Revision [21663]

This is an old revision of KlenwellAdminOnlyInstaller made by KlenWell on 2012-01-17 21:42:00.

 

Admin-Only Installer

Proposal for changes to wikka script to restrict installer to run only for an admin user.

Problem

When installing new code in a production environment, the installer script will run for any visitor to the site. It would be preferable if the script was restricted to running only for logged-in admin users.

Solution

Code below outlines a solution. I try here to be as uninvasive as possible. The code could be made more secure. It has been successfully tested but not very thoroughly.

Patch

The code is patched against 1.3.2-p7 release version of wikka.php
diff -r 4d82ee3ea32c www/is/wikka.php
--- a/www/is/wikka.php	Mon Jan 16 23:54:27 2012 -0800
+++ b/www/is/wikka.php	Tue Jan 17 19:22:08 2012 -0800
@@ -509,26 +509,55 @@
 
 /**
  * Compare versions, start installer if necessary.
+ * Fresh installs run immediately. Wait until Wikka class is loaded to run
+ * upgrades so we can limit access to admin users. (See below.)
  */
-if (!isset($wakkaConfig['wakka_version'])) $wakkaConfig['wakka_version'] = 0;
-if ($wakkaConfig['wakka_version'] !== WAKKA_VERSION)
-{
-	/**
-	 * Start installer.
-	 *
-	 * Data entered by the user is submitted in $_POST, next action for the
-	 * installer (which will receive this data) is passed as a $_GET parameter!
-	 */
-	$installAction = 'default';
-	if (isset($_GET['installAction'])) $installAction = trim($_GET['installAction']);	#312
-	if (file_exists('setup'.DIRECTORY_SEPARATOR.'header.php'))
-	include('setup'.DIRECTORY_SEPARATOR.'header.php'); else print '<em class="error">'.ERROR_SETUP_HEADER_MISSING.'</em>'; #89
-	if
-	(file_exists('setup'.DIRECTORY_SEPARATOR.$installAction.'.php'))
-	include('setup'.DIRECTORY_SEPARATOR.$installAction.'.php'); else print '<em class="error">'.ERROR_SETUP_FILE_MISSING.'</em>'; #89
-	if (file_exists('setup'.DIRECTORY_SEPARATOR.'footer.php'))
-	include('setup'.DIRECTORY_SEPARATOR.'footer.php'); else print '<em class="error">'.ERROR_SETUP_FOOTER_MISSING.'</em>'; #89
-	exit;
+$is_new_install = ! isset($wakkaConfig['wakka_version']);
+$is_upgrade = $wakkaConfig['wakka_version'] !== WAKKA_VERSION;
+
+function start_installer() {
+    /**
+    * Start installer.
+    *
+    * Data entered by the user is submitted in $_POST, next action for the
+    * installer (which will receive this data) is passed as a $_GET parameter!
+    */
+    global $wakkaConfig, $wakkaConfigLocation, $fallback_lang_path;
+
+    $installAction = 'default';
+
+    if (isset($_GET['installAction'])) {
+        $installAction = trim($_GET['installAction']);	#312
+    }
+
+    if (file_exists('setup'.DIRECTORY_SEPARATOR.'header.php')) {
+        include('setup'.DIRECTORY_SEPARATOR.'header.php');
+    }
+    else {
+        print '<em class="error">'.ERROR_SETUP_HEADER_MISSING.'</em>'; #89
+    }
+
+    if (file_exists('setup'.DIRECTORY_SEPARATOR.$installAction.'.php')) {
+        include('setup'.DIRECTORY_SEPARATOR.$installAction.'.php');
+    }
+    else {
+        print '<em class="error">'.ERROR_SETUP_FILE_MISSING.'</em>'; #89
+    }
+
+    if (file_exists('setup'.DIRECTORY_SEPARATOR.'footer.php')) {
+        include('setup'.DIRECTORY_SEPARATOR.'footer.php');
+    }
+    else {
+        print '<em class="error">'.ERROR_SETUP_FOOTER_MISSING.'</em>'; #89
+    }
+
+    exit;
+}
+
+
+if ( $is_new_install ) {
+    $wakkaConfig['wakka_version'] = 0;
+    start_installer();
 }
 
 /**
@@ -590,6 +619,7 @@
 	exit;
 }
 
+
 /**
  * Save session ID
  */
@@ -609,6 +639,39 @@
 		$wakka->Query("INSERT INTO ".$wakka->config['table_prefix']."sessions (sessionid, userid, session_start) VALUES('".session_id()."', '".$user['name']."', FROM_UNIXTIME(".$wakka->GetMicroTime()."))");
 	}
 }
+
+/**
+ * Check for upgrade. If so an user is admin, show setup page, else show
+ * a maintenance message to all other visitors.
+ *
+ * Add ?help=1 to the url if installer gets stuck and it will print some debug
+ * info.
+ */
+$is_admin = $wakka->IsAdmin($user);
+$install_action = isset($_GET['installAction']) ? $_GET['installAction'] : '';
+$help_requested = isset($_GET['help']) ? 1 : 0;
+$at_install_step = ( $install_action == 'writeconfig') && (isset($_POST['config']));
+$upgrade_allowed = $is_admin || $at_install_step;
+
+if ( $is_upgrade && $upgrade_allowed ) {
+	start_installer();
+}
+elseif ( $is_upgrade && $help_requested ) {
+    $debug_info = array(
+        '_POST' => $_POST,
+        '_GET' => $_GET,
+        '_SESSION' => $_SESSION
+    );
+    print "<h2>Installer Help</h2>";
+    printf('<pre>%s</pre>', print_r($debug_info,1));
+}
+elseif ( $is_upgrade ) {
+    header('HTTP/1.1 503 Service Temporarily Unavailable');
+    header('Status: 503 Service Temporarily Unavailable');
+    header('Retry-After: 300');
+    die('<h2>Site Undergoing Temporary Maintenance</h2><h4>Please check back shortly.</h4>');
+}
+
 
 /**
  * Run the engine.


Full Updated wikka.php File

<?php
/**
 * The Wikka mainscript.
 *
 * This file is called each time a request is made from the browser.
 * Most of the core methods used by the engine are located in the Wakka class.
 * @see Wakka
 * This file was originally written by Hendrik Mans for WakkaWiki
 * and released under the terms of the modified BSD license
 * @see /docs/WakkaWiki.LICENSE
 *
 * @package Wikka
 * @subpackage Core
 * @version $Id$
 * @license http://www.gnu.org/copyleft/gpl.html GNU General Public License
 * @see /docs/Wikka.LICENSE
 * @filesource
 *
 * @author  {@link http://www.mornography.de/ Hendrik Mans}
 * @author  {@link http://wikkawiki.org/JsnX Jason Tourtelotte}
 * @author  {@link http://wikkawiki.org/JavaWoman Marjolein Katsma}
 * @author  {@link http://wikkawiki.org/NilsLindenberg Nils Lindenberg}
 * @author  {@link http://wikkawiki.org/DotMG Mahefa Randimbisoa}
 * @author  {@link http://wikkawiki.org/DarTar Dario Taraborelli}
 * @author  {@link http://wikkawiki.org/BrianKoontz Brian Koontz}
 * @author  {@link http://wikkawiki.org/TormodHaugen Tormod Haugen}
 *
 * @copyright Copyright 2002-2003, Hendrik Mans <hendrik@mans.de>
 * @copyright Copyright 2004-2005, Jason Tourtelotte <wikka-admin@jsnx.com>
 * @copyright Copyright 2006-2010, {@link http://wikkawiki.org/CreditsPage Wikka Development Team}
 *
 * @todo use templating class for page generation;
 * @todo add phpdoc documentation for configuration array elements;
 */


// ---------------------- DEBUGGING AND ERROR REPORTING -----------------------
if(version_compare(phpversion(),'5.3','<'))
    error_reporting(E_ALL);
else
    error_reporting(E_ALL & !E_DEPRECATED);
// ---------------------- END DEBUGGING AND ERROR REPORTING -------------------

// ---------------------------- VERSIONING ------------------------------------
/**#@+
 * Defines current Wikka version.
 */

include_once('version.php');

// ----------------------------- BASIC CONSTANTS -------------------------------
/**#@+
 * Simple constant. May be made a configurable value.
 */

/**
 * Defines the default cookie name.
 */

if (!defined('BASIC_COOKIE_NAME')) define('BASIC_COOKIE_NAME', 'Wikkawiki');
/**
 * Length to use for generated part of id attribute.
 */

define('ID_LENGTH',10);         // @@@ maybe make length configurable
/**
 * Character used for multi-path lists
 */

if(!defined('PATH_DIVIDER')) define('PATH_DIVIDER', ',');
/**#@-*/
/**#@+
 * Minimum version requirement.
 */

if (!defined('MINIMUM_PHP_VERSION'))    define('MINIMUM_PHP_VERSION', '5.0');
if (!defined('MINIMUM_MYSQL_VERSION'))  define('MINIMUM_MYSQL_VERSION', '4.1');
/**#@-*/
// ----------------------------- END BASIC CONSTANTS ---------------------------

// ------------ CRITICAL ERROR MESSAGES USED BEFORE LANG FILE LOADED -----------
// Do not move these declaration to lang files.
if(!defined('ERROR_WRONG_PHP_VERSION')) define('ERROR_WRONG_PHP_VERSION', 'Wikka requires PHP %s or higher!');  // %s - version number
if(!defined('ERROR_MYSQL_SUPPORT_MISSING')) define('ERROR_MYSQL_SUPPORT_MISSING', 'PHP can\'t find MySQL support but Wikka requires MySQL. Please check the output of <tt>phpinfo()</tt> in a php document for MySQL support: it needs to be compiled into PHP, the module itself needs to be present in the expected location, <strong>and</strong> php.ini needs to have it enabled.<br />Also note that you cannot have <tt>mysqli</tt> and <tt>mysql</tt> support both enabled at the same time.<br />Please double-check all of these things, restart your webserver after any fixes, and then try again!');
if(!defined('ERROR_WAKKA_LIBRARY_MISSING')) define('ERROR_WAKKA_LIBRARY_MISSING','The necessary file "libs/Wakka.class.php" could not be found. To run Wikka, please make sure the file exists and is placed in the right directory!');
// --------END: CRITICAL ERROR MESSAGES USED BEFORE LANG FILE LOADED -----------

// ----------------------------- SANITY CHECKS ---------------------------------

// More intelligent version check, more intelligently placed ;)
if (!function_exists('version_compare') ||
    version_compare(phpversion(),MINIMUM_PHP_VERSION,'<')   // < PHP minimum version??
   )
{
    $php_version_error = sprintf(ERROR_WRONG_PHP_VERSION,MINIMUM_PHP_VERSION);
    die($php_version_error);        # fatalerror    !!! default error in English
}
// MySQL needs to be installed and available
// @@@ message could be refined by detecting detect OS (mention module name) and maybe server name
if (!function_exists('mysql_connect'))
{
    die(ERROR_MYSQL_SUPPORT_MISSING);
}

/**
 * Include main library if it exists.
 * @see libs/Wakka.class.php
 */

if (file_exists('libs/Wakka.class.php'))
{
    require_once('libs/Compatibility.lib.php');
    require_once('libs/Wakka.class.php');
}
else
{
    die(ERROR_WAKKA_LIBRARY_MISSING);
}

// ----------------------------- END SANITY CHECKS ----------------------------

ob_start();
global $tstart;
$tstart = getmicrotime();
ini_set('magic_quotes_runtime', 0);
if (get_magic_quotes_gpc())
{
    magicQuotesWorkaround($_POST);
    magicQuotesWorkaround($_GET);
    magicQuotesWorkaround($_COOKIE);
}

/**
 * Default configuration.
 */

// attempt to derive base URL fragments and whether rewrite mode is enabled (#438)
$t_domain   = $_SERVER['SERVER_NAME'];
$t_scheme = ((isset($_SERVER['HTTPS'])) && !empty($_SERVER['HTTPS']) && 'off' != $_SERVER['HTTPS']) ? 'https://' : 'http://';
$t_port = ':'.$_SERVER['SERVER_PORT'];
if ((('http://' == $t_scheme) && (':80' == $t_port)) || (('https://' == $t_scheme) && (':443' == $t_port)))
{
    $t_port = '';
}
$t_request  = $_SERVER['REQUEST_URI'];
// append slash if $t_request does not end with either a slash or the string .php
if (!preg_match('@(\\.php|/)$@i', $t_request))
{
//  $t_request .= '/';
}

if (preg_match('@\.php$@', $t_request) && !preg_match('@wikka\.php$@', $t_request))
{
    // handle "overridden" redirect from index.php
    $t_request = preg_replace('@/[^.]+\.php@', '/wikka.php', $t_request);   // handle "overridden" redirect from index.php
}

if ( !preg_match('@wakka=@',$_SERVER['REQUEST_URI']) && isset($_SERVER['QUERY_STRING']) && preg_match('@wakka=@',$_SERVER['QUERY_STRING']))
{
    // looks like we got a rewritten request via .htaccess
    // remove 'wikka.php' and request (page name) from 'request' part: should not be part of base_url!
    $query_part = preg_replace('@wakka=@', '', $_SERVER['QUERY_STRING']);
    $t_request  = preg_replace('@'.preg_quote('wikka.php').'@', '', $t_request);
    $t_request  = preg_replace('@'.preg_quote($query_part).'@', '', $t_request);
    $t_query = '';
    $t_rewrite_mode = 1;
}
else
{
    // no rewritten request apparent
    $t_query = '?wakka=';
    $t_rewrite_mode = 0;
}

// ---------------------- DEFINE URL DOMAIN / PATH -----------------------------
/**#@+*
 * URL or URL component, derived just once for later usage.
 */

// first derive domain, path and base_url, as well as cookie path just once
// so they are ready for later use.
// detect actual scheme (might be https!)   @@@ TEST
// please recopy modif into setup/test/test-mod-rewrite.php
$scheme = ((isset($_SERVER['HTTPS'])) && !empty($_SERVER['HTTPS']) && 'off' != $_SERVER['HTTPS']) ? 'https://' : 'http://';
$server_port = ':'.$_SERVER['SERVER_PORT'];
if ((('http://' == $scheme) && (':80' == $server_port)) || (('https://' == $scheme) && (':443' == $server_port)))
{
    $server_port = '';
}
/**
 * URL fragment consisting of scheme + domain part.
 * Represents the domain URL where the current instance of Wikka is located.
 * This variable can be overriden in {@link override.config.php}
 *
 * @var string
 */

if (!defined('WIKKA_BASE_DOMAIN_URL')) define('WIKKA_BASE_DOMAIN_URL', $scheme.$_SERVER['SERVER_NAME'].$server_port);
/**
 * URL fragment consisting of a path component.
 * Points to the instance of Wikka within {@link WIKKA_BASE_DOMAIN_URL}.
 *
 * @var string
 */

define('WIKKA_BASE_URL_PATH', preg_replace('/wikka\\.php/', '', $_SERVER['SCRIPT_NAME']));
/**
 * Base URL consisting of {@link WIKKA_BASE_DOMAIN_URL} and {@link WIKKA_BASE_URL_PATH} concatenated.
 * Ready to append a relative path to a "static" file to.
 *
 * @var string
 */

define('WIKKA_BASE_URL', WIKKA_BASE_DOMAIN_URL.WIKKA_BASE_URL_PATH);
/**
 * Path to be used for cookies.
 * Derived from {@link WIKKA_BASE_URL_PATH}
 *
 * @var string
 */

define('WIKKA_COOKIE_PATH', ('/' == WIKKA_BASE_URL_PATH) ? '/' : substr(WIKKA_BASE_URL_PATH, 0, -1));
/**
 * Default number of hours after which a permanent cookie is to expire: corresponds to 90 days.
 */

if (!defined('DEFAULT_COOKIE_EXPIRATION_HOURS')) define('DEFAULT_COOKIE_EXPIRATION_HOURS',90 * 24);
/**
 * Path for Wikka libs
 *
 * @var string
 */

if(!defined('WIKKA_LIBRARY_PATH')) define('WIKKA_LIBRARY_PATH', 'lib');

/**#@-*/
// ----------------------- END URL DOMAIN / PATH -------------------------------


$wakkaDefaultConfig = array(
    'mysql_host'                => 'localhost',
    'mysql_database'            => 'wikka',
    'mysql_user'                => 'wikka',
    'table_prefix'              => 'wikka_',

    'root_page'                 => 'HomePage',
    'wakka_name'                => 'MyWikkaSite',
//  'base_url'                  => $t_scheme.$t_domain.$t_port.$t_request.$t_query,
    'rewrite_mode'              => $t_rewrite_mode,
    'wiki_suffix'               => '@wikka',
    'enable_user_host_lookup'   => '0', #enable (1) or disable (0, default) lookup of user hostname from IP address

    'action_path'               => 'plugins/actions'.PATH_DIVIDER.'actions',
    'handler_path'              => 'plugins/handlers'.PATH_DIVIDER.'handlers',
    'lang_path'                 => 'plugins/lang',
    'gui_editor'                => '1',
    'default_comment_display'   => 'threaded',
    'theme'                     => 'light',

    // formatter and code highlighting paths
    'wikka_formatter_path'      => 'plugins/formatters'.PATH_DIVIDER.'formatters',      # (location of Wikka formatter - REQUIRED)
    'wikka_highlighters_path'   => 'formatters',        # (location of Wikka code highlighters - REQUIRED)
    'geshi_path'                => '3rdparty/plugins/geshi',                # (location of GeSHi package)
    'geshi_languages_path'      => '3rdparty/plugins/geshi/geshi',      # (location of GeSHi language highlighting files)

    // template
    'wikka_template_path'       => 'plugins/templates'.PATH_DIVIDER.'templates',        # (location of Wikka template files - REQUIRED)
    'feedcreator_path'          => '3rdparty/core/feedcreator',
    'menu_config_path'          => 'config', #858
    'safehtml_path'             => '3rdparty/core/safehtml',
    'referrers_purge_time'      => '30',
    'pages_purge_time'          => '0',
    'xml_recent_changes'        => '10',
    'hide_comments'             => '0',
    'require_edit_note'         => '0',     # edit note optional (0, default), edit note required (1) edit note disabled (2)
    'anony_delete_own_comments' => '1',
    'public_sysinfo'            => '0',     # enable or disable public display of system information in SysInfo
    'double_doublequote_html'   => 'safe',
    'sql_debugging'             => '0',
    'admin_users'               => '',
    'admin_email'               => '',
    'upload_path'               => 'uploads',
    'mime_types'                => 'mime_types.txt',

    // code hilighting with GeSHi
    'geshi_header'              => 'div',   # 'div' (default) or 'pre' to surround code block
    'geshi_line_numbers'        => '1',     # disable line numbers (0), or enable normal (1) or fancy line numbers (2)
    'geshi_tab_width'           => '4',     # set tab width
    'grabcode_button'           => '1',     # allow code block downloading

    'wikiping_server'           => '',

    'default_write_acl'         => '+',
    'default_read_acl'          => '*',
    'default_comment_read_acl'      => '*',
    'default_comment_post_acl'      => '+',
    'allow_user_registration'   => '1',
    'enable_version_check'      => '1',
    'version_check_interval'    => '1h',
    'default_lang'              => 'en',
    'spamlog_path'              => './spamlog.txt.php',
    'badwords_path'             => './badwords.txt.php',
    'spam_logging'              => '0',
    'content_filtering'         => '0',
    'max_new_document_urls'     => '15',
    'max_new_comment_urls'      => '6',
    'max_new_feedback_urls'     => '6',
    'utf8_compat_search'        => '0'
    );

// load config
$wakkaConfig = array();
if (file_exists('wakka.config.php')) rename('wakka.config.php', 'wikka.config.php"');   // upgrade from Wakka
#if (!$configfile = GetEnv("WAKKA_CONFIG")) $configfile = "wikka.config.php";
if (defined('WAKKA_CONFIG'))    // use a define instead of GetEnv [SEC]
{
    $configfile = WAKKA_CONFIG;
}
else
{
    $configfile = 'wikka.config.php';
}
if (file_exists($configfile)) include($configfile);
$wakkaConfigLocation = $configfile;

// remove obsolete config settings (should come before merge!)
//TODO move these checks to a directive file to be used by the installer/upgrader, #97
if (isset($wakkaConfig['header_action']))
{
    unset($wakkaConfig['header_action']); //since 1.1.6.4
}
if (isset($wakkaConfig['footer_action'])) //since 1.1.6.4
{
    unset($wakkaConfig['footer_action']);
}

// Remove old stylesheet, #6
if(isset($wakkaConfig['stylesheet']))
{
    unset($wakkaConfig['stylesheet']); // since 1.2
}

// Add plugin paths if they do not already exist
if(isset($wakkaConfig['action_path']) && preg_match('/plugins\/actions/', $wakkaConfig['action_path']) <= 0)
    $wakkaConfig['action_path'] = "plugins/actions," .  $wakkaConfig['action_path'];
if(isset($wakkaConfig['handler_path']) && preg_match('/plugins\/handlers/', $wakkaConfig['handler_path']) <= 0)
    $wakkaConfig['handler_path'] = "plugins/handlers," .  $wakkaConfig['handler_path'];
if(isset($wakkaConfig['wikka_template_path']) && preg_match('/plugins\/templates/', $wakkaConfig['wikka_template_path']) <= 0)
    $wakkaConfig['wikka_template_path'] = "plugins/templates," .  $wakkaConfig['wikka_template_path'];
if(isset($wakkaConfig['wikka_formatter_path']) && preg_match('/plugins\/formatters/', $wakkaConfig['wikka_formatter_path']) <= 0)
    $wakkaConfig['wikka_formatter_path'] = "plugins/formatters," .  $wakkaConfig['wikka_formatter_path'];
if(isset($wakkaConfig['lang_path']) && preg_match('/plugins\/lang/', $wakkaConfig['lang_path']) <= 0)
    $wakkaConfig['lang_path'] = "plugins/lang," .  $wakkaConfig['lang_path'];

$wakkaConfig = array_merge($wakkaDefaultConfig, $wakkaConfig);  // merge defaults with config from file

// ---------------------------- LANGUAGE DEFAULTS -----------------------------

/**
  * php-gettext
  */

  include_once('localization.php');

/**
 * Include language file(s) if it/they exist(s).
 * @see /lang/en.inc.php
 *
 * Note that all lang_path entries in wikka.config.php are scanned for
 * default_lang files in the order specified in lang_path, with the
 * fallback language pack scanned last to pick up any undefined
 * strings.
 *
 * TODO: Handlers and actions that use their own language packs are
 * responsible for loading their own translation strings.  This
 * process should be unified across the application.
 *
 */

$default_lang = $wakkaConfig['default_lang'];
$fallback_lang = 'en';
$default_lang_path = 'lang'.DIRECTORY_SEPARATOR.$default_lang;
$plugin_lang_path = $wakkaConfig['lang_path'].DIRECTORY_SEPARATOR.$default_lang;
$fallback_lang_path = 'lang'.DIRECTORY_SEPARATOR.$fallback_lang;
$default_lang_strings = $default_lang_path.DIRECTORY_SEPARATOR.$default_lang.'.inc.php';
$plugin_lang_strings = $plugin_lang_path.DIRECTORY_SEPARATOR.$default_lang.'.inc.php';
$fallback_lang_strings = $fallback_lang_path.DIRECTORY_SEPARATOR.$fallback_lang.'.inc.php';
$lang_packs_found = false;
if (file_exists($plugin_lang_strings))
{
    require_once($plugin_lang_strings);
    $lang_packs_found = true;
}
if (file_exists($default_lang_strings))
{
    require_once($default_lang_strings);
    $lang_packs_found = true;
}
if (file_exists($fallback_lang_strings))
{
    require_once($fallback_lang_strings);
    $lang_packs_found = true;
}
if(!$lang_packs_found)
{
    die('Language file '.$default_lang_strings.' not found! In addition, the default language file '.$fallback_lang_strings.' is missing. Please add the file(s).');
}

if(!defined('WIKKA_LANG_PATH')) define('WIKKA_LANG_PATH', $default_lang_path);
// ------------------------- END LANGUAGE DEFAULTS -----------------------------

/**
 * To activate multisite deployment capabilities, just create an empty file multi.config.php in
 * your Wikkawiki installation directory. This file can contain an array definition for
 * $multiConfig.
 * Relevant keys in the array are a global directory for local settings 'local_config' and
 * designated directories for different host requests, e.g. you may want http://example.com
 * and http://www.example.com using the same local config file.
 * 'http_www_example_com' => 'http.example.com'
 * 'http_example_com' => 'http.example.com'
*/

$multisite_configfile = 'multi.config.php';
if (file_exists($multisite_configfile))
{
    $wakkaGlobalConfig = $wakkaConfig;  // copy config file, #878
    $multiDefaultConfig = array(
        'local_config'            => 'wikka.config' # path to local configs
    );
    $multiConfig = array();

    include($multisite_configfile);

    $multiConfig = array_merge($multiDefaultConfig, $multiConfig);    // merge default multi config with config from file

    $configkey = str_replace('://','_',$t_scheme).str_replace('.','_',$t_domain);
    if($t_port != '') $configkey .= '_'.$t_port;


/**
 * Admin can decide to put a specific local config in a more readable and shorter directory.
 * The $configkey is created as 'protocol_thirdleveldomain_secondleveldomain_topleveldomain'
 * Subdirectories are not supported at the moment, but should be easy to implement.
 * If no designated directory is found in multi.config.php, the script uses the $configkey
 * value and replaces all underscore by dots:
 * protocol.thirdleveldomain.secondleveldomain.topleveldomain e.g.
 * http.www.example.com
*/

    if (isset($multiConfig[$configkey])) $configpath = $multiConfig[$configkey];
    else
    {
        $requested_host = str_replace('_','.',$configkey);
        $configpath = $multiConfig['local_config'].DIRECTORY_SEPARATOR.$requested_host;
        $multiConfig[$configkey] = $requested_host;
    }

    $local_configfile = $configpath.DIRECTORY_SEPARATOR.'local.config.php';
/**
 * As each site may differ in its configuration and capabilities, we should consider using
 * plugin directories below the $configpath. Effectively, this replaces the 1.1.6.6 plugins
 * folder. It goes even a little bit further by providing a site specific upload directory.
*/


    $localDefaultConfig = array(
        'menu_config_path'          => $configpath.DIRECTORY_SEPARATOR.'config'.PATH_DIVIDER.'config',
        'action_path'               => $configpath.DIRECTORY_SEPARATOR.'actions'.PATH_DIVIDER.'plugins'.DIRECTORY_SEPARATOR.'actions'.PATH_DIVIDER.'actions',
        'handler_path'              => $configpath.DIRECTORY_SEPARATOR.'handlers'.PATH_DIVIDER.'plugins'.DIRECTORY_SEPARATOR.'handlers'.PATH_DIVIDER.'handlers',
        'wikka_formatter_path'      => $configpath.DIRECTORY_SEPARATOR.'formatters'.PATH_DIVIDER.'plugins'.DIRECTORY_SEPARATOR.'formatters'.PATH_DIVIDER.'formatters',        # (location of Wikka formatter - REQUIRED)
        'wikka_highlighters_path'   => $configpath.DIRECTORY_SEPARATOR.'formatters'.PATH_DIVIDER.'plugins'.DIRECTORY_SEPARATOR.'formatters'.PATH_DIVIDER.'formatters',        # (location of Wikka code highlighters - REQUIRED)
        'wikka_template_path'       => $configpath.DIRECTORY_SEPARATOR.'templates'.PATH_DIVIDER.'plugins'.DIRECTORY_SEPARATOR.'templates'.PATH_DIVIDER.'templates',        # (location of Wikka template files - REQUIRED)
        'upload_path'               => $configpath.DIRECTORY_SEPARATOR.'uploads'
    );
    $localConfig = array();
    if (!file_exists($configpath))
    {
        $path_parts = explode(DIRECTORY_SEPARATOR,$configpath);
        $partialpath = '';
        foreach($path_parts as $part)
        {
            $partialpath .= $part;
            if (!file_exists($partialpath)) mkdir($partialpath,0755);
            $partialpath .= DIRECTORY_SEPARATOR;
        }
        mkdir($configpath.DIRECTORY_SEPARATOR.'config',0700);
        mkdir($configpath.DIRECTORY_SEPARATOR.'actions',0700);
        mkdir($configpath.DIRECTORY_SEPARATOR.'handlers',0700);
        mkdir($configpath.DIRECTORY_SEPARATOR.'handlers'.DIRECTORY_SEPARATOR.'page',0700);
        mkdir($configpath.DIRECTORY_SEPARATOR.'formatters',0700);
        mkdir($configpath.DIRECTORY_SEPARATOR.'templates',0700);
        mkdir($configpath.DIRECTORY_SEPARATOR.'uploads',0755);
//        if(file_exists($wakkaConfig['stylesheet'])) copy($wakkaConfig['stylesheet'],$localDefaultConfig['stylesheet']);
    }
    else if (file_exists($local_configfile)) include($local_configfile);

    $wakkaGlobalConfig = array_merge($wakkaGlobalConfig, $localDefaultConfig);    // merge global config with default local config

    $wakkaConfigLocation = $local_configfile;

    $wakkaConfig = array_merge($wakkaGlobalConfig, $wakkaConfig);    // merge localized global config with local config from file
}

/**
 * Check for locking.
 */

if (file_exists('locked'))
{
    // read password from lockfile
    $lines = file("locked");
    $lockpw = trim($lines[0]);

    // is authentification given?
    $ask = false;
    if (isset($_SERVER["PHP_AUTH_USER"])) {
        if (!(($_SERVER["PHP_AUTH_USER"] == "admin") && ($_SERVER["PHP_AUTH_PW"] == $lockpw))) {
            $ask = true;
        }
    } else {
        $ask = true;
    }

    if ($ask) {
        header("WWW-Authenticate: Basic realm=\"".$wakkaConfig["wakka_name"]." Install/Upgrade Interface\"");
        header("HTTP/1.0 401 Unauthorized");
        print T_("This site is currently being upgraded. Please try again later.");
        exit;
    }
}

/**
 * Compare versions, start installer if necessary.
 * Fresh installs run immediately. Wait until Wikka class is loaded to run
 * upgrades so we can limit access to admin users. (See below.)
 */

$is_new_install = ! isset($wakkaConfig['wakka_version']);
$is_upgrade = $wakkaConfig['wakka_version'] !== WAKKA_VERSION;

function start_installer() {
    /**
    * Start installer.
    *
    * Data entered by the user is submitted in $_POST, next action for the
    * installer (which will receive this data) is passed as a $_GET parameter!
    */

    global $wakkaConfig, $wakkaConfigLocation, $fallback_lang_path;

    $installAction = 'default';

    if (isset($_GET['installAction'])) {
        $installAction = trim($_GET['installAction']);  #312
    }

    if (file_exists('setup'.DIRECTORY_SEPARATOR.'header.php')) {
        include('setup'.DIRECTORY_SEPARATOR.'header.php');
    }
    else {
        print '<em class="error">'.ERROR_SETUP_HEADER_MISSING.'</em>'; #89
    }

    if (file_exists('setup'.DIRECTORY_SEPARATOR.$installAction.'.php')) {
        include('setup'.DIRECTORY_SEPARATOR.$installAction.'.php');
    }
    else {
        print '<em class="error">'.ERROR_SETUP_FILE_MISSING.'</em>'; #89
    }

    if (file_exists('setup'.DIRECTORY_SEPARATOR.'footer.php')) {
        include('setup'.DIRECTORY_SEPARATOR.'footer.php');
    }
    else {
        print '<em class="error">'.ERROR_SETUP_FOOTER_MISSING.'</em>'; #89
    }

    exit;
}


if ( $is_new_install ) {
    $wakkaConfig['wakka_version'] = 0;
    start_installer();
}

/**
 * Start session.
 */

$base_url_path = preg_replace('/wikka\.php/', '', $_SERVER['SCRIPT_NAME']);
$wikka_cookie_path = ('/' == $base_url_path) ? '/' : substr($base_url_path,0,-1);
session_set_cookie_params(0, $wikka_cookie_path);
session_name(md5(BASIC_COOKIE_NAME.$wakkaConfig['wiki_suffix']));
session_start();
if(!isset($_SESSION['CSRFToken']))
{
    $_SESSION['CSRFToken'] = sha1(getmicrotime());
}

// fetch wakka location
/**
 * Fetch wakka location (requested page + parameters)
 *
 * @todo files action uses POST, everything else uses GET #312
 */

$wakka = $_GET['wakka']; #312

/**
 * Remove leading slash.
 */

$wakka = preg_replace("/^\//", "", $wakka);

/**
 * Extract pagename and handler from URL
 *
 * Note this splits at the FIRST / so $handler may contain one or more slashes;
 * this is not allowed, and ultimately handled in the Handler() method. [SEC]
 */

if (preg_match("#^(.+?)/(.*)$#", $wakka, $matches)) list(, $page, $handler) = $matches;
else if (preg_match("#^(.*)$#", $wakka, $matches)) list(, $page) = $matches;
//Fix lowercase mod_rewrite bug: URL rewriting makes pagename lowercase. #135
if ((strtolower($page) == $page) && (isset($_SERVER['REQUEST_URI']))) #38
{
    $pattern = preg_quote($page, '/');
    if (preg_match("/($pattern)/i", urldecode($_SERVER['REQUEST_URI']), $match_url))
    {
        $page = $match_url[1];
    }
}
//$page = preg_replace('/_/', ' ', $page);

/**
 * Create Wakka object
 */

$wakka = instantiate('Wakka',$wakkaConfig);

/**
 * Check for database access.
 */

if (!$wakka->dblink)
{
    echo '<em class="error">'.T_("Error: Unable to connect to the database.").'</em>';
    exit;
}


/**
 * Save session ID
 */

$user = $wakka->GetUser();
// Only store sessions for real users!
if(NULL != $user)
{
    $res = $wakka->LoadSingle("SELECT * FROM ".$wakka->config['table_prefix']."sessions WHERE sessionid='".session_id()."' AND userid='".$user['name']."'");
    if(isset($res))
    {
        // Just update the session_start time
        $wakka->Query("UPDATE ".$wakka->config['table_prefix']."sessions SET session_start=FROM_UNIXTIME(".$wakka->GetMicroTime().") WHERE sessionid='".session_id()."' AND userid='".$user['name']."'");
    }
    else
    {
        // Create new session record
        $wakka->Query("INSERT INTO ".$wakka->config['table_prefix']."sessions (sessionid, userid, session_start) VALUES('".session_id()."', '".$user['name']."', FROM_UNIXTIME(".$wakka->GetMicroTime()."))");
    }
}

/**
 * Check for upgrade. If so an user is admin, show setup page, else show
 * a maintenance message to all other visitors.
 *
 * Add ?help=1 to the url if installer gets stuck and it will print some debug
 * info.
 */

$is_admin = $wakka->IsAdmin($user);
$install_action = isset($_GET['installAction']) ? $_GET['installAction'] : '';
$help_requested = isset($_GET['help']) ? 1 : 0;
$at_install_step = ( $install_action == 'writeconfig') && (isset($_POST['config']));
$upgrade_allowed = $is_admin || $at_install_step;

if ( $is_upgrade && $upgrade_allowed ) {
    start_installer();
}
elseif ( $is_upgrade && $help_requested ) {
    $debug_info = array(
        '_POST' => $_POST,
        '_GET' => $_GET,
        '_SESSION' => $_SESSION
    );
    print "<h2>Installer Help</h2>";
    printf('<pre>%s</pre>', print_r($debug_info,1));
}
elseif ( $is_upgrade ) {
    header('HTTP/1.1 503 Service Temporarily Unavailable');
    header('Status: 503 Service Temporarily Unavailable');
    header('Retry-After: 300');
    die('<h2>Site Undergoing Temporary Maintenance</h2><h4>Please check back shortly.</h4>');
}


/**
 * Run the engine.
 */

if (!isset($handler)) $handler='';
$wakka->Run($page, $handler);
$content =  ob_get_contents();
/**
 * Use gzip compression if possible.
 */

/*
if ( isset($_SERVER['HTTP_ACCEPT_ENCODING']) && strstr ($_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip') && function_exists('gzencode') ) #38
{
    // Tell the browser the content is compressed with gzip
    header ("Content-Encoding: gzip");
    $page_output = gzencode($content);
    $page_length = strlen($page_output);
} else {
 */

    $page_output = $content;
    $page_length = strlen($page_output);
//}

// header("Cache-Control: pre-check=0");
header("Cache-Control: no-cache");
// header("Pragma: ");
// header("Expires: ");

$etag =  md5($content);
header('ETag: '.$etag);

header('Content-Length: '.$page_length);
ob_end_clean();

/**
 * Output the page.
 */

echo $page_output;
There is one comment on this page. [Display comment]
Valid XHTML :: Valid CSS: :: Powered by WikkaWiki