con.php

   1 <?php
   2 /**
   3  * con.php: Generic setup file.
   4  *
   5  * Contains user authentication, database connection and other exciting stuff.
   6  * Everything else depends on this file. Don't touch it unless you know what
   7  * you're doing, all the config is done in other places (mostly mysql.php).
   8  *
   9  * @author Anthony Parsons (xmpp:ant@specialops.ath.cx)
  10  * @license file://COPYING
  11  * @version $Id$
  12  */
  13
  14 /**
  15  * Source revision displayed in the page footer.
  16  * AFAIK there's no way to get the overall value both accurately and quickly,
  17  * so the revision for just this file will have to do.
  18  */
  19 define('SO2VER', '$Rev$');
  20
  21
  22 // SO2 won't run on anything less than PHP 5, unless you're masochistic.
  23 if ( version_compare(PHP_VERSION, '5.0', '<') ) {
  24         header('HTTP/1.1 500 Internal Server Error');
  25         die('Server configuration error: PHP 5.0 or higher is _required_.');
  26 }
  27
  28
  29 // Use verbose errors. They won't be shown to the general public anyway.
  30 error_reporting(E_ALL|E_STRICT);
  31
  32
  33 /**
  34  * Start that timer at the bottom of each page.
  35  */
  36 define('CLOCK', microtime(1));
  37
  38
  39 /* Empty exception classes.
  40    These allow for more specific catch{} blocks. */
  41 class InvalidInputException extends Exception {}
  42 class DatabaseException     extends Exception {}
  43 class RateLimitException    extends Exception {}
  44
  45
  46 /* SPL exception classes:
  47    These classes are defined in the Standard PHP Library in PHP 5.1 and above.
  48    If you only run the code on a 5.0 server, you can delete the "if...{" and "}" lines.
  49    If you only run it on a 5.1 server, you can delete the lines inbetween too. */
  50 if ( version_compare(PHP_VERSION, '5.1', '<') ) {
  51         class OutOfBoundsException extends Exception {}
  52         class RuntimeException     extends Exception {}
  53         class LengthException      extends Exception {}
  54 }
  55
  56
  57 /**
  58  * Class autoloader
  59  */
  60 function __autoload($classname)
  61 {
  62         require 'lib/class.'.$classname.'.php';
  63 }
  64 // While we're doing that, these are always used
  65 require 'lib/class.page.php';
  66 require 'lib/class.so2mysqli.php';
  67 require 'lib/class.anonuser.php';
  68
  69 // Debug settings
  70 if ( $_SERVER['REMOTE_ADDR'] === $_SERVER['SERVER_ADDR'] ) {
  71         /**
  72          * If the "DEVELOPER" constant is defined a bunch of stuff works differently.
  73          */
  74         define('DEVELOPER', 1);
  75 }
  76
  77 // Create page object. The earlier this is done the better, because it contains the error handler stuff.
  78 $page = new page;
  79
  80
  81 // Set up exception handler and database connection here
  82 if ( defined('DEVELOPER') ) {
  83         /* Using the output buffer lets us switch off XHTML mode later if something buggers up.
  84            Fixing PHP errors is a lot less stressful when they're not hidden behind XML ones. */
  85         ob_start();
  86
  87         function e_handler($exception)
  88         {
  89                 header('HTTP/1.1 500 Internal Server Error');
  90                 header('Content-Type: text/html; charset=UTF-8');
  91                 echo '<pre class="error">',$exception,'</pre>';
  92                 exit;
  93         }
  94
  95         // DB
  96         $dbtype = 'debugmysqli';
  97 } else {
  98         function e_handler($exception)
  99         {
 100                 if ( !headers_sent() ) {
 101                         header('HTTP/1.1 500 Internal Server Error');
 102                         header('Content-Type: text/html; charset=UTF-8');
 103                 }
 104
 105                 $GLOBALS['page']->errorfooter('runtime');
 106         }
 107
 108         $dbtype = 'so2mysqli';
 109 }
 110
 111 set_exception_handler('e_handler');
 112 require 'mysql.php';
 113
 114
 115 // Check for a DB connection error. Shit happens.
 116 if ( mysqli_connect_errno() ) {
 117         header('HTTP/1.1 500 Internal Server Error');
 118         die('Server error: No database connection');
 119 }
 120
 121
 122 // Check MySQL server version. See the comment about PHP versions at the top of the file.
 123 if ( version_compare($DB->server_info, '5.0', '<') ) {
 124         header('HTTP/1.1 500 Internal Server Error');
 125         die('Server error: MySQL 5 not found');
 126 }
 127
 128
 129 // Login cookie setting hack
 130 if ( isset($_POST['login'], $_POST['u'], $_POST['p']) ) {
 131         list($_COOKIE['u'], $_COOKIE['p']) = array($_POST['u'], $_POST['p']);
 132 }
 133
 134
 135 // The rest of the file is stuff to decide whether you're logged in or not:
 136 if ( isset($_POST['logout']) ) {
 137
 138         setcookie('u', null, 1, '/');
 139         setcookie('p', null, 1, '/');
 140         unset($_COOKIE);
 141         $user = new anonuser;
 142
 143 } elseif ( isset($_COOKIE['u'], $_COOKIE['p']) ) {
 144
 145         /* Try to get the user ID from the DB.
 146            Also tells the DB to remember your user ID, saves fucking around with PHP globals all the time. */
 147         $q = $DB->query('SELECT @userid := `userid` FROM `users`
 148                                 WHERE `alias` = '.$DB->string($_COOKIE['u']).'
 149                                 AND (`password` = AES_ENCRYPT('.$DB->string($_COOKIE['p']).', `reg_ip`)
 150                                         OR `password` IS NULL)');
 151
 152         // If there's a matching row in the DB then they're authenticated
 153         if ( 1 === $q->num_rows ) {
 154                 // Keep people logged in for 24 hours after their last page view
 155                 setcookie('u', $_COOKIE['u'], time()+86400, '/');
 156                 setcookie('p', $_COOKIE['p'], time()+86400, '/');
 157
 158                 $user = new authuser(isset($prefetch) ? $prefetch : null);
 159         } else {
 160                 /* This block of code gets executed if they fail a login attempt.
 161                    The relevant insults are in lib/class.page.php */
 162                 setcookie('u', null, 1, '/');
 163                 setcookie('p', null, 1, '/');
 164
 165                 $user = new anonuser;
 166         }
 167 } else
 168         $user = new anonuser;
 169 ?>