| <?PHP |
| |
| class |
| { |
| |
| protected $magicquotes = 0; |
| |
| public $debug; |
| public $page_error_code = null; |
| public $ignore_clean_variables = array(); |
| |
| # define all allowed keys here. |
| # if the request-method is "get", |
| # the class will delete all unregistered keys from query-string and generate |
| # a header-location-change |
| |
| # the keys are grouped by render-type |
| public $clean_variables = array("int" => array("debug", "page", "lightroom", "pid", "id", "f", "b", "s", "w", "h", "c", "q"), |
| "float" => array("val"), |
| "intarr" => array("group"), |
| "floatarr" => array("fgroup"), |
| "url" => array("browse", "path", "self"), |
| "path" => array("image", "file"), |
| "null" => array("refresh", "read", "md5"), |
| "text" => array("message"), |
| "bool" => array("t"), |
| "hex" => array("i"), |
| ); |
| public $request_method = ""; |
| public $request_url = ""; |
| public $self = ""; |
| public $selfname = ""; |
| public $input = array(); |
| public $token = 0; |
| |
| |
| |
| |
| public function |
| __CONSTRUCT |
| () |
| { |
| |
| if(version_compare(PHP_VERSION, "5", "<")) die("Required PHP-Version is 5."); |
| $this->self = (basename($_SERVER['PHP_SELF']) == "/" || basename($_SERVER['PHP_SELF']) == "") ? "index.php" : $this->self = basename($_SERVER['PHP_SELF']); |
| $protected = array("_COOKIE", "_ENV", "_FILES", "_GET", "GLOBALS", "_POST", "_SERVER"); |
| foreach($protected as $var) if((isset($_REQUEST) && isset($_REQUEST[$var])) || (isset($_COOKIE) && isset($_COOKIE[$var]))) die(":)"); |
| if(get_magic_quotes_gpc()): |
| $this->magicquotes = 1; |
| $this->sa($_POST); |
| $this->sa($_GET); |
| $this->sa($_COOKIE); |
| endif; |
| set_magic_quotes_runtime(0); |
| @ini_set("magic_quotes_gpc", 0); |
| @ini_set("magic_quotes_runtime", 0); |
| @ini_set("register_globals", "Off"); |
| $this->parse_in($_GET); |
| $this->parse_in($_POST); |
| if($_SERVER['REQUEST_METHOD'] == "POST") $this->request_method = "POST"; |
| if($_SERVER['REQUEST_METHOD'] == "GET") $this->request_method = "GET"; |
| if (@ini_get("register_globals") == 1): |
| $this->gl($_POST); |
| $this->gl($_GET); |
| $this->gl($_FILES); |
| $this->gl($_COOKIE); |
| endif; |
| $this->clean_in(); |
| $this->req(); |
| if(@ini_get("safe_mode") == 1) $this->safemode = true; |
| } |
| |
| |
| |
| |
| private function |
| parse_in |
| ($a) |
| { |
| |
| if(!is_array($a)) return; |
| foreach($a as $k => $v) $this->input[$k] = $v; |
| |
| } |
| |
| |
| |
| |
| private function |
| sa |
| (&$a) |
| { |
| |
| foreach($a as $k => $v): |
| if(is_array($a[$k])): |
| $this->sa($a[$k]); |
| else: |
| $a[$k] = stripslashes($a[$k]); |
| endif; |
| endforeach; |
| |
| } |
| |
| |
| |
| |
| private function |
| gl |
| ($a) |
| { |
| |
| if(!is_array($a)) return; |
| foreach(array_keys($a) as $k): |
| unset($_GLOBALS[$k]); |
| global $$k; |
| unset($$k); |
| endforeach; |
| } |
| |
| |
| |
| # render the incoming values from query-string |
| private function |
| clean_in |
| () |
| { |
| |
| $r = array(); |
| foreach($this->clean_variables as $t => $k): |
| foreach($k as $v): |
| if(in_array($v, $this->ignore_clean_variables)) continue; |
| switch($t): |
| |
| case "url": |
| if(isset($this->input[$v])): |
| $this->input[$v] = str_replace(array(chr(0x5C),chr(0x2F).chr(0x2E).chr(0x2E).chr(0x2F), |
| chr(0x2E).chr(0x2E).chr(0x2F),chr(0x2F).chr(0x2E). |
| chr(0x2E),chr(0x2F).chr(0x2E),chr(0x2E).chr(0x2F), |
| chr(0x2A)), chr(0x2F), $this->input[$v]); |
| $this->input[$v] = ereg_replace(chr(0x28).chr(0x2F).chr(0x2B).chr(0x29), chr(0x2F), $this->input[$v]); |
| $this->input[$v] = (substr($this->input[$v], 0, 1) != chr(0x2F)) ? chr(0x2F).$this->input[$v] : $this->input[$v]; |
| $this->input[$v] = (substr($this->input[$v], -1, 1) == chr(0x2F)) ? substr($this->input[$v],0,strlen($this->input[$v])-1) : $this->input[$v]; |
| $this->input[$v] = implode(chr(0x2F), array_map("rawurlencode", (explode(chr(0x2F), $this->input[$v])))); |
| endif; |
| break; |
| |
| case "int": |
| if(isset($this->input[$v])) $this->input[$v] = intval($this->input[$v]); |
| break; |
| |
| case "float": |
| if(isset($this->input[$v])) $this->input[$v] = floatval($this->input[$v]); |
| break; |
| |
| case "intarr": |
| if(isset($this->input[$v])): |
| $this->input[$v] = @array_unique(@array_map("abs", @array_map("intval", @explode("|", $this->input[$v])))); |
| @sort($this->input[$v]); |
| $this->input[$v] = @implode("|", $this->input[$v]); |
| endif; |
| break; |
| |
| case "floatarr": |
| if(isset($this->input[$v])): |
| $this->input[$v] = @array_unique(@array_map("abs", @array_map("floatval", @explode("|", $this->input[$v])))); |
| @sort($this->input[$v]); |
| $this->input[$v] = @implode("|", $this->input[$v]); |
| endif; |
| break; |
| |
| case "path": |
| break; |
| |
| case "null": |
| if(isset($this->input[$v])) $this->input[$v] = null; |
| break; |
| |
| case "bool": |
| if(isset($this->input[$v])) $this->input[$v] = (intval($this->input[$v]) != 1 && intval($this->input[$v]) != 0) ? 0 : intval($this->input[$v]); |
| break; |
| |
| case "hex": |
| if(isset($this->input[$v])) $this->input[$v] = $this->input[$v]; |
| break; |
| |
| default: |
| break; |
| |
| endswitch; |
| endforeach; |
| endforeach; |
| |
| } |
| |
| |
| |
| # check-up |
| # all unregistered keys |
| private function |
| req |
| () |
| { |
| |
| if($this->request_method == "GET" && count($this->input) > 0): |
| $r = array(); |
| $q = null; |
| foreach($this->input as $k => $v): |
| if(in_array($k, $this->clean_variables['null'])) $this->add_action($k, true); |
| foreach($this->clean_variables as $t): |
| |
| # will be removed: |
| if(in_array($k, $t) && !empty($v)) $r[] = $k.chr(0x3D).$v; |
| endforeach; |
| @sort($r); |
| endforeach; |
| |
| # create a new query-string: |
| $q = implode("&", $r); |
| foreach($r as $k => $v) $q .= ""; |
| $this->url = empty($q) ? null : chr(0x3F).$q; |
| $i = ($this->self == "index.php") ? null : $this->self; |
| |
| # check, if the incoming query-string is similar to the allowed string; |
| if($i.$this->url != $i.chr(0x3F).$_SERVER['QUERY_STRING']): |
| # if not, the core will forward the user to a allowed url: |
| header("location: ".$i.$this->url); |
| endif; |
| endif; |
| |
| } |
| |
| |
| |
| |
| public function |
| add_action |
| ($a, $v = null) |
| { |
| |
| $_SESSION['EXEC']['actions'][$a] = $v; |
| |
| } |
| |
| |
| |
| |
| public function |
| remove_action |
| ($a) |
| { |
| |
| if(isset($_SESSION['EXEC']) && isset($_SESSION['EXEC']['actions']) && isset($_SESSION['EXEC']['actions'][$a])) unset($_SESSION['EXEC']['actions'][$a]); |
| |
| } |
| |
| |
| |
| |
| public function |
| remove_all_actions |
| () |
| { |
| |
| if(isset($_SESSION['EXEC']) && isset($_SESSION['EXEC']['actions'])) if(is_array($_SESSION['EXEC']['actions'])) unset($_SESSION['EXEC']['actions']); |
| |
| } |
| |
| |
| |
| |
| public function |
| get_action |
| ($a) |
| { |
| |
| if(isset($_SESSION['EXEC']) && isset($_SESSION['EXEC']['actions']) && isset($_SESSION['EXEC']['actions'][$a])) return $_SESSION['EXEC']['actions'][$a]; |
| |
| } |
| |
| |
| |
| |
| public function |
| is_action |
| ($a) |
| { |
| |
| if(isset($_SESSION['EXEC']) && isset($_SESSION['EXEC']['actions']) && isset($_SESSION['EXEC']['actions'][$a])) return true; |
| |
| } |
| |
| |
| |
| |
| public function |
| run_action |
| ($a, $u = true) |
| { |
| |
| if(isset($_SESSION['EXEC']) && isset($_SESSION['EXEC']['actions']) && isset($_SESSION['EXEC']['actions'][$a]) && $_SESSION['EXEC']['actions'][$a] === true): |
| if($u) unset($_SESSION['EXEC']['actions'][$a]); |
| return true; |
| else: |
| return false; |
| endif; |
| |
| } |
| |
| |
| |
| public function |
| get_request_method |
| () |
| { |
| |
| return $this->request_method; |
| |
| } |
| |
| |
| |
| |
| public function |
| request_method_is |
| ($m = null) |
| { |
| |
| $m = ($this->request_method == $m) ? true : false; |
| return $m; |
| |
| } |
| |
| |
| |
| |
| public function |
| replace_url |
| ($a, $url = null) |
| { |
| |
| $url = (!$url) ? $this->url : $url; |
| if(is_array($a)): |
| foreach($a as $k => $v): |
| if(array_key_exists($k, $this->input)): |
| if(empty($v)): |
| $url = str_replace("&".$k.chr(0x3D).$this->input[$k], null, $url); |
| $url = str_replace("&".$k.chr(0x3D).$this->input[$k], null, $url); |
| $url = str_replace(chr(0x3F).$k.chr(0x3D).$this->input[$k], null, $url); |
| $url = str_replace($k.chr(0x3D).$this->input[$k], null, $url); |
| else: |
| $url = str_replace($k.chr(0x3D).$this->input[$k], $k.chr(0x3D).$v, $url); |
| endif; |
| else: |
| $url = (count($this->input) == 0) ? "?".$k.chr(0x3D).$v : $this->url."&".$k.chr(0x3D).$v; |
| endif; |
| endforeach; |
| endif; |
| return $url; |
| |
| } |
| |
| |
| |
| |
| } |
| |
| ?> |