con.php

   1 <?php
   2 /**
   3  * con.php: Generic setup file.
   4  *
   5  * Contains user authentication, database connection and other exciting stuff.
   6  * Everything else depends on this file. Don't touch it unless you know what
   7  * you're doing, all the config is done in other places (mostly mysql.php).
   8  *
   9  * @author Anthony Parsons (xmpp:ant@specialops.ath.cx)
  10  * @license file:COPYING
  11  * @version $Id$
  12  */
  13
  14 /**
  15  * Source revision displayed in the page footer.
  16  * AFAIK there's no way to get the overall value both accurately and quickly,
  17  * so the revision for just this file will have to do.
  18  */
  19 define('SO2VER', '$Rev$');
  20
  21
  22 // SO2 won't run on anything less than PHP 5, unless you're masochistic.
  23 if ( version_compare(PHP_VERSION, '5.0', '<') ) {
  24         header('HTTP/1.1 500 Internal Server Error');
  25         die('Server configuration error: PHP 5.0 or higher is _required_.');
  26 }
  27
  28
  29 // Use verbose errors. They won't be shown to the general public anyway.
  30 error_reporting(E_ALL|E_STRICT);
  31
  32
  33 /**
  34  * Start that timer at the bottom of each page.
  35  */
  36 define('CLOCK', microtime(1));
  37
  38
  39 /* Empty exception classes.
  40    These allow for more specific catch{} blocks. */
  41 class InvalidInputException extends Exception {}
  42 class DatabaseException     extends Exception {}
  43 class RateLimitException    extends Exception {}
  44
  45
  46 /* SPL exception classes:
  47    These classes are defined in the Standard PHP Library in PHP 5.1 and above.
  48    If you only run the code on a 5.0 server, you can delete the "if...{" and "}" lines.
  49    If you only run it on a 5.1 server, you can delete the lines inbetween too. */
  50 if ( version_compare(PHP_VERSION, '5.1', '<') ) {
  51         class OutOfBoundsException extends Exception {}
  52         class RuntimeException     extends Exception {}
  53         class LengthException      extends Exception {}
  54 }
  55
  56
  57 /**
  58  * Class autoloader
  59  */
  60 function __autoload($classname)
  61 {
  62         require 'lib/class.'.$classname.'.php';
  63 }
  64 // While we're doing that, these are always used
  65 require 'lib/class.page.php';
  66 require 'lib/class.so2mysqli.php';
  67 require 'lib/class.anonuser.php';
  68
  69 // Debug settings
  70 if ( $_SERVER['REMOTE_ADDR'] === $_SERVER['SERVER_ADDR'] )
  71         /**
  72          * If the "DEVELOPER" constant is defined a bunch of stuff works differently.
  73          */
  74         define('DEVELOPER', 1);
  75
  76
  77 // Create page object. The earlier this is done the better, because it contains the error handler stuff.
  78 $page = new page;
  79
  80
  81 // Set up exception handler and database connection here
  82 if ( defined('DEVELOPER') ) {
  83         /* Using the output buffer lets us switch off XHTML mode later if something buggers up.
  84            Fixing PHP errors is a lot less stressful when they're not hidden behind XML ones. */
  85         ob_start();
  86
  87         function e_handler($exception)
  88         {
  89                 header('HTTP/1.1 500 Internal Server Error');
  90                 header('Content-Type: text/html; charset=UTF-8');
  91                 echo '<pre class="error">',$exception,'</pre>';
  92                 exit;
  93         }
  94
  95         // DB
  96         $dbtype='debugmysqli';
  97 } else {
  98         function e_handler($exception)
  99         {
 100                 if ( !headers_sent() ) {
 101                         header('HTTP/1.1 500 Internal Server Error');
 102                         header('Content-Type: text/html; charset=UTF-8');
 103                 }
 104                 $GLOBALS['page']->errorfooter('runtime');
 105         }
 106
 107         $dbtype='so2mysqli';
 108 }
 109
 110 set_exception_handler('e_handler');
 111 require 'mysql.php';
 112
 113
 114 // Check for a DB connection error. Shit happens.
 115 if ( mysqli_connect_errno() ) {
 116         header('HTTP/1.1 500 Internal Server Error');
 117         die('Server error: No database connection');
 118 }
 119
 120
 121 // Check MySQL server version. See the comment about PHP versions at the top of the file.
 122 if ( version_compare($DB->server_info, '5.0', '<') ) {
 123         header('HTTP/1.1 500 Internal Server Error');
 124         die('Server error: MySQL 5 not found');
 125 }
 126
 127
 128 // Login cookie setting hack
 129 if ( isset($_POST['login'], $_POST['u'], $_POST['p']) )
 130         list($_COOKIE['u'], $_COOKIE['p']) = array($_POST['u'], $_POST['p']);
 131
 132
 133 // The rest of the file is stuff to decide whether you're logged in or not:
 134 if ( isset($_POST['logout']) ) {
 135         setcookie('u', null, 1, '/');
 136         setcookie('p', null, 1, '/');
 137         unset($_COOKIE);
 138         $user = new anonuser;
 139
 140 } elseif ( isset($_COOKIE['u'], $_COOKIE['p']) ) {
 141
 142         /* Try to get the user ID from the DB.
 143            Also tells the DB to remember your user ID, saves fucking around with PHP globals all the time. */
 144         $q = $DB->query('SELECT @userid := `userid` FROM `users`
 145                                          WHERE `alias` = '.$DB->string($_COOKIE['u']).'
 146                                          AND (`password` = AES_ENCRYPT('.$DB->string($_COOKIE['p']).', `reg_ip`)
 147                                                   OR `password` IS NULL)');
 148
 149         // If there's a matching row in the DB then they're authenticated
 150         if ( 1 === $q->num_rows ) {
 151                 // Keep people logged in for 24 hours after their last page view
 152                 setcookie('u', $_COOKIE['u'], time()+86400, '/');
 153                 setcookie('p', $_COOKIE['p'], time()+86400, '/');
 154
 155                 $user = new authuser(isset($prefetch) ? $prefetch : null);
 156         } else {
 157                 /* This block of code gets executed if they fail a login attempt.
 158                    The relevant insults are in lib/class.page.php */
 159                 setcookie('u', null, 1, '/');
 160                 setcookie('p', null, 1, '/');
 161
 162                 $user = new anonuser;
 163         }
 164 } else
 165         $user = new anonuser;
 166 ?>