Forgotten fix: don't allow special read/write access for 'developer'

[lhc/web/wiklou.git] / wiki.phtml

diff --git a/wiki.phtml b/wiki.phtml
index 8b07102..d30db09 100644 (file)
--- a/wiki.phtml
+++ b/wiki.phtml
@@ -3,19 +3,28 @@
 #
 $wgRequestTime = microtime();
 
-session_cache_limiter( "public" );
-session_start();
-session_register( "wsUserID" );
-session_register( "wsUserName" );
-session_register( "wsUserPassword" );
-
-global $IP;
+unset( $IP );
+ini_set( "allow_url_fopen", 0 ); # For security...
 include_once( "./LocalSettings.php" );
-include_once( "$IP/Setup.php" );
+
+# Windows requires ';' as separator, ':' for Unix
+$sep = strchr( $include_path = ini_get( "include_path" ), ";" ) ? ";" : ":";
+ini_set( "include_path", "$IP$sep$include_path" );
+
+include_once( "Setup.php" );
 
 wfProfileIn( "main-misc-setup" );
 OutputPage::setEncodings(); # Not really used yet
 
+# Useful debug output
+wfDebug( "\nStart request\n" );
+wfDebug( "$REQUEST_METHOD $REQUEST_URI\n" );
+$headers = getallheaders();
+foreach ($headers as $name => $value) {
+       wfDebug( "$name: $value\n" );
+}
+wfDebug( "\n" );
+
 # Query string fields
 #
 global $action, $title, $search, $go, $target, $printable;
@@ -30,42 +39,61 @@ if ( "" == $title && "delete" != $action ) {
 } else {
        $wgTitle = Title::newFromURL( $title );
 #      if( $wgTitle->getInterwiki() != "" or $wgTitle->getDBkey() == "" or strncmp($wgTitle->getDBkey(),"_",1) == 0 ) {
-       if( $wgTitle->getInterwiki() != "" or $wgTitle->getDBkey() == "" ) {
+       if( !$wgTitle or $wgTitle->getInterwiki() != "" or $wgTitle->getDBkey() == "" ) {
+               $wgTitle = Title::newFromText( wfMsg( "badtitle" ) );
                $wgOut->errorpage( "badtitle", "badtitletext" );
                $wgOut->output();
                exit;
        }
 }
-wfProfileOut();
-if ( -1 == $wgTitle->getNamespace() ) {
+wfProfileOut( "main-misc-setup" );
+
+if ( Namespace::getSpecial() == $wgTitle->getNamespace() ) {
        wfSpecialPage();
 } else if ( "" != $search ) {
        if($go) {
-       
-               wfGo ($search);
-       
+               wfGo( $search );
        } else {
-       
                wfSearch( $search );
-               
        }
-               
 } else {
-       $wgArticle = new Article();
+       if ( Namespace::getMedia() == $wgTitle->getNamespace() ) {
+               $wgTitle = Title::makeTitle( Namespace::getImage(), $wgTitle->getDBkey() );
+       }       
+       
+       switch( $wgTitle->getNamespace() ) {
+       case 6:
+               include_once( "ImagePage.php" );
+               $wgArticle = new ImagePage( $wgTitle );
+               break;
+       default:
+               $wgArticle = new Article( $wgTitle );
+       }
 
-       if ( "view" == $action ) { $wgArticle->view(); }
-       else if ( "edit" == $action ) { $wgArticle->edit(); }
-       else if ( "submit" == $action ) { $wgArticle->submit(); }
-       else if ( "print" == $action ) { $wgArticle->view(); }
-       else if ( "watch" == $action ) { $wgArticle->watch(); }
-       else if ( "unwatch" == $action ) { $wgArticle->unwatch(); }
-       else if ( "history" == $action ) { $wgArticle->history(); }
-       else if ( "delete" == $action ) { $wgArticle->delete(); }
-       else if ( "revert" == $action ) { $wgArticle->revert(); }
-       else if ( "rollback" == $action ) { $wgArticle->rollback(); }
-       else if ( "protect" == $action ) { $wgArticle->protect(); }
-       else if ( "unprotect" == $action ) { $wgArticle->unprotect(); }
-       else { $wgOut->errorpage( "nosuchaction", "nosuchactiontext" ); }
+       switch( $action ) {
+               case "view":
+               case "watch":
+               case "unwatch":
+               case "history":
+               case "delete":
+               case "revert":
+               case "rollback":
+               case "protect":
+               case "unprotect":
+                       $wgArticle->$action();
+                       break;
+               case "print":
+                       $wgArticle->view();
+                       break;
+               case "edit":
+               case "submit":
+                       include_once( "EditPage.php" );
+                       $editor = new EditPage( $wgArticle );
+                       $editor->$action();
+                       break;
+               default:
+                       $wgOut->errorpage( "nosuchaction", "nosuchactiontext" );
+       }
 }
 
 $wgOut->output();