[0000281] Filename saitization added
[fa-stable.git] / includes / main.inc
1 <?php
2 /**********************************************************************
3     Copyright (C) FrontAccounting, LLC.
4         Released under the terms of the GNU General Public License, GPL, 
5         as published by the Free Software Foundation, either version 3 
6         of the License, or (at your option) any later version.
7     This program is distributed in the hope that it will be useful,
8     but WITHOUT ANY WARRANTY; without even the implied warranty of
9     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
10     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
11 ***********************************************************************/
12 include_once($path_to_root . "/includes/db/connect_db.inc");
13
14 include_once($path_to_root . "/includes/errors.inc");
15 include_once($path_to_root . "/includes/types.inc");
16 include_once($path_to_root . "/includes/systypes.inc");
17 include_once($path_to_root . "/includes/references.inc");
18 include_once($path_to_root . "/includes/db/comments_db.inc");
19 include_once($path_to_root . "/includes/db/sql_functions.inc");
20 include_once($path_to_root . "/includes/db/audit_trail_db.inc");
21 //include_once($path_to_root . "/includes/validation.inc");
22
23 include_once($path_to_root . "/admin/db/users_db.inc");
24 include_once($path_to_root . "/includes/ui/ui_view.inc");
25 include_once($path_to_root . "/includes/ui/ui_controls.inc");
26         
27 function page($title, $no_menu=false, $is_index=false, $onload="", $js="", $script_only=false, $css='')
28 {
29
30         global $path_to_root, $page_security;
31
32
33         $hide_menu = $no_menu;
34
35         include($path_to_root . "/includes/page/header.inc");
36
37         page_header($title, $no_menu, $is_index, $onload, $js, $css);
38         check_page_security($page_security);
39 //      error_box();
40         if($script_only) {              
41                 echo '<noscript>';
42                 echo display_heading(_('This page is usable only with javascript enabled browsers.'));
43                 echo '</noscript>';
44                 div_start('_page_body', null, true);
45         } else {
46                 div_start('_page_body'); // whole page content for ajax reloading
47         }
48 }
49
50 function end_page($no_menu=false, $is_index=false, $hide_back_link=false, $type_no=0, $trans_no=0)
51 {
52         global $path_to_root;
53
54         if (!$is_index && !$hide_back_link && function_exists('hyperlink_back'))
55                 hyperlink_back(true, $no_menu, $type_no, $trans_no);
56         div_end();      // end of _page_body section
57
58         include($path_to_root . "/includes/page/footer.inc");
59         page_footer($no_menu, $is_index, $hide_back_link);
60 }
61
62 function cache_js_file($fpath, $text) 
63 {
64         global $go_debug;
65
66         if(!$go_debug) $text = js_compress($text);
67
68         $file = fopen($fpath, 'w');
69         if (!$file) return false;
70         if (!fwrite($file, $text)) return false;
71         return fclose($file);
72
73 }
74
75 function add_js_file($filename) 
76 {
77           global $js_static;
78
79           $search = array_search($filename, $js_static);
80           if ($search === false || $search === null) // php>4.2.0 returns null
81                 $js_static[] = $filename;       
82 }
83
84 function add_js_ufile($filename) 
85 {
86           global $js_userlib;
87
88           $search = array_search($filename, $js_userlib);
89           if ($search === false || $search === null) // php>4.2.0 returns null
90                 $js_userlib[] = $filename;
91 }
92
93 function add_js_source($text) 
94 {
95           global $js_lib;
96           
97           $search = array_search($text, $js_lib);
98           if ($search === false || $search === null) // php>4.2.0 returns null
99                 $js_lib[] = $text;
100 }
101
102 /**
103  * Compresses the Javascript code for more efficient delivery.
104  * copyright (c) 2005 by Jared White & J. Max Wilson
105  * http://www.xajaxproject.org
106  * Added removing comments from output.
107  * Warning: Fails on RegExp with quotes - use new RegExp() in this case.
108  */
109 function js_compress($sJS)
110 {
111         //remove windows cariage returns
112         $sJS = str_replace("\r","",$sJS);
113         
114         //array to store replaced literal strings
115         $literal_strings = array();
116         
117         //explode the string into lines
118         $lines = explode("\n",$sJS);
119         //loop through all the lines, building a new string at the same time as removing literal strings
120         $clean = "";
121         $inComment = false;
122         $literal = "";
123         $inQuote = false;
124         $escaped = false;
125         $quoteChar = "";
126         
127         for($i=0;$i<count($lines);$i++)
128         {
129                 $line = $lines[$i];
130                 $inNormalComment = false;
131         
132                 //loop through line's characters and take out any literal strings, replace them with ___i___ where i is the index of this string
133                 $len = strlen($line);
134                 for($j=0;$j<$len;$j++)
135                 {
136                         $c = $line[$j];         // this is _really_ faster than subst
137                         $d = $c.$line[$j+1];
138         
139                         //look for start of quote
140                         if(!$inQuote && !$inComment)
141                         {
142                                 //is this character a quote or a comment
143                                 if(($c=="\"" || $c=="'") && !$inComment && !$inNormalComment)
144                                 {
145                                         $inQuote = true;
146                                         $inComment = false;
147                                         $escaped = false;
148                                         $quoteChar = $c;
149                                         $literal = $c;
150                                 }
151                                 else if($d=="/*" && !$inNormalComment)
152                                 {
153                                         $inQuote = false;
154                                         $inComment = true;
155                                         $escaped = false;
156                                         $quoteChar = $d;
157                                         $literal = $d;  
158                                         $j++;   
159                                 }
160                                 else if($d=="//") //ignore string markers that are found inside comments
161                                 {
162                                         $inNormalComment = true;
163                                         $clean .= $c;
164                                 }
165                                 else
166                                 {
167                                         $clean .= $c;
168                                 }
169                         }
170                         else //allready in a string so find end quote
171                         {
172                                 if($c == $quoteChar && !$escaped && !$inComment)
173                                 {
174                                         $inQuote = false;
175                                         $literal .= $c;
176         
177                                         //subsitute in a marker for the string
178                                         $clean .= "___" . count($literal_strings) . "___";
179         
180                                         //push the string onto our array
181                                         array_push($literal_strings,$literal);
182         
183                                 }
184                                 else if($inComment && $d=="*/")
185                                 {
186                                         $inComment = false;
187                                         $literal .= $d;
188         
189                                         //subsitute in a marker for the string
190                                         $clean .= "___" . count($literal_strings) . "___";
191         
192                                         //push the string onto our array
193                                         array_push($literal_strings,$literal);
194         
195                                         $j++;
196                                 }
197                                 else if($c == "\\" && !$escaped)
198                                         $escaped = true;
199                                 else
200                                         $escaped = false;
201         
202                                 $literal .= $c;
203                         }
204                 }
205                 if($inComment) $literal .= "\n";
206                 $clean .= "\n";
207         }
208         //explode the clean string into lines again
209         $lines = explode("\n",$clean);
210         
211         //now process each line at a time
212         for($i=0;$i<count($lines);$i++)
213         {
214                 $line = $lines[$i];
215         
216                 //remove comments
217                 $line = preg_replace("/\/\/(.*)/","",$line);
218         
219                 //strip leading and trailing whitespace
220                 $line = trim($line);
221         
222                 //remove all whitespace with a single space
223                 $line = preg_replace("/\s+/"," ",$line);
224         
225                 //remove any whitespace that occurs after/before an operator
226                 $line = preg_replace("/\s*([!\}\{;,&=\|\-\+\*\/\)\(:])\s*/","\\1",$line);
227         
228                 $lines[$i] = $line;
229         }
230         
231         //implode the lines
232         $sJS = implode("\n",$lines);
233         
234         //make sure there is a max of 1 \n after each line
235         $sJS = preg_replace("/[\n]+/","\n",$sJS);
236         
237         //strip out line breaks that immediately follow a semi-colon
238         $sJS = preg_replace("/;\n/",";",$sJS);
239         
240         //curly brackets aren't on their own
241         $sJS = preg_replace("/[\n]*\{[\n]*/","{",$sJS);
242         
243         //finally loop through and replace all the literal strings:
244         for($i=0;$i<count($literal_strings);$i++) {
245             if (strpos($literal_strings[$i],"/*")!==false) 
246                 $literal_strings[$i]= '';
247                 $sJS = str_replace("___".$i."___",$literal_strings[$i],$sJS);
248         }
249         return $sJS;
250 }
251
252 /*
253         Check if file can be updated, restoring subdirectories 
254         if needed. Returns 1 when no confilcts, -1 when file exists and is writable
255 */
256 function check_write($path)
257 {
258         if ($path == ''//|| $path == '.' || $path == '..'
259         ) return 0;
260         
261         return is_writable($path) ? (is_dir($path) ? 1 : -1) 
262                 : (is_file($path) ? 0 : ($path == '.' ? 0 : check_write(dirname($path))));
263 }
264
265 /*
266         Copies set of files. When $strict is set
267         also removes files from the $to which 
268         does not exists in $from directory but arelisted in $flist.
269 */
270 function copy_files($flist, $from, $to, $strict=false)
271 {
272         foreach ($flist as $file) {
273                 if (file_exists($from.'/'.$file)) {
274                         if (!copy_file($file, $from, $to))
275                                 return false;
276                 } else if ($strict) {
277                                 unlink($to.'/'.$file);
278                 }
279         }
280         return true;
281 }
282
283 /*
284         Copies file from base to target directory, restoring subdirectories 
285         if needed.
286 */
287 function copy_file($file, $from, $to)
288 {
289
290         if (!is_dir(dirname($file=='.' ? $to : ($to.'/'.$file)))) {
291                 if (!copy_file(dirname($file), null, $to))
292                         return false;
293         }
294         if (!$from) {
295         //              error_log( 'dodanie katalogu '.$to.'/'.$file);
296                 return @mkdir($file=='.' ? $to : ($to.'/'.$file));
297         }
298         else {
299         //              error_log( 'skopiowanie '.$to.'/'.$file);
300                 return @copy($from.'/'.$file, $to.'/'.$file);
301         }
302 }
303 /*
304         Search for file, looking first for company specific version, then for 
305         version provided by any extension module, finally in main FA directory.
306         Also adds include path for any related files, and sets $local_path_to_root 
307         to enable local translation domains.
308         
309         Returns found file path or null.
310 */
311 function find_custom_file($rep)
312 {
313         global $installed_extensions, $path_to_root, $local_path_to_root;
314
315         // customized per company version
316         $path = company_path();
317         $file = $path.$rep;
318         if (file_exists($file)) {
319                 // add local include path
320                 $local_path_to_root = $path;
321                 set_include_path(dirname($file).PATH_SEPARATOR.get_include_path());
322                 return $file;
323         }
324         // file added by active extension modules
325         if (count($installed_extensions) > 0)
326         {
327                 $extensions = $installed_extensions;
328                 foreach ($extensions as $ext)
329                         if (($ext['active'] && $ext['type'] == 'extension')) {
330                                 $path = $path_to_root.'/'.$ext['path'];
331                                 $file = $path.$rep;
332                                 if (file_exists($file)) {
333                                         set_include_path($path.PATH_SEPARATOR.get_include_path());
334                                         $local_path_to_root = $path;
335                                         return $file;
336                                 }
337                         }
338         }
339         // standard location
340         $file = $path_to_root.$rep;
341         if (file_exists($file))
342                 return $file;
343
344         return null;
345 }
346 /*
347         
348         Protect against directory traversal.
349         Changes all not POSIX compatible chars to underscore.
350 */
351 function clean_file_name($filename) {
352     return preg_replace('/[^a-zA-Z0-9.\-_]/', '_', $filename);
353 }
354
355 ?>