Recover somewhat gracefully if people insist on turning on

register_globals and magic_quotes_gpc. Remove request parameters from global scope, and if they're quoted by magic_quotes_gpc, dequote them. git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@3006 c91229c3-7414-0410-bfa2-8a42b809f60b

Recover somewhat gracefully if people insist on turning on
register_globals and magic_quotes_gpc. Remove request parameters from global scope, and if they're quoted by magic_quotes_gpc, dequote them. git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@3006 c91229c3-7414-0410-bfa2-8a42b809f60b
nbm
1 parent 6c9d48c1
Showing 1 changed file with 62 additions and 10 deletions
config/dmsDefaults.php
@@ -12,20 +12,23 @@
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
  * (at your option) any later version.
- * 
+ *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- * 
+ *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- */ 
+ */
+// Default settings differ, we need some of these, so force the matter.
+// Can be overridden here if actually necessary.
 error_reporting(E_ALL & ~E_NOTICE);
 ini_set('display_errors', '1');
 ini_set('display_startup_errors', '1');
+ini_set('magic_quotes_runtime', '0');
 // If not defined, set KT_DIR based on my usual location in the tree
 if (!defined('KT_DIR')) {
@@ -71,18 +74,18 @@ class KTInit {
     function setupI18n () {
         global $default;
         if (in_array("gettext", get_loaded_extensions()) && function_exists('gettext') && function_exists('_')) {
-            require_once("$default->fileSystemRoot/lib/i18n/languageFunctions.inc");	
-            require_once("$default->fileSystemRoot/lib/i18n/accept-to-gettext.inc");	
+            require_once("$default->fileSystemRoot/lib/i18n/languageFunctions.inc");
+            require_once("$default->fileSystemRoot/lib/i18n/accept-to-gettext.inc");
             if ($default->useAcceptLanguageHeader) {
                 $aInstalledLocales = getInstalledLocales();
                 $sLocale=al2gt($aInstalledLocales, 'text/html');
                 $default->defaultLanguage = $sLocale;
-            }		
-            putenv('LANG=' . $default->defaultLanguage); 
+            }
+            putenv('LANG=' . $default->defaultLanguage);
             setlocale(LC_ALL, $default->defaultLanguage);
             // Set the text domain
             $sDomain = 'knowledgeTree';
-            bindtextdomain($sDomain, $default->fileSystemRoot . "/i18n"); 
+            bindtextdomain($sDomain, $default->fileSystemRoot . "/i18n");
             textdomain($sDomain);
         } else {
             $default->log->info("Gettext not installed, i18n disabled.");
@@ -93,6 +96,50 @@ class KTInit {
         }
     }
     // }}}
+
+
+    // {{{ cleanGlobals()
+    function cleanGlobals () {
+        /* 
+         * Borrowed from TikiWiki
+         * 
+         * Copyright (c) 2002-2004, Luis Argerich, Garland Foster,
+         * Eduardo Polidor, et. al.
+         */
+        if (ini_get('register_globals')) {
+            foreach (array($_ENV, $_GET, $_POST, $_COOKIE, $_SERVER) as $superglob) {
+                foreach ($superglob as $key => $val) {
+                    if (isset($GLOBALS[$key]) && $GLOBALS[$key] == $val) {
+                        unset($GLOBALS[$key]);
+                    }
+                }
+            }
+        }
+    }
+    // }}}
+
+    // {{{ cleanMagicQuotesItem()
+    function cleanMagicQuotesItem (&$var) {
+        if (is_array($var)) {
+            foreach ($var as $key => $val) {
+                KTInit::cleanMagicQuotesItem($var[$key]);
+            }
+        } else {
+            $var = stripslashes($var);
+        }
+    }
+    // }}}
+
+    // {{{ cleanMagicQuotes()
+    function cleanMagicQuotes () {
+        if (get_magic_quotes_gpc()) {
+            KTInit::cleanMagicQuotesItem($_GET);
+            KTInit::cleanMagicQuotesItem($_POST);
+            KTInit::cleanMagicQuotesItem($_REQUEST);
+            KTInit::cleanMagicQuotesItem($_COOKIE);
+        }
+    }
+    // }}}
 }
 // }}}
@@ -113,6 +160,9 @@ KTInit::setupLogging();
 KTInit::setupI18n();
+KTInit::cleanGlobals();
+KTInit::cleanMagicQuotes();
+
 // site map definition
 include("siteMap.inc");
@@ -123,6 +173,8 @@ require_once(KT_DIR . &#39;/presentation/Html.inc&#39;);
 // browser settings
 require_once(KT_DIR . '/phpSniff/phpSniff.class.php');
 require_once('browsers.inc');
-// import request variables and setup language
-require_once(KT_LIB_DIR . '/dms.inc');
+
+// Give everyone access to KTUtil utility functions
+require_once(KT_LIB_DIR . '/util/ktutil.inc');
+
 ?>