true to allow it.
* @param array $vars An array of additionnal parameters to give to the action, in the form
* array( 'param' => 'value').
* This allows you to call Action() internally, setting $action to the name of the action
* you want to call and it's parameters in an array, wich is more efficient than
* the pattern-matching algorithm used to extract the parameters from $action.
* @return The output generated by the action.
*/
function Action($action, $forceLinkTracking = 0, $vars = array())
{
$cmd = trim($action);
// extract $action and $vars_temp ("raw" attributes)
if (!preg_match("/^([a-zA-Z-0-9]+)\/?(.*)$/", $cmd, $matches))
{
return 'Action invalide "' . htmlspecialchars($cmd) . '"';
}
list(, $action, $vars_temp) = $matches;
$vars[$vars_temp] = $vars_temp; // usefull for {{action/vars_temp}}
// now that we have the action's name, we can check if the user satisfies the ACLs
if (!$this->CheckModuleACL($action, 'action'))
{
return 'Erreur: vous n\'avez pas accès à l\'action ' . $action . '.';
}
// match all attributes (key and value)
// prepare an array for extract() to work with (in $this->IncludeBuffered())
if (preg_match_all("/([a-zA-Z0-9]*)=\"(.*)\"/U", $vars_temp, $matches))
{
for ($a = 0; $a < count($matches[1]); $a++)
{
$vars[$matches[1][$a]] = $matches[2][$a];
}
}
if (!$forceLinkTracking) $this->StopLinkTracking();
if ($actionObj = &$this->GetActionObject($action))
{
if (is_object($actionObj))
{
$result = $actionObj->PerformAction($vars, $cmd);
}
else // $actionObj is an error message
{
$result = $actionObj;
}
}
else // $actionObj == null (not found, no error message)
{
$this->parameter = &$vars;
$result = $this->IncludeBuffered(strtolower($action).".php", "Action inconnue "$action"", $vars, $this->config["action_path"]);
unset($this->parameter);
}
$this->StartLinkTracking(); // shouldn't we restore the previous status ?
return $result;
}
/**
* Finds the object corresponding to an action, if it exists.
* @param string $name The name of an action (should be alphanumeric)
* @return mixed
* - null if the corresponding file was not found or the corresponding class didn't exist after inclusion
* - an error string if the corresponding file was found but an error append while loading it
* - the object corresponding to this action if no problem happend
* To check the result, you should use is_object() on it.
* You should always assign the result of this method by referrence
* to avoid copying the object, which is the default beheviour in PHP4.
* @example
* $var = &$wiki->GetActionObject('actionname');
* if (is_object($var))
* {
* // normal behaviour
* }
* elseif ($var) // $var is not an object but an error string
* {
* // threat error
* }
* else // action was not found
* {
* // rescue from inexising action or sth
* }
*/
function &GetActionObject($name)
{
$name = strtolower($name);
$actionObj = null; // the generated object
if (!preg_match('/^[a-z0-9]+$/', $name)) // paranoiac
{
return $actionObj;
}
// already tried to load this object ? (may be null)
if (isset($this->actionObjects[$name]))
{
return $this->actionObjects[$name];
}
// object not loaded, try to load it
$filename = $name . '.class.php';
// load parent class for all action objects (only once)
require_once 'includes/action.class.php';
// include the action file, this should return an empty string
$result = $this->IncludeBuffered($filename, null, null, $this->GetConfigValue('action_path'));
if ($result) // the result was not an empty string, certainly an error message
{
$actionObj = $result;
}
elseif ($result !== false) // the result was empty but the file was found
{
$class = 'Action' . ucfirst($name);
if (class_exists($class))
{
$actionObj = &new $class($this);
if (!is_a($actionObj, 'WikiniAction'))
{
die("Action invalide '$name': classe incorrecte");
}
}
}
$this->actionObjects[$name] = &$actionObj;
return $actionObj;
}
/**
* Retrieves the list of existing actions
* @return array An unordered array of all the available actions.
*/
function GetActionsList()
{
$action_path = $this->GetConfigValue('action_path');
$list = array();
if ($dh = opendir($action_path))
{
while (($file = readdir($dh)) !== false)
{
if (preg_match('/^([a-zA-Z-0-9]+)(.class)?.php$/', $file, $matches))
{
$list[] = $matches[1];
}
}
}
return $list;
}
/**
* Retrieves the list of existing handlers
* @return array An unordered array of all the available handlers.
*/
function GetHandlersList()
{
$handler_path = $this->GetConfigValue('handler_path') . '/page/';
$list = array();
if ($dh = opendir($handler_path))
{
while (($file = readdir($dh)) !== false)
{
if (preg_match('/^([a-zA-Z-0-9]+)(.class)?.php$/', $file, $matches))
{
$list[] = $matches[1];
}
}
}
return $list;
}
function Method($method) {
if (!$handler = $this->page["handler"]) $handler = "page";
$methodLocation = $handler."/".$method.".php";
return $this->IncludeBuffered($methodLocation, "Méthode inconnue \"$methodLocation\"", "", $this->config["handler_path"]);
}
function Format($text, $formatter = "wakka") {
return $this->IncludeBuffered("formatters/".$formatter.".php", "Impossible de trouver le formateur \"$formatter\"", compact("text"));
}
// USERS
function LoadUser($name, $password = 0) { return $this->LoadSingle("select * from ".$this->config["table_prefix"]."users where name = '".mysql_escape_string($name)."' ".($password === 0 ? "" : "and password = '".mysql_escape_string($password)."'")." limit 1"); }
function LoadUsers() { return $this->LoadAll("select * from ".$this->config["table_prefix"]."users order by name"); }
function GetUserName() { if ($user = $this->GetUser()) $name = $user["name"]; else if (!$name = gethostbyaddr($_SERVER["REMOTE_ADDR"])) $name = $_SERVER["REMOTE_ADDR"]; return $name; }
function GetUser() { return (isset($_SESSION["user"]) ? $_SESSION["user"] : '');}
function SetUser($user, $remember=0) { $_SESSION["user"] = $user; $this->SetPersis/ all comment pages sorted by their first revision's (!) time. ugh!
// load ids of the first revisions of latest comments. err, huh?
if ($ids = $this->LoadAll("select min(id) as id from ".$this->config["table_prefix"]."pages where comment_on != '' group by tag order by id desc"))
{
// load complete comments
$num=0;
foreach ($ids as $id)
{
$comment = $this->LoadSingle("select * from ".$this->config["table_prefix"]."pages where id = '".$id["id"]."' limit 1");
if (!isset($comments[$comment["comment_on"]]) && $num < $limit)
{
$comments[$comment["comment_on"]] = $comment;
$num++;
}
}
// now load pages
if ($comments)
{
// now using these ids, load the actual pages
foreach ($comments as $comment)
{
$page = $this->LoadPage($comment["comment_on"]);
$page["comment_user"] = $comment["user"];
$page["comment_time"] = $comment["time"];
$page["comment_tag"] = $comment["tag"];
$pages[] = $page;
}
}
}
// load tags of pages
//return $this->LoadAll("select comment_on as tag, max(time) as time, tag as comment_tag, user from ".$this->config["table_prefix"]."pages where comment_on != '' group by comment_on order by time desc");
return $pages;
}
// ACCESS CONTROL
// returns true if logged in user is owner of current page, or page specified in $tag
function UserIsOwner($tag = "") {
// check if user is logged in
if (!$this->GetUser()) return false;
// set default tag
if (!$tag = trim($tag)) $tag = $this->GetPageTag();
// check if user is owner
if ($this->GetPageOwner($tag) == $this->GetUserName()) return true;
}
/**
* @param string $group The name of a group
* @return string the ACL associated with the group $gname
* @see UserIsInGroup to check if a user belongs to some group
*/
function GetGroupACL($group)
{
if (array_key_exists($group, $this->_groupsCache))
{
return $this->_groupsCache[$group];
}
return $this->_groupsCache[$group] = $this->GetTripleValue($group, WIKINI_VOC_ACLS, GROUP_PREFIX);
}
/**
* Checks if a new group acl is not defined recursively
* (this method expects that groups that are already defined are not themselves defined recursively...)
* @param string $gname The name of the group
* @param string $acl The new acl for that group
* @return boolean True iff the new acl defines the group recursively
*/
function MakesGroupRecursive($gname, $acl, $origin = null, $checked = array())
{
$gname = strtolower($gname);
if ($origin === null)
{
$origin = $gname;
}
elseif ($gname === $origin)
{
return true;
}
foreach (explode("\n", $acl) as $line)
{
if (!$line) continue;
if ($line[0] == '!')
{
$line = substr($line, 1);
}
if (!$line) continue;
if ($line[0] == '@')
{
$line = substr($line, 1);
if (!in_array($line, $checked))
{
if ($this->MakesGroupRecursive($line, $this->GetGroupACL($line), $origin, $checked))
{
return true;
}
}
}
}
$checked[] = $gname;
return false;
}
/**
* Sets a new ACL to a given group
* @param string $gname The name of a group
* @param string $acl The new ACL to associate with the group $gname
* @return int 0 if successful, a triple error code or a specific error code:
* 1000 if the new value would define the group recursively
* 1001 if $gname is not named with alphanumeric chars
* @see GetGroupACL
*/
function SetGroupACL($gname, $acl)
{
if (preg_match('/[^A-Za-z0-9]/', $gname))
{
return 1001;
}
$old = $this->GetGroupACL($gname);
if ($this->MakesGroupRecursive($gname, $acl))
{
return 1000;
}
$this->_groupsCache[$gname] = $acl;
if ($old === null)
{
return $this->InsertTriple($gname, WIKINI_VOC_ACLS, $acl, GROUP_PREFIX);
}
elseif ($old === $acl)
{
return 0; // nothing has changed
}
else
{
return $this->UpdateTriple($gname, WIKINI_VOC_ACLS, $old, $acl, GROUP_PREFIX);
}
}
/**
* @return array The list of all group names
*/
function GetGroupsList()
{
$res = $this->GetMatchingTriples(GROUP_PREFIX . '%', WIKINI_VOC_ACLS_URI);
$prefix_len = strlen(GROUP_PREFIX);
$list = array();
foreach ($res as $line)
{
$list[] = substr($line['resource'], $prefix_len);
}
return $list;
}
/**
* @param string $group The name of a group
* @return boolean true iff the user is in the given $group
*/
function UserIsInGroup($group, $user = null, $admincheck = true)
{
return $this->CheckACL($this->GetGroupACL($group), $user, $admincheck);
}
/**
* Checks if a given user is andministrator
* @param string $user The name of the user (defaults to the current user if not given)
* @return boolean true iff the user is an administrator
*/
function UserIsAdmin($user = null)
{
return $this->UserIsInGroup(ADMIN_GROUP, $user, false);
}
function GetPageOwner($tag = "", $time = "") { if (!$tag = trim($tag)) $tag = $this->GetPageTag(); if ($page = $this->LoadPage($tag, $time)) return $page["owner"]; }
function SetPageOwner($tag, $user) {
// check if user exists
if (!$this->LoadUser($user)) return;
// updated latest revision with new owner
$this->Query("update ".$this->config["table_prefix"]."pages set owner = '".mysql_escape_string($user)."' where tag = '".mysql_escape_string($tag)."' and latest = 'Y' limit 1");
}
function LoadAcl($tag, $privilege, $useDefaults = 1) {
if ((!$acl = $this->LoadSingle("select * from ".$this->config["table_prefix"]."acls where page_tag = '".mysql_escape_string($tag)."' and privilege = '".mysql_escape_string($privilege)."' limit 1")) && $useDefaults)
{
$acl = array("page_tag" => $tag, "privilege" => $privilege, "list" => $this->GetConfigValue("default_".$privilege."_acl"));
}
return $acl;
}
function SaveAcl($tag, $privilege, $list) {
if ($this->LoadAcl($tag, $privilege, 0)) $this->Query("update ".$this->config["table_prefix"]."acls set list = '".mysql_escape_string(trim(str_replace("\r", "", $list)))."' where page_tag = '".mysql_escape_string($tag)."' and privilege = '".mysql_escape_string($privilege)."' limit 1");
else $this->Query("insert into ".$this->config["table_prefix"]."acls set list = '".mysql_escape_string(trim(str_replace("\r", "", $list)))."', page_tag = '".mysql_escape_string($tag)."', privilege = '".mysql_escape_string($privilege)."'");
}
// returns true if $user (defaults to current user) has access to $privilege on $page_tag (defaults to current page)
function HasAccess($privilege, $tag = "", $user = "") {
// set defaults
if (!$tag = trim($tag)) $tag = $this->GetPageTag();
if (!$user)
{
// if current user is owner, return true. owner can do anything!
if ($this->UserIsOwner($tag)) return true;
$user = $this->GetUserName();
}
// TODO: we might want to check if a given $user (other than the current user)
// has access to a given page. If the $user is the owner of that page,
// this method might give a wrong result (because we can't check that)
// load acl
$acl = $this->LoadAcl($tag, $privilege);
// fine fine... now go through acl
return $this->CheckACL($acl["list"], $user);
}
/**
* Checks if some $user satisfies the given $acl
* @param string $acl The acl to check, in the same format than for pages ACL's
* @param string $user The name of the user that must satisfy the ACL. By default
* the current remote user.
* @return bool True if the $user satisfies the $acl, false otherwise
*/
function CheckACL($acl, $user = null, $admincheck = true)
{
if (!$user)
{
$user = $this->GetUserName();
}
if ($admincheck && $this->UserIsAdmin($user))
{
return true;
}
foreach (explode("\n", $acl) as $line)
{
$line = trim($line);
// check for inversion character "!"
if (preg_match("/^[!](.*)$/", $line, $matches))
{
$negate = 1;
$line = $matches[1];
}
else
{
$negate = 0;
}
// if there's still anything left... lines with just a "!" don't count!
if ($line)
{
switch ($line[0])
{
case "#": // comments
break;
case "*": // everyone
return !$negate;
case "+": // registered users
if (!$this->LoadUser($user))
{
return $negate;
}
else
{
return !$negate;
}
case '@': // groups
$gname = substr($line, 1);
// paranoiac: avoid line = '@'
if ($gname && $this->UserIsInGroup($gname, $user, false /* we have allready checked if user was an admin */))
{
return !$negate;
}
break;
default: // simple user entry
if ($line == $user)
{
return !$negate;
}
}
}
}
// tough luck.
return false;
}
/**
* Loads the module ACL for a certain module
* @param string $module The name of the module
* @param string $module_type The type of module: 'action' or 'handler'
* @return mixed The ACL for the given module or null if no such
* ACL was found (which should probably be interpreted as '*').
*/
function GetModuleACL($module, $module_type)
{
$module = strtolower($module);
switch ($module_type)
{
case 'action':
if (array_key_exists($module, $this->_actionsAclsCache))
{
$acl = $this->_actionsAclsCache[$module];
break;
}
$this->_actionsAclsCache[$module] = $acl = $this->GetTripleValue($module, WIKINI_VOC_ACLS, WIKINI_VOC_ACTIONS_PREFIX);
if ($acl === null)
{
$action = &$this->GetActionObject($module);
if (is_object($action))
{
return $this->_actionsAclsCache[$module] = $action->GetDefaultACL();
}
}
break;
case 'handler':
$acl = $this->GetTripleValue($module, WIKINI_VOC_ACLS, WIKINI_VOC_HANDLERS_PREFIX);
break;
default:
return null; // TODO error msg ?
}
return $acl === null ? '*' : $acl;
}
/**
* Sets the $acl for a given $module
* @param string $module The name of the module
* @param string $module_type The type of module ('action' or 'handler')
* @param string $acl The new ACL for that module
* @return 0 on success, > 0 on error (see InsertTriple and UpdateTriple)
*/
function SetModuleACL($module, $module_type, $acl)
{
$module = strtolower($module);
$voc_prefix = $module_type == 'action' ? WIKINI_VOC_ACTIONS_PREFIX : WIKINI_VOC_HANDLERS_PREFIX;
$old = $this->GetTripleValue($module, WIKINI_VOC_ACLS, $voc_prefix);
if ($module_type == 'action')
{
$this->_actionsAclsCache[$module] = $acl;
}
if ($old === null)
{
return $this->InsertTriple($module, WIKINI_VOC_ACLS, $acl, $voc_prefix);
}
elseif ($old === $acl)
{
return 0; // nothing has changed
}
else
{
return $this->UpdateTriple($module, WIKINI_VOC_ACLS, $old, $acl, $voc_prefix);
}
}
/**
* Checks if a $user satisfies the ACL to access a certain $module
* @param string $module The name of the module to access
* @param string $module_type The type of the module ('action' or 'handler')
* @param string $user The name of the user. By default
* the current remote user.
* @return bool True if the $user has access to the given $module, false otherwise.
*/
function CheckModuleACL($module, $module_type, $user = null)
{
$acl = $this->GetModuleACL($module, $module_type);
if ($acl === null) return true; // undefined ACL means everybody has access
return $this->CheckACL($acl, $user);
}
// MAINTENANCE
function Maintenance() {
// purge referrers
$this->PurgeReferrers();
// purge old page revisions
$this->PurgePages();
}
// THE BIG EVIL NASTY ONE!
function Run($tag, $method = "") {
if(!($this->GetMicroTime()%9)) $this->Maintenance();
$this->ReadInterWikiConfig();
// do our stuff!
if (!$this->method = trim($method)) $this->method = "show";
if (!$this->tag = trim($tag)) $this->Redirect($this->href("", $this->config["root_page"]));
if ((!$this->GetUser() && isset($_COOKIE["name"])) && ($user = $this->LoadUser($_COOKIE["name"], $_COOKIE["password"]))) $this->SetUser($user, $_COOKIE["remember"]);
$this->SetPage($this->LoadPage($tag, (isset($_REQUEST["time"]) ? $_REQUEST["time"] :'')));
$this->LogReferrer();
//correction pour un support plus facile de nouveaux handlers
if ($this->CheckModuleACL($this->method, 'handler'))
{
echo $this->Method($this->method);
}
else
{
ecikini",
"mysql_user" => "wikini",
"mysql_password" => '',
"table_prefix" => "wikini_",
"root_page" => "PagePrincipale",
"wakka_name" => "MonSiteWikiNi",
"base_url" => computeBaseURL($_rewrite_mode),
"rewrite_mode" => $_rewrite_mode,
'meta_keywords' => '',
'meta_description' => '',
"action_path" => "actions",
"handler_path" => "handlers",
"header_action" => "header",
"footer_action" => "footer",
"navigation_links" => "DerniersChangements :: DerniersCommentaires :: ParametresUtilisateur",
"referrers_purge_time" => 24,
"pages_purge_time" => 90,
"default_write_acl" => "*",
"default_read_acl" => "*",
"default_comment_acl" => "*",
"preview_before_save" => 0,
'allow_raw_html' => false);
unset($_rewrite_mode);
// load config
if (!$configfile = GetEnv("WAKKA_CONFIG")) $configfile = "wakka.config.php";
if (file_exists($configfile)) include($configfile);
$wakkaConfigLocation = $configfile;
$wakkaConfig = array_merge($wakkaDefaultConfig, $wakkaConfig);
// check for locking
if (file_exists("locked")) {
// read password from lockfile
$lines = file("locked");
$lockpw = trim($lines[0]);
// is authentification given?
if (isset($_SERVER["PHP_AUTH_USER"])) {
if (!(($_SERVER["PHP_AUTH_USER"] == "admin") && ($_SERVER["PHP_AUTH_PW"] == $lockpw))) {
$ask = 1;
}
} else {
$ask = 1;
}
if ($ask) {
header("WWW-Authenticate: Basic realm=\"".$wakkaConfig["wakka_name"]." Install/Upgrade Interface\"");
header("HTTP/1.0 401 Unauthorized");
echo "Ce site est en cours de mise à jour. Veuillez essayer plus tard." ;
exit;
}
}
// compare versions, start installer if necessary
if ($wakkaConfig["wakka_version"] && (!$wakkaConfig["wikini_version"])) { $wakkaConfig["wikini_version"]=$wakkaConfig["wakka_version"]; }
if (($wakkaConfig["wakka_version"] != WAKKA_VERSION) || ($wakkaConfig["wikini_version"] != WIKINI_VERSION)) {
// start installer
if (!isset($_REQUEST["installAction"]) OR !$installAction = trim($_REQUEST["installAction"])) $installAction = "default";
include("setup/header.php");
if (file_exists("setup/".$installAction.".php")) include("setup/".$installAction.".php"); else echo "Invalid action" ;
include("setup/footer.php");
exit;
}
// Check if the server is configured to automatically compress the output
if (!ini_get('zlib.output_compression') && !ini_get('zlib.output_handler'))
{
// Check if we can use ob_gzhandler (requires the zlib extension)
if (function_exists('ob_gzhandler'))
{
// let ob_gzhandler do the dirty job
// NB.: this must be done BEFORE session_start() when session.use_trans_sid is on
ob_start('ob_gzhandler');
}
// else lets do the dirty job by ourselves...
elseif (!empty($_SERVER['HTTP_ACCEPT_ENCODING']) && strstr($_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip') && function_exists('gzencode'))
{
ob_start ('gzencode');
// Tell the browser the content is compressed with gzip
header ("Content-Encoding: gzip");
}
}
// configuration du cookie de session
// determine le chemin pour les cookies
$a = parse_url($wakkaConfig['base_url'])te wiki object
$wiki = new Wiki($wakkaConfig);
// check for database access
if (!$wiki->dblink)
{
echo "Pour des raisons indépendantes de notre volonté, ". "le contenu de ce Wiki est temporairement inaccessible. Veuillez ". "réessayer ultérieurement, merci de votre ". "compréhension.
"; // Log error (useful to find the buggy server in a load balancing platform) trigger_error("WikiNi : DB connection failed"); exit; } // go! if (!isset($method)) $method=''; // Security (quick hack) : Check method syntax if (!(preg_match('#^[A-Za-z0-9_]*$#',$method))) { $method=''; } $wiki->Run($page, $method); ?>