--- docman.php 2002/07/28 16:24:54 1.18 +++ docman.php 2002/07/28 18:56:49 1.22 @@ -86,12 +86,12 @@ // for security and configuration $realm=$HTTP_SERVER_VARS["HTTP_HOST"]; - $fsDocumentRoot = dirname($HTTP_SERVER_VARS[SCRIPT_FILENAME]); + $fsDocumentRoot = dirname($HTTP_SERVER_VARS["SCRIPT_FILENAME"]); if ($fsDocumentRoot == "") Error("Configuration error","Can't get SCRIPT_FILENAME from your web server. Please set \$fsDocumentRoot in \$",1); // globals for later - $gblLogin = $HTTP_SERVER_VARS[PHP_AUTH_USER]; - $gblPasswd = $HTTP_SERVER_VARS[PHP_AUTH_PW]; + $gblLogin = $HTTP_SERVER_VARS["PHP_AUTH_USER"]; + $gblPasswd = $HTTP_SERVER_VARS["PHP_AUTH_PW"]; ////////////////////////////////////////////////////////////////// @@ -109,9 +109,8 @@ function StartHTML($title,$text="") { - global $html,$fsDocumentRoot,$HTTP_SERVER_VARS; + global $html,$fsDocumentRoot,$gblTitle,$HTTP_SERVER_VARS; - $title = $gblTitle." ".$title ; $host = $HTTP_SERVER_VARS["HTTP_HOST"] ; $self = $HTTP_SERVER_VARS["PHP_SELF"] ; @@ -156,7 +155,10 @@ function DetailPage($fsRoot,$relDir,$fn) { - global $gblEditable, $gblImages, $webRoot, $html, $HTTP_SERVER_VARS ; + global $gblEditable, $gblImages, + $gblDateFmt, $gblTimeFmt, + $webRoot, $html, + $HTTP_SERVER_VARS ; $self = $HTTP_SERVER_VARS["PHP_SELF"] ; $relPath = $relDir . "/" . $fn ; @@ -189,8 +191,8 @@ echo "

" . $relDir . "/" . $fn . "

" ; if ($exists) { // get file info $fsize = filesize($fsPath) ; - $fmodified = date("$GLOBALS[gblDateFmt] $GLOBALS[gblTimeFmt]", filemtime($fsPath)) ; - $faccessed = date("$GLOBALS[gblDateFmt] $GLOBALS[gblTimeFmt]", fileatime($fsPath)) ; + $fmodified = date("$gblDateFmt $gblTimeFmt", filemtime($fsPath)) ; + $faccessed = date("$gblDateFmt $gblTimeFmt", fileatime($fsPath)) ; $fuid=fileowner($fsPath); $fgid=filegroup($fsPath); $userinfo = posix_getpwuid($fuid); @@ -579,8 +581,10 @@ global $gblEditable, $gblIcon, $gblModDays, $webRoot, $gblHide, $gblIgnoreUnknownFileType, $gblRepositoryDir, + $gblLogin, $gblUserName, $fsRealmDir, $realm, $realm_sep, - $HTTP_GET_VARS, $html, $realm_config; + $html, $realm_config, + $HTTP_GET_VARS, $HTTP_SERVER_VARS; $self = $HTTP_SERVER_VARS["PHP_SELF"] ; @@ -592,12 +596,15 @@ global $debug; $debug .= "[$gblLogin|$relDir] before >"; - if (! check_perm($relDir,(trperm_b | trperm_r))) + if (! check_perm($relDir,trperm_b)) Error("Access denied","User $gblLogin tried to access $relDir without valid trustee.",1); $debug .= "< afeter"; $hide_items=",$gblHide,"; + $dirList = array(); + $fileList = array(); + // read directory contents if ( !($dir = @opendir($fsDir)) ) Error("Read Access denied",$relDir,1) ; @@ -622,7 +629,7 @@ closedir($dir) ; // scan deleted files - if ( $HTTP_GET_VARS["show_deleted"] == 1 && ($dir = @opendir("$fsDir/.del")) ) { + if ( HTTP_GET_VAR("show_deleted") == 1 && ($dir = @opendir("$fsDir/.del")) ) { while ($item = readdir($dir)) { if ( substr($item,0,1) == "." || strstr($hide_items,",$item,") || !check_perm($relDir.$item,trperm_w) ) continue ; $fileList[$item] = ".del/$item" ; @@ -637,7 +644,7 @@ // start navigation page $text = "Use this page to add, delete"; - if (! isset($HTTP_GET_VARS[show_deleted])) { + if (! isset($HTTP_GET_VARS["show_deleted"])) { $text .= ", undelete"; } $text .= " or revise files on this web site." ; @@ -663,8 +670,7 @@ return $out; } - $dsort = $HTTP_GET_VARS[dsort]; - if (! isset($dsort)) $dsort = "name"; // default directory sort + if (! HTTP_GET_VAR("dsort")) $dsort = "name"; // default directory sort $dsort_arr = array( "name" => array ("rname", "note"), @@ -673,8 +679,7 @@ "rnote" => array ("name", "note") ); - $fsort = $HTTP_GET_VARS[fsort]; - if (! isset($fsort)) $fsort = "name"; // default directory sort + if (! HTTP_GET_VAR("fsort")) $fsort = "name"; // default directory sort $fsort_arr = array( "name" => array ("rname", "note", "date", "size"), @@ -690,6 +695,7 @@ $D="D=".urlencode($relDir); function self_args($arr = array()) { + global $self; $arg = implode("&",$arr); if ($arg) { return $self."?".$arg; @@ -813,7 +819,7 @@ $ext = strtolower(strrchr($file,".")) ; if ($file_lock) { - if ($file_lock == $GLOBALS[gblUserName]) { + if ($file_lock == $gblUserName) { $b.="" ; $file_url_html=$b; @@ -841,7 +847,7 @@ } } - $mod = date("$GLOBALS[gblDateFmt] $GLOBALS[gblTimeFmt]",$mod); + $mod = date("$gblDateFmt $gblTimeFmt",$mod); include("$html/Navigate-fileEntry.html"); @@ -953,6 +959,8 @@ function LogIt($target,$msg, $changelog=0) { + global $gblDateFmt, $gblTimeFmt, $gblUserName, $gblFsRoot; + $dir=dirname($target); if (! file_exists($dir."/.log")) { if (! @mkdir($dir."/.log",0700)) Error("docman installation problem","can't create log directory $dir/.log",1); @@ -960,18 +968,17 @@ $file=basename($target); $log=fopen("$dir/.log/$file","a+"); - fputs($log,date("$GLOBALS[gblDateFmt]\t$GLOBALS[gblTimeFmt]"). - "\t$GLOBALS[gblUserName]\t$msg\n"); + fputs($log,date("$gblDateFmt\t$gblTimeFmt"). + "\t$gblUserName\t$msg\n"); fclose($log); if (! $changelog) return; - global $gblFsRoot; $log=fopen("$gblFsRoot/.changelog","a+"); if (substr($target,0,strlen($gblFsRoot)) == $gblFsRoot) $target=substr($target,strlen($gblFsRoot),strlen($target)-strlen($gblFsRoot)); $msg=str_replace("\t"," ",$msg); - fputs($log,time()."\t$target\t$GLOBALS[gblUserName]\t$msg\n"); + fputs($log,time()."\t$target\t$gblUserName\t$msg\n"); fclose($log); // FIX: implement e-mail notification based on $changelog @@ -1031,6 +1038,8 @@ function Lock($target) { + global $gblUserName; + $target=stripSlashes($target); $dir=dirname($target); if (! file_exists($dir."/.lock")) { @@ -1042,7 +1051,7 @@ LogIt($target,"attempt to locked allready locked file!"); } else { $lock=fopen("$dir/.lock/$file","w"); - fputs($lock,"$GLOBALS[gblUserName]\n"); + fputs($lock,"$gblUserName\n"); fclose($lock); LogIt($target,"file locked"); @@ -1091,6 +1100,9 @@ ////////////////////////////////////////////////////////////////// function safe_rename($fromdir,$fromfile,$tofile) { + + global $gblNumBackups; + function try_rename($from,$to) { # print "$from -> $to\n"; if (file_exists($from) && is_writeable(dirname($to))) { @@ -1120,7 +1132,7 @@ try_dir("$todir/.lock"); try_rename("$fromdir/.lock/$fromfile","$todir/.lock/$tofile"); try_dir("$todir/.bak"); - for($i=0;$i<=$GLOBALS[gblNumBackups];$i++) { + for($i=0;$i<=$gblNumBackups;$i++) { try_rename("$fromdir/.bak/$i/$fromfile","$todir/.bak/$i/$tofile"); } } @@ -1148,7 +1160,10 @@ function DisplayChangeLog($day) { - global $gblFsRoot,$HTTP_SERVER_VARS; + global $gblFsRoot, $gblDateFmt, $gblTimeFmt; + $HTTP_SERVER_VARS; + + $self = $HTTP_SERVER_VARS["PHP_SELF"]; if (!file_exists("$gblFsRoot/.changelog")) return; $log=fopen("$gblFsRoot/.changelog","r"); @@ -1167,14 +1182,14 @@ print "\n"; while ($e = array_shift($logarr)) { $cl=$cl1; $cl1=$cl2; $cl2=$cl; - $date = date("$GLOBALS[gblDateFmt]", $e[0]); - $time = date("$GLOBALS[gblTimeFmt]", $e[0]); + $date = date($gblDateFmt, $e[0]); + $time = date($gblTimeFmt, $e[0]); $dir = dirname($e[1]); $file = basename($e[1]); print "$date$time$dir/$file$e[2]$e[3]\n"; } print "
"; - print "

".GifIcon(up)." Back to front page.

"; + print "

".GifIcon(up)." Back to front page.

"; } ////////////////////////////////////////////////////////////////// @@ -1238,16 +1253,16 @@ by Vyacheslav Zavadsky */ -define(trmask_not,1 << 0); -define(trmask_clear,1 << 1); -define(trmask_deny,1 << 2); -define(trmask_one_level,1 << 3); -define(trmask_group,1 << 4); - -define(trperm_r,1 << 5); -define(trperm_w,1 << 6); -define(trperm_b,1 << 7); -define(trperm_n,1 << 8); +define('trmask_not',1 << 0); +define('trmask_clear',1 << 1); +define('trmask_deny',1 << 2); +define('trmask_one_level',1 << 3); +define('trmask_group',1 << 4); + +define('trperm_r',1 << 5); +define('trperm_w',1 << 6); +define('trperm_b',1 << 7); +define('trperm_n',1 << 8); $trustee_a2n = array( '!' => trmask_not, @@ -1295,7 +1310,7 @@ $error="".dirname($trustee_php)." must be writable by web server user"; } elseif (file_exists($trustee_php) && !is_writable($trustee_php)) { $error="trustees cache file $trustee_php exists, but is not writable by web server"; -} elseif (1 || filemtime($trustee_conf) >= filemtime($trustee_php)) { +} elseif (@filemtime($trustee_conf) >= @filemtime($trustee_php)) { $fp_php=@fopen($trustee_php,"w"); fputs($fp_php,"\n"; } } - $tr_arr[$path][$user] |= $perm; + if (isset($tr_arr[$path][$user])) { + $tr_arr[$path][$user] |= $perm; + } else { + $tr_arr[$path][$user] = $perm; + } } } } @@ -1370,10 +1389,10 @@ fclose($fp_php); } -if ($error) { +if (isset($error)) { Error("Trustee error",$error,1); } else { - include("$trustee_php"); + include_once("$trustee_php"); } return 1; @@ -1386,30 +1405,34 @@ } // helper function -function unroll_perm($u,$t,$user,$perm) { +function unroll_perm($u,$t,$user,$perm,$one_level) { - // check user FIX - if ($t & trmask_not && ($u==$user)) continue; - if (!($t & trmask_not) && ($u!=$user)) continue; + if ($t & trmask_one_level && !$one_level) return $perm; + + // user is user whose trustee is this + if ($t & trmask_not && ($u==$user)) return $perm; + if (!($t & trmask_not) && ($u!=$user)) return $perm; if ($t & trmask_deny) { if ($t & trmask_clear) { - $perm[deny] &= ~$t; + $perm['deny'] &= ~$t; } else { - $perm[deny] |= $t; + $perm['deny'] |= $t; } } elseif ($t & trmask_clear) { - $perm[allow] &= ~$t; + $perm['allow'] &= ~$t; } else { - $perm[allow] |= $t; + $perm['allow'] |= $t; } return $perm; }// end of helper function function check_trustee($user,$path) { global $trustees; - $perm[allow] = 0; - $perm[deny] = 0; + $perm['allow'] = 0; + $perm['deny'] = 0; + + if (! isset($trustees)) Error("Trustees not found","Can't find in-memory trustee structure \$trustees. Probably bug in code. Contact dpavlin@rot13.org",1); global $debug; $debug .= "
check_trustee $path ... "; @@ -1419,17 +1442,17 @@ while (count($path_arr)) { $tmppath.=array_shift($path_arr); $debug.= ">> $tmppath "; - if (substr($tmppath,strlen($tmppath)-1,1) != "/") $tmppath.="/"; + + if (! isset($trustees[$tmppath])) continue; $tr = $trustees[$tmppath]; - # clear one level flag - $perm[allow] &= ~trperm_one_level; - $perm[deny] &= ~trperm_one_level; + $one_level = (!count($path_arr)); +$debug.=" O($one_level) "; if (isset($tr)) { // first apply trustee for all if (isset($tr['*'])) { - $perm = unroll_perm($user,$tr['*'],$user, $perm); + $perm = unroll_perm($user,$tr['*'],'*', $perm, $one_level); unset($tr['*']); } // then apply group policies @@ -1437,21 +1460,21 @@ if ($t & trmask_group && in_group($user,$g)) { // resolv user $t = $t & ~trmask_group; - $perm = unroll_perm($user,$t,$user, $perm); + $perm = unroll_perm($user,$t,$g, $perm, $one_level); unset($tr[$g]); } } // then apply user policy if (isset($tr[$user])) { - $perm = unroll_perm($user,$tr[$user],$user, $perm); + $perm = unroll_perm($user,$tr[$user],$user, $perm,$one_level); unset($tr[$user]); } } -$debug.="d:".display_trustee($perm[deny])." a:".display_trustee($perm[allow])." "; +$debug.="d(".display_trustee($perm['deny']).") a(".display_trustee($perm['allow']).") "; } $debug.="
check_trustee: user: $user path: $path==$tmppath perm: "; -$debug.="d: $perm[deny] (".display_trustee($perm[deny]).") a: $perm[allow] (".display_trustee($perm[allow]).")
\n"; +$debug.="d: ".$perm['deny']." (".display_trustee($perm['deny']).") a: ".$perm['allow']." (".display_trustee($perm['allow']).")
\n"; return $perm; } @@ -1461,14 +1484,14 @@ global $gblLogin,$HAVE_TRUSTEE; global $debug; -$debug.="
check_perm: $path test perm ".display_trustee($perm)."
\n"; +$debug.="
check_perm: on $path for perm ".display_trustee($trperm)."
\n"; $return = ! $HAVE_TRUSTEE; if ($HAVE_TRUSTEE) { $perm = check_trustee($gblLogin,$path); -$debug.=" d: $perm[deny] (".display_trustee($perm[deny]).") a: $perm[allow] (".display_trustee($perm[allow]).") perm to have: $trperm (".display_trustee($trperm).")"; - if ($perm[deny] & $trperm) $return=0; - elseif (($perm[allow] & $trperm) == $trperm) $return=1; +$debug.=" d: ".$perm['deny']." (".display_trustee($perm['deny']).") a: ".$perm['allow']." (".display_trustee($perm['allow']).") perm to have: $trperm (".display_trustee($trperm).")"; + if ($perm['deny'] & $trperm) $return=0; + elseif (($perm['allow'] & $trperm) == $trperm) $return=1; } $debug.=" return: $return
\n"; return($return); @@ -1513,13 +1536,38 @@ } ////////////////////////////////////////////////////////////////// + +// functions to move HTTP server variables to global namespace +// [replacement for register_globals in php.ini] + +function HTTP_GET_VAR($var) { + global $HTTP_GET_VARS, $GLOBALS; + if (isset($HTTP_GET_VARS[$var])) { + $GLOBALS[$var] = stripSlashes($HTTP_GET_VARS[$var]); + return $GLOBALS[$var]; + } +} + +function HTTP_POST_VAR($var) { + global $HTTP_POST_VARS, $GLOBALS; + if (isset($HTTP_POST_VARS[$var])) { + $GLOBALS[$var] = stripSlashes($HTTP_POST_VARS[$var]); + return $GLOBALS[$var]; + } +} + +////////////////////////////////////////////////////////////////// + +function Warn($text) { +} + +////////////////////////////////////////////////////////////////// // MAIN PROGRAM $gblFilePerms = 0640 ; // default for new files $gblDirPerms = 0750 ; // default for new dirs - $STYLE = $HTTP_GET_VARS[STYLE]; - if (isset($STYLE) && $STYLE == "get") { + if (isset($HTTP_GET_VARS["STYLE"]) && $HTTP_GET_VARS["STYLE"] == "get") { include("$html/docman.css"); exit; } @@ -1539,8 +1587,8 @@ } // try to add dir to script name to realm var - if (is_dir("$fsRealmDir/$realm/".dirname($HTTP_SERVER_VARS[SCRIPT_NAME]))) { - $realm .= dirname($HTTP_SERVER_VARS[SCRIPT_NAME]); + if (is_dir("$fsRealmDir/$realm/".dirname($HTTP_SERVER_VARS["SCRIPT_NAME"]))) { + $realm .= dirname($HTTP_SERVER_VARS["SCRIPT_NAME"]); $realm_sep = "/"; } else { $realm_sep = "."; @@ -1565,8 +1613,8 @@ } // take additional login vars - $relogin = $HTTP_GET_VARS[relogin]; - $force_login = $HTTP_GET_VARS[force_login]; + HTTP_GET_VAR("relogin"); + HTTP_GET_VAR("force_login"); // if no password, or empty password logout if ( @@ -1593,10 +1641,10 @@ $HAVE_TRUSTEE = init_trustee(); if (strtolower($gblLogin) == "anonymous" || !isset($gblLogin)) { - $perm = check_trustee("anonymous",$path); + $perm = check_trustee("anonymous","/"); // browsing must be explicitly allowed for root directory // of repository for anonymous user to work! - if ($perm[allow] & trperm_b) { + if ($perm['allow'] & trperm_b) { $gblLogin = $gblPasswd = "anonymous"; $secHash = md5($gblLogin.$gblPasswd); $gblUserName = "Anonymous user"; @@ -1617,30 +1665,33 @@ if ($HTTP_SERVER_VARS["REQUEST_METHOD"] == "POST") { // take variables from server - $FN=stripSlashes($HTTP_POST_VARS["FN"]); - $DIR=stripSlashes($HTTP_POST_VARS["DIR"]); - $RELPATH=stripSlashes($HTTP_POST_VARS["RELPATH"]); - $T=stripSlashes($HTTP_POST_VARS["T"]); - $CONFIRM=stripSlashes($HTTP_POST_VARS["CONFIRM"]); - - check_filename($FN); - check_dirname($DIR); - check_dirname($RELPATH); + if (HTTP_POST_VAR("FN")) check_filename($FN); + if (HTTP_POST_VAR("DIR")) { + check_dirname($DIR); + $relDir = $DIR; + } else { + trigger_error("Can't get DIR",E_USER_WARNING); + $relDir = "/"; + } + if (HTTP_POST_VAR("RELPATH")) check_dirname($RELPATH); + HTTP_POST_VAR("T"); + HTTP_POST_VAR("CONFIRM"); - $relDir = $DIR; } else { // get - $A=stripSlashes($HTTP_GET_VARS["A"]); - $D=stripSlashes(urldecode($HTTP_GET_VARS["D"])); - $F=stripSlashes($HTTP_GET_VARS["F"]); - - check_filename($F); - check_dirname($D); - - $relDir = $D; + HTTP_GET_VAR("A"); + if (HTTP_GET_VAR("D")) { + check_dirname($D); + $D=urldecode($D); + $relDir = $D; + } else { + //trigger_error("Can't get D",E_USER_WARNING); + $relDir = "/"; + } + if (HTTP_GET_VAR("F")) check_filename($F); } - $relScriptDir = dirname($SCRIPT_NAME) ; + $relScriptDir = dirname($HTTP_SERVER_VARS["SCRIPT_NAME"]) ; // i.e. /docman // start on server root @@ -1659,7 +1710,7 @@ } $webRoot .= $HTTP_SERVER_VARS["HTTP_HOST"] . $relScriptDir; - switch ($HTTP_POST_VARS["POSTACTION"]) { + if (HTTP_POST_VAR("POSTACTION")) switch ($POSTACTION) { case "UPLOAD" : $FN_name=stripSlashes($HTTP_POST_FILES["FN"]["tmp_name"]); $FN=stripSlashes($HTTP_POST_FILES["FN"]["name"]); @@ -1670,8 +1721,7 @@ Error("You must select file with browse to upload it!"); } - $FILENAME = $HTTP_POST_VARS["FILENAME"]; - check_filename($FILENAME); + if (HTTP_POST_VAR("FILENAME")) check_filename($FILENAME); if (! isset($FILENAME)) { // from update file $target = "$fsDir/".basename($FN); @@ -1684,11 +1734,11 @@ if (! file_exists($dir."/.bak")) { mkdir($dir."/.bak",0700); } - if (! file_exists($dir."/.bak/$GLOBALS[gblNumBackups]")) { - mkdir($dir."/.bak/$GLOBALS[gblNumBackups]",0700); + if (! file_exists($dir."/.bak/$gblNumBackups")) { + mkdir($dir."/.bak/$gblNumBackups",0700); } $file=basename($target); - for($i=$GLOBALS[gblNumBackups]-1;$i>0;$i--) { + for($i=$gblNumBackups-1;$i>0;$i--) { MoveTo("$dir/.bak/$i/$file","$dir/.bak/".($i+1)."/"); } MoveTo($target,$dir."/.bak/1/"); @@ -1827,9 +1877,9 @@ } // common to all POSTs : redirect to directory view ($relDir) - if ( $POSTACTION != "" ) { - $tstr = $PHP_SELF . "?D=" . urlencode($relDir) ; - header("Location: " . $tstr) ; + if (isset($POSTACTION)) { + $tstr = $HTTP_SERVER_VARS["PHP_SELF"]."?D=".urlencode($relDir); + header("Location: ".$tstr) ; exit ; } @@ -1843,7 +1893,7 @@ // $A=I : include file .$F.php from [$gblIncDir|realm]/include_php // default : display directory $D - switch ($A) { + if (isset($A)) switch ($A) { case "U" : // upload to $relDir if (! check_perm($relDir, trperm_w))