' + $lang.get('user_login_success_short') + '
\ +
' + $lang.get('user_login_success_short') + '
\ +
$debug"; } class mysql { - var $num_queries, $query_backtrace, $latest_result, $latest_query, $_conn, $sql_stack_fields, $sql_stack_values; + var $num_queries, $query_backtrace, $query_times, $query_sources, $latest_result, $latest_query, $_conn, $sql_stack_fields, $sql_stack_values, $debug; var $row = array(); var $rowset = array(); var $errhandler; function enable_errorhandler() { + // echo "DBAL: enabling error handler
Enano has caught and prevented an SQL injection attempt. Your IP address has been recorded and the administrator has been notified.
Query was:
'.htmlspecialchars($q).''); } + $time_start = microtime_float(); $r = mysql_query($q, $this->_conn); + $this->query_times[$q] = microtime_float() - $time_start; $this->latest_result = $r; $this->disable_errorhandler(); return $r; @@ -214,8 +243,9 @@ function sql_unbuffered_query($q) { $this->enable_errorhandler(); + $this->num_queries++; - $this->query_backtrace .= '(UNBUFFERED) ' . $q."\n"; + $this->query_backtrace[] = '(UNBUFFERED) ' . $q; $this->latest_query = $q; dc_here('dbal: making SQL query:
Enano has caught and prevented an SQL injection attempt. Your IP address has been recorded and the administrator has been notified.
Query was:
'.htmlspecialchars($q).''); } + $time_start = microtime_float(); $r = mysql_unbuffered_query($q, $this->_conn); + $this->query_times[$q] = microtime_float() - $time_start; $this->latest_result = $r; $this->disable_errorhandler(); return $r; @@ -681,6 +713,79 @@ return false; } } + /** + * Generates and outputs a report of all the SQL queries made during execution. Should only be called after everything's over with. + */ + + function sql_report() + { + global $db, $session, $paths, $template, $plugins; // Common objects + if ( !$session->get_permissions('mod_misc') ) + { + die_friendly('Access denied', '
You are not authorized to generate a SQL backtrace.
'); + } + // Create copies of variables that may be changed after header is called + $backtrace = $this->query_backtrace; + $times = $this->query_times; + $template->header(); + echo '| SQL backtrace for a normal page load of ' . htmlspecialchars($paths->cpage['urlname']) . ' | +|
|---|---|
| + | |
| Query: | +' . htmlspecialchars($query) . ' |
+
| Time: | +' . number_format($this->query_times[$query], 6) . ' seconds | +
| Unbuffered: | +' . ( $unbuffered ? 'Yes' : 'No' ) . ' | +
| Called from: | +' . $this->query_sources[$query] . ' | +
| + Total time taken for SQL queries: ' . round( $query_time_total, 6 ) . ' seconds + | +|
There are no subcategories in this category.
'; - echo '| ' . htmlspecialchars($paths->pages[$paths->nslist[$row['namespace']].$row['page_id']]['name']) . ' | '; - if ( $ticker == 2 ) - { - echo '
There are no pages in this category.
'; - } - echo '| '.htmlspecialchars($paths->pages[$paths->nslist[$row['namespace']].$row['page_id']]['name']).' | '; - if ( $ticker == 2 ) - { - echo '
';
+ }
$texts = Array();
$textq = $db->sql_unbuffered_query($this->fetch_page_search_resource());
if(!$textq) $db->_die('');
while($row = $db->fetchrow())
{
+ if ( $verbose )
+ {
+ ob_start();
+ echo "Indexing page " . $this->nslist[$row['namespace']] . sanitize_page_id($row['page_id']) . "
";
+ ob_flush();
+ while (@ob_end_flush());
+ flush();
+ }
if ( isset($this->nslist[$row['namespace']]) )
{
$idstring = $this->nslist[$row['namespace']] . sanitize_page_id($row['page_id']);
@@ -710,7 +724,19 @@
}
$texts[(string)$row['page_idstring']] = $row['page_text'] . ' ' . $page['name'];
}
+ if ( $verbose )
+ {
+ ob_start();
+ echo "Calculating word list...";
+ ob_flush();
+ while (@ob_end_flush());
+ flush();
+ }
$search->buildIndex($texts);
+ if ( $verbose )
+ {
+ echo '
'.print_r($search->index, true).''; // return; $q = $db->sql_query('DELETE FROM '.table_prefix.'search_index'); diff -r dc08c70ca550 -r e2cb5f1432c8 includes/rijndael.php --- a/includes/rijndael.php Sun Dec 02 15:27:21 2007 -0500 +++ b/includes/rijndael.php Sun Dec 02 16:00:10 2007 -0500 @@ -16,10 +16,13 @@ define ('ENC_BASE64', 202); define ('ENC_BINARY', 203); +$_aes_objcache = array(); + class AESCrypt { var $debug = false; var $mcrypt = false; + var $decrypt_cache = array(); // Rijndael parameters -- Valid values are 128, 192, or 256 @@ -128,6 +131,18 @@ $this->debug = $debug; } + function singleton($key_size, $block_size) + { + global $_aes_objcache; + if ( isset($_aes_objcache["$key_size,$block_size"]) ) + { + return $_aes_objcache["$key_size,$block_size"]; + } + + $_aes_objcache["$key_size,$block_size"] = new AESCrypt($key_size, $block_size); + return $_aes_objcache["$key_size,$block_size"]; + } + // Error handler function trigger_error($text, $level = E_USER_NOTICE) @@ -804,6 +819,14 @@ { if ( $text == '' ) return ''; + $text_orig = $text; + if ( isset($this->decrypt_cache[$key]) && is_array($this->decrypt_cache[$key]) ) + { + if ( isset($this->decrypt_cache[$key][$text]) ) + { + return $this->decrypt_cache[$key][$text]; + } + } switch($input_encoding) { case ENC_BINARY: @@ -838,6 +861,11 @@ } $dypt = $this->byteArrayToString($dypt); } + if ( !isset($this->decrypt_cache[$key]) ) + $this->decrypt_cache[$key] = array(); + + $this->decrypt_cache[$key][$text_orig] = $dypt; + return $dypt; } diff -r dc08c70ca550 -r e2cb5f1432c8 includes/search.php --- a/includes/search.php Sun Dec 02 15:27:21 2007 -0500 +++ b/includes/search.php Sun Dec 02 16:00:10 2007 -0500 @@ -19,7 +19,7 @@ * @param array $arr2 * @return array */ - + function enano_safe_array_merge($arr1, $arr2) { $arr3 = $arr1; @@ -34,7 +34,7 @@ * In Enano versions prior to 1.0.2, this class provided a search function that was keyword-based and allowed boolean searches. It was * cut from Coblynau and replaced with perform_search(), later in this file, because of speed issues. Now mostly deprecated. The only * thing remaining is the buildIndex function, which is still used by the path manager and the new search framework. - * + * * @package Enano * @subpackage Page management frontend * @license GNU General Public License
(indexable) ' . htmlspecialchars(print_r($query, true)) . '(non-indexable) ' . htmlspecialchars(print_r($query_phrase, true)) . ''); - + if ( $row = $db->fetchrow() ) { do { $id =& $row['id']; + $inc = 1; + + // Is this search term present in the page's title? If so, give extra points + preg_match("/^ns=$ns_list;pid=(.+)$/", $id, $piecesparts); + $pathskey = $paths->nslist[ $piecesparts[1] ] . sanitize_page_id($piecesparts[2]); + if ( isset($paths->pages[$pathskey]) ) + { + $test_func = ( $case_sensitive ) ? 'strstr' : 'stristr'; + foreach ( array_merge($query_phrase['any'], $query_phrase['req']) as $term ) + { + if ( $test_func($paths->pages[$pathskey]['name'], $term) || $test_func($paths->pages[$pathskey]['urlname_nons'], $term) ) + { + $inc = 1.5; + break; + } + } + } if ( isset($scores[$id]) ) { - $scores[$id]++; + $scores[$id] = $scores[$id] + $inc; } else { - $scores[$id] = 1; + $scores[$id] = $inc; } } while ( $row = $db->fetchrow() ); } $db->free_result(); } - + // // STAGE 4 - SELECT PAGE TEXT AND ELIMINATE NOTS // At this point, we have a complete list of all the possible pages. Now we want to obtain the page text, and within the same query // eliminate any terms that shouldn't be in there. // - + // Generate master word list for the highlighter $word_list = array_values(array_merge($query['any'], $query['req'], $query_phrase['any'], $query_phrase['req'])); - + $text_where = array(); foreach ( $scores as $page_id => $_ ) { $text_where[] = $db->escape($page_id); } $text_where = '( CONCAT("ns=",t.namespace,";pid=",t.page_id) = \'' . implode('\' OR CONCAT("ns=",t.namespace,";pid=",t.page_id) = \'', $text_where) . '\' )'; - + if ( count($query['not']) > 0 ) $text_where .= ' AND'; - + $where_not = array(); foreach ( $query['not'] as $term ) { @@ -390,14 +455,14 @@ $where_not[] = $term; } $where_not = ( count($where_not) > 0 ) ? "$text_col NOT LIKE '%" . implode("%' AND $text_col NOT LIKE '%", $where_not) . "%'" : ''; - + $sql = 'SELECT CONCAT("ns=",t.namespace,";pid=",t.page_id) AS id, t.page_id, t.namespace, CHAR_LENGTH(t.page_text) AS page_length, t.page_text, p.name AS page_name FROM ' . table_prefix . "page_text AS t LEFT JOIN " . table_prefix . "pages AS p ON ( p.urlname = t.page_id AND p.namespace = t.namespace ) WHERE $text_where $where_not;"; if ( !($q = $db->sql_unbuffered_query($sql)) ) $db->_die('Error is in perform_search(), includes/search.php, query 3'); - + $page_data = array(); if ( $row = $db->fetchrow() ) { @@ -405,7 +470,7 @@ { $row['page_text'] = htmlspecialchars($row['page_text']); $row['page_name'] = htmlspecialchars($row['page_name']); - + // Highlight results (this is wonderfully automated) $row['page_text'] = highlight_and_clip_search_result($row['page_text'], $word_list, $case_sensitive); if ( strlen($row['page_text']) > 250 && !preg_match('/^\.\.\.(.+)\.\.\.$/', $row['page_text']) ) @@ -413,7 +478,7 @@ $row['page_text'] = substr($row['page_text'], 0, 150) . '...'; } $row['page_name'] = highlight_search_result($row['page_name'], $word_list, $case_sensitive); - + $page_data[$row['id']] = $row; } while ( $row = $db->fetchrow() ); @@ -424,27 +489,29 @@ // STAGE 5 - SPECIAL PAGE TITLE SEARCH // Iterate through $paths->pages and check the titles for search terms. Score accordingly. // - - foreach ( $paths->pages as $page ) + + foreach ( $paths->pages as $id => $page ) { if ( $page['namespace'] != 'Special' ) continue; + if ( !is_int($id) ) + continue; $idstring = 'ns=' . $page['namespace'] . ';pid=' . $page['urlname_nons']; - $any = array_merge($query['any'], $query_phrase['any']); + $any = array_values(array_unique(array_merge($query['any'], $query_phrase['any']))); foreach ( $any as $term ) { if ( $case_sensitive ) { if ( strstr($page['name'], $term) || strstr($page['urlname_nons'], $term) ) { - ( isset($scores[$idstring]) ) ? $scores[$idstring]++ : $scores[$idstring] = 1; + ( isset($scores[$idstring]) ) ? $scores[$idstring] = $scores[$idstring] + 1.5 : $scores[$idstring] = 1.5; } } else { - if ( strstr(strtolower($page['name']), strtolower($term)) || strstr(strtolower($page['urlname_nons']), strtolower($term)) ) + if ( stristr($page['name'], $term) || stristr($page['urlname_nons'], $term) ) { - ( isset($scores[$idstring]) ) ? $scores[$idstring]++ : $scores[$idstring] = 1; + ( isset($scores[$idstring]) ) ? $scores[$idstring] = $scores[$idstring] + 1.5 : $scores[$idstring] = 1.5; } } } @@ -466,7 +533,7 @@ // STAGE 6 - SECOND ELIMINATION ROUND // Iterate through the list of required terms. If a given page is not found to have the required term, eliminate it // - + $required = array_merge($query['req'], $query_phrase['req']); foreach ( $required as $term ) { @@ -478,54 +545,54 @@ } } } - + // At this point, all of our normal results are in. However, we can also allow plugins to hook into the system and score their own // pages and add text, etc. as necessary. // Plugins are COMPLETELY responsible for using the search terms and handling Boolean logic properly - + $code = $plugins->setHook('search_global_inner'); foreach ( $code as $cmd ) { eval($cmd); } - + // a marvelous debugging aid :-) // die('
' . htmlspecialchars(print_r($page_data, true)) . ''); - + // // STAGE 7 - HIGHLIGHT, TRIM, AND SCORE RESULTS // We now have the complete results of the search. We need to trim text down to show only portions of the page containing search // terms, highlight any search terms within the page, and sort the final results array in descending order of score. // - + // Sort scores array arsort($scores); - + // Divisor for calculating relevance scores - $divisor = count($query['any']) + count($query_phrase['any']) + count($query['req']) + count($query_phrase['not']); - + $divisor = ( count($query['any']) + count($query_phrase['any']) + count($query['req']) + count($query_phrase['not']) ) * 1.5; + foreach ( $scores as $page_id => $score ) { if ( !isset($page_data[$page_id]) ) // It's possible that $scores contains a score for a page that was later eliminated because it contained a disallowed term continue; - + // Make a copy of the datum, then delete the original (it frees up a LOT of RAM) $datum = $page_data[$page_id]; unset($page_data[$page_id]); - + // This is an internal value used for sorting - it's no longer needed. unset($datum['id']); - + // Calculate score - if ( $score > $divisor ) - $score = $divisor; + // if ( $score > $divisor ) + // $score = $divisor; $datum['score'] = round($score / $divisor, 2) * 100; - + // Store it in our until-now-unused results array $results[] = $datum; } - + // Our work here is done. :-D return $results; } @@ -558,7 +625,7 @@ $chr = $query{$i}; $prev = ( $i > 0 ) ? $query{ $i - 1 } : ''; $next = ( ( $i + 1 ) < strlen($query) ) ? $query{ $i + 1 } : ''; - + if ( ( $chr == ' ' && !$in_quote ) || ( $i + 1 == strlen ( $query ) ) ) { $len = ( $next == '' ) ? $i + 1 : $i - $start_term; @@ -566,36 +633,36 @@ $terms[] = $word; $start_term = $i + 1; } - + elseif ( $chr == '"' && $in_quote && $prev != '\\' ) { $word = substr ( $query, $start_term, $i - $start_term + 1 ); $start_pos = ( $next == ' ' ) ? $i + 2 : $i + 1; $in_quote = false; } - + elseif ( $chr == '"' && !$in_quote ) { $in_quote = true; $start_pos = $i; } - + } - + $ticker = 0; - + foreach ( $terms as $element => $__unused ) { $atom =& $terms[$element]; - + $ticker++; - + if ( $ticker == 20 ) { $warnings[] = 'Some of your search terms were excluded because searches are limited to 20 terms to prevent excessive server load.'; break; } - + if ( substr ( $atom, 0, 2 ) == '+"' && substr ( $atom, ( strlen ( $atom ) - 1 ), 1 ) == '"' ) { $word = substr ( $atom, 2, ( strlen( $atom ) - 3 ) ); @@ -732,11 +799,11 @@ if(!empty($words[$i])) $words2[] = preg_quote($words[$i]); } - + $flag = ( $case_sensitive ) ? '' : 'i'; $regex = '/(' . implode('|', $words2) . ')/' . $flag; $pt = preg_replace($regex, '
Something went wrong during the AES decryption process.
'.print_r($decrypted_key, true).''); + // die_semicritical('AES encryption error', '
Something went wrong during the AES decryption process.
'.print_r($decrypted_key, true).''); + return false; } $n = preg_match('/^u='.$this->valid_username.';p=([A-Fa-f0-9]+?);s=([A-Fa-f0-9]+?)$/', $decrypted_key, $keydata); @@ -1183,16 +1197,19 @@ } $keyhash = md5($key); $salt = $db->escape($keydata[3]); - $query = $db->sql_query('SELECT u.user_id AS uid,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level,COUNT(p.message_id) AS num_pms,u.user_lang,x.* FROM '.table_prefix.'session_keys AS k - LEFT JOIN '.table_prefix.'users AS u - ON ( u.user_id=k.user_id ) - LEFT JOIN '.table_prefix.'users_extra AS x - ON ( u.user_id=x.user_id OR x.user_id IS NULL ) - LEFT JOIN '.table_prefix.'privmsgs AS p - ON ( p.message_to=u.username AND p.message_read=0 ) - WHERE k.session_key=\''.$keyhash.'\' - AND k.salt=\''.$salt.'\' - GROUP BY u.user_id;'); + // using a normal call to $db->sql_query to avoid failing on errors here + $query = $db->sql_query('SELECT u.user_id AS uid,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,' . "\n" + . ' u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level,COUNT(p.message_id) AS num_pms,' . "\n" + . ' x.* FROM '.table_prefix.'session_keys AS k' . "\n" + . ' LEFT JOIN '.table_prefix.'users AS u' . "\n" + . ' ON ( u.user_id=k.user_id )' . "\n" + . ' LEFT JOIN '.table_prefix.'users_extra AS x' . "\n" + . ' ON ( u.user_id=x.user_id OR x.user_id IS NULL )' . "\n" + . ' LEFT JOIN '.table_prefix.'privmsgs AS p' . "\n" + . ' ON ( p.message_to=u.username AND p.message_read=0 )' . "\n" + . ' WHERE k.session_key=\''.$keyhash.'\'' . "\n" + . ' AND k.salt=\''.$salt.'\'' . "\n" + . ' GROUP BY u.user_id;'); if ( !$query ) { $query = $this->sql('SELECT u.user_id AS uid,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level,COUNT(p.message_id) AS num_pms FROM '.table_prefix.'session_keys AS k @@ -1337,7 +1354,7 @@ $oid = $this->user_id; if($level > USER_LEVEL_CHPREF) { - $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE); + $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE); if(!$this->user_logged_in || $this->auth_level < USER_LEVEL_MOD) { return 'success'; @@ -1416,7 +1433,7 @@ function rijndael_genkey() { - $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE); + $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE); $key = $aes->gen_readymade_key(); $keys = getConfig('login_key_cache'); if(is_string($keys)) @@ -1434,7 +1451,7 @@ function dss_rand() { - $aes = new AESCrypt(); + $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE); $random = $aes->randkey(128); unset($aes); return md5(microtime() . $random); @@ -1551,7 +1568,7 @@ { global $db, $session, $paths, $template, $plugins; // Common objects $col_reason = ( $this->compat ) ? '"No reason entered (session manager is in compatibility mode)" AS reason' : 'reason'; - $is_banned = false; + $banned = false; if ( $this->user_logged_in ) { // check by IP, email, and username @@ -1646,7 +1663,7 @@ global $db, $session, $paths, $template, $plugins; // Common objects // Initialize AES - $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE); + $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE); if(!preg_match('#^'.$this->valid_username.'$#', $username)) return 'The username you chose contains invalid characters.'; $username = str_replace('_', ' ', $username); @@ -2002,7 +2019,7 @@ function register_temp_password($user_id, $password) { - $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE); + $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE); $temp_pass = $aes->encrypt($password, $this->private_key, ENC_HEX); $this->sql('UPDATE '.table_prefix.'users SET temp_password=\'' . $temp_pass . '\',temp_password_time='.time().' WHERE user_id='.intval($user_id).';'); } @@ -2113,7 +2130,7 @@ if(intval($user_id) < 1) $errors[] = 'SQL injection attempt'; // Instanciate the AES encryption class - $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE); + $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE); // If all of our input vars are false, then we've effectively done our job so get out of here if($username === false && $password === false && $email === false && $realname === false && $signature === false && $user_level === false) @@ -2407,7 +2424,9 @@ $this->acl_defaults_used = $this->perms; // Fetch sitewide defaults from the permissions table - $bs = 'SELECT rules FROM '.table_prefix.'acl WHERE page_id IS NULL AND namespace IS NULL AND ( '; + $bs = 'SELECT rules, target_type, target_id FROM '.table_prefix.'acl' . "\n" + . ' WHERE page_id IS NULL AND namespace IS NULL AND' . "\n" + . ' ( '; $q = Array(); $q[] = '( target_type='.ACL_TYPE_USER.' AND target_id='.$this->user_id.' )'; @@ -2418,7 +2437,7 @@ $q[] = '( target_type='.ACL_TYPE_GROUP.' AND target_id='.intval($g_id).' )'; } } - $bs .= implode(' OR ', $q) . ' ) ORDER BY target_type ASC, target_id ASC;'; + $bs .= implode(" OR \n ", $q) . " ) \n ORDER BY target_type ASC, target_id ASC;"; $q = $this->sql($bs); if ( $row = $db->fetchrow() ) { @@ -2462,7 +2481,7 @@ } // The reason we're using an ORDER BY statement here is because ACL_TYPE_GROUP is less than ACL_TYPE_USER, causing the user's individual // permissions to override group permissions. - $bs .= implode(' OR ', $q) . ' ) AND (' . $pg_info . ' ( page_id=\''.$db->escape($paths->cpage['urlname_nons']).'\' AND namespace=\''.$db->escape($paths->namespace).'\' ) ) + $bs .= implode(" OR\n ", $q) . " )\n AND (" . $pg_info . ' ( page_id=\''.$db->escape($paths->cpage['urlname_nons']).'\' AND namespace=\''.$db->escape($paths->namespace).'\' ) ) ORDER BY target_type ASC, page_id ASC, namespace ASC;'; $q = $this->sql($bs); if ( $row = $db->fetchrow() ) @@ -2904,7 +2923,8 @@ } // Build a query to grab ACL info - $bs = 'SELECT rules FROM '.table_prefix.'acl WHERE ( '; + $bs = 'SELECT rules FROM '.table_prefix.'acl WHERE ' . "\n" + . ' ( '; $q = Array(); $q[] = '( target_type='.ACL_TYPE_USER.' AND target_id='.$session->user_id.' )'; if(count($session->groups) > 0) @@ -2916,7 +2936,7 @@ } // The reason we're using an ORDER BY statement here is because ACL_TYPE_GROUP is less than ACL_TYPE_USER, causing the user's individual // permissions to override group permissions. - $bs .= implode(' OR ', $q) . ' ) AND (' . $pg_info . ' page_id=\''.$db->escape($page_id).'\' AND namespace=\''.$db->escape($namespace).'\' ) + $bs .= implode(" OR\n ", $q) . ' ) AND (' . $pg_info . ' page_id=\''.$db->escape($page_id).'\' AND namespace=\''.$db->escape($namespace).'\' ) ORDER BY target_type ASC, page_id ASC, namespace ASC;'; $q = $session->sql($bs); if ( $row = $db->fetchrow() ) diff -r dc08c70ca550 -r e2cb5f1432c8 includes/tagcloud.php --- a/includes/tagcloud.php Sun Dec 02 15:27:21 2007 -0500 +++ b/includes/tagcloud.php Sun Dec 02 16:00:10 2007 -0500 @@ -35,7 +35,7 @@ * @param array Optional. An initial list of words, just a plain old array. */ - function __construct($words) + function __construct($words = array()) { if ( count($words) > 0 ) { diff -r dc08c70ca550 -r e2cb5f1432c8 includes/template.php --- a/includes/template.php Sun Dec 02 15:27:21 2007 -0500 +++ b/includes/template.php Sun Dec 02 16:00:10 2007 -0500 @@ -775,7 +775,8 @@ 'STYLE_ID'=>$this->style, 'JS_DYNAMIC_VARS'=>$js_dynamic, 'UNREAD_PMS'=>$session->unread_pms, - 'URL_ABOUT_ENANO' => makeUrlNS('Special', 'About_Enano', '', true) + 'URL_ABOUT_ENANO' => makeUrlNS('Special', 'About_Enano', '', true), + 'REPORT_URI' => makeUrl($paths->page, 'do=sql_report', true) ); foreach ( $paths->nslist as $ns_id => $ns_prefix ) @@ -1076,7 +1077,7 @@ continue; $tag_complete = <<
The action "'.$_GET['do'].'" is not defined. Return to viewing this page\'s text.
'); + die_friendly('Invalid action', 'The action "'.htmlspecialchars($_GET['do']).'" is not defined. Return to viewing this page\'s text.
'); break; case 'view': // echo PageUtils::getpage($paths->page, true, ( (isset($_GET['oldid'])) ? $_GET['oldid'] : false )); @@ -118,10 +118,18 @@ $template->footer(); break; case 'edit': - if(isset($_POST['_cancel'])) { header('Location: '.makeUrl($paths->page)); echo ''.nl2br($r).' ' . $lang->get('etc_return_to_page') . '.
'); + die_friendly($lang->get('page_rename_success_title'), ''.nl2br($r).' ' . $lang->get('etc_return_to_page') . '.
'); } $template->header(); ?> @@ -434,6 +442,17 @@ $data = ( isset($_POST['data']) ) ? $_POST['data'] : Array('mode' => 'listgroups'); PageUtils::aclmanager($data); break; + case 'sql_report': + $rev_id = ( (isset($_GET['oldid'])) ? intval($_GET['oldid']) : 0 ); + $page = new PageProcessor( $paths->cpage['urlname_nons'], $paths->namespace, $rev_id ); + $page->send_headers = true; + $pagepass = ( isset($_REQUEST['pagepass']) ) ? sha1($_REQUEST['pagepass']) : ''; + $page->password = $pagepass; + $page->send(true); + ob_end_clean(); + ob_start(); + $db->sql_report(); + break; } // @@ -443,7 +462,7 @@ { // Load up the HTML $html = ob_get_contents(); - ob_end_clean(); + @ob_end_clean(); $html = aggressive_optimize_html($html); diff -r dc08c70ca550 -r e2cb5f1432c8 install.php --- a/install.php Sun Dec 02 15:27:21 2007 -0500 +++ b/install.php Sun Dec 02 16:00:10 2007 -0500 @@ -338,7 +338,7 @@ if ( $act_get ) return $decrypted_pass; - $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE); + $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE); if ( !empty($_POST['crypt_data']) ) { @@ -368,7 +368,7 @@ if ( $act_get ) return $key; - $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE); + $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE); $key = $aes->gen_readymade_key(); return true; } @@ -381,7 +381,7 @@ $admin_pass = stg_decrypt_admin_pass(true); $key = stg_generate_aes_key(true); - $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE); + $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE); $key = $aes->hextostring($key); $admin_pass = $aes->encrypt($admin_pass, $key, ENC_HEX); @@ -461,7 +461,7 @@ { $admin_pass = stg_decrypt_admin_pass(true); $key = stg_generate_aes_key(true); - $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE); + $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE); $key = $aes->hextostring($key); $admin_pass = $aes->encrypt($admin_pass, $key, ENC_HEX); $admin_user = mysql_real_escape_string($_POST['admin_user']); @@ -826,6 +826,10 @@ $title = $lang->get('pophelp_admin_embed_php_title'); $content = $lang->get('pophelp_admin_embed_php_body'); break; + case 'url_schemes': + $title = $lang->get('pophelp_url_schemes_title'); + $content = $lang->get('pophelp_url_schemes_body'); + break; default: $title = 'Invalid topic'; $content = 'Invalid help topic.'; @@ -1021,6 +1025,7 @@|
name="urlscheme" value="ugly" id="ugly" /> name="urlscheme" value="short" id="short" /> - + + get('website_field_urlscheme_helplink'); ?> |
Unlike deleting or editing this page, this action is not reversible! You should only do this if you are desparate for database space.
Do you really want to continue?
', flushlogs_btn_submit: 'Flush logs', diff -r dc08c70ca550 -r e2cb5f1432c8 language/english/install.json --- a/language/english/install.json Sun Dec 02 15:27:21 2007 -0500 +++ b/language/english/install.json Sun Dec 02 16:00:10 2007 -0500 @@ -61,6 +61,7 @@ heading: 'Checking your server', blurb: 'Enano has several requirements that must be met before it can be installed. If all is good then note any warnings and click Continue below.', req_php: 'PHP Version >=4.3.0', + req_php5: 'PHP 5.2.0 or later', req_mysql: 'MySQL extension for PHP', req_uploads: 'File upload support', req_apache: 'Apache HTTP Server', @@ -70,6 +71,7 @@ req_fileswriteable: 'File uploads directory writable', req_desc_php: 'It seems that the version of PHP that your server is running is too old to support Enano properly. If this is your server, please upgrade to the most recent version of PHP, remembering to use the --with-mysql configure option if you compile it yourself. If this is not your server, please contact your webhost and ask them if it would be possible to upgrade PHP. If this is not possible, you will need to switch to a different webhost in order to use Enano.', + req_desc_php5: 'Your server does not have support for PHP 5.2.0. While you may continue installing Enano, please be warned that as of December 31, 2007, all support for Enano on PHP 4 servers is discontinued. If you have at least PHP 5.0.0, support will still be available, but there are many security problems in PHP versions under 5.2.0 that Enano cannot effectively prevent.', req_desc_mysql: 'It seems that your PHP installation does not have the MySQL extension enabled. If this is your own server, you may need to just enable the "libmysql.so" extension in php.ini. If you do not have the MySQL extension installed, you will need to either use your distribution\'s package manager to install it, or you will have to compile PHP from source. If you compile PHP from source, please remember to use the "--with-mysql" configure option, and you will have to have the MySQL development files installed (they usually are). If this is not your server, please contact your hosting company and ask them to install the PHP MySQL extension.', req_desc_uploads: 'It seems that your server does not support uploading files. Enano *requires* this functionality in order to work properly. Please ask your server administrator to set the "file_uploads" option in php.ini to "On".', req_desc_apache: 'Apparently your server is running a web server other than Apache. Enano will work nontheless, but there are some known bugs with non-Apache servers, and the "fancy" URLs will not work properly. The "Standard URLs" option will be set on the website configuration page, only change it if you are absolutely certain that your server is running Apache.', @@ -151,6 +153,7 @@ field_urlscheme_ugly: 'Standard URLs - compatible with any web server (www.example.com/index.php?title=Page_name)', field_urlscheme_short: 'Short URLs - requires Apache with a PHP module (www.example.com/index.php/Page_name)', field_urlscheme_tiny: 'Tiny URLs - requires Apache on Linux/Unix/BSD with PHP module and mod_rewrite enabled (www.example.com/Page_name)', + field_urlscheme_helplink: 'Which URL scheme should I choose?', objective_verify: 'Verify that your site information is correct. Again, all of the above settings can be changed from the administration panel.', }, @@ -253,6 +256,23 @@ embed Javascript and arbitrary HTML and CSS.If you don\'t have experience coding in PHP, you can safely disable this option. You may change this at any time using the ACL editor by selecting the Administrators group and This Entire Website under the scope selection.
', + url_scheme_title: 'URL schemes', + url_scheme_body: 'The URL scheme allows you to decide how the URLs to your Enano pages will look.
+The first option (Standard URLs) works on any web server. You should select it if your server doesn\'t run Apache, or + if you are at all unsure of your server\'s configuration. With this scheme, URLs at your site will look like + http://yoursite.com/path-to-enano/index.php/Main_Page.
+The second option, Small URLs, will be selected by default if Enano detects Apache. Small URLs are more friendly towards + search engines, but they don\'t work on very many non-Apache servers, or if PHP is set up through CGI on your server. Many + free and low-cost web hosts will configure PHP through CGI in order to keep your user account as the owner of any files that + Enano generates. With this scheme, URLs at your site will look like http://yoursite.com/path-to-enano/index.php/Main_Page. +
+The last option, Tiny URLs, is the most friendly URL scheme for search engines, because your URLs won\'t have any special characters + at all in them. However, this only works if your webhost has configured Apache with support for mod_rewrite. Most of the time if your + host supports this you will see a listing for it in their feature matrix. None of the popular Linux distributions (such as Ubuntu, + Debian, Red Hat Enterprise Linux™, Fedora, openSUSE™, or CentOS) come with mod_rewrite enabled, so if you run a + home-brew server, you should consult your distribution\'s documentation for enabling mod_rewrite before selecting this option. + With this scheme, URLs at your site will look like http://yoursite.com/path-to-enano/Main_Page.
+ ', btn_close_window: 'Close window', } } diff -r dc08c70ca550 -r e2cb5f1432c8 plugins/SpecialAdmin.php --- a/plugins/SpecialAdmin.php Sun Dec 02 15:27:21 2007 -0500 +++ b/plugins/SpecialAdmin.php Sun Dec 02 16:00:10 2007 -0500 @@ -818,6 +818,7 @@ $t = -1; $cl = 'row1'; echo "\n".'