Mercurial > hg > rc1
annotate index.php @ 58:082a19037887 default tip
More cleaning up php8 Warnings/deprecations
| author | Charlie Root |
|---|---|
| date | Wed, 15 Oct 2025 14:06:01 -0400 |
| parents | 91f005a4f7e9 |
| children |
| rev | line source |
|---|---|
| 39 | 1 <?php |
| 2 /** | |
| 3 +-------------------------------------------------------------------------+ | |
| 4 | Roundcube Webmail IMAP Client | | |
| 5 | Version 1.3.3 | | |
| 6 | | | |
| 7 | Copyright (C) 2005-2017, The Roundcube Dev Team | | |
| 8 | | | |
| 9 | This program is free software: you can redistribute it and/or modify | | |
| 10 | it under the terms of the GNU General Public License (with exceptions | | |
| 11 | for skins & plugins) as published by the Free Software Foundation, | | |
| 12 | either version 3 of the License, or (at your option) any later version. | | |
| 13 | | | |
| 14 | This file forms part of the Roundcube Webmail Software for which the | | |
| 15 | following exception is added: Plugins and Skins which merely make | | |
| 16 | function calls to the Roundcube Webmail Software, and for that purpose | | |
| 17 | include it by reference shall not be considered modifications of | | |
| 18 | the software. | | |
| 19 | | | |
| 20 | If you wish to use this file in another project or create a modified | | |
| 21 | version that will not be part of the Roundcube Webmail Software, you | | |
| 22 | may remove the exception above and use this source code under the | | |
| 23 | original version of the license. | | |
| 24 | | | |
| 25 | This program is distributed in the hope that it will be useful, | | |
| 26 | but WITHOUT ANY WARRANTY; without even the implied warranty of | | |
| 27 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | | |
| 28 | GNU General Public License for more details. | | |
| 29 | | | |
| 30 | You should have received a copy of the GNU General Public License | | |
| 31 | along with this program. If not, see http://www.gnu.org/licenses/. | | |
| 32 | | | |
| 33 +-------------------------------------------------------------------------+ | |
| 34 | Author: Thomas Bruederli <roundcube@gmail.com> | | |
| 35 | Author: Aleksander Machniak <alec@alec.pl> | | |
| 36 +-------------------------------------------------------------------------+ | |
| 37 */ | |
| 38 | |
| 39 // include environment | |
| 40 require_once 'program/include/iniset.php'; | |
| 41 | |
| 42 // init application, start session, init output class, etc. | |
| 45 | 43 $RCMAIL = rcmail::get_instance(0, isset($GLOBALS['env']) ? $GLOBALS['env'] : null); |
| 39 | 44 |
| 45 // Make the whole PHP output non-cacheable (#1487797) | |
| 46 $RCMAIL->output->nocacheing_headers(); | |
| 47 $RCMAIL->output->common_headers(); | |
| 48 | |
| 49 // turn on output buffering | |
| 50 ob_start(); | |
| 51 | |
| 52 // check if config files had errors | |
| 53 if ($err_str = $RCMAIL->config->get_error()) { | |
| 54 rcmail::raise_error(array( | |
| 55 'code' => 601, | |
| 56 'type' => 'php', | |
| 57 'message' => $err_str), false, true); | |
| 58 } | |
| 59 | |
| 60 // check DB connections and exit on failure | |
| 61 if ($err_str = $RCMAIL->db->is_error()) { | |
| 62 rcmail::raise_error(array( | |
| 63 'code' => 603, | |
| 64 'type' => 'db', | |
| 65 'message' => $err_str), false, true); | |
| 66 } | |
| 67 | |
| 68 // error steps | |
| 69 if ($RCMAIL->action == 'error' && !empty($_GET['_code'])) { | |
| 70 rcmail::raise_error(array('code' => hexdec($_GET['_code'])), false, true); | |
| 71 } | |
| 72 | |
| 73 // check if https is required (for login) and redirect if necessary | |
| 74 if (empty($_SESSION['user_id']) && ($force_https = $RCMAIL->config->get('force_https', false))) { | |
| 75 // force_https can be true, <hostname>, <hostname>:<port>, <port> | |
| 76 if (!is_bool($force_https)) { | |
| 77 list($host, $port) = explode(':', $force_https); | |
| 78 | |
| 79 if (is_numeric($host) && empty($port)) { | |
| 80 $port = $host; | |
| 81 $host = ''; | |
| 82 } | |
| 83 } | |
| 84 | |
| 85 if (!rcube_utils::https_check($port ?: 443)) { | |
| 86 if (empty($host)) { | |
| 87 $host = preg_replace('/:[0-9]+$/', '', $_SERVER['HTTP_HOST']); | |
| 88 } | |
| 89 if ($port && $port != 443) { | |
| 90 $host .= ':' . $port; | |
| 91 } | |
| 92 | |
| 93 header('Location: https://' . $host . $_SERVER['REQUEST_URI']); | |
| 94 exit; | |
| 95 } | |
| 96 } | |
| 97 | |
| 98 // trigger startup plugin hook | |
| 99 $startup = $RCMAIL->plugins->exec_hook('startup', array('task' => $RCMAIL->task, 'action' => $RCMAIL->action)); | |
| 100 $RCMAIL->set_task($startup['task']); | |
| 101 $RCMAIL->action = $startup['action']; | |
| 102 | |
|
49
91f005a4f7e9
Slowly cleaning up more php8 Warnings/deprecations
Charlie Root
parents:
45
diff
changeset
|
103 $session_error = false; |
| 39 | 104 // try to log in |
| 105 if ($RCMAIL->task == 'login' && $RCMAIL->action == 'login') { | |
| 106 $request_valid = $_SESSION['temp'] && $RCMAIL->check_request(); | |
| 107 $pass_charset = $RCMAIL->config->get('password_charset', 'ISO-8859-1'); | |
| 108 | |
| 109 // purge the session in case of new login when a session already exists | |
| 110 $RCMAIL->kill_session(); | |
| 111 | |
| 112 $auth = $RCMAIL->plugins->exec_hook('authenticate', array( | |
| 113 'host' => $RCMAIL->autoselect_host(), | |
| 114 'user' => trim(rcube_utils::get_input_value('_user', rcube_utils::INPUT_POST)), | |
| 115 'pass' => rcube_utils::get_input_value('_pass', rcube_utils::INPUT_POST, true, $pass_charset), | |
| 116 'valid' => $request_valid, | |
| 117 'cookiecheck' => true, | |
| 118 )); | |
| 119 | |
| 120 // Login | |
| 121 if ($auth['valid'] && !$auth['abort'] | |
| 122 && $RCMAIL->login($auth['user'], $auth['pass'], $auth['host'], $auth['cookiecheck']) | |
| 123 ) { | |
| 124 // create new session ID, don't destroy the current session | |
| 125 // it was destroyed already by $RCMAIL->kill_session() above | |
| 126 $RCMAIL->session->remove('temp'); | |
| 127 $RCMAIL->session->regenerate_id(false); | |
| 128 | |
| 129 // send auth cookie if necessary | |
| 130 $RCMAIL->session->set_auth_cookie(); | |
| 131 | |
| 132 // log successful login | |
| 133 $RCMAIL->log_login(); | |
| 134 | |
| 135 // restore original request parameters | |
| 136 $query = array(); | |
| 137 if ($url = rcube_utils::get_input_value('_url', rcube_utils::INPUT_POST)) { | |
| 138 parse_str($url, $query); | |
| 139 | |
| 140 // prevent endless looping on login page | |
| 141 if ($query['_task'] == 'login') { | |
| 142 unset($query['_task']); | |
| 143 } | |
| 144 | |
| 145 // prevent redirect to compose with specified ID (#1488226) | |
| 146 if ($query['_action'] == 'compose' && !empty($query['_id'])) { | |
| 147 $query = array('_action' => 'compose'); | |
| 148 } | |
| 149 } | |
| 150 | |
| 151 // allow plugins to control the redirect url after login success | |
| 152 $redir = $RCMAIL->plugins->exec_hook('login_after', $query + array('_task' => 'mail')); | |
| 153 unset($redir['abort'], $redir['_err']); | |
| 154 | |
| 155 // send redirect | |
| 156 $OUTPUT->redirect($redir, 0, true); | |
| 157 } | |
| 158 else { | |
| 159 if (!$auth['valid']) { | |
| 160 $error_code = rcmail::ERROR_INVALID_REQUEST; | |
| 161 } | |
| 162 else { | |
| 163 $error_code = is_numeric($auth['error']) ? $auth['error'] : $RCMAIL->login_error(); | |
| 164 } | |
| 165 | |
| 166 $error_labels = array( | |
| 167 rcmail::ERROR_STORAGE => 'storageerror', | |
| 168 rcmail::ERROR_COOKIES_DISABLED => 'cookiesdisabled', | |
| 169 rcmail::ERROR_INVALID_REQUEST => 'invalidrequest', | |
| 170 rcmail::ERROR_INVALID_HOST => 'invalidhost', | |
| 171 rcmail::ERROR_RATE_LIMIT => 'accountlocked', | |
| 172 ); | |
| 173 | |
| 174 $error_message = !empty($auth['error']) && !is_numeric($auth['error']) ? $auth['error'] : ($error_labels[$error_code] ?: 'loginfailed'); | |
| 175 | |
| 176 $OUTPUT->show_message($error_message, 'warning'); | |
| 177 | |
| 178 // log failed login | |
| 179 $RCMAIL->log_login($auth['user'], true, $error_code); | |
| 180 | |
| 181 $RCMAIL->plugins->exec_hook('login_failed', array( | |
| 182 'code' => $error_code, 'host' => $auth['host'], 'user' => $auth['user'])); | |
| 183 | |
| 184 $RCMAIL->kill_session(); | |
| 185 } | |
| 186 } | |
| 187 | |
| 188 // end session | |
| 189 else if ($RCMAIL->task == 'logout' && isset($_SESSION['user_id'])) { | |
| 190 $RCMAIL->request_security_check($mode = rcube_utils::INPUT_GET); | |
| 191 | |
| 192 $userdata = array( | |
| 193 'user' => $_SESSION['username'], | |
| 194 'host' => $_SESSION['storage_host'], | |
| 195 'lang' => $RCMAIL->user->language, | |
| 196 ); | |
| 197 | |
| 198 $OUTPUT->show_message('loggedout'); | |
| 199 | |
| 200 $RCMAIL->logout_actions(); | |
| 201 $RCMAIL->kill_session(); | |
| 202 $RCMAIL->plugins->exec_hook('logout_after', $userdata); | |
| 203 } | |
| 204 | |
| 205 // check session and auth cookie | |
| 206 else if ($RCMAIL->task != 'login' && $_SESSION['user_id']) { | |
| 207 if (!$RCMAIL->session->check_auth()) { | |
| 208 $RCMAIL->kill_session(); | |
| 209 $session_error = true; | |
| 210 } | |
| 211 } | |
| 212 | |
| 213 // not logged in -> show login page | |
| 214 if (empty($RCMAIL->user->ID)) { | |
| 215 // log session failures | |
| 216 $task = rcube_utils::get_input_value('_task', rcube_utils::INPUT_GPC); | |
| 217 | |
| 218 if ($task && !in_array($task, array('login','logout')) | |
| 219 && !$session_error && ($sess_id = $_COOKIE[ini_get('session.name')]) | |
| 220 ) { | |
| 221 $RCMAIL->session->log("Aborted session $sess_id; no valid session data found"); | |
| 222 $session_error = true; | |
| 223 } | |
| 224 | |
| 58 | 225 if ($session_error || ($_REQUEST['_err']??null) == 'session') { |
| 39 | 226 $OUTPUT->show_message('sessionerror', 'error', null, true, -1); |
| 227 } | |
| 228 | |
| 229 if ($OUTPUT->ajax_call || $OUTPUT->get_env('framed')) { | |
| 230 $OUTPUT->command('session_error', $RCMAIL->url(array('_err' => 'session'))); | |
| 231 $OUTPUT->send('iframe'); | |
| 232 } | |
| 233 | |
| 234 // check if installer is still active | |
| 235 if ($RCMAIL->config->get('enable_installer') && is_readable('./installer/index.php')) { | |
| 236 $OUTPUT->add_footer(html::div(array('style' => "background:#ef9398; border:2px solid #dc5757; padding:0.5em; margin:2em auto; width:50em"), | |
| 237 html::tag('h2', array('style' => "margin-top:0.2em"), "Installer script is still accessible") . | |
| 238 html::p(null, "The install script of your Roundcube installation is still stored in its default location!") . | |
| 239 html::p(null, "Please <b>remove</b> the whole <tt>installer</tt> folder from the Roundcube directory because | |
| 240 these files may expose sensitive configuration data like server passwords and encryption keys | |
| 241 to the public. Make sure you cannot access the <a href=\"./installer/\">installer script</a> from your browser.") | |
| 242 )); | |
| 243 } | |
| 244 | |
| 245 $plugin = $RCMAIL->plugins->exec_hook('unauthenticated', array('task' => 'login', 'error' => $session_error)); | |
| 246 | |
| 247 $RCMAIL->set_task($plugin['task']); | |
| 248 | |
| 249 $OUTPUT->send($plugin['task']); | |
| 250 } | |
| 251 else { | |
| 252 // CSRF prevention | |
| 253 $RCMAIL->request_security_check(); | |
| 254 | |
| 255 // check access to disabled actions | |
| 256 $disabled_actions = (array) $RCMAIL->config->get('disabled_actions'); | |
| 257 if (in_array($RCMAIL->task . '.' . ($RCMAIL->action ?: 'index'), $disabled_actions)) { | |
| 258 rcube::raise_error(array( | |
| 259 'code' => 404, 'type' => 'php', | |
| 260 'message' => "Action disabled"), true, true); | |
| 261 } | |
| 262 } | |
| 263 | |
| 264 // we're ready, user is authenticated and the request is safe | |
| 265 $plugin = $RCMAIL->plugins->exec_hook('ready', array('task' => $RCMAIL->task, 'action' => $RCMAIL->action)); | |
| 266 $RCMAIL->set_task($plugin['task']); | |
| 267 $RCMAIL->action = $plugin['action']; | |
| 268 | |
| 269 // handle special actions | |
| 270 if ($RCMAIL->action == 'keep-alive') { | |
| 271 $OUTPUT->reset(); | |
| 272 $RCMAIL->plugins->exec_hook('keep_alive', array()); | |
| 273 $OUTPUT->send(); | |
| 274 } | |
| 275 else if ($RCMAIL->action == 'save-pref') { | |
| 276 include INSTALL_PATH . 'program/steps/utils/save_pref.inc'; | |
| 277 } | |
| 45 | 278 else if ($RCMAIL->action == 'info') { |
| 279 phpinfo(); | |
| 280 #xdebug_info(); | |
| 281 exit(); | |
| 282 } | |
| 39 | 283 |
| 284 | |
| 285 // include task specific functions | |
| 286 if (is_file($incfile = INSTALL_PATH . 'program/steps/'.$RCMAIL->task.'/func.inc')) { | |
| 287 include_once $incfile; | |
| 288 } | |
| 289 | |
| 290 // allow 5 "redirects" to another action | |
| 291 $redirects = 0; $incstep = null; | |
| 292 while ($redirects < 5) { | |
| 293 // execute a plugin action | |
| 294 if (preg_match('/^plugin\./', $RCMAIL->action)) { | |
| 295 $RCMAIL->plugins->exec_action($RCMAIL->action); | |
| 296 break; | |
| 297 } | |
| 298 // execute action registered to a plugin task | |
| 299 else if ($RCMAIL->plugins->is_plugin_task($RCMAIL->task)) { | |
| 300 if (!$RCMAIL->action) $RCMAIL->action = 'index'; | |
| 301 $RCMAIL->plugins->exec_action($RCMAIL->task.'.'.$RCMAIL->action); | |
| 302 break; | |
| 303 } | |
| 304 // try to include the step file | |
| 305 else if (($stepfile = $RCMAIL->get_action_file()) | |
| 306 && is_file($incfile = INSTALL_PATH . 'program/steps/'.$RCMAIL->task.'/'.$stepfile) | |
| 307 ) { | |
| 308 // include action file only once (in case it don't exit) | |
| 309 include_once $incfile; | |
| 310 $redirects++; | |
| 311 } | |
| 312 else { | |
| 313 #rcube::write_log('mail',$incfile." not found"); | |
| 314 break; | |
| 315 } | |
| 316 } | |
| 317 | |
| 318 if ($RCMAIL->action == 'refresh') { | |
| 319 $RCMAIL->plugins->exec_hook('refresh', array('last' => intval(rcube_utils::get_input_value('_last', rcube_utils::INPUT_GPC)))); | |
| 320 } | |
| 321 | |
| 322 #rcube::write_log('mail',"task: ".$RCMAIL->task." action: ".$RCMAIL->action); | |
| 323 // parse main template (default) | |
| 324 $OUTPUT->send($RCMAIL->task); | |
| 325 | |
| 326 // if we arrive here, something went wrong | |
| 327 rcmail::raise_error(array( | |
| 328 'code' => 404, | |
| 329 'type' => 'php', | |
| 330 'line' => __LINE__, | |
| 331 'file' => __FILE__, | |
| 332 'message' => "Invalid request"), true, true); |