1 <?php

     2 

     3 /*

     4  * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between

     5  * Version 1.1.1

     6  * Copyright (C) 2006-2007 Dan Fuhry

     7  * install.php - handles everything related to installation and initial configuration

     8  *

     9  * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

    10  * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

    11  *

    12  * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

    13  * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

    14  */

    15  

    16 @include('config.php');

    17 if( ( defined('ENANO_INSTALLED') || defined('MIDGET_INSTALLED') ) && ((isset($_GET['mode']) && ($_GET['mode']!='finish' && $_GET['mode']!='css') && $_GET['mode']!='showlicense') || !isset($_GET['mode'])))

    18 {

    19   $_GET['title'] = 'Enano:Installation_locked';

    20   require('includes/common.php');

    21   die_friendly('Installation locked', '<p>The Enano installer has found a Enano installation in this directory. You MUST delete config.php if you want to re-install Enano.</p><p>If you wish to upgrade an older Enano installation to this version, please use the <a href="upgrade.php">upgrade script</a>.</p>');

    22   exit;

    23 }

    24 

    25 define('IN_ENANO_INSTALL', 'true');

    26 

    27 define('ENANO_VERSION', '1.1.1');

    28 define('ENANO_CODE_NAME', 'Germination');

    29 // In beta versions, define ENANO_BETA_VERSION here

    30 

    31 // This is required to make installation work right

    32 define("ENANO_ALLOW_LOAD_NOLANG", 1);

    33 

    34 if(!defined('scriptPath')) {

    35   $sp = dirname($_SERVER['REQUEST_URI']);

    36   if($sp == '/' || $sp == '\\') $sp = '';

    37   define('scriptPath', $sp);

    38 }

    39 

    40 if(!defined('contentPath')) {

    41   $sp = dirname($_SERVER['REQUEST_URI']);

    42   if($sp == '/' || $sp == '\\') $sp = '';

    43   define('contentPath', $sp);

    44 }

    45 global $_starttime, $this_page, $sideinfo;

    46 $_starttime = microtime(true);

    47 

    48 global $db;

    49 

    50 // Determine directory (special case for development servers)

    51 if ( strpos(__FILE__, '/repo/') && file_exists('.enanodev') )

    52 {

    53   $filename = str_replace('/repo/', '/', __FILE__);

    54 }

    55 else

    56 {

    57   $filename = __FILE__;

    58 }

    59 

    60 define('ENANO_ROOT', dirname($filename));

    61 

    62 function is_page($p)

    63 {

    64   return true;

    65 }

    66 

    67 function microtime_float()

    68 {

    69   list($usec, $sec) = explode(" ", microtime());

    70   return ((float)$usec + (float)$sec);

    71 }

    72 

    73 require('includes/wikiformat.php');

    74 require('includes/constants.php');

    75 require('includes/rijndael.php');

    76 require('includes/functions.php');

    77 require('includes/dbal.php');

    78 require('includes/lang.php');

    79 require('includes/json.php');

    80 

    81 // Initialize language support

    82 $lang = new Language('eng');

    83 $lang->load_file('./language/english/install.json');

    84 

    85 strip_magic_quotes_gpc();

    86 

    87 //

    88 // INSTALLER LIBRARY

    89 //

    90 

    91 $neutral_color = 'C';

    92 

    93 function run_installer_stage($stage_id, $stage_name, $function, $failure_explanation, $allow_skip = true)

    94 {

    95   static $resumed = false;

    96   static $resume_stack = array();

    97   

    98   if ( empty($resume_stack) && isset($_POST['resume_stack']) && preg_match('/[a-z_]+((\|[a-z_]+)+)/', $_POST['resume_stack']) )

    99   {

   100     $resume_stack = explode('|', $_POST['resume_stack']);

   101   }

   102   

   103   $already_run = false;

   104   if ( in_array($stage_id, $resume_stack) )

   105   {

   106     $already_run = true;

   107   }

   108   

   109   if ( !$resumed )

   110   {

   111     if ( !isset($_GET['stage']) )

   112       $resumed = true;

   113     if ( isset($_GET['stage']) && $_GET['stage'] == $stage_id )

   114     {

   115       $resumed = true;

   116     }

   117   }

   118   if ( !$resumed && $allow_skip )

   119   {

   120     echo_stage_success($stage_id, $stage_name);

   121     return false;

   122   }

   123   if ( !function_exists($function) )

   124     die('libenanoinstall: CRITICAL: function "' . $function . '" for ' . $stage_id . ' doesn\'t exist');

   125   $result = @call_user_func($function, false, $already_run);

   126   if ( $result )

   127   {

   128     echo_stage_success($stage_id, $stage_name);

   129     $resume_stack[] = $stage_id;

   130     return true;

   131   }

   132   else

   133   {

   134     echo_stage_failure($stage_id, $stage_name, $failure_explanation, $resume_stack);

   135     return false;

   136   }

   137 }

   138 

   139 function start_install_table()

   140 {

   141   echo '<table border="0" cellspacing="0" cellpadding="0" style="margin-top: 10px;">' . "\n";

   142   ob_start();

   143 }

   144 

   145 function close_install_table()

   146 {

   147   echo '</table>' . "\n\n";

   148   ob_end_flush();

   149 }

   150 

   151 function echo_stage_success($stage_id, $stage_name)

   152 {

   153   global $neutral_color;

   154   $neutral_color = ( $neutral_color == 'A' ) ? 'C' : 'A';

   155   echo '<tr><td style="width: 500px; background-color: #' . "{$neutral_color}{$neutral_color}FF{$neutral_color}{$neutral_color}" . '; padding: 0 5px;">' . htmlspecialchars($stage_name) . '</td><td style="padding: 0 5px;"><img alt="Done" src="images/good.gif" /></td></tr>' . "\n";

   156   ob_flush();

   157 }

   158 

   159 function echo_stage_failure($stage_id, $stage_name, $failure_explanation, $resume_stack)

   160 {

   161   global $neutral_color;

   162   global $lang;

   163   

   164   $neutral_color = ( $neutral_color == 'A' ) ? 'C' : 'A';

   165   echo '<tr><td style="width: 500px; background-color: #' . "FF{$neutral_color}{$neutral_color}{$neutral_color}{$neutral_color}" . '; padding: 0 5px;">' . htmlspecialchars($stage_name) . '</td><td style="padding: 0 5px;"><img alt="Failed" src="images/bad.gif" /></td></tr>' . "\n";

   166   ob_flush();

   167   close_install_table();

   168   $post_data = '';

   169   $mysql_error = mysql_error();

   170   foreach ( $_POST as $key => $value )

   171   {

   172     // FIXME: These should really also be sanitized for double quotes

   173     $value = htmlspecialchars($value);

   174     $key = htmlspecialchars($key);

   175     $post_data .= "          <input type=\"hidden\" name=\"$key\" value=\"$value\" />\n";

   176   }

   177   echo '<form action="install.php?mode=install&amp;stage=' . $stage_id . '" method="post">

   178           ' . $post_data . '

   179           <input type="hidden" name="resume_stack" value="' . htmlspecialchars(implode('|', $resume_stack)) . '" />

   180           <h3>' . $lang->get('meta_msg_err_stagefailed_title') . '</h3>

   181            <p>' . $failure_explanation . '</p>

   182            ' . ( !empty($mysql_error) ? "<p>" . $lang->get('meta_msg_err_stagefailed_mysqlerror') . " $mysql_error</p>" : '' ) . '

   183            <p>' . $lang->get('meta_msg_err_stagefailed_body') . '</p>

   184            <p style="text-align: center;"><input type="submit" value="' . $lang->get('meta_btn_retry_installation') . '" /></p>

   185         </form>';

   186   global $template, $template_bak;

   187   if ( is_object($template_bak) )

   188     $template_bak->footer();

   189   else

   190     $template->footer();

   191   exit;

   192 }

   193 

   194 //

   195 // INSTALLER STAGES

   196 //

   197 

   198 function stg_mysql_connect($act_get = false)

   199 {

   200   global $db;

   201   $db = new mysql();

   202   

   203   static $conn = false;

   204   if ( $act_get )

   205     return $conn;

   206   

   207   $db_user =& $_POST['db_user'];

   208   $db_pass =& $_POST['db_pass'];

   209   $db_name =& $_POST['db_name'];

   210   

   211   if ( !preg_match('/^[a-z0-9_-]+$/', $db_name) )

   212   {

   213     $db_name = htmlspecialchars($db_name);

   214     die("<p>SECURITY: malformed database name \"$db_name\"</p>");

   215   }

   216   

   217   // First, try to connect using the normal credentials

   218   $conn = @mysql_connect($_POST['db_host'], $_POST['db_user'], $_POST['db_pass']);

   219   if ( !$conn )

   220   {

   221     // Connection failed. Do we have the root username and password?

   222     if ( !empty($_POST['db_root_user']) && !empty($_POST['db_root_pass']) )

   223     {

   224       $conn_root = @mysql_connect($_POST['db_host'], $_POST['db_root_user'], $_POST['db_root_pass']);

   225       if ( !$conn_root )

   226       {

   227         // Couldn't connect using either set of credentials. Bail out.

   228         return false;

   229       }

   230       unset($db_user, $db_pass);

   231       $db_user = mysql_real_escape_string($_POST['db_user']);

   232       $db_pass = mysql_real_escape_string($_POST['db_pass']);

   233       // Create the user account

   234       $q = @mysql_query("GRANT ALL PRIVILEGES ON test.* TO '{$db_user}'@'localhost' IDENTIFIED BY '$db_pass' WITH GRANT OPTION;", $conn_root);

   235       if ( !$q )

   236       {

   237         return false;

   238       }

   239       // Revoke privileges from test, we don't need them

   240       $q = @mysql_query("REVOKE ALL PRIVILEGES ON test.* FROM '{$db_user}'@'localhost';", $conn_root);

   241       if ( !$q )

   242       {

   243         return false;

   244       }

   245       if ( $_POST['db_host'] != 'localhost' && $_POST['db_host'] != '127.0.0.1' && $_POST['db_host'] != '::1' )

   246       {

   247         // If not connecting to a server running on localhost, allow from any host

   248         // this is safer than trying to detect the hostname of the webserver, but less secure

   249         $q = @mysql_query("GRANT ALL PRIVILEGES ON test.* TO '{$db_user}'@'%' IDENTIFIED BY '$db_pass' WITH GRANT OPTION;", $conn_root);

   250         if ( !$q )

   251         {

   252           return false;

   253         }

   254         // Revoke privileges from test, we don't need them

   255         $q = @mysql_query("REVOKE ALL PRIVILEGES ON test.* FROM '{$db_user}'@'%';", $conn_root);

   256         if ( !$q )

   257         {

   258           return false;

   259         }

   260       }

   261       mysql_close($conn_root);

   262       $conn = @mysql_connect($_POST['db_host'], $_POST['db_user'], $_POST['db_pass']);

   263       if ( !$conn )

   264       {

   265         // This should honestly never happen.

   266         return false;

   267       }

   268     }

   269   }

   270   $q = @mysql_query("USE `$db_name`;", $conn);

   271   if ( !$q )

   272   {

   273     // access denied to the database; try the whole root schenanegan again

   274     if ( !empty($_POST['db_root_user']) && !empty($_POST['db_root_pass']) )

   275     {

   276       $conn_root = @mysql_connect($_POST['db_host'], $_POST['db_root_user'], $_POST['db_root_pass']);

   277       if ( !$conn_root )

   278       {

   279         // Couldn't connect as root; bail out

   280         return false;

   281       }

   282       // create the database, if it doesn't exist

   283       $q = @mysql_query("CREATE DATABASE IF NOT EXISTS `$db_name`;", $conn_root);

   284       if ( !$q )

   285       {

   286         // this really should never fail, so don't give any tolerance to it

   287         return false;

   288       }

   289       unset($db_user, $db_pass);

   290       $db_user = mysql_real_escape_string($_POST['db_user']);

   291       $db_pass = mysql_real_escape_string($_POST['db_pass']);

   292       // we're in with root rights; grant access to the database

   293       $q = @mysql_query("GRANT ALL PRIVILEGES ON `$db_name`.* TO '{$db_user}'@'localhost';", $conn_root);

   294       if ( !$q )

   295       {

   296         return false;

   297       }

   298       if ( $_POST['db_host'] != 'localhost' && $_POST['db_host'] != '127.0.0.1' && $_POST['db_host'] != '::1' )

   299       {

   300         $q = @mysql_query("GRANT ALL PRIVILEGES ON `$db_name`.* TO '{$db_user}'@'%';", $conn_root);

   301         if ( !$q )

   302         {

   303           return false;

   304         }

   305       }

   306       mysql_close($conn_root);

   307       // grant tables have hopefully been flushed, kill and reconnect our regular user connection

   308       mysql_close($conn);

   309       $conn = @mysql_connect($_POST['db_host'], $_POST['db_user'], $_POST['db_pass']);

   310       if ( !$conn )

   311       {

   312         return false;

   313       }

   314     }

   315     else

   316     {

   317       return false;

   318     }

   319     // try again

   320     $q = @mysql_query("USE `$db_name`;", $conn);

   321     if ( !$q )

   322     {

   323       // really failed this time; bail out

   324       return false;

   325     }

   326   }

   327   // initialize DBAL

   328   $db->connect(true, $_POST['db_host'], $db_user, $db_pass, $db_name);

   329   // connected and database exists

   330   return true;

   331 }

   332 

   333 function stg_pgsql_connect($act_get = false)

   334 {

   335   global $db;

   336   $db = new postgresql();

   337   

   338   static $conn = false;

   339   if ( $act_get )

   340     return $conn;

   341   

   342   $db_user =& $_POST['db_user'];

   343   $db_pass =& $_POST['db_pass'];

   344   $db_name =& $_POST['db_name'];

   345   

   346   if ( !preg_match('/^[a-z0-9_-]+$/', $db_name) )

   347   {

   348     $db_name = htmlspecialchars($db_name);

   349     die("<p>SECURITY: malformed database name \"$db_name\"</p>");

   350   }

   351   

   352   // First, try to connect using the normal credentials

   353   $conn = @pg_connect("host={$_POST['db_host']} port=5432 user={$_POST['db_user']} password={$_POST['db_pass']}");

   354   if ( !$conn )

   355   {

   356     // Connection failed. Do we have the root username and password?

   357     if ( !empty($_POST['db_root_user']) && !empty($_POST['db_root_pass']) )

   358     {

   359       $conn_root = @pg_connect("host={$_POST['db_host']} port=5432 user={$_POST['db_root_user']} password={$_POST['db_root_pass']}");

   360       if ( !$conn_root )

   361       {

   362         // Couldn't connect using either set of credentials. Bail out.

   363         return false;

   364       }

   365       unset($db_user, $db_pass);

   366       $db_user = pg_escape_string($_POST['db_user']);

   367       $db_pass = pg_escape_string($_POST['db_pass']);

   368       // Create the user account

   369       $q = @pg_query("CREATE ROLE '$db_user' WITH NOSUPERUSER UNENCRYPTED PASSWORD '$db_pass';", $conn_root);

   370       if ( !$q )

   371       {

   372         return false;

   373       }

   374       pg_close($conn_root);

   375       $conn = @pg_connect("host={$_POST['db_host']} port=5432 user={$_POST['db_user']} password={$_POST['db_pass']}");

   376       if ( !$conn )

   377       {

   378         // This should honestly never happen.

   379         return false;

   380       }

   381     }

   382   }

   383   if ( !$q )

   384   {

   385     // access denied to the database; try the whole root schenanegan again

   386     if ( !empty($_POST['db_root_user']) && !empty($_POST['db_root_pass']) )

   387     {

   388       $conn_root = @pg_connect("host={$_POST['db_host']} port=5432 user={$_POST['db_root_user']} password={$_POST['db_root_pass']}");

   389       if ( !$conn_root )

   390       {

   391         // Couldn't connect as root; bail out

   392         return false;

   393       }

   394       unset($db_user, $db_pass);

   395       $db_user = pg_escape_string($_POST['db_user']);

   396       $db_pass = pg_escape_string($_POST['db_pass']);

   397       // create the database, if it doesn't exist

   398       $q = @mysql_query("CREATE DATABASE $db_name WITH OWNER $db_user;", $conn_root);

   399       if ( !$q )

   400       {

   401         // this really should never fail, so don't give any tolerance to it

   402         return false;

   403       }

   404       // Setting the owner to $db_user should grant all the rights we need

   405       pg_close($conn_root);

   406       // grant tables have hopefully been flushed, kill and reconnect our regular user connection

   407       pg_close($conn);

   408       $conn = @pg_connect("host={$_POST['db_host']} port=5432 user={$_POST['db_user']} password={$_POST['db_pass']}");

   409       if ( !$conn )

   410       {

   411         return false;

   412       }

   413     }

   414     else

   415     {

   416       return false;

   417     }

   418     // try again

   419     $q = @mysql_query("USE `$db_name`;", $conn);

   420     if ( !$q )

   421     {

   422       // really failed this time; bail out

   423       return false;

   424     }

   425   }

   426   // initialize DBAL

   427   $db->connect(true, $_POST['db_host'], $db_user, $db_pass, $db_name);

   428   // connected and database exists

   429   return true;

   430 }

   431 

   432 function stg_drop_tables()

   433 {

   434   global $db;

   435   // Our list of tables included in Enano

   436   $tables = Array( 'categories', 'comments', 'config', 'logs', 'page_text', 'session_keys', 'pages', 'users', 'users_extra', 'themes', 'buddies', 'banlist', 'files', 'privmsgs', 'sidebar', 'hits', 'search_index', 'groups', 'group_members', 'acl', 'tags', 'page_groups', 'page_group_members' );

   437   

   438   // Drop each table individually; if it fails, it probably means we're trying to drop a

   439   // table that didn't exist in the Enano version we're deleting the database for.

   440   foreach ( $tables as $table )

   441   {

   442     // Remember that table_prefix is sanitized.

   443     $table = "{$_POST['table_prefix']}$table";

   444     $db->sql_query("DROP TABLE $table;", $conn);

   445   }

   446   return true;

   447 }

   448 

   449 function stg_decrypt_admin_pass($act_get = false)

   450 {

   451   static $decrypted_pass = false;

   452   if ( $act_get )

   453     return $decrypted_pass;

   454   

   455   $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);

   456   

   457   if ( !empty($_POST['crypt_data']) )

   458   {

   459     require('config.new.php');

   460     if ( !isset($cryptkey) )

   461     {

   462       return false;

   463     }

   464     define('_INSTRESUME_AES_KEYBACKUP', $key);

   465     $key = hexdecode($cryptkey);

   466     

   467     $decrypted_pass = $aes->decrypt($_POST['crypt_data'], $key, ENC_HEX);

   468     

   469   }

   470   else

   471   {

   472     $decrypted_pass = $_POST['admin_pass'];

   473   }

   474   if ( empty($decrypted_pass) )

   475     return false;

   476   return true;

   477 }

   478 

   479 function stg_generate_aes_key($act_get = false)

   480 {

   481   static $key = false;

   482   if ( $act_get )

   483     return $key;

   484   

   485   $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);

   486   $key = $aes->gen_readymade_key();

   487   return true;

   488 }

   489 

   490 function stg_parse_schema($act_get = false)

   491 {

   492   static $schema;

   493   if ( $act_get )

   494     return $schema;

   495   

   496   global $db;

   497   

   498   $admin_pass = stg_decrypt_admin_pass(true);

   499   $key = stg_generate_aes_key(true);

   500   $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);

   501   $key = $aes->hextostring($key);

   502   $admin_pass = $aes->encrypt($admin_pass, $key, ENC_HEX);

   503   

   504   $cacheonoff = is_writable(ENANO_ROOT.'/cache/') ? '1' : '0';

   505   

   506   $admin_user = $_POST['admin_user'];

   507   $admin_user = str_replace('_', ' ', $admin_user);

   508   $admin_user = $db->escape($admin_user);

   509   

   510   switch ( $_POST['db_driver'] )

   511   {

   512     case 'mysql':

   513       $schema_file = 'schema.sql';

   514       break;

   515     case 'postgresql':

   516       $schema_file = 'schema-pg.sql';

   517       break;

   518   }

   519   

   520   if ( !isset($schema_file) )

   521     die('insanity');

   522   

   523   $schema = file_get_contents($schema_file);

   524   $schema = str_replace('{{SITE_NAME}}',    $db->escape($_POST['sitename']   ), $schema);

   525   $schema = str_replace('{{SITE_DESC}}',    $db->escape($_POST['sitedesc']   ), $schema);

   526   $schema = str_replace('{{COPYRIGHT}}',    $db->escape($_POST['copyright']  ), $schema);

   527   $schema = str_replace('{{ADMIN_USER}}',   $admin_user                                    , $schema);

   528   $schema = str_replace('{{ADMIN_PASS}}',   $db->escape($admin_pass          ), $schema);

   529   $schema = str_replace('{{ADMIN_EMAIL}}',  $db->escape($_POST['admin_email']), $schema);

   530   $schema = str_replace('{{ENABLE_CACHE}}', $db->escape($cacheonoff          ), $schema);

   531   $schema = str_replace('{{REAL_NAME}}',    '',                                              $schema);

   532   $schema = str_replace('{{TABLE_PREFIX}}', $_POST['table_prefix'],                          $schema);

   533   $schema = str_replace('{{VERSION}}',      ENANO_VERSION,                                   $schema);

   534   $schema = str_replace('{{ADMIN_EMBED_PHP}}', $_POST['admin_embed_php'],                    $schema);

   535   // Not anymore!! :-D

   536   // $schema = str_replace('{{BETA_VERSION}}', ENANO_BETA_VERSION,                              $schema);

   537   

   538   if(isset($_POST['wiki_mode']))

   539   {

   540     $schema = str_replace('{{WIKI_MODE}}', '1', $schema);

   541   }

   542   else

   543   {

   544     $schema = str_replace('{{WIKI_MODE}}', '0', $schema);

   545   }

   546   

   547   // Build an array of queries      

   548   $schema = explode("\n", $schema);

   549   

   550   foreach ( $schema as $i => $sql )

   551   {

   552     $query =& $schema[$i];

   553     $t = trim($query);

   554     if ( empty($t) || preg_match('/^(\#|--)/i', $t) )

   555     {

   556       unset($schema[$i]);

   557       unset($query);

   558     }

   559   }

   560   

   561   $schema = array_values($schema);

   562   $schema = implode("\n", $schema);

   563   $schema = explode(";\n", $schema);

   564   

   565   foreach ( $schema as $i => $sql )

   566   {

   567     $query =& $schema[$i];

   568     if ( substr($query, ( strlen($query) - 1 ), 1 ) != ';' )

   569     {

   570       $query .= ';';

   571     }

   572   }

   573   

   574   return true;

   575 }

   576 

   577 function stg_install($_unused, $already_run)

   578 {

   579   // This one's pretty easy.

   580   $conn = stg_mysql_connect(true);

   581   if ( !is_resource($conn) )

   582     return false;

   583   $schema = stg_parse_schema(true);

   584   if ( !is_array($schema) )

   585     return false;

   586   

   587   // If we're resuming installation, the encryption key was regenerated.

   588   // This means we'll have to update the encrypted password in the database.

   589   if ( $already_run )

   590   {

   591     $admin_pass = stg_decrypt_admin_pass(true);

   592     $key = stg_generate_aes_key(true);

   593     $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);

   594     $key = $aes->hextostring($key);

   595     $admin_pass = $aes->encrypt($admin_pass, $key, ENC_HEX);

   596     $admin_user = mysql_real_escape_string($_POST['admin_user']);

   597     $admin_user = str_replace('_', ' ', $admin_user);

   598     

   599     $q = @mysql_query("UPDATE {$_POST['table_prefix']}users SET password='$admin_pass' WHERE username='$admin_user';");

   600     if ( !$q )

   601     {

   602       echo '<p><tt>MySQL return: ' . mysql_error() . '</tt></p>';

   603       return false;

   604     }

   605     

   606     return true;

   607   }

   608   

   609   // OK, do the loop, baby!!!

   610   foreach($schema as $q)

   611   {

   612     $r = mysql_query($q, $conn);

   613     if ( !$r )

   614     {

   615       echo '<p><tt>MySQL return: ' . mysql_error() . '</tt></p>';

   616       return false;

   617     }

   618   }

   619   

   620   return true;

   621 }

   622 

   623 function stg_write_config()

   624 {

   625   $privkey = stg_generate_aes_key(true);

   626   

   627   switch($_POST['urlscheme'])

   628   {

   629     case "ugly":

   630     default:

   631       $cp = scriptPath.'/index.php?title=';

   632       break;

   633     case "short":

   634       $cp = scriptPath.'/index.php/';

   635       break;

   636     case "tiny":

   637       $cp = scriptPath.'/';

   638       break;

   639   }

   640   

   641   if ( $_POST['urlscheme'] == 'tiny' )

   642   {

   643     $contents = '# Begin Enano rules

   644 RewriteEngine on

   645 RewriteCond %{REQUEST_FILENAME} !-d

   646 RewriteCond %{REQUEST_FILENAME} !-f

   647 RewriteRule ^(.+) '.scriptPath.'/index.php?title=$1 [L,QSA]

   648 RewriteRule \.(php|html|gif|jpg|png|css|js)$ - [L]

   649 # End Enano rules

   650 ';

   651     if ( file_exists('./.htaccess') )

   652       $ht = fopen(ENANO_ROOT.'/.htaccess', 'a+');

   653     else

   654       $ht = fopen(ENANO_ROOT.'/.htaccess.new', 'w');

   655     if ( !$ht )

   656       return false;

   657     fwrite($ht, $contents);

   658     fclose($ht);

   659   }

   660 

   661   $config_file = '<?php

   662 /* Enano auto-generated configuration file - editing not recommended! */

   663 $dbhost   = \''.addslashes($_POST['db_host']).'\';

   664 $dbname   = \''.addslashes($_POST['db_name']).'\';

   665 $dbuser   = \''.addslashes($_POST['db_user']).'\';

   666 $dbpasswd = \''.addslashes($_POST['db_pass']).'\';

   667 if ( !defined(\'ENANO_CONSTANTS\') )

   668 {

   669 define(\'ENANO_CONSTANTS\', \'\');

   670 define(\'table_prefix\', \''.addslashes($_POST['table_prefix']).'\');

   671 define(\'scriptPath\', \''.scriptPath.'\');

   672 define(\'contentPath\', \''.$cp.'\');

   673 define(\'ENANO_INSTALLED\', \'true\');

   674 }

   675 $crypto_key = \''.$privkey.'\';

   676 ?>';

   677 

   678   $cf_handle = fopen(ENANO_ROOT.'/config.new.php', 'w');

   679   if ( !$cf_handle )

   680     return false;

   681   fwrite($cf_handle, $config_file);

   682   

   683   fclose($cf_handle);

   684   

   685   return true;

   686 }

   687 

   688 function _stg_rename_config_revert()

   689 {

   690   if ( file_exists('./config.php') )

   691   {

   692     @rename('./config.php', './config.new.php');

   693   }

   694   

   695   $handle = @fopen('./config.php.new', 'w');

   696   if ( !$handle )

   697     return false;

   698   $contents = '<?php $cryptkey = \'' . _INSTRESUME_AES_KEYBACKUP . '\'; ?>';

   699   fwrite($handle, $contents);

   700   fclose($handle);

   701   return true;

   702 }

   703 

   704 function stg_build_index()

   705 {

   706   global $db, $session, $paths, $template, $plugins; // Common objects;

   707   if ( $paths->rebuild_search_index() )

   708     return true;

   709   return false;

   710 }

   711 

   712 function stg_rename_config()

   713 {

   714   if ( !@rename('./config.new.php', './config.php') )

   715   {

   716     echo '<p>Can\'t rename config.php</p>';

   717     _stg_rename_config_revert();

   718     return false;

   719   }

   720   

   721   if ( $_POST['urlscheme'] == 'tiny' && !file_exists('./.htaccess') )

   722   {

   723     if ( !@rename('./.htaccess.new', './.htaccess') )

   724     {

   725       echo '<p>Can\'t rename .htaccess</p>';

   726       _stg_rename_config_revert();

   727       return false;

   728     }

   729   }

   730   return true;

   731 }

   732 

   733 function stg_start_api_success()

   734 {

   735   return true;

   736 }

   737 

   738 function stg_start_api_failure()

   739 {

   740   return false;

   741 }

   742 

   743 function stg_import_language()

   744 {

   745   global $db, $session, $paths, $template, $plugins; // Common objects

   746   

   747   $lang_file = ENANO_ROOT . "/language/english/enano.json";

   748   install_language("eng", "English", "English", $lang_file);

   749   

   750   return true;

   751 }

   752 

   753 function stg_init_logs()

   754 {

   755   global $db, $session, $paths, $template, $plugins; // Common objects

   756   

   757   $q = $db->sql_query('INSERT INTO ' . table_prefix . 'logs(log_type,action,time_id,date_string,author,page_text,edit_summary) VALUES(\'security\', \'install_enano\', ' . time() . ', \'' . enano_date('d M Y h:i a') . '\', \'' . mysql_real_escape_string($_POST['admin_user']) . '\', \'' . mysql_real_escape_string(ENANO_VERSION) . '\', \'' . mysql_real_escape_string($_SERVER['REMOTE_ADDR']) . '\');');

   758   if ( !$q )

   759   {

   760     echo '<p><tt>MySQL return: ' . mysql_error() . '</tt></p>';

   761     return false;

   762   }

   763   

   764   if ( !$session->get_permissions('clear_logs') )

   765   {

   766     echo '<p><tt>$session: denied clear_logs</tt></p>';

   767     return false;

   768   }

   769   

   770   PageUtils::flushlogs('Main_Page', 'Article');

   771   

   772   return true;

   773 }

   774 

   775 //die('Key size: ' . AES_BITS . '<br />Block size: ' . AES_BLOCKSIZE);

   776 

   777 if(!function_exists('wikiFormat'))

   778 {

   779   function wikiFormat($message, $filter_links = true)

   780   {

   781     $wiki = & Text_Wiki::singleton('Mediawiki');

   782     $wiki->setRenderConf('Xhtml', 'code', 'css_filename', 'codefilename');

   783     $wiki->setRenderConf('Xhtml', 'wikilink', 'view_url', contentPath);

   784     $result = $wiki->transform($message, 'Xhtml');

   785     

   786     // HTML fixes

   787     $result = preg_replace('#<tr>([\s]*?)<\/tr>#is', '', $result);

   788     $result = preg_replace('#<p>([\s]*?)<\/p>#is', '', $result);

   789     $result = preg_replace('#<br />([\s]*?)<table#is', '<table', $result);

   790     

   791     return $result;

   792   }

   793 }

   794 

   795 global $failed, $warned;

   796 

   797 $failed = false;

   798 $warned = false;

   799 

   800 function not($var)

   801 {

   802   if($var)

   803   {

   804     return false;

   805   } 

   806   else

   807   {

   808     return true;

   809   }

   810 }

   811 

   812 function run_test($code, $desc, $extended_desc, $warn = false)

   813 {

   814   global $failed, $warned;

   815   static $cv = true;

   816   $cv = not($cv);

   817   $val = eval($code);

   818   if($val)

   819   {

   820     if($cv) $color='CCFFCC'; else $color='AAFFAA';

   821     echo "<tr><td style='background-color: #$color; width: 500px; padding: 5px;'>$desc</td><td style='padding-left: 10px;'><img alt='Test passed' src='images/good.gif' /></td></tr>";

   822   } elseif(!$val && $warn) {

   823     if($cv) $color='FFFFCC'; else $color='FFFFAA';

   824     echo "<tr><td style='background-color: #$color; width: 500px; padding: 5px;'>$desc<br /><b>$extended_desc</b></td><td style='padding-left: 10px;'><img alt='Test passed with warning' src='images/unknown.gif' /></td></tr>";

   825     $warned = true;

   826   } else {

   827     if($cv) $color='FFCCCC'; else $color='FFAAAA';

   828     echo "<tr><td style='background-color: #$color; width: 500px; padding: 5px;'>$desc<br /><b>$extended_desc</b></td><td style='padding-left: 10px;'><img alt='Test failed' src='images/bad.gif' /></td></tr>";

   829     $failed = true;

   830   }

   831 }

   832 function is_apache() { $r = strstr($_SERVER['SERVER_SOFTWARE'], 'Apache') ? true : false; return $r; }

   833 

   834 function show_license($fb = false)

   835 {

   836   global $lang;

   837   ?>

   838   <div style="height: 500px; clip: rect(0px,auto,500px,auto); overflow: auto; padding: 10px; border: 1px dashed #456798; margin: 1em;">

   839   <?php

   840     if ( !file_exists('./GPL') || !file_exists('./language/english/install/license-deed.html') )

   841     {

   842       echo 'Cannot find the license files.';

   843     }

   844     echo file_get_contents('./language/english/install/license-deed.html');

   845     if ( defined('ENANO_BETA_VERSION') || $branch == 'unstable' )

   846     {

   847       ?>

   848       <h3><?php echo $lang->get('license_info_unstable_title'); ?></h3>

   849       <p><?php echo $lang->get('license_info_unstable_body'); ?></p>

   850       <?php

   851     }

   852     ?>

   853     <h3><?php echo $lang->get('license_section_gpl_heading'); ?></h3>

   854     <?php if ( $lang->lang_code != 'eng' ): ?>

   855     <p><i><?php echo $lang->get('license_gpl_blurb_inenglish'); ?></i></p>

   856     <?php endif; ?>

   857     <?php echo wikiFormat(file_get_contents(ENANO_ROOT . '/GPL')); ?>

   858    <?php

   859    global $template;

   860    if ( $fb )

   861    {

   862      echo '<p style="text-align: center;">Because I could never find the Create a Page button in PHP-Nuke.</p>';

   863      echo '<p>' . str_replace('http://enanocms.org/', 'http://www.2robots.com/2003/10/15/web-portals-suck/', $template->fading_button) . '</p>';

   864      echo '<p style="text-align: center;">It\'s not a portal, my friends.</p>';

   865    }

   866    ?>

   867  </div>

   868  <?php

   869 }

   870 

   871 require_once('includes/template.php');

   872 

   873 if(!isset($_GET['mode']))

   874 {

   875   $_GET['mode'] = 'welcome';

   876 }

   877 switch($_GET['mode'])

   878 {

   879   case 'mysql_test':

   880     error_reporting(0);

   881     $dbhost     = rawurldecode($_POST['host']);

   882     $dbname     = rawurldecode($_POST['name']);

   883     $dbuser     = rawurldecode($_POST['user']);

   884     $dbpass     = rawurldecode($_POST['pass']);

   885     $dbrootuser = rawurldecode($_POST['root_user']);

   886     $dbrootpass = rawurldecode($_POST['root_pass']);

   887     if($dbrootuser != '')

   888     {

   889       $conn = mysql_connect($dbhost, $dbrootuser, $dbrootpass);

   890       if(!$conn)

   891       {

   892         $e = mysql_error();

   893         if(strstr($e, "Lost connection"))

   894           die('host'.$e);

   895         else

   896           die('root'.$e);

   897       }

   898       $rsp = 'good';

   899       $q = mysql_query('USE `' . mysql_real_escape_string($dbname) . '`;', $conn);

   900       if(!$q)

   901       {

   902         $e = mysql_error();

   903         if(strstr($e, 'Unknown database'))

   904         {

   905           $rsp .= '_creating_db';

   906         }

   907       }

   908       mysql_close($conn);

   909       $conn = mysql_connect($dbhost, $dbuser, $dbpass);

   910       if(!$conn)

   911       {

   912         $e = mysql_error();

   913         if(strstr($e, "Lost connection"))

   914           die('host'.$e);

   915         else

   916           $rsp .= '_creating_user';

   917       }

   918       mysql_close($conn);

   919       die($rsp);

   920     }

   921     else

   922     {

   923       $conn = mysql_connect($dbhost, $dbuser, $dbpass);

   924       if(!$conn)

   925       {

   926         $e = mysql_error();

   927         if(strstr($e, "Lost connection"))

   928           die('host'.$e);

   929         else

   930           die('auth'.$e);

   931       }

   932       $q = mysql_query('USE `' . mysql_real_escape_string($dbname) . '`;', $conn);

   933       if(!$q)

   934       {

   935         $e = mysql_error();

   936         if(strstr($e, 'Unknown database'))

   937         {

   938           die('name'.$e);

   939         }

   940         else

   941         {

   942           die('perm'.$e);

   943         }

   944       }

   945     }

   946     $v = mysql_get_server_info();

   947     if(version_compare($v, '4.1.17', '<')) die('vers'.$v);

   948     mysql_close($conn);

   949     die('good');

   950     break;

   951   case 'pgsql_test':

   952     error_reporting(0);

   953     $dbhost     = rawurldecode($_POST['host']);

   954     $dbname     = rawurldecode($_POST['name']);

   955     $dbuser     = rawurldecode($_POST['user']);

   956     $dbpass     = rawurldecode($_POST['pass']);

   957     $dbrootuser = rawurldecode($_POST['root_user']);

   958     $dbrootpass = rawurldecode($_POST['root_pass']);

   959     if($dbrootuser != '')

   960     {

   961       $conn = @pg_connect("host=$dbhost port=5432 user=$dbuser password=$dbpass dbname=$dbname");

   962       if(!$conn)

   963       {

   964         $e = pg_last_error();

   965         if(strstr($e, "Lost connection"))

   966           die('host'.$e);

   967         else

   968           die('root'.$e);

   969       }

   970       $rsp = 'good';

   971       $q = mysql_query('USE `' . mysql_real_escape_string($dbname) . '`;', $conn);

   972       if(!$q)

   973       {

   974         $e = mysql_error();

   975         if(strstr($e, 'Unknown database'))

   976         {

   977           $rsp .= '_creating_db';

   978         }

   979       }

   980       mysql_close($conn);

   981       $conn = mysql_connect($dbhost, $dbuser, $dbpass);

   982       if(!$conn)

   983       {

   984         $e = mysql_error();

   985         if(strstr($e, "Lost connection"))

   986           die('host'.$e);

   987         else

   988           $rsp .= '_creating_user';

   989       }

   990       mysql_close($conn);

   991       die($rsp);

   992     }

   993     else

   994     {

   995       $conn = mysql_connect($dbhost, $dbuser, $dbpass);

   996       if(!$conn)

   997       {

   998         $e = mysql_error();

   999         if(strstr($e, "Lost connection"))

  1000           die('host'.$e);

  1001         else

  1002           die('auth'.$e);

  1003       }

  1004       $q = mysql_query('USE `' . mysql_real_escape_string($dbname) . '`;', $conn);

  1005       if(!$q)

  1006       {

  1007         $e = mysql_error();

  1008         if(strstr($e, 'Unknown database'))

  1009         {

  1010           die('name'.$e);

  1011         }

  1012         else

  1013         {

  1014           die('perm'.$e);

  1015         }

  1016       }

  1017     }

  1018     $v = mysql_get_server_info();

  1019     if(version_compare($v, '4.1.17', '<')) die('vers'.$v);

  1020     mysql_close($conn);

  1021     die('good');

  1022     break;  

  1023   case 'pophelp':

  1024     $topic = ( isset($_GET['topic']) ) ? $_GET['topic'] : 'invalid';

  1025     switch($topic)

  1026     {

  1027       case 'admin_embed_php':

  1028         $title = $lang->get('pophelp_admin_embed_php_title');

  1029         $content = $lang->get('pophelp_admin_embed_php_body');

  1030         break;

  1031       case 'url_schemes':

  1032         $title = $lang->get('pophelp_url_schemes_title');

  1033         $content = $lang->get('pophelp_url_schemes_body');

  1034         break;

  1035       default:

  1036         $title = 'Invalid topic';

  1037         $content = 'Invalid help topic.';

  1038         break;

  1039     }

  1040     $close_window = $lang->get('pophelp_btn_close_window');

  1041     echo <<<EOF

  1042 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">

  1043 <html>

  1044   <head>

  1045     <title>Enano installation quick help &bull; {$title}</title>

  1046     <meta http-equiv="Content-type" content="text/html; charset=utf-8" />

  1047     <style type="text/css">

  1048       body {

  1049         font-family: trebuchet ms, verdana, arial, helvetica, sans-serif;

  1050         font-size: 9pt;

  1051       }

  1052       h2          { border-bottom: 1px solid #90B0D0; margin-bottom: 0; }

  1053       h3          { font-size: 11pt; font-weight: bold; }

  1054       li          { list-style: url(../images/bullet.gif); }

  1055       p           { margin: 1.0em; }

  1056       blockquote  { background-color: #F4F4F4; border: 1px dotted #406080; margin: 1em; padding: 10px; max-height: 250px; overflow: auto; }

  1057       a           { color: #7090B0; }

  1058       a:hover     { color: #90B0D0; }

  1059     </style>

  1060   </head>

  1061   <body>

  1062     <h2>{$title}</h2>

  1063     {$content}

  1064     <p style="text-align: right;">

  1065       <a href="#" onclick="window.close(); return false;">{$close_window}</a>

  1066     </p>

  1067   </body>

  1068 </html>

  1069 EOF;

  1070     exit;

  1071     break;

  1072   case 'langjs':

  1073     header('Content-type: text/javascript');

  1074     $lang_js = enano_json_encode($lang->strings);

  1075     // use EEOF here because jEdit misinterprets "typ'eof'"

  1076     echo <<<EEOF

  1077 if ( typeof(enano_lang) != 'object' )

  1078   var enano_lang = new Object();

  1079 

  1080 enano_lang[1] = $lang_js;

  1081 

  1082 EEOF;

  1083     exit;

  1084     break;

  1085   default:

  1086     break;

  1087 }

  1088 

  1089 $template = new template_nodb();

  1090 $template->load_theme('stpatty', 'shamrock', false);

  1091 

  1092 $modestrings = Array(

  1093               'welcome' => $lang->get('welcome_modetitle'),

  1094               'license' => $lang->get('license_modetitle'),

  1095               'sysreqs' => $lang->get('sysreqs_modetitle'),

  1096               'database' => $lang->get('database_modetitle'),

  1097               'database_mysql'=> $lang->get('database_mysql_modetitle'),

  1098               'database_pgsql'=> $lang->get('database_pgsql_modetitle'),

  1099               'website' => $lang->get('website_modetitle'), 

  1100               'login'   => $lang->get('login_modetitle'),

  1101               'confirm' => $lang->get('confirm_modetitle'),

  1102               'install' => $lang->get('install_modetitle'),

  1103               'finish'  => $lang->get('finish_modetitle'),

  1104               '_hiddenstages' => '...', // all stages below this line are hidden

  1105               'showlicense' => $lang->get('license_modetitle')

  1106             );

  1107 

  1108 $sideinfo = '';

  1109 $vars = $template->extract_vars('elements.tpl');

  1110 $p = $template->makeParserText($vars['sidebar_button']);

  1111 $hidden = false;

  1112 foreach ( $modestrings as $id => $str )

  1113 {

  1114   if ( $_GET['mode'] == $id )

  1115   {

  1116     $flags = 'style="font-weight: bold; text-decoration: underline;"';

  1117     $this_page = $str;

  1118   }

  1119   else

  1120   {

  1121     $flags = '';

  1122   }

  1123   if ( $id == '_hiddenstages' )

  1124     $hidden = true;

  1125   if ( !$hidden )

  1126   {

  1127     $p->assign_vars(Array(

  1128         'HREF' => '#',

  1129         'FLAGS' => $flags . ' onclick="return false;"',

  1130         'TEXT' => $str

  1131       ));

  1132     $sideinfo .= $p->run();

  1133   }

  1134 }

  1135