<?php

/*

 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between

 * Version 1.1.4 (Caoineag alpha 4)

 * Copyright (C) 2006-2008 Dan Fuhry

 *

 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

 */

/**

 * Fetch a value from the site configuration.

 * @param string The identifier of the value ("site_name" etc.)

 * @param string If specified, this is the "default" value for the configuration entry. Defaults to false.

 * @return string Configuration value, or bool(false) if the value is not set

 */

function getConfig($n, $default = false)

{

  global $enano_config;

  if ( isset( $enano_config[ $n ] ) )

  {

    return $enano_config[$n];

  }

  else

  {

    return $default;

  }

}

/**

 * Update or change a configuration value.

 * @param string The identifier of the value ("site_name" etc.)

 * @param string The new value

 * @return null

 */

function setConfig($n, $v)

{

  global $enano_config, $db;

  if ( isset($enano_config[$n]) )

  {

    if ( $enano_config[$n] === $v )

    {

      // configuration already matches this value

      return true;

    }

  }

  $enano_config[$n] = $v;

  $v = $db->escape($v);

  $e = $db->sql_query('DELETE FROM '.table_prefix.'config WHERE config_name=\''.$n.'\';');

  if ( !$e )

  {

    $db->_die('Error during generic setConfig() call row deletion.');

  }

  $e = $db->sql_query('INSERT INTO '.table_prefix.'config(config_name, config_value) VALUES(\''.$n.'\', \''.$v.'\')');

  if ( !$e )

  {

    $db->_die('Error during generic setConfig() call row insertion.');

  }

}

/**

 * Create a URI for an internal link.

 * @param string The full identifier of the page to link to (Special:Administration)

 * @param string The GET query string to append

 * @param bool   If true, perform htmlspecialchars() on the return value to make it HTML-safe

 * @return string

 */

if ( !function_exists('makeUrl') )

{

  function makeUrl($t, $query = false, $escape = false)

  {

    global $db, $session, $paths, $template, $plugins; // Common objects

    $flags = '';

    $sep = urlSeparator;

    $t = sanitize_page_id($t);

    if ( isset($_GET['printable'] ) )

    {

      $flags .= $sep . 'printable=yes';

      $sep = '&';

    }

    if ( isset($_GET['theme'] ) )

    {

      $flags .= $sep . 'theme='.$session->theme;

      $sep = '&';

    }

    if ( isset($_GET['style'] ) )

    {

      $flags .= $sep . 'style='.$session->style;

      $sep = '&';

    }

    if ( isset($_GET['lang']) && preg_match('/^[a-z0-9_]+$/', @$_GET['lang']) )

    {

      $flags .= $sep . 'lang=' . urlencode($_GET['lang']);

      $sep = '&';

    }

    $url = $session->append_sid(contentPath.$t.$flags);

    if($query)

    {

      $sep = strstr($url, '?') ? '&' : '?';

      $url = $url . $sep . $query;

    }

    return ($escape) ? htmlspecialchars($url) : $url;

  }

}

/**

 * Create a URI for an internal link, and be namespace-friendly. Watch out for this one because it's different from most other Enano functions, in that the namespace is the first parameter.

 * @param string The namespace ID

 * @param string The page ID

 * @param string The GET query string to append

 * @param bool   If true, perform htmlspecialchars() on the return value to make it HTML-safe

 * @return string

 */

if ( !function_exists('makeUrlNS') )

{

  function makeUrlNS($n, $t, $query = false, $escape = false)

  {

    global $db, $session, $paths, $template, $plugins; // Common objects

    $flags = '';

    if(defined('ENANO_BASE_CLASSES_INITIALIZED'))

    {

      $sep = urlSeparator;

    }

    else

    {

      $sep = (strstr($_SERVER['REQUEST_URI'], '?')) ? '&' : '?';

    }

    if ( isset( $_GET['printable'] ) ) {

      $flags .= $sep . 'printable';

      $sep = '&';

    }

    if ( isset( $_GET['theme'] ) )

    {

      $flags .= $sep . 'theme='.$session->theme;

      $sep = '&';

    }

    if ( isset( $_GET['style'] ) )

    {

      $flags .= $sep . 'style='.$session->style;

      $sep = '&';

    }

    if ( isset($_GET['lang']) && preg_match('/^[a-z0-9_]+$/', @$_GET['lang']) )

    {

      $flags .= $sep . 'lang=' . urlencode($_GET['lang']);

      $sep = '&';

    }

    $ns_prefix = "$n:";

    if(defined('ENANO_BASE_CLASSES_INITIALIZED'))

    {

      $ns_prefix = ( isset($paths->nslist[$n]) ) ? $paths->nslist[$n] : $n . substr($paths->nslist['Special'], -1);

      $url = contentPath . $ns_prefix . $t . $flags;

    }

    else

    {

      // If the path manager hasn't been initted yet, take an educated guess at what the URI should be

      $url = contentPath . $n . ':' . $t . $flags;

    }

    if($query)

    {

      if(strstr($url, '?'))

      {

        $sep =  '&';

      }

      else

      {

        $sep = '?';

      }

      $url = $url . $sep . $query . $flags;

    }

    if(defined('ENANO_BASE_CLASSES_INITIALIZED'))

    {

      $url = $session->append_sid($url);

    }

    return ($escape) ? htmlspecialchars($url) : $url;

  }

}

/**

 * Create a URI for an internal link, be namespace-friendly, and add http://hostname/scriptpath to the beginning if possible. Watch out for this one because it's different from most other Enano functions, in that the namespace is the first parameter.

 * @param string The namespace ID

 * @param string The page ID

 * @param string The GET query string to append

 * @param bool   If true, perform htmlspecialchars() on the return value to make it HTML-safe

 * @return string

 */

function makeUrlComplete($n, $t, $query = false, $escape = false)

{

  global $db, $session, $paths, $template, $plugins; // Common objects

  $flags = '';

  if(defined('ENANO_BASE_CLASSES_INITIALIZED'))

  {

    $sep = urlSeparator;

  }

  else

  {

    $sep = (strstr($_SERVER['REQUEST_URI'], '?')) ? '&' : '?';

  }

  if ( isset( $_GET['printable'] ) ) {

    $flags .= $sep . 'printable';

    $sep = '&';

  }

  if ( isset( $_GET['theme'] ) )

  {

    $flags .= $sep . 'theme='.$session->theme;

    $sep = '&';

  }

  if ( isset( $_GET['style'] ) )

  {

    $flags .= $sep . 'style='.$session->style;

    $sep = '&';

  }

  if ( isset($_GET['lang']) && preg_match('/^[a-z0-9_]+$/', @$_GET['lang']) )

  {

    $flags .= $sep . 'lang=' . urlencode($_GET['lang']);

    $sep = '&';

  }

  if(defined('ENANO_BASE_CLASSES_INITIALIZED'))

  {

    $url = $session->append_sid(contentPath . $paths->nslist[$n] . $t . $flags);

  }

  else

  {

    // If the path manager hasn't been initted yet, take an educated guess at what the URI should be

    $url = contentPath . $n . ':' . $t . $flags;

  }

  if($query)

  {

    if(strstr($url, '?')) $sep =  '&';

    else $sep = '?';

    $url = $url . $sep . $query . $flags;

  }

  $baseprot = 'http' . ( isset($_SERVER['HTTPS']) ? 's' : '' ) . '://' . $_SERVER['HTTP_HOST'];

  $url = $baseprot . $url;

  return ($escape) ? htmlspecialchars($url) : $url;

}

/**

 * Enano replacement for date(). Accounts for individual users' timezone preferences.

 * @param string Date-formatted string

 * @param int Optional - UNIX timestamp value to use. If omitted, the current time is used.

 * @return string Formatted string

 */

function enano_date($string, $timestamp = false)

{

  if ( !is_int($timestamp) && !is_double($timestamp) && strval(intval($timestamp)) !== $timestamp )

    $timestamp = time();

  /*

  // List of valid characters for date()

  $date_chars = 'dDjlNSwzWFmMntLoYyaABgGhHisueIOPTZFcrU';

  // Split them into an array

  $date_chars = enano_str_split($date_chars);

  // Emulate date() formatting by replacing date characters with their

  // percentage-signed counterparts, but not escaped characters which

  // shouldn't be parsed.

  foreach ( $date_chars as $char )

  {

    $string = str_replace($char, "%$char", $string);

    $string = str_replace("\\%$char", $char, $string);

  }

  */

  // perform timestamp offset

  global $timezone;

  // it's gonna be in minutes, so multiply by 60 to offset the unix timestamp

  $timestamp = $timestamp + ( $timezone * 60 );

  // Let PHP do the work for us =)

  return gmdate($string, $timestamp);

}

/**

 * Tells you the title for the given page ID string

 * @param string Page ID string (ex: Special:Administration)

 * @param bool Optional. If true, and if the namespace turns out to be something other than Article, the namespace prefix will be prepended to the return value.

 * @return string

 */

function get_page_title($page_id, $show_ns = true)

{

  global $db, $session, $paths, $template, $plugins; // Common objects

  $idata = RenderMan::strToPageID($page_id);

  $page_id_key = $paths->nslist[ $idata[1] ] . $idata[0];

  $page_id_key = sanitize_page_id($page_id_key);

  $page_data = @$paths->pages[$page_id_key];

  $title = ( isset($page_data['name']) ) ?

    ( ( $page_data['namespace'] == 'Article' || !$show_ns ) ?

      '' :

      $paths->nslist[ $idata[1] ] )

    . $page_data['name'] :

    ( $show_ns ? $paths->nslist[$idata[1]] : '' ) . str_replace('_', ' ', dirtify_page_id( $idata[0] ) );

  return $title;

}

/**

 * Tells you the title for the given page ID and namespace

 * @param string Page ID

 * @param string Namespace

 * @return string

 */

function get_page_title_ns($page_id, $namespace)

{

  global $db, $session, $paths, $template, $plugins; // Common objects

  $ns_prefix = ( isset($paths->nslist[ $namespace ]) ) ? $paths->nslist[ $namespace ] : $namespace . substr($paths->nslist['Special'], -1);

  $page_id_key = $ns_prefix . $page_id;

  if ( isset($paths->pages[$page_id_key]) )

  {

    $page_data = $paths->pages[$page_id_key];

  }

  else

  {

    $page_data = array();

  }

  $title = ( isset($page_data['name']) ) ? $page_data['name'] : $ns_prefix . str_replace('_', ' ', dirtify_page_id( $page_id ) );

  return $title;

}

/**

 * Redirect the user to the specified URL.

 * @param string $url The URL, either relative or absolute.

 * @param string $title The title of the message

 * @param string $message A short message to show to the user

 * @param string $timeout Timeout, in seconds, to delay the redirect. Defaults to 3. If 0, sends a 307 Temporary Redirect.

 */

function redirect($url, $title = 'etc_redirect_title', $message = 'etc_redirect_body', $timeout = 3)

{

  global $db, $session, $paths, $template, $plugins; // Common objects

  global $lang;

  // POST check added in 1.1.x because Firefox asks us if we want to "resend the form

  // data to the new location", which can be confusing for some users.

  if ( $timeout == 0 && empty($_POST) )

  {

    header('Location: ' . $url);

    header('Content-length: 0');

    header('HTTP/1.1 307 Temporary Redirect');

    // with 3xx codes HTTP clients expect a response of 0 bytes, so just die here

    exit();

  }

  if ( !is_object($template) )

  {

    $template = new template_nodb();

    $template->load_theme('oxygen', 'bleu', false);

    $template->assign_vars(array(

        'SITE_NAME' => 'Enano',

        'SITE_DESC' => 'This site is experiencing a critical error and cannot load.',

        'COPYRIGHT' => 'Powered by Enano CMS - &copy; 2006-2008 Dan Fuhry. This program is Free Software; see the <a href="' . scriptPath . '/install.php?mode=license">GPL file</a> included with this package for details.',

        'PAGE_NAME' => htmlspecialchars($title)

      ));

  }

  $template->add_header('<meta http-equiv="refresh" content="' . $timeout . '; url=' . str_replace('"', '\\"', $url) . '" />');

  $template->add_header('<script type="text/javascript">

      function __r() {

        // FUNCTION AUTOMATICALLY GENERATED

        window.location="' . str_replace('"', '\\"', $url) . '";

      }

      setTimeout(\'__r();\', ' . $timeout . '000);

    </script>

    ');

  if ( get_class($template) == 'template_nodb' )

    $template->init_vars();

  $template->assign_vars(array('PAGE_NAME' => $title));

  $template->header(true);

  echo '<p>' . $message . '</p>';

  $subst = array(

      'timeout' => $timeout,

      'redirect_url' => str_replace('"', '\\"', $url)

    );

  echo '<p>' . $lang->get('etc_redirect_timeout', $subst) . '</p>';

  $template->footer(true);

  $db->close();

  exit(0);

}

/**

 * Generates a confirmation form if a CSRF check fails. Will terminate execution.

 */

function csrf_request_confirm()

{

  global $db, $session, $paths, $template, $plugins; // Common objects

  global $lang;

  // If the token was overridden with the correct one, the user confirmed the action using this form. Continue exec.

  if ( isset($_POST['cstok']) || isset($_GET ['cstok']) )

  {

    // using the if() check makes sure that the token isn't in a cookie, since $_REQUEST includes $_COOKIE.

    $token_check =& $_REQUEST['cstok'];

    if ( $token_check === $session->csrf_token )

    {

      // overridden token matches, continue exec

      return true;

    }

  }

  $template->tpl_strings['PAGE_NAME'] = htmlspecialchars($lang->get('user_csrf_confirm_title'));

  $template->header();

  // initial info

  echo '<p>' . $lang->get('user_csrf_confirm_body') . '</p>';

  // start form

  $form_method = ( empty($_POST) ) ? 'get' : 'post';

  echo '<form action="' . htmlspecialchars($_SERVER['REQUEST_URI']) . '" method="' . $form_method . '" enctype="multipart/form-data">';

  echo '<fieldset enano:expand="closed">';

  echo '<legend>' . $lang->get('user_csrf_confirm_btn_viewrequest') . '</legend><div>';

  if ( empty($_POST) )

  {

    // GET request

    echo csrf_confirm_get_recursive();

  }

  else

  {

    // POST request

    echo csrf_confirm_post_recursive();

  }

  echo '</div></fieldset>';

  // insert the right CSRF token

  echo '<input type="hidden" name="cstok" value="' . $session->csrf_token . '" />';

  echo '<p><input type="submit" value="' . $lang->get('user_csrf_confirm_btn_continue') . '" /></p>';

  echo '</form>';

  $template->footer();

  exit;

}

function csrf_confirm_get_recursive($_inner = false, $pfx = false, $data = false)

{

  // make posted arrays work right

  if ( !$data )

    ( $_inner == 'post' ) ? $data =& $_POST : $data =& $_GET;

  foreach ( $data as $key => $value )

  {

    $pfx_this = ( empty($pfx) ) ? $key : "{$pfx}[{$key}]";

    if ( is_array($value) )

    {

      csrf_confirm_get_recursive(true, $pfx_this, $value);

    }

    else if ( empty($value) )

    {

      echo htmlspecialchars($pfx_this . " = <nil>") . "<br />\n";

      echo '<input type="hidden" name="' . htmlspecialchars($pfx_this) . '" value="" />';

    }

    else

    {

      echo htmlspecialchars($pfx_this . " = " . $value) . "<br />\n";

      echo '<input type="hidden" name="' . htmlspecialchars($pfx_this) . '" value="' . htmlspecialchars($value) . '" />';

    }

  }

}

function csrf_confirm_post_recursive()

{