From 029c1ff20ea4ded8bbe8d1625837029411ee9822 Mon Sep 17 00:00:00 2001 From: flashwave Date: Wed, 19 Jul 2023 19:03:53 +0000 Subject: [PATCH] Restructured public folder and initialisation process. --- misuzu.php | 223 +----------------- .../_github-callback.php | 1 - {public => public-legacy}/auth/index.php | 2 - {public => public-legacy}/auth/login.php | 2 - {public => public-legacy}/auth/logout.php | 2 - {public => public-legacy}/auth/password.php | 2 - {public => public-legacy}/auth/register.php | 2 - {public => public-legacy}/auth/revert.php | 2 - {public => public-legacy}/auth/twofactor.php | 2 - {public => public-legacy}/comments.php | 2 - {public => public-legacy}/forum/forum.php | 2 - {public => public-legacy}/forum/index.php | 2 - .../forum/leaderboard.php | 2 - {public => public-legacy}/forum/post.php | 2 - {public => public-legacy}/forum/posting.php | 2 - {public => public-legacy}/forum/topic.php | 2 - .../manage/changelog/change.php | 2 - .../manage/changelog/index.php | 2 - .../manage/changelog/tag.php | 2 - .../manage/changelog/tags.php | 2 - .../manage/forum/category.php | 2 - .../manage/forum/index.php | 2 - .../manage/forum/redirs.php | 2 - .../manage/general/emoticon.php | 2 - .../manage/general/emoticons.php | 2 - .../manage/general/index.php | 2 - .../manage/general/logs.php | 2 - .../manage/general/setting-delete.php | 2 - .../manage/general/setting.php | 2 - .../manage/general/settings.php | 2 - {public => public-legacy}/manage/index.php | 2 - .../manage/news/categories.php | 2 - .../manage/news/category.php | 2 - .../manage/news/index.php | 2 - .../manage/news/post.php | 2 - .../manage/news/posts.php | 2 - .../manage/users/index.php | 2 - .../manage/users/role.php | 2 - .../manage/users/roles.php | 2 - .../manage/users/user.php | 2 - .../manage/users/warnings.php | 2 - {public => public-legacy}/members.php | 2 - {public => public-legacy}/profile.php | 2 - {public => public-legacy}/search.php | 2 - .../settings/account.php | 2 - {public => public-legacy}/settings/data.php | 2 - {public => public-legacy}/settings/index.php | 2 - {public => public-legacy}/settings/logs.php | 2 - .../settings/sessions.php | 2 - public/_sockchat.php | 2 - public/auth.php | 2 - public/changelog.php | 2 - public/index.php | 200 +++++++++++++++- public/info.php | 2 - public/news.php | 2 - public/news/category.php | 2 - public/news/feed.php | 2 - public/news/index.php | 2 - public/news/post.php | 2 - public/settings.php | 2 - public/user-assets.php | 2 - src/Http/Handlers/Handler.php | 1 - 62 files changed, 210 insertions(+), 331 deletions(-) rename {public => public-legacy}/_github-callback.php (99%) rename {public => public-legacy}/auth/index.php (60%) rename {public => public-legacy}/auth/login.php (99%) rename {public => public-legacy}/auth/logout.php (91%) rename {public => public-legacy}/auth/password.php (99%) rename {public => public-legacy}/auth/register.php (99%) rename {public => public-legacy}/auth/revert.php (92%) rename {public => public-legacy}/auth/twofactor.php (98%) rename {public => public-legacy}/comments.php (99%) rename {public => public-legacy}/forum/forum.php (98%) rename {public => public-legacy}/forum/index.php (97%) rename {public => public-legacy}/forum/leaderboard.php (98%) rename {public => public-legacy}/forum/post.php (99%) rename {public => public-legacy}/forum/posting.php (99%) rename {public => public-legacy}/forum/topic.php (99%) rename {public => public-legacy}/manage/changelog/change.php (99%) rename {public => public-legacy}/manage/changelog/index.php (96%) rename {public => public-legacy}/manage/changelog/tag.php (98%) rename {public => public-legacy}/manage/changelog/tags.php (89%) rename {public => public-legacy}/manage/forum/category.php (93%) rename {public => public-legacy}/manage/forum/index.php (94%) rename {public => public-legacy}/manage/forum/redirs.php (97%) rename {public => public-legacy}/manage/general/emoticon.php (98%) rename {public => public-legacy}/manage/general/emoticons.php (97%) rename {public => public-legacy}/manage/general/index.php (99%) rename {public => public-legacy}/manage/general/logs.php (95%) rename {public => public-legacy}/manage/general/setting-delete.php (95%) rename {public => public-legacy}/manage/general/setting.php (98%) rename {public => public-legacy}/manage/general/settings.php (91%) rename {public => public-legacy}/manage/index.php (66%) rename {public => public-legacy}/manage/news/categories.php (94%) rename {public => public-legacy}/manage/news/category.php (98%) rename {public => public-legacy}/manage/news/index.php (63%) rename {public => public-legacy}/manage/news/post.php (98%) rename {public => public-legacy}/manage/news/posts.php (94%) rename {public => public-legacy}/manage/users/index.php (93%) rename {public => public-legacy}/manage/users/role.php (99%) rename {public => public-legacy}/manage/users/roles.php (93%) rename {public => public-legacy}/manage/users/user.php (99%) rename {public => public-legacy}/manage/users/warnings.php (99%) rename {public => public-legacy}/members.php (99%) rename {public => public-legacy}/profile.php (99%) rename {public => public-legacy}/search.php (98%) rename {public => public-legacy}/settings/account.php (99%) rename {public => public-legacy}/settings/data.php (99%) rename {public => public-legacy}/settings/index.php (83%) rename {public => public-legacy}/settings/logs.php (95%) rename {public => public-legacy}/settings/sessions.php (98%) delete mode 100644 public/_sockchat.php delete mode 100644 public/auth.php delete mode 100644 public/changelog.php delete mode 100644 public/info.php delete mode 100644 public/news.php delete mode 100644 public/news/category.php delete mode 100644 public/news/feed.php delete mode 100644 public/news/index.php delete mode 100644 public/news/post.php delete mode 100644 public/settings.php delete mode 100644 public/user-assets.php diff --git a/misuzu.php b/misuzu.php index 39cd6e9..2bf2ab1 100644 --- a/misuzu.php +++ b/misuzu.php @@ -3,13 +3,8 @@ namespace Misuzu; use Index\Autoloader; use Index\Environment; -use Index\Data\ConnectionFailedException; use Index\Data\DbTools; use Misuzu\Config\DbConfig; -use Misuzu\Users\User; -use Misuzu\Users\UserNotFoundException; -use Misuzu\Users\UserSession; -use Misuzu\Users\UserSessionNotFoundException; define('MSZ_STARTUP', microtime(true)); define('MSZ_ROOT', __DIR__); @@ -33,38 +28,18 @@ Environment::setDebug(MSZ_DEBUG); mb_internal_encoding('utf-8'); date_default_timezone_set('utc'); -set_include_path(get_include_path() . PATH_SEPARATOR . MSZ_ROOT); -set_exception_handler(function(\Throwable $ex) { - if(MSZ_CLI) { - echo (string)$ex; - } else { - http_response_code(500); - ob_clean(); - - if(MSZ_DEBUG) { - header('Content-Type: text/plain; charset=utf-8'); - echo (string)$ex; - } else { - header('Content-Type: text/html; charset=utf-8'); - echo file_get_contents(MSZ_TEMPLATES . '/500.html'); - } - } - exit; -}); - -require_once 'vendor/autoload.php'; - -require_once 'utility.php'; -require_once 'src/perms.php'; -require_once 'src/manage.php'; -require_once 'src/url.php'; -require_once 'src/Forum/perms.php'; -require_once 'src/Forum/forum.php'; -require_once 'src/Forum/leaderboard.php'; -require_once 'src/Forum/post.php'; -require_once 'src/Forum/topic.php'; -require_once 'src/Forum/validate.php'; +require_once MSZ_ROOT . '/vendor/autoload.php'; +require_once MSZ_ROOT . '/utility.php'; +require_once MSZ_SOURCE . '/perms.php'; +require_once MSZ_SOURCE . '/manage.php'; +require_once MSZ_SOURCE . '/url.php'; +require_once MSZ_SOURCE . '/Forum/perms.php'; +require_once MSZ_SOURCE . '/Forum/forum.php'; +require_once MSZ_SOURCE . '/Forum/leaderboard.php'; +require_once MSZ_SOURCE . '/Forum/post.php'; +require_once MSZ_SOURCE . '/Forum/topic.php'; +require_once MSZ_SOURCE . '/Forum/validate.php'; $dbConfig = parse_ini_file(MSZ_CONFIG . '/config.ini', true, INI_SCANNER_TYPED); @@ -86,179 +61,3 @@ $cfg = new DbConfig($db); Mailer::init($cfg->scopeTo('mail')); $msz = new MisuzuContext($db, $cfg); - -if(MSZ_CLI) - return; - -// Everything below here should eventually be moved to index.php, probably only initialised when required. -// Serving things like the css/js doesn't need to initialise sessions. - -ob_start(); - -if(file_exists(MSZ_ROOT . '/.migrating')) { - http_response_code(503); - if(!isset($_GET['_check'])) { - header('Content-Type: text/html; charset=utf-8'); - echo file_get_contents(MSZ_TEMPLATES . '/503.html'); - } - exit; -} - -if(!MSZ_DEBUG) { - $twigCacheDirSfx = GitInfo::hash(true); - if(empty($twigCacheDirSfx)) - $twigCacheDirSfx = md5(MSZ_ROOT); - - $twigCache = sys_get_temp_dir() . '/msz-tpl-' . $twigCacheDirSfx; - if(!is_dir($twigCache)) - mkdir($twigCache, 0775, true); -} - -$globals = $cfg->getValues([ - ['site.name:s', 'Misuzu'], - 'site.desc:s', - 'site.url:s', - 'sockChat.chatPath.normal:s', - 'eeprom.path:s', - 'eeprom.app:s', - ['auth.secret:s', 'meow'], - ['csrf.secret:s', 'soup'], -]); - -Template::init($msz, $twigCache ?? null, MSZ_DEBUG); - -Template::set('globals', [ - 'site_name' => $globals['site.name'], - 'site_description' => $globals['site.desc'], - 'site_url' => $globals['site.url'], - 'site_chat' => $globals['sockChat.chatPath.normal'], - 'eeprom' => [ - 'path' => $globals['eeprom.path'], - 'app' => $globals['eeprom.app'], - ], -]); - -$mszAssetsInfo = json_decode(file_get_contents(MSZ_ASSETS . '/current.json')); -if(!empty($mszAssetsInfo)) - Template::set('assets', $mszAssetsInfo); -unset($mszAssetsInfo); - -Template::addPath(MSZ_TEMPLATES); - -AuthToken::setSecretKey($globals['auth.secret']); - -if(isset($_COOKIE['msz_uid']) && isset($_COOKIE['msz_sid'])) { - $authToken = new AuthToken; - $authToken->setUserId(filter_input(INPUT_COOKIE, 'msz_uid', FILTER_SANITIZE_NUMBER_INT) ?? 0); - $authToken->setSessionToken(filter_input(INPUT_COOKIE, 'msz_sid') ?? ''); - - if($authToken->isValid()) - $authToken->applyCookie(strtotime('1 year')); - - AuthToken::nukeCookieLegacy(); -} - -if(!isset($authToken)) - $authToken = AuthToken::unpack(filter_input(INPUT_COOKIE, 'msz_auth') ?? ''); - -if($authToken->isValid()) { - $authToken->setCurrent(); - - try { - $sessionInfo = UserSession::byToken($authToken->getSessionToken()); - if($sessionInfo->hasExpired()) { - $sessionInfo->delete(); - } elseif($sessionInfo->getUserId() === $authToken->getUserId()) { - $userInfo = $sessionInfo->getUser(); - if(!$userInfo->isDeleted()) { - $sessionInfo->setCurrent(); - $userInfo->setCurrent(); - $sessionInfo->bump($_SERVER['REMOTE_ADDR']); - - if($sessionInfo->shouldBumpExpire()) - $authToken->applyCookie($sessionInfo->getExpiresTime()); - - // only allow impersonation when super user - if($authToken->hasImpersonatedUserId() && $userInfo->isSuper()) { - $userInfoReal = $userInfo; - - try { - $userInfo = User::byId($authToken->getImpersonatedUserId()); - } catch(UserNotFoundException $ex) { - $userInfo = $userInfoReal; - $authToken->removeImpersonatedUserId(); - $authToken->applyCookie(); - } - - $userInfo->setCurrent(); - } - } - } - } catch(UserNotFoundException $ex) { - UserSession::unsetCurrent(); - User::unsetCurrent(); - } catch(UserSessionNotFoundException $ex) { - UserSession::unsetCurrent(); - User::unsetCurrent(); - } - - if(UserSession::hasCurrent()) { - $userInfo->bumpActivity($_SERVER['REMOTE_ADDR']); - } else - AuthToken::nukeCookie(); -} - -CSRF::init( - $globals['csrf.secret'], - (UserSession::hasCurrent() ? UserSession::getCurrent()->getToken() : ($_SERVER['REMOTE_ADDR'] ?? '::1')) -); - -function mszLockdown(): void { - global $misuzuBypassLockdown, $cfg; - - if($cfg->getBoolean('private.enabled')) { - $onLoginPage = $_SERVER['PHP_SELF'] === url('auth-login'); - $onPasswordPage = parse_url($_SERVER['PHP_SELF'], PHP_URL_PATH) === url('auth-forgot'); - $misuzuBypassLockdown = !empty($misuzuBypassLockdown) || $onLoginPage; - - if(!$misuzuBypassLockdown) { - if(UserSession::hasCurrent()) { - ['private.perm.cat' => $privatePermCat, 'private.perm.val' => $privatePermVal] = $cfg->getValues(['private.perm.cat:s', 'private.perm.val:i']); - - if(!empty($privatePermCat) && $privatePermVal > 0) { - if(!perms_check_user($privatePermCat, User::getCurrent()->getId(), $privatePermVal)) { - // au revoir - UserSession::unsetCurrent(); - User::unsetCurrent(); - } - } - } elseif(!$onLoginPage && !($onPasswordPage && $cfg->getBoolean('private.allow_password_reset', true))) { - url_redirect('auth-login'); - exit; - } - } - } -} - -if(parse_url($_SERVER['PHP_SELF'], PHP_URL_PATH) !== '/index.php') - mszLockdown(); - -if(!empty($userInfo)) - Template::set('current_user', $userInfo); -if(!empty($userInfoReal)) - Template::set('current_user_real', $userInfoReal); - -$inManageMode = str_starts_with($_SERVER['REQUEST_URI'], '/manage'); -$hasManageAccess = User::hasCurrent() - && !User::getCurrent()->hasActiveWarning() - && perms_check_user(MSZ_PERMS_GENERAL, User::getCurrent()->getId(), MSZ_PERM_GENERAL_CAN_MANAGE); -Template::set('has_manage_access', $hasManageAccess); - -if($inManageMode) { - if(!$hasManageAccess) { - echo render_error(403); - exit; - } - - Template::set('manage_menu', manage_get_menu(User::getCurrent()->getId())); -} diff --git a/public/_github-callback.php b/public-legacy/_github-callback.php similarity index 99% rename from public/_github-callback.php rename to public-legacy/_github-callback.php index 3946f2f..71abb68 100644 --- a/public/_github-callback.php +++ b/public-legacy/_github-callback.php @@ -2,7 +2,6 @@ namespace Misuzu; $misuzuBypassLockdown = true; -require_once '../misuzu.php'; function ghcb_strip_prefix(string $line): string { $findColon = mb_strpos($line, ':'); diff --git a/public/auth/index.php b/public-legacy/auth/index.php similarity index 60% rename from public/auth/index.php rename to public-legacy/auth/index.php index f6afcf7..d11f371 100644 --- a/public/auth/index.php +++ b/public-legacy/auth/index.php @@ -1,6 +1,4 @@ hasImpersonatedUserId() || !CSRF::validateRequest()) { url_redirect('index'); return; diff --git a/public/auth/twofactor.php b/public-legacy/auth/twofactor.php similarity index 98% rename from public/auth/twofactor.php rename to public-legacy/auth/twofactor.php index 2a149fc..7c1877d 100644 --- a/public/auth/twofactor.php +++ b/public-legacy/auth/twofactor.php @@ -8,8 +8,6 @@ use Misuzu\Users\UserSessionCreationFailedException; use Misuzu\Users\UserAuthSession; use Misuzu\Users\UserAuthSessionNotFoundException; -require_once '../../misuzu.php'; - if(UserSession::hasCurrent()) { url_redirect('index'); return; diff --git a/public/comments.php b/public-legacy/comments.php similarity index 99% rename from public/comments.php rename to public-legacy/comments.php index 3bc6935..b2d9047 100644 --- a/public/comments.php +++ b/public-legacy/comments.php @@ -4,8 +4,6 @@ namespace Misuzu; use RuntimeException; use Misuzu\Users\User; -require_once '../misuzu.php'; - // basing whether or not this is an xhr request on whether a referrer header is present // this page is never directy accessed, under normal circumstances $redirect = !empty($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : url('index'); diff --git a/public/forum/forum.php b/public-legacy/forum/forum.php similarity index 98% rename from public/forum/forum.php rename to public-legacy/forum/forum.php index 86ed80b..1116159 100644 --- a/public/forum/forum.php +++ b/public-legacy/forum/forum.php @@ -3,8 +3,6 @@ namespace Misuzu; use Misuzu\Users\User; -require_once '../../misuzu.php'; - $forumId = !empty($_GET['f']) && is_string($_GET['f']) ? (int)$_GET['f'] : 0; $forumId = max($forumId, 0); diff --git a/public/forum/index.php b/public-legacy/forum/index.php similarity index 97% rename from public/forum/index.php rename to public-legacy/forum/index.php index e168c33..cf4aa3e 100644 --- a/public/forum/index.php +++ b/public-legacy/forum/index.php @@ -3,8 +3,6 @@ namespace Misuzu; use Misuzu\Users\User; -require_once '../../misuzu.php'; - $indexMode = !empty($_GET['m']) && is_string($_GET['m']) ? (string)$_GET['m'] : ''; $forumId = !empty($_GET['f']) && is_string($_GET['f']) ? (int)$_GET['f'] : 0; diff --git a/public/forum/leaderboard.php b/public-legacy/forum/leaderboard.php similarity index 98% rename from public/forum/leaderboard.php rename to public-legacy/forum/leaderboard.php index 6da7515..bcce292 100644 --- a/public/forum/leaderboard.php +++ b/public-legacy/forum/leaderboard.php @@ -3,8 +3,6 @@ namespace Misuzu; use Misuzu\Users\User; -require_once '../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_FORUM, User::getCurrent()->getId(), MSZ_PERM_FORUM_VIEW_LEADERBOARD)) { echo render_error(403); return; diff --git a/public/forum/post.php b/public-legacy/forum/post.php similarity index 99% rename from public/forum/post.php rename to public-legacy/forum/post.php index d67a6db..0d9f197 100644 --- a/public/forum/post.php +++ b/public-legacy/forum/post.php @@ -4,8 +4,6 @@ namespace Misuzu; use Misuzu\Users\User; use Misuzu\Users\UserSession; -require_once '../../misuzu.php'; - $postId = !empty($_GET['p']) && is_string($_GET['p']) ? (int)$_GET['p'] : 0; $postMode = !empty($_GET['m']) && is_string($_GET['m']) ? (string)$_GET['m'] : ''; $submissionConfirmed = !empty($_GET['confirm']) && is_string($_GET['confirm']) && $_GET['confirm'] === '1'; diff --git a/public/forum/posting.php b/public-legacy/forum/posting.php similarity index 99% rename from public/forum/posting.php rename to public-legacy/forum/posting.php index 7b2b94d..aa78665 100644 --- a/public/forum/posting.php +++ b/public-legacy/forum/posting.php @@ -4,8 +4,6 @@ namespace Misuzu; use Misuzu\Parsers\Parser; use Misuzu\Users\User; -require_once '../../misuzu.php'; - $currentUser = User::getCurrent(); if($currentUser === null) { diff --git a/public/forum/topic.php b/public-legacy/forum/topic.php similarity index 99% rename from public/forum/topic.php rename to public-legacy/forum/topic.php index 49e2656..98c856c 100644 --- a/public/forum/topic.php +++ b/public-legacy/forum/topic.php @@ -4,8 +4,6 @@ namespace Misuzu; use Misuzu\Users\User; use Misuzu\Users\UserSession; -require_once '../../misuzu.php'; - $postId = !empty($_GET['p']) && is_string($_GET['p']) ? (int)$_GET['p'] : 0; $topicId = !empty($_GET['t']) && is_string($_GET['t']) ? (int)$_GET['t'] : 0; $moderationMode = !empty($_GET['m']) && is_string($_GET['m']) ? (string)$_GET['m'] : ''; diff --git a/public/manage/changelog/change.php b/public-legacy/manage/changelog/change.php similarity index 99% rename from public/manage/changelog/change.php rename to public-legacy/manage/changelog/change.php index 24f80a4..00be592 100644 --- a/public/manage/changelog/change.php +++ b/public-legacy/manage/changelog/change.php @@ -8,8 +8,6 @@ use Misuzu\Changelog\Changelog; use Misuzu\Users\User; use Misuzu\Users\UserNotFoundException; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_CHANGELOG, User::getCurrent()->getId(), MSZ_PERM_CHANGELOG_MANAGE_CHANGES)) { echo render_error(403); return; diff --git a/public/manage/changelog/index.php b/public-legacy/manage/changelog/index.php similarity index 96% rename from public/manage/changelog/index.php rename to public-legacy/manage/changelog/index.php index d1aa340..d6d7dc8 100644 --- a/public/manage/changelog/index.php +++ b/public-legacy/manage/changelog/index.php @@ -3,8 +3,6 @@ namespace Misuzu; use Misuzu\Users\User; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_CHANGELOG, User::getCurrent()->getId(), MSZ_PERM_CHANGELOG_MANAGE_CHANGES)) { echo render_error(403); return; diff --git a/public/manage/changelog/tag.php b/public-legacy/manage/changelog/tag.php similarity index 98% rename from public/manage/changelog/tag.php rename to public-legacy/manage/changelog/tag.php index 65f54d2..9d7c082 100644 --- a/public/manage/changelog/tag.php +++ b/public-legacy/manage/changelog/tag.php @@ -4,8 +4,6 @@ namespace Misuzu; use RuntimeException; use Misuzu\Users\User; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_CHANGELOG, User::getCurrent()->getId(), MSZ_PERM_CHANGELOG_MANAGE_TAGS)) { echo render_error(403); return; diff --git a/public/manage/changelog/tags.php b/public-legacy/manage/changelog/tags.php similarity index 89% rename from public/manage/changelog/tags.php rename to public-legacy/manage/changelog/tags.php index 669ff52..67d1107 100644 --- a/public/manage/changelog/tags.php +++ b/public-legacy/manage/changelog/tags.php @@ -3,8 +3,6 @@ namespace Misuzu; use Misuzu\Users\User; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_CHANGELOG, User::getCurrent()->getId(), MSZ_PERM_CHANGELOG_MANAGE_TAGS)) { echo render_error(403); return; diff --git a/public/manage/forum/category.php b/public-legacy/manage/forum/category.php similarity index 93% rename from public/manage/forum/category.php rename to public-legacy/manage/forum/category.php index 22a23f3..7767bcf 100644 --- a/public/manage/forum/category.php +++ b/public-legacy/manage/forum/category.php @@ -3,8 +3,6 @@ namespace Misuzu; use Misuzu\Users\User; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_GENERAL, User::getCurrent()->getId(), MSZ_PERM_FORUM_MANAGE_FORUMS)) { echo render_error(403); return; diff --git a/public/manage/forum/index.php b/public-legacy/manage/forum/index.php similarity index 94% rename from public/manage/forum/index.php rename to public-legacy/manage/forum/index.php index 1cb0ca8..fe96e11 100644 --- a/public/manage/forum/index.php +++ b/public-legacy/manage/forum/index.php @@ -3,8 +3,6 @@ namespace Misuzu; use Misuzu\Users\User; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_GENERAL, User::getCurrent()->getId(), MSZ_PERM_FORUM_MANAGE_FORUMS)) { echo render_error(403); return; diff --git a/public/manage/forum/redirs.php b/public-legacy/manage/forum/redirs.php similarity index 97% rename from public/manage/forum/redirs.php rename to public-legacy/manage/forum/redirs.php index 89890cb..988dd0c 100644 --- a/public/manage/forum/redirs.php +++ b/public-legacy/manage/forum/redirs.php @@ -3,8 +3,6 @@ namespace Misuzu; use Misuzu\Users\User; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_GENERAL, User::getCurrent()->getId(), MSZ_PERM_FORUM_TOPIC_REDIRS)) { echo render_error(403); return; diff --git a/public/manage/general/emoticon.php b/public-legacy/manage/general/emoticon.php similarity index 98% rename from public/manage/general/emoticon.php rename to public-legacy/manage/general/emoticon.php index 7cb1e40..ef37bab 100644 --- a/public/manage/general/emoticon.php +++ b/public-legacy/manage/general/emoticon.php @@ -4,8 +4,6 @@ namespace Misuzu; use RuntimeException; use Misuzu\Users\User; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_GENERAL, User::getCurrent()->getId(), MSZ_PERM_GENERAL_MANAGE_EMOTES)) { echo render_error(403); return; diff --git a/public/manage/general/emoticons.php b/public-legacy/manage/general/emoticons.php similarity index 97% rename from public/manage/general/emoticons.php rename to public-legacy/manage/general/emoticons.php index d4e0f55..9caadfb 100644 --- a/public/manage/general/emoticons.php +++ b/public-legacy/manage/general/emoticons.php @@ -4,8 +4,6 @@ namespace Misuzu; use RuntimeException; use Misuzu\Users\User; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_GENERAL, User::getCurrent()->getId(), MSZ_PERM_GENERAL_MANAGE_EMOTES)) { echo render_error(403); return; diff --git a/public/manage/general/index.php b/public-legacy/manage/general/index.php similarity index 99% rename from public/manage/general/index.php rename to public-legacy/manage/general/index.php index ba17ac6..fddfdd7 100644 --- a/public/manage/general/index.php +++ b/public-legacy/manage/general/index.php @@ -1,8 +1,6 @@ getId(), MSZ_PERM_GENERAL_VIEW_LOGS)) { echo render_error(403); return; diff --git a/public/manage/general/setting-delete.php b/public-legacy/manage/general/setting-delete.php similarity index 95% rename from public/manage/general/setting-delete.php rename to public-legacy/manage/general/setting-delete.php index a47ea5a..5d598bb 100644 --- a/public/manage/general/setting-delete.php +++ b/public-legacy/manage/general/setting-delete.php @@ -4,8 +4,6 @@ namespace Misuzu; use Misuzu\Config\CfgTools; use Misuzu\Users\User; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_GENERAL, User::getCurrent()->getId(), MSZ_PERM_GENERAL_MANAGE_CONFIG)) { echo render_error(403); diff --git a/public/manage/general/setting.php b/public-legacy/manage/general/setting.php similarity index 98% rename from public/manage/general/setting.php rename to public-legacy/manage/general/setting.php index 3ce6a8c..10256fb 100644 --- a/public/manage/general/setting.php +++ b/public-legacy/manage/general/setting.php @@ -4,8 +4,6 @@ namespace Misuzu; use Misuzu\Config\DbConfig; use Misuzu\Users\User; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_GENERAL, User::getCurrent()->getId(), MSZ_PERM_GENERAL_MANAGE_CONFIG)) { echo render_error(403); diff --git a/public/manage/general/settings.php b/public-legacy/manage/general/settings.php similarity index 91% rename from public/manage/general/settings.php rename to public-legacy/manage/general/settings.php index 050323d..07670e6 100644 --- a/public/manage/general/settings.php +++ b/public-legacy/manage/general/settings.php @@ -3,8 +3,6 @@ namespace Misuzu; use Misuzu\Users\User; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_GENERAL, User::getCurrent()->getId(), MSZ_PERM_GENERAL_MANAGE_CONFIG)) { echo render_error(403); diff --git a/public/manage/index.php b/public-legacy/manage/index.php similarity index 66% rename from public/manage/index.php rename to public-legacy/manage/index.php index 23923f9..e842be6 100644 --- a/public/manage/index.php +++ b/public-legacy/manage/index.php @@ -1,6 +1,4 @@ getId(), MSZ_PERM_NEWS_MANAGE_CATEGORIES)) { echo render_error(403); return; diff --git a/public/manage/news/category.php b/public-legacy/manage/news/category.php similarity index 98% rename from public/manage/news/category.php rename to public-legacy/manage/news/category.php index d307f38..9e5e538 100644 --- a/public/manage/news/category.php +++ b/public-legacy/manage/news/category.php @@ -4,8 +4,6 @@ namespace Misuzu; use RuntimeException; use Misuzu\Users\User; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_NEWS, User::getCurrent()->getId(), MSZ_PERM_NEWS_MANAGE_CATEGORIES)) { echo render_error(403); return; diff --git a/public/manage/news/index.php b/public-legacy/manage/news/index.php similarity index 63% rename from public/manage/news/index.php rename to public-legacy/manage/news/index.php index 77cbfd5..a983e91 100644 --- a/public/manage/news/index.php +++ b/public-legacy/manage/news/index.php @@ -1,6 +1,4 @@ getId(), MSZ_PERM_NEWS_MANAGE_POSTS)) { echo render_error(403); return; diff --git a/public/manage/news/posts.php b/public-legacy/manage/news/posts.php similarity index 94% rename from public/manage/news/posts.php rename to public-legacy/manage/news/posts.php index 683bd71..fc2645c 100644 --- a/public/manage/news/posts.php +++ b/public-legacy/manage/news/posts.php @@ -3,8 +3,6 @@ namespace Misuzu; use Misuzu\Users\User; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_NEWS, User::getCurrent()->getId(), MSZ_PERM_NEWS_MANAGE_POSTS)) { echo render_error(403); return; diff --git a/public/manage/users/index.php b/public-legacy/manage/users/index.php similarity index 93% rename from public/manage/users/index.php rename to public-legacy/manage/users/index.php index 158b9a9..13ef647 100644 --- a/public/manage/users/index.php +++ b/public-legacy/manage/users/index.php @@ -3,8 +3,6 @@ namespace Misuzu; use Misuzu\Users\User; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_USER, User::getCurrent()->getId(), MSZ_PERM_USER_MANAGE_USERS)) { echo render_error(403); return; diff --git a/public/manage/users/role.php b/public-legacy/manage/users/role.php similarity index 99% rename from public/manage/users/role.php rename to public-legacy/manage/users/role.php index dce7841..9902194 100644 --- a/public/manage/users/role.php +++ b/public-legacy/manage/users/role.php @@ -7,8 +7,6 @@ use Misuzu\Users\User; use Misuzu\Users\UserRole; use Misuzu\Users\UserRoleNotFoundException; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_USER, User::getCurrent()->getId(), MSZ_PERM_USER_MANAGE_ROLES)) { echo render_error(403); return; diff --git a/public/manage/users/roles.php b/public-legacy/manage/users/roles.php similarity index 93% rename from public/manage/users/roles.php rename to public-legacy/manage/users/roles.php index f805b08..859e876 100644 --- a/public/manage/users/roles.php +++ b/public-legacy/manage/users/roles.php @@ -4,8 +4,6 @@ namespace Misuzu; use Misuzu\Users\User; use Misuzu\Users\UserRole; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_USER, User::getCurrent()->getId(), MSZ_PERM_USER_MANAGE_ROLES)) { echo render_error(403); return; diff --git a/public/manage/users/user.php b/public-legacy/manage/users/user.php similarity index 99% rename from public/manage/users/user.php rename to public-legacy/manage/users/user.php index 5d41ebb..bdbb4c1 100644 --- a/public/manage/users/user.php +++ b/public-legacy/manage/users/user.php @@ -7,8 +7,6 @@ use Misuzu\Users\UserNotFoundException; use Misuzu\Users\UserRole; use Misuzu\Users\UserRoleNotFoundException; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_USER, User::getCurrent()->getId(), MSZ_PERM_USER_MANAGE_USERS)) { echo render_error(403); return; diff --git a/public/manage/users/warnings.php b/public-legacy/manage/users/warnings.php similarity index 99% rename from public/manage/users/warnings.php rename to public-legacy/manage/users/warnings.php index ee88525..86bb547 100644 --- a/public/manage/users/warnings.php +++ b/public-legacy/manage/users/warnings.php @@ -8,8 +8,6 @@ use Misuzu\Users\UserWarning; use Misuzu\Users\UserWarningNotFoundException; use Misuzu\Users\UserWarningCreationFailedException; -require_once '../../../misuzu.php'; - if(!User::hasCurrent() || !perms_check_user(MSZ_PERMS_USER, User::getCurrent()->getId(), MSZ_PERM_USER_MANAGE_WARNINGS)) { echo render_error(403); return; diff --git a/public/members.php b/public-legacy/members.php similarity index 99% rename from public/members.php rename to public-legacy/members.php index 4856326..e0208ca 100644 --- a/public/members.php +++ b/public-legacy/members.php @@ -5,8 +5,6 @@ use Misuzu\Users\User; use Misuzu\Users\UserRole; use Misuzu\Users\UserRoleNotFoundException; -require_once '../misuzu.php'; - $roleId = !empty($_GET['r']) && is_string($_GET['r']) ? (int)$_GET['r'] : UserRole::DEFAULT; $orderBy = !empty($_GET['ss']) && is_string($_GET['ss']) ? mb_strtolower($_GET['ss']) : ''; $orderDir = !empty($_GET['sd']) && is_string($_GET['sd']) ? mb_strtolower($_GET['sd']) : ''; diff --git a/public/profile.php b/public-legacy/profile.php similarity index 99% rename from public/profile.php rename to public-legacy/profile.php index 5852706..1235e26 100644 --- a/public/profile.php +++ b/public-legacy/profile.php @@ -14,8 +14,6 @@ use Misuzu\Users\Assets\UserImageAssetInvalidTypeException; use Misuzu\Users\Assets\UserImageAssetInvalidDimensionsException; use Misuzu\Users\Assets\UserImageAssetFileTooLargeException; -require_once '../misuzu.php'; - $userId = !empty($_GET['u']) && is_string($_GET['u']) ? trim($_GET['u']) : 0; $profileMode = !empty($_GET['m']) && is_string($_GET['m']) ? (string)$_GET['m'] : ''; $isEditing = !empty($_GET['edit']) && is_string($_GET['edit']) ? (bool)$_GET['edit'] : !empty($_POST) && is_array($_POST); diff --git a/public/search.php b/public-legacy/search.php similarity index 98% rename from public/search.php rename to public-legacy/search.php index 81c484f..298609a 100644 --- a/public/search.php +++ b/public-legacy/search.php @@ -5,8 +5,6 @@ use RuntimeException; use Misuzu\Comments\CommentsCategory; use Misuzu\Users\User; -require_once '../misuzu.php'; - $searchQuery = !empty($_GET['q']) && is_string($_GET['q']) ? $_GET['q'] : ''; if(!empty($searchQuery)) { diff --git a/public/settings/account.php b/public-legacy/settings/account.php similarity index 99% rename from public/settings/account.php rename to public-legacy/settings/account.php index 2c6f427..7a76580 100644 --- a/public/settings/account.php +++ b/public-legacy/settings/account.php @@ -8,8 +8,6 @@ use Misuzu\Users\UserSession; use chillerlan\QRCode\QRCode; use chillerlan\QRCode\QROptions; -require_once '../../misuzu.php'; - if(!UserSession::hasCurrent()) { echo render_error(401); return; diff --git a/public/settings/data.php b/public-legacy/settings/data.php similarity index 99% rename from public/settings/data.php rename to public-legacy/settings/data.php index 4e7203e..2c9b43a 100644 --- a/public/settings/data.php +++ b/public-legacy/settings/data.php @@ -7,8 +7,6 @@ use Index\IO\FileStream; use Misuzu\Users\User; use Misuzu\Users\UserSession; -require_once '../../misuzu.php'; - if(!UserSession::hasCurrent()) { echo render_error(401); return; diff --git a/public/settings/index.php b/public-legacy/settings/index.php similarity index 83% rename from public/settings/index.php rename to public-legacy/settings/index.php index 865505c..266811e 100644 --- a/public/settings/index.php +++ b/public-legacy/settings/index.php @@ -3,8 +3,6 @@ namespace Misuzu; use Misuzu\Users\UserSession; -require_once '../../misuzu.php'; - if(!UserSession::hasCurrent()) { echo render_error(401); return; diff --git a/public/settings/logs.php b/public-legacy/settings/logs.php similarity index 95% rename from public/settings/logs.php rename to public-legacy/settings/logs.php index 2ec4a29..7ddda79 100644 --- a/public/settings/logs.php +++ b/public-legacy/settings/logs.php @@ -5,8 +5,6 @@ use Misuzu\Pagination; use Misuzu\Users\User; use Misuzu\Users\UserLoginAttempt; -require_once '../../misuzu.php'; - $currentUser = User::getCurrent(); if($currentUser === null) { diff --git a/public/settings/sessions.php b/public-legacy/settings/sessions.php similarity index 98% rename from public/settings/sessions.php rename to public-legacy/settings/sessions.php index 401fa17..fca07b1 100644 --- a/public/settings/sessions.php +++ b/public-legacy/settings/sessions.php @@ -5,8 +5,6 @@ use Misuzu\Users\User; use Misuzu\Users\UserSession; use Misuzu\Users\UserSessionNotFoundException; -require_once '../../misuzu.php'; - if(!User::hasCurrent()) { echo render_error(401); return; diff --git a/public/_sockchat.php b/public/_sockchat.php deleted file mode 100644 index 41cc616..0000000 --- a/public/_sockchat.php +++ /dev/null @@ -1,2 +0,0 @@ -setUpHttp(str_contains($request->getPath(), '.php')); +ob_start(); + +if(file_exists(MSZ_ROOT . '/.migrating')) { + http_response_code(503); + if(!isset($_GET['_check'])) { + header('Content-Type: text/html; charset=utf-8'); + echo file_get_contents(MSZ_TEMPLATES . '/503.html'); + } + exit; +} + +if(!MSZ_DEBUG) { + $twigCacheDirSfx = GitInfo::hash(true); + if(empty($twigCacheDirSfx)) + $twigCacheDirSfx = md5(MSZ_ROOT); + + $twigCache = sys_get_temp_dir() . '/msz-tpl-' . $twigCacheDirSfx; + if(!is_dir($twigCache)) + mkdir($twigCache, 0775, true); +} + +$globals = $cfg->getValues([ + ['site.name:s', 'Misuzu'], + 'site.desc:s', + 'site.url:s', + 'sockChat.chatPath.normal:s', + 'eeprom.path:s', + 'eeprom.app:s', + ['auth.secret:s', 'meow'], + ['csrf.secret:s', 'soup'], + 'private.enabled:b', +]); + +Template::init($msz, $twigCache ?? null, MSZ_DEBUG); + +Template::set('globals', [ + 'site_name' => $globals['site.name'], + 'site_description' => $globals['site.desc'], + 'site_url' => $globals['site.url'], + 'site_chat' => $globals['sockChat.chatPath.normal'], + 'eeprom' => [ + 'path' => $globals['eeprom.path'], + 'app' => $globals['eeprom.app'], + ], +]); + +$mszAssetsInfo = json_decode(file_get_contents(MSZ_ASSETS . '/current.json')); +if(!empty($mszAssetsInfo)) + Template::set('assets', $mszAssetsInfo); +unset($mszAssetsInfo); + +Template::addPath(MSZ_TEMPLATES); + +AuthToken::setSecretKey($globals['auth.secret']); + +if(isset($_COOKIE['msz_uid']) && isset($_COOKIE['msz_sid'])) { + $authToken = new AuthToken; + $authToken->setUserId(filter_input(INPUT_COOKIE, 'msz_uid', FILTER_SANITIZE_NUMBER_INT) ?? 0); + $authToken->setSessionToken(filter_input(INPUT_COOKIE, 'msz_sid') ?? ''); + + if($authToken->isValid()) + $authToken->applyCookie(strtotime('1 year')); + + AuthToken::nukeCookieLegacy(); +} + +if(!isset($authToken)) + $authToken = AuthToken::unpack(filter_input(INPUT_COOKIE, 'msz_auth') ?? ''); + +if($authToken->isValid()) { + $authToken->setCurrent(); + + try { + $sessionInfo = UserSession::byToken($authToken->getSessionToken()); + if($sessionInfo->hasExpired()) { + $sessionInfo->delete(); + } elseif($sessionInfo->getUserId() === $authToken->getUserId()) { + $userInfo = $sessionInfo->getUser(); + if(!$userInfo->isDeleted()) { + $sessionInfo->setCurrent(); + $userInfo->setCurrent(); + $sessionInfo->bump($_SERVER['REMOTE_ADDR']); + + if($sessionInfo->shouldBumpExpire()) + $authToken->applyCookie($sessionInfo->getExpiresTime()); + + // only allow impersonation when super user + if($authToken->hasImpersonatedUserId() && $userInfo->isSuper()) { + $userInfoReal = $userInfo; + + try { + $userInfo = User::byId($authToken->getImpersonatedUserId()); + } catch(UserNotFoundException $ex) { + $userInfo = $userInfoReal; + $authToken->removeImpersonatedUserId(); + $authToken->applyCookie(); + } + + $userInfo->setCurrent(); + } + } + } + } catch(UserNotFoundException $ex) { + UserSession::unsetCurrent(); + User::unsetCurrent(); + } catch(UserSessionNotFoundException $ex) { + UserSession::unsetCurrent(); + User::unsetCurrent(); + } + + if(UserSession::hasCurrent()) { + $userInfo->bumpActivity($_SERVER['REMOTE_ADDR']); + } else + AuthToken::nukeCookie(); +} + +CSRF::init( + $globals['csrf.secret'], + (UserSession::hasCurrent() ? UserSession::getCurrent()->getToken() : ($_SERVER['REMOTE_ADDR'] ?? '::1')) +); + +if($globals['private.enabled']) { + $onLoginPage = $_SERVER['PHP_SELF'] === url('auth-login'); + $onPasswordPage = parse_url($_SERVER['PHP_SELF'], PHP_URL_PATH) === url('auth-forgot'); + $misuzuBypassLockdown = !empty($misuzuBypassLockdown) || $onLoginPage; + + if(!$misuzuBypassLockdown) { + if(UserSession::hasCurrent()) { + ['private.perm.cat' => $privatePermCat, 'private.perm.val' => $privatePermVal] = $cfg->getValues(['private.perm.cat:s', 'private.perm.val:i']); + + if(!empty($privatePermCat) && $privatePermVal > 0) { + if(!perms_check_user($privatePermCat, User::getCurrent()->getId(), $privatePermVal)) { + // au revoir + UserSession::unsetCurrent(); + User::unsetCurrent(); + } + } + } elseif(!$onLoginPage && !($onPasswordPage && $cfg->getBoolean('private.allow_password_reset', true))) { + url_redirect('auth-login'); + exit; + } + } +} + +if(!empty($userInfo)) + Template::set('current_user', $userInfo); +if(!empty($userInfoReal)) + Template::set('current_user_real', $userInfoReal); + +$inManageMode = str_starts_with($_SERVER['REQUEST_URI'], '/manage'); +$hasManageAccess = User::hasCurrent() + && !User::getCurrent()->hasActiveWarning() + && perms_check_user(MSZ_PERMS_GENERAL, User::getCurrent()->getId(), MSZ_PERM_GENERAL_CAN_MANAGE); +Template::set('has_manage_access', $hasManageAccess); + +if($inManageMode) { + if(!$hasManageAccess) { + echo render_error(403); + exit; + } + + Template::set('manage_menu', manage_get_menu(User::getCurrent()->getId())); +} + +$mszRequestPath = $request->getPath(); +$mszLegacyPathPrefix = MSZ_PUBLIC . '-legacy/'; +$mszLegacyPath = realpath($mszLegacyPathPrefix . $mszRequestPath); + +if(!empty($mszLegacyPath) && str_starts_with($mszLegacyPath, $mszLegacyPathPrefix)) { + if(is_dir($mszLegacyPath)) + $mszLegacyPath .= '/index.php'; + + if(is_file($mszLegacyPath)) { + require_once $mszLegacyPath; + return; + } +} + +$msz->setUpHttp(str_contains($mszRequestPath, '.php')); $msz->dispatchHttp($request); diff --git a/public/info.php b/public/info.php deleted file mode 100644 index 41cc616..0000000 --- a/public/info.php +++ /dev/null @@ -1,2 +0,0 @@ -context = $context; } }