Close include hole on some insecure PHP configurations
[lhc/web/wiklou.git] / includes / SkinPHPTal.php
index 2a098c3..3206b5e 100644 (file)
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or 
+# the Free Software Foundation; either version 2 of the License, or
 # (at your option) any later version.
-# 
+#
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU General Public License for more details.
-# 
+#
 # You should have received a copy of the GNU General Public License along
 # with this program; if not, write to the Free Software Foundation, Inc.,
 # 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 # http://www.gnu.org/copyleft/gpl.html
 
+if( defined( "MEDIAWIKI" ) ) {
        require_once "GlobalFunctions.php";
        global $IP;
        require_once $IP."/PHPTAL-NP-0.7.0/libs/PHPTAL.php";
@@ -43,7 +44,9 @@
                        // interpolate variables
                        while (preg_match('/\$([0-9]*?)/sm', $value, $m)) {
                                list($src, $var) = $m;
-                               $varValue = @$this->_context[$var];
+                               wfSuppressWarnings();
+                               $varValue = $this->_context[$var];
+                               wfRestoreWarnings();
                                $value = str_replace($src, $varValue, $value);
                        }
                        return $value;
                        global $wgMimeType, $wgOutputEncoding, $wgUseDatabaseMessages, $wgRequest;
                        global $wgDisableCounters, $wgLogo, $action, $wgFeedClasses, $wgSiteNotice;
                        global $wgMaxCredits, $wgShowCreditsIfMax;
-                   
+
                        extract( $wgRequest->getValues( 'oldid', 'diff' ) );
 
                        $this->initPage( $out );
                        $tpl = new PHPTAL($this->template . '.pt', 'templates');
-                       
+
                        #if ( $wgUseDatabaseMessages ) { // uncomment this to fall back to GetText
                        $tpl->setTranslator(new MediaWiki_I18N());
                        #}
-                       
+
                        $this->thispage = $wgTitle->getPrefixedDbKey();
                        $this->thisurl = $wgTitle->getPrefixedURL();
                        $this->loggedin = $wgUser->getID() != 0;
                        $this->username = $wgUser->getName();
                        $this->userpage = $wgLang->getNsText( Namespace::getUser() ) . ":" . $wgUser->getName();
                        $this->userpageUrlDetails = $this->makeUrlDetails($this->userpage);
-                       
+
                        $this->usercss =  $this->userjs = $this->userjsprev = false;
                        $this->setupUserCssJs();
 
                        $this->titletxt = $wgTitle->getPrefixedText();
-                       
+
                        $tpl->set( "title", $wgOut->getPageTitle() );
                        $tpl->set( "pagetitle", $wgOut->getHTMLTitle() );
-                       
+
                        $tpl->setRef( "thispage", $this->thispage );
                        $subpagestr = $this->subPageSubtitle();
-                       $tpl->set( 
+                       $tpl->set(
                                "subtitle",  !empty($subpagestr)?
                                '<span class="subpages">'.$subpagestr.'</span>'.$out->getSubtitle():
-                               $out->getSubtitle()  
+                               $out->getSubtitle()
                        );
                        $undelete = $this->getUndeleteLink();
                        $tpl->set(
                        $tpl->setRef( "userjs", $this->userjs);
                        $tpl->setRef( "userjsprev", $this->userjsprev);
                        if($this->loggedin) {
-                               $tpl->set( "jsvarurl", $this->makeUrl('-','action=raw&gen=js&smaxage=0') );
+                               $tpl->set( "jsvarurl", $this->makeUrl('-','action=raw&smaxage=0&gen=js') );
                        } else {
                                $tpl->set( "jsvarurl", $this->makeUrl('-','action=raw&gen=js') );
                        }
                                $usertitle = Title::newFromText( $this->userpage );
                                $usertalktitle = $usertitle->getTalkPage();
                                if($usertalktitle->getPrefixedDbKey() != $this->thispage){
-                                       
+
                                        $ntl = wfMsg( "newmessages",
-                                       $this->makeKnownLink( 
+                                       $this->makeKnownLink(
                                                $wgLang->getNsText( Namespace::getTalk( Namespace::getUser() ) )
                                                . ":" . $this->username,
-                                               wfMsg("newmessageslink") ) 
+                                               wfMsg("newmessageslink") )
                                        );
                                }
                        } else {
                                }
                                $tpl->set('lastmod', $this->lastModified());
                                $tpl->set('copyright',$this->getCopyright());
-                           
+
                                $this->credits = false;
-                   
+
                                if (isset($wgMaxCredits) && $wgMaxCredits != 0) {
                                    require_once("Credits.php");
                                    $this->credits = getCredits($wgArticle, $wgMaxCredits, $wgShowCreditsIfMax);
                                }
-                   
+
                                $tpl->setRef( "credits", $this->credits );
-                           
+
                        } elseif ( isset( $oldid ) && !isset( $diff ) ) {
                                $tpl->set('copyright', $this->getCopyright());
                        }
                        $tpl->setRef( "debug", $out->mDebugtext );
                        $tpl->set( "reporttime", $out->reportTime() );
                        $tpl->set( "sitenotice", $wgSiteNotice );
-                   
+
                        $tpl->setRef( "bodytext", $out->mBodytext );
 
                        $language_urls = array();
                        $content_actions = $this->buildContentActionUrls();
                        $tpl->setRef('content_actions', $content_actions);
                        // XXX: attach this from javascript, same with section editing
-                       if($this->iseditable && $wgUser->getOption("editondblclick") ) 
+                       if($this->iseditable && $wgUser->getOption("editondblclick") )
                        {
                                $tpl->set('body-ondblclick', 'document.location = "' .$content_actions['edit']['href'] .'";');
                        } else {
                                );
                                $personal_urls['preferences'] = array(
                                        'text' => wfMsg('preferences'),
-                                       'href' => $this->makeSpecialUrl('Preferences')          
+                                       'href' => $this->makeSpecialUrl('Preferences')
                                );
                                $personal_urls['watchlist'] = array(
                                        'text' => wfMsg('watchlist'),
-                                       'href' => $this->makeSpecialUrl('Watchlist')    
+                                       'href' => $this->makeSpecialUrl('Watchlist')
                                );
                                $personal_urls['mycontris'] = array(
                                        'text' => wfMsg('mycontris'),
-                                       'href' => $this->makeSpecialUrl('Contributions','target=' . urlencode( $this->username ) )              
+                                       'href' => $this->makeSpecialUrl('Contributions','target=' . urlencode( $this->username ) )
                                );
                                $personal_urls['logout'] = array(
                                        'text' => wfMsg('userlogout'),
-                                       'href' => $this->makeSpecialUrl('Userlogout','returnto=' . $this->thisurl )             
+                                       'href' => $this->makeSpecialUrl('Userlogout','returnto=' . $this->thisurl )
                                );
                        } else {
                                if( $wgShowIPinHeader && isset(  $_COOKIE[ini_get("session.name")] ) ) {
                                        $personal_urls['anonuserpage'] = array(
                                                'text' => $this->username,
                                                'href' => &$this->userpageUrlDetails['href'],
-                                               'class' => $this->userpageUrlDetails['exists']?false:'new'                      
+                                               'class' => $this->userpageUrlDetails['exists']?false:'new'
                                        );
                                        $usertalkUrlDetails = $this->makeTalkUrlDetails($this->userpage);
                                        $personal_urls['anontalk'] = array(
 
                        return $personal_urls;
                }
-               
+
                # an array of edit links by default used for the tabs
                function buildContentActionUrls () {
-                       global $wgTitle, $wgUser, $wgRequest;
+                       global $wgTitle, $wgUser, $wgRequest, $wgUseValidation;
                        $action = $wgRequest->getText( 'action' );
                        $section = $wgRequest->getText( 'section' );
                        $oldid = $wgRequest->getVal( 'oldid' );
                        $diff = $wgRequest->getVal( 'diff' );
                        $content_actions = array();
-                       
+
                        if( $this->iscontent ) {
 
                                $nskey = $this->getNameSpaceKey();
-                               $content_actions[$nskey] = array('class' => (!Namespace::isTalk( $wgTitle->getNamespace())) ? 'selected' : false,
+                               $is_active = !Namespace::isTalk( $wgTitle->getNamespace()) ;
+                               if ( $action == 'validate' ) $is_active = false ; # Show article tab deselected when validating
+                               $content_actions[$nskey] = array('class' => ($is_active) ? 'selected' : false,
                                'text' => wfMsg($nskey),
                                'href' => $this->makeArticleUrl($this->thispage));
 
                                /* set up the classes for the talk link */
-                               $talk_class = (Namespace::isTalk( $wgTitle->getNamespace()) ? 'selected' : false);                              
+                               $talk_class = (Namespace::isTalk( $wgTitle->getNamespace()) ? 'selected' : false);
                                $talktitle = Title::newFromText( $this->titletxt );
                                $talktitle = $talktitle->getTalkPage();
-                               $this->checkTitle($talktitle, $this->titletxt); 
-                               if($talktitle->getArticleId() != 0) { 
+                               $this->checkTitle($talktitle, $this->titletxt);
+                               if($talktitle->getArticleId() != 0) {
                                        $content_actions['talk'] = array(
                                                'class' => $talk_class,
                                                'text' => wfMsg('talk'),
                                                        $content_actions['unprotect'] = array(
                                                                'class' => ($action == 'unprotect') ? 'selected' : false,
                                                                'text' => wfMsg('unprotect'),
-                                                               'href' => $this->makeUrl($this->thispage, 'action=unprotect')                                       
+                                                               'href' => $this->makeUrl($this->thispage, 'action=unprotect')
                                                        );
                                                }
                                                $content_actions['delete'] = array(
 
                                                }
                                        }
-                               } else { 
+                               } else {
                                        //article doesn't exist or is deleted
                                        if($wgUser->isSysop()){
                                                if( $n = $wgTitle->isDeleted() ) {
                                                'text' => wfMsg('watch'),
                                                'href' => $this->makeUrl($this->thispage, 'action=watch'));
                                        } else {
-                                               $content_actions['watch'] = array('class' => ($action == 'unwatch' or $action == 'watch') ? 'selected' : false,
+                                               $content_actions['unwatch'] = array('class' => ($action == 'unwatch' or $action == 'watch') ? 'selected' : false,
                                                'text' => wfMsg('unwatch'),
                                                'href' => $this->makeUrl($this->thispage, 'action=unwatch'));
                                        }
                                }
+
+                               # Show validate tab
+                               if ( $wgUseValidation && $wgTitle->getArticleId() && $wgTitle->getNamespace() == 0 ) {
+                                       global $wgArticle ;
+                                       $article_time = "&timestamp=" . $wgArticle->mTimestamp ;
+                                       $content_actions['validate'] = array('class' => ($action == 'validate') ? 'selected' : false ,
+                                               'text' => wfMsg('val_tab'),
+                                               'href' => $this->makeUrl($this->thispage, "action=validate{$article_time}"));
+                                       }
+
                        } else {
                                /* show special page tab */
 
                function buildNavUrls () {
                        global $wgTitle, $wgUser, $wgRequest;
                        global $wgSiteSupportPage;
-                       
+
                        $action = $wgRequest->getText( 'action' );
                        $oldid = $wgRequest->getVal( 'oldid' );
                        $diff = $wgRequest->getVal( 'diff' );
                        $nav_urls['help'] = array('href' => htmlspecialchars( $this->makeI18nUrl('helppage')));
                        $nav_urls['upload'] = array('href' => htmlspecialchars( $this->makeSpecialUrl('Upload')));
                        $nav_urls['specialpages'] = array('href' => htmlspecialchars( $this->makeSpecialUrl('Specialpages')));
-                       
+
                        if( $wgTitle->getNamespace() == NS_USER || $wgTitle->getNamespace() == NS_USER_TALK ) {
                                $id = User::idFromName($wgTitle->getText());
                                $ip = User::isIP($wgTitle->getText());
 
                function getNameSpaceKey () {
                        global $wgTitle;
-                       switch ($wgTitle->getNamespace()) { 
+                       switch ($wgTitle->getNamespace()) {
                                case NS_MAIN:
                                case NS_TALK:
                                        return 'nstab-main';
                        $action = $wgRequest->getText('action');
                        # generated css
                        $this->usercss = '@import "'.$this->makeUrl('-','action=raw&gen=css').'";'."\n";
-                       
+
                        if( $this->loggedin ) {
                                if($wgTitle->isCssSubpage() and $action == 'submit' and  $wgTitle->userCanEditCssJsSubpage()) {
                                        # generated css
-                                       $this->usercss = '@import "'.$this->makeUrl('-','action=raw&gen=css&smaxage=0&maxage=0').');'."\n";
+                                       $this->usercss = '@import "'.$this->makeUrl('-','action=raw&smaxage=0&maxage=0&gen=css').'";'."\n";
                                        // css preview
                                        $this->usercss .= $wgRequest->getText('wpTextbox1');
                                } else {
                                        # generated css
-                                       $this->usercss .= '@import "'.$this->makeUrl('-','action=raw&gen=css&smaxage=0').'";'."\n";
+                                       $this->usercss .= '@import "'.$this->makeUrl('-','action=raw&smaxage=0&gen=css').'";'."\n";
                                        # import user stylesheet
                                        $this->usercss .= '@import "'.
                                        $this->makeUrl($this->userpage.'/'.$this->skinname.'.css', 'action=raw&ctype=text/css').'";'."\n";
                                        # XXX: additional security check/prompt?
                                        $this->userjsprev = $wgRequest->getText('wpTextbox1');
                                } else {
-                                       $this->userjs = $this->makeUrl($this->userpage.'/'.$this->skinname.'.js', 'action=raw&ctype=text/javascript');
+                                       $this->userjs = $this->makeUrl($this->userpage.'/'.$this->skinname.'.js', 'action=raw&ctype=text/javascript&dontcountme=s');
                                }
                        }
                }
                        $this->skinname = "davinci";
                }
        }
-       
+
        class SkinMono extends SkinPHPTal {
                function initPage( &$out ) {
                        SkinPHPTal::initPage( $out );
                        $this->skinname = "mono";
                }
        }
-       
+
        class SkinMonoBook extends SkinPHPTal {
                function initPage( &$out ) {
                        SkinPHPTal::initPage( $out );
                        $this->skinname = "myskin";
                }
        }
-       
+}
 ?>