 header("Location: public.php?" . $_SERVER['QUERY_STRING']);
  35                 return;
  36         }
  37
  38         $csrf_token = $_REQUEST['csrf_token'];
  39
  40         if (!$csrf_token)
  41                 error_log("[$op/$method] CSRF: [$csrf_token]\n", 3, "/tmp/csrf.log");
  42
  43         require_once "functions.php";
  44         require_once "sessions.php";
  45         require_once "sanity_check.php";
  46         require_once "config.php";
  47         require_once "db.php";
  48         require_once "db-prefs.php";
  49
  50         no_cache_incantation();
  51
  52         startup_gettext();
  53
  54         $script_started = getmicrotime();
  55
  56         $link = db_connect(DB_HOST, DB_USER, DB_PASS, DB_NAME);
  57
  58         if (!init_connection($link)) return;
  59
  60         header("Content-Type: text/plain; charset=utf-8");
  61
  62         if (ENABLE_GZIP_OUTPUT) {
  63                 ob_start("ob_gzhandler");
  64         }
  65
  66         if (SINGLE_USER_MODE) {
  67                 authenticate_user($link, "admin", null);
  68         }
  69
  70         // TODO remove and handle within Handlers
  71
  72         if (!($_SESSION["uid"] && validate_session($link))) {
  73                 if ($op == 'pref-feeds' && $method == 'add') {
  74                         header("Content-Type: text/html");
  75                         login_sequence($link);
  76                         render_login_form($link);
  77                 } else {
  78                         header("Content-Type: text/plain");
  79                         print json_encode(array("error" => array("code" => 6)));
  80                 }
  81                 return;
  82         }
  83
  84         $purge_intervals = array(
  85                 0  => __("Use default"),
  86                 -1 => __("Never purge"),
  87                 5  => __("1 week old"),
  88                 14 => __("2 weeks old"),
  89                 31 => __("1 month old"),
  90                 60 => __("2 months old"),
  91                 90 => __("3 months old"));
  92
  93         $update_intervals = array(
  94                 0   => __("Default interval"),
  95                 -1  => __("Disable updates"),
  96                 15  => __("Each 15 minutes"),
  97                 30  => __("Each 30 minutes"),
  98                 60  => __("Hourly"),
  99                 240 => __("Each 4 hours"),
 100                 720 => __("Each 12 hours"),
 101                 1440 => __("Daily"),
 102                 10080 => __("Weekly"));
 103
 104         $update_intervals_nodefault = array(
 105                 -1  => __("Disable updates"),
 106                 15  => __("Each 15 minutes"),
 107                 30  => __("Each 30 minutes"),
 108                 60  => __("Hourly"),
 109                 240 => __("Each 4 hours"),
 110                 720 => __("Each 12 hours"),
 111                 1440 => __("Daily"),
 112                 10080 => __("Weekly"));
 113
 114         $update_methods = array(
 115                 0   => __("Default"),
 116                 1   => __("Magpie"),
 117                 2   => __("SimplePie"),
 118                 3   => __("Twitter OAuth"));
 119
 120         if (DEFAULT_UPDATE_METHOD == "1") {
 121                 $update_methods[0] .= ' (SimplePie)';
 122         } else {
 123                 $update_methods[0] .= ' (Magpie)';
 124         }
 125
 126         $access_level_names = array(
 127                 0 => __("User"),
 128                 5 => __("Power User"),
 129                 10 => __("Administrator"));
 130
 131         $error = sanity_check($link);
 132
 133         if ($error['code'] != 0 && $op != "logout") {
 134                 print json_encode(array("error" => $error));
 135                 return;
 136         }
 137
 138         function __autoload($class) {
 139                 $file = "classes/".strtolower(basename($class)).".php";
 140                 if (file_exists($file)) {
 141                         require $file;
 142                 }
 143         }
 144
 145         $op = str_replace("-", "_", $op);
 146
 147         if (class_exists($op)) {
 148                 $handler = new $op($link, $_REQUEST);
 149
 150                 if ($handler) {
 151                         if (validate_csrf($csrf_token) || $handler->csrf_ignore($method)) {
 152                                 if ($handler->before($method)) {
 153                                         if ($method && method_exists($handler, $method)) {
 154                                                 $handler->$method();
 155                                         }
 156                                         $handler->after();
 157                                         return;
 158                                 }
 159                         } else {
 160                                 header("Content-Type: text/plain");
 161                                 print json_encode(array("error" => array("code" => 6)));
 162                                 return;
 163                         }
 164                 }
 165         }
 166
 167         header("Content-Type: text/plain");
 168         print json_encode(array("error" => array("code" => 7)));
 169
 170         // We close the connection to database.
 171         db_close($link);
 172 ?>