From d3c61d791decc0cee3a31f350346ef0311309a6e Mon Sep 17 00:00:00 2001
From: Brion Vibber <brion@users.mediawiki.org>
Date: Mon, 17 Nov 2003 03:00:18 +0000
Subject: [PATCH] Security fix: include path

---
 includes/DatabaseFunctions.php          |  5 ++--
 includes/GlobalFunctions.php            |  7 +++--
 includes/Setup.php                      | 36 ++++++++++++-------------
 includes/SpecialRecentchangeslinked.php |  3 +--
 includes/UpdateClasses.php              | 13 +++++----
 languages/Language.php                  |  3 +--
 languages/LanguagePl.php                |  3 +--
 languages/LanguageSk.php                |  2 +-
 languages/LanguageUtf8.php              |  2 +-
 texvc.phtml                             |  3 +--
 wiki.phtml                              | 15 ++++++++---
 11 files changed, 45 insertions(+), 47 deletions(-)

diff --git a/includes/DatabaseFunctions.php b/includes/DatabaseFunctions.php
index 3c1ce5ac19..d753a016d9 100644
--- a/includes/DatabaseFunctions.php
+++ b/includes/DatabaseFunctions.php
@@ -1,7 +1,6 @@
 <?
-global $IP;
-include_once( "$IP/FulltextStoplist.php" );
-include_once( "$IP/CacheManager.php" );
+include_once( "FulltextStoplist.php" );
+include_once( "CacheManager.php" );
 
 define( "DB_READ", -1 );
 define( "DB_WRITE", -2 );
diff --git a/includes/GlobalFunctions.php b/includes/GlobalFunctions.php
index 0d05f419f1..390db76fa3 100644
--- a/includes/GlobalFunctions.php
+++ b/includes/GlobalFunctions.php
@@ -5,10 +5,9 @@ $wgNumberOfArticles = -1; # Unset
 $wgTotalViews = -1;
 $wgTotalEdits = -1;
 
-global $IP;
-include_once( "$IP/DatabaseFunctions.php" );
-include_once( "$IP/UpdateClasses.php" );
-include_once( "$IP/LogPage.php" );
+include_once( "DatabaseFunctions.php" );
+include_once( "UpdateClasses.php" );
+include_once( "LogPage.php" );
 
 /*
  * Compatibility functions
diff --git a/includes/Setup.php b/includes/Setup.php
index 16cc547460..c4c1de079c 100644
--- a/includes/Setup.php
+++ b/includes/Setup.php
@@ -5,13 +5,11 @@
 # setting up a few globals.
 #
 
-global $IP;
-
 if( !isset( $wgProfiling ) )
 	$wgProfiling = false;
 
 if ( $wgProfiling ) {
-	include_once( "$IP/Profiling.php" );
+	include_once( "Profiling.php" );
 } else {
 	function wfProfileIn( $fn ) {}
 	function wfProfileOut( $fn = "" ) {}
@@ -25,19 +23,19 @@ wfProfileIn( "$fname-includes" );
 
 # Only files which are used on every invocation should be included here
 # Otherwise, include them conditionally [TS]
-include_once( "$IP/GlobalFunctions.php" );
-include_once( "$IP/Namespace.php" );
-include_once( "$IP/Skin.php" );
-include_once( "$IP/OutputPage.php" );
-include_once( "$IP/User.php" );
-include_once( "$IP/LinkCache.php" );
-include_once( "$IP/Title.php" );
-include_once( "$IP/Article.php" );
-include_once( "$IP/MagicWord.php" );
-include_once( "$IP/MemCachedClient.inc.php" );
-include_once( "$IP/Block.php" );
-include_once( "$IP/SearchEngine.php" );
-include_once( "$IP/DifferenceEngine.php" );
+include_once( "GlobalFunctions.php" );
+include_once( "Namespace.php" );
+include_once( "Skin.php" );
+include_once( "OutputPage.php" );
+include_once( "User.php" );
+include_once( "LinkCache.php" );
+include_once( "Title.php" );
+include_once( "Article.php" );
+include_once( "MagicWord.php" );
+include_once( "MemCachedClient.inc.php" );
+include_once( "Block.php" );
+include_once( "SearchEngine.php" );
+include_once( "DifferenceEngine.php" );
 
 wfProfileOut( "$fname-includes" );
 wfProfileIn( "$fname-memcached" );
@@ -66,21 +64,21 @@ if( $wgUseMemCached ) {
 wfProfileOut( "$fname-memcached" );
 wfProfileIn( "$fname-misc" );
 
-include_once( "$IP/Language.php" );
+include_once( "Language.php" );
 
 $wgOut = new OutputPage();
 wfDebug( "\n\n" );
 
 $wgLangClass = "Language" . ucfirst( $wgLanguageCode );
 if( ! class_exists( $wgLangClass ) ) {
-	include_once( "$IP/LanguageUtf8.php" );
+	include_once( "LanguageUtf8.php" );
 	$wgLangClass = "LanguageUtf8";
 }
 $wgLang = new $wgLangClass();
 
 if( !$wgCommandLineMode ) {
 	if( $wgSessionsInMemcached ) {
-		include_once( "$IP/MemcachedSessions.php" );
+		include_once( "MemcachedSessions.php" );
 	}
 	session_set_cookie_params( 0, $wgCookiePath, $wgCookieDomain );
 	session_cache_limiter( "private, must-revalidate" );
diff --git a/includes/SpecialRecentchangeslinked.php b/includes/SpecialRecentchangeslinked.php
index e2b1d3aafb..458cfe6d9b 100644
--- a/includes/SpecialRecentchangeslinked.php
+++ b/includes/SpecialRecentchangeslinked.php
@@ -1,6 +1,5 @@
 <?
-global $IP;
-include_once( "$IP/SpecialRecentchanges.php" );
+include_once( "SpecialRecentchanges.php" );
 
 function wfSpecialRecentchangeslinked( $par = NULL )
 {
diff --git a/includes/UpdateClasses.php b/includes/UpdateClasses.php
index ed80289e60..8e2e17c6cc 100644
--- a/includes/UpdateClasses.php
+++ b/includes/UpdateClasses.php
@@ -1,11 +1,10 @@
 <?
 # See deferred.doc
-global $IP;
-include_once( "$IP/UserUpdate.php" );
-include_once( "$IP/ViewCountUpdate.php" );
-include_once( "$IP/SiteStatsUpdate.php" );
-include_once( "$IP/LinksUpdate.php" );
-include_once( "$IP/SearchUpdate.php" );
-include_once( "$IP/UserTalkUpdate.php" );
+include_once( "UserUpdate.php" );
+include_once( "ViewCountUpdate.php" );
+include_once( "SiteStatsUpdate.php" );
+include_once( "LinksUpdate.php" );
+include_once( "SearchUpdate.php" );
+include_once( "UserTalkUpdate.php" );
 
 ?>
diff --git a/languages/Language.php b/languages/Language.php
index f162d33f3c..f54a5a6d24 100644
--- a/languages/Language.php
+++ b/languages/Language.php
@@ -1650,7 +1650,6 @@ class Language {
 	}
 }
 
-global $IP;
-include_once( "{$IP}/Language" . ucfirst( $wgLanguageCode ) . ".php" );
+include_once( "Language" . ucfirst( $wgLanguageCode ) . ".php" );
 
 ?>
diff --git a/languages/LanguagePl.php b/languages/LanguagePl.php
index 9180e5ca0d..76a2ffc467 100644
--- a/languages/LanguagePl.php
+++ b/languages/LanguagePl.php
@@ -1,6 +1,5 @@
 <?
-global $IP;
-include_once("{$IP}/LanguageUtf8.php");
+include_once("LanguageUtf8.php");
 
 # NOTE: To turn off "Current Events" in the sidebar,
 # set "currentevents" => "-"
diff --git a/languages/LanguageSk.php b/languages/LanguageSk.php
index 629e921cae..c9dabcb185 100644
--- a/languages/LanguageSk.php
+++ b/languages/LanguageSk.php
@@ -1,6 +1,6 @@
 <?
 
-include_once("$IP/LanguageUtf8.php");
+include_once("LanguageUtf8.php");
 
 # Tu môžete meniť názvy "namespaces" (no proste, rôznych častí encyklopédie),
 # ale čísla nechajte tak, ako sú! Program to tak vyžaduje...
diff --git a/languages/LanguageUtf8.php b/languages/LanguageUtf8.php
index 5106512106..a0b622fb8a 100644
--- a/languages/LanguageUtf8.php
+++ b/languages/LanguageUtf8.php
@@ -7,7 +7,7 @@ $wikiUpperChars = $wgMemc->get( $key1 = "$wgDBname:utf8:upper" );
 $wikiLowerChars = $wgMemc->get( $key2 = "$wgDBname:utf8:lower" );
 
 if(($wikiUpperChars === false) || ($wikiLowerChars === false)) {
-	include_once("$IP/Utf8Case.php");
+	include_once( "Utf8Case.php" );
 	$wgMemc->set( $key1, $wikiUpperChars );
 	$wgMemc->set( $key2, $wikiLowerChars );
 }
diff --git a/texvc.phtml b/texvc.phtml
index eefb444227..4dfd7320ba 100644
--- a/texvc.phtml
+++ b/texvc.phtml
@@ -1,7 +1,6 @@
 <?
-global $IP;
 include( "./LocalSettings.php" );
-include( "$IP/Setup.php" );
+include( "Setup.php" );
 header( "Content-type: text/xml; charset={$wgInputEncoding}" );
 print "<";
 print "?xml version=\"1.0\" encoding=\"utf-8\"?";
diff --git a/wiki.phtml b/wiki.phtml
index 1c6164044d..2ab801a03d 100644
--- a/wiki.phtml
+++ b/wiki.phtml
@@ -10,9 +10,16 @@ session_register( "wsUserName" );
 session_register( "wsUserPassword" );
 session_register( "wsUploadFiles" );
 
-global $IP;
+unset( $IP );
+ini_set( "allow_url_fopen", 0 ); # For security...
 include_once( "./LocalSettings.php" );
-include_once( "$IP/Setup.php" );
+
+$include_path = ini_get( "include_path" );
+# Windows requires ';' as separator, ':' for Unix
+if( strchr( $include_path, ";" ) ) $sep = ";"; else $sep = ":";
+ini_set( "include_path", $IP . $sep . ini_get( "include_path" ) );
+
+include_once( "Setup.php" );
 
 wfProfileIn( "main-misc-setup" );
 OutputPage::setEncodings(); # Not really used yet
@@ -64,7 +71,7 @@ if ( Namespace::getSpecial() == $wgTitle->getNamespace() ) {
 	
 	switch( $wgTitle->getNamespace() ) {
 	case 6:
-		include_once( "$IP/ImagePage.php" );
+		include_once( "ImagePage.php" );
 		$wgArticle = new ImagePage( $wgTitle );
 		break;
 	default:
@@ -88,7 +95,7 @@ if ( Namespace::getSpecial() == $wgTitle->getNamespace() ) {
 			break;
 		case "edit":
 		case "submit":
-			include_once( "$IP/EditPage.php" );
+			include_once( "EditPage.php" );
 			$editor = new EditPage( $wgArticle );
 			$editor->$action();
 			break;
-- 
2.20.1