[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3  *
   4  * This file is part of the phpBB Forum Software package.
   5  *
   6  * @copyright (c) phpBB Limited <https://www.phpbb.com>
   7  * @license GNU General Public License, version 2 (GPL-2.0)
   8  *
   9  * For full copyright and license information, please see
  10  * the docs/CREDITS.txt file.
  11  *
  12  */
  13  
  14  /**
  15  */
  16  if (!defined('IN_PHPBB'))
  17  {
  18      exit;
  19  }
  20  
  21  // Report all errors, except notices and deprecation messages
  22  if (!defined('E_DEPRECATED'))
  23  {
  24      define('E_DEPRECATED', 8192);
  25  }
  26  $level = E_ALL & ~E_NOTICE & ~E_DEPRECATED;
  27  error_reporting($level);
  28  
  29  /*
  30  * Remove variables created by register_globals from the global scope
  31  * Thanks to Matt Kavanagh
  32  */
  33  function deregister_globals()
  34  {
  35      $not_unset = array(
  36          'GLOBALS'    => true,
  37          '_GET'        => true,
  38          '_POST'        => true,
  39          '_COOKIE'    => true,
  40          '_REQUEST'    => true,
  41          '_SERVER'    => true,
  42          '_SESSION'    => true,
  43          '_ENV'        => true,
  44          '_FILES'    => true,
  45          'phpEx'        => true,
  46          'phpbb_root_path'    => true
  47      );
  48  
  49      // Not only will array_merge and array_keys give a warning if
  50      // a parameter is not an array, array_merge will actually fail.
  51      // So we check if _SESSION has been initialised.
  52      if (!isset($_SESSION) || !is_array($_SESSION))
  53      {
  54          $_SESSION = array();
  55      }
  56  
  57      // Merge all into one extremely huge array; unset this later
  58      $input = array_merge(
  59          array_keys($_GET),
  60          array_keys($_POST),
  61          array_keys($_COOKIE),
  62          array_keys($_SERVER),
  63          array_keys($_SESSION),
  64          array_keys($_ENV),
  65          array_keys($_FILES)
  66      );
  67  
  68      foreach ($input as $varname)
  69      {
  70          if (isset($not_unset[$varname]))
  71          {
  72              // Hacking attempt. No point in continuing.
  73              if (isset($_COOKIE[$varname]))
  74              {
  75                  echo "Clear your cookies. ";
  76              }
  77              echo "Malicious variable name detected. Contact the administrator and ask them to disable register_globals.";
  78              exit;
  79          }
  80  
  81          unset($GLOBALS[$varname]);
  82      }
  83  
  84      unset($input);
  85  }
  86  
  87  // Register globals and magic quotes have been dropped in PHP 5.4
  88  if (version_compare(PHP_VERSION, '5.4.0-dev', '>='))
  89  {
  90      /**
  91      * @ignore
  92      */
  93      define('STRIP', false);
  94  }
  95  else
  96  {
  97      if (get_magic_quotes_runtime())
  98      {
  99          // Deactivate
 100          @set_magic_quotes_runtime(0);
 101      }
 102  
 103      // Be paranoid with passed vars
 104      if (@ini_get('register_globals') == '1' || strtolower(@ini_get('register_globals')) == 'on' || !function_exists('ini_get'))
 105      {
 106          deregister_globals();
 107      }
 108  
 109      define('STRIP', (get_magic_quotes_gpc()) ? true : false);
 110  }
 111  
 112  // Prevent date/time functions from throwing E_WARNING on PHP 5.3 by setting a default timezone
 113  if (function_exists('date_default_timezone_set') && function_exists('date_default_timezone_get'))
 114  {
 115      // For PHP 5.1.0 the date/time functions have been rewritten
 116      // and setting a timezone is required prior to calling any date/time function.
 117  
 118      // Since PHP 5.2.0 calls to date/time functions without having a timezone set
 119      // result in E_STRICT errors being thrown.
 120      // Note: We already exclude E_STRICT errors
 121      // (to be exact: they are not included in E_ALL in PHP 5.2)
 122  
 123      // In PHP 5.3.0 the error level has been raised to E_WARNING which causes problems
 124      // because we show E_WARNING errors and do not set a default timezone.
 125      // This is because we have our own timezone handling and work in UTC only anyway.
 126  
 127      // So what we basically want to do is set our timezone to UTC,
 128      // but we don't know what other scripts (such as bridges) are involved,
 129      // so we check whether a timezone is already set by calling date_default_timezone_get().
 130  
 131      // Unfortunately, date_default_timezone_get() itself might throw E_WARNING
 132      // if no timezone has been set, so we have to keep it quiet with @.
 133  
 134      // date_default_timezone_get() tries to guess the correct timezone first
 135      // and then falls back to UTC when everything fails.
 136      // We just set the timezone to whatever date_default_timezone_get() returns.
 137      date_default_timezone_set(@date_default_timezone_get());
 138  }
 139  
 140  // Autoloading of dependencies.
 141  // Three options are supported:
 142  // 1. If dependencies are installed with Composer, Composer will create a
 143  //    vendor/autoload.php. If this file exists it will be
 144  //    automatically used by phpBB. This is the default mode that phpBB
 145  //    will use when shipped.
 146  // 2. To disable composer autoloading, PHPBB_NO_COMPOSER_AUTOLOAD can be specified.
 147  //       Additionally specify PHPBB_AUTOLOAD=/path/to/autoload.php in the
 148  //    environment. This is useful for running CLI scripts and tests.
 149  //    /path/to/autoload.php should define and register class loaders
 150  //    for all of phpBB's dependencies.
 151  // 3. You can also set PHPBB_NO_COMPOSER_AUTOLOAD without setting PHPBB_AUTOLOAD.
 152  //    In this case autoloading needs to be defined before running any phpBB
 153  //    script. This might be useful in cases when phpBB is integrated into a
 154  //    larger program.
 155  if (getenv('PHPBB_NO_COMPOSER_AUTOLOAD'))
 156  {
 157      if (getenv('PHPBB_AUTOLOAD'))
 158      {
 159          require(getenv('PHPBB_AUTOLOAD'));
 160      }
 161  }
 162  else
 163  {
 164      if (!file_exists($phpbb_root_path . 'vendor/autoload.php'))
 165      {
 166          trigger_error(
 167              'Composer dependencies have not been set up yet, run ' .
 168              "'php ../composer.phar install' from the phpBB directory to do so.",
 169              E_USER_ERROR
 170          );
 171      }
 172      require ($phpbb_root_path . 'vendor/autoload.php');
 173  }
 174  
 175  $starttime = explode(' ', microtime());
 176  $starttime = $starttime[1] + $starttime[0];