diff options
Diffstat (limited to 'mod.php')
| -rw-r--r-- | mod.php | 262 |
1 files changed, 150 insertions, 112 deletions
@@ -14,7 +14,7 @@ require_once 'inc/mod/pages.php'; check_login(true); -$query = isset($_SERVER['QUERY_STRING']) ? rawurldecode($_SERVER['QUERY_STRING']) : ''; +$query = isset($_SERVER['QUERY_STRING']) ? rawurldecode((string) $_SERVER['QUERY_STRING']) : ''; // If there's a thread parameter (eg, for returning to after enacting a ban) // drop it from the $query. @@ -22,111 +22,153 @@ if(isset($_GET['thread'])) { $query = explode("&thread=", $query)[0]; } -$pages = array( - '' => ':?/', // redirect to dashboard - '/' => 'dashboard', // dashboard - '/confirm/(.+)' => 'confirm', // confirm action (if javascript didn't work) - '/logout' => 'secure logout', // logout - - '/users' => 'users', // manage users - '/users/(\d+)/(promote|demote)' => 'secure user_promote', // prmote/demote user - '/users/(\d+)' => 'secure_POST user', // edit user - '/users/new' => 'secure_POST user_new', // create a new user - - '/new_PM/([^/]+)' => 'secure_POST new_pm', // create a new pm - '/PM/(\d+)(/reply)?' => 'pm', // read a pm - '/inbox' => 'inbox', // pm inbox - - '/log' => 'log', // modlog - '/log/(\d+)' => 'log', // modlog - '/log:([^/:]+)' => 'user_log', // modlog - '/log:([^/:]+)/(\d+)' => 'user_log', // modlog - '/log:b:([^/]+)' => 'board_log', // modlog - '/log:b:([^/]+)/(\d+)' => 'board_log', // modlog - - '/edit_news' => 'secure_POST news', // view news - '/edit_news/(\d+)' => 'secure_POST news', // view news - '/edit_news/delete/(\d+)' => 'secure news_delete', // delete from news - - '/edit_pages(?:/?(\%b)?)' => 'secure_POST pages', - '/edit_page/(\d+)' => 'secure_POST edit_page', - '/edit_pages/delete/([a-z0-9]+)' => 'secure delete_page', - '/edit_pages/delete/([a-z0-9]+)/(\%b)' => 'secure delete_page_board', - - '/noticeboard' => 'secure_POST noticeboard', // view noticeboard - '/noticeboard/(\d+)' => 'secure_POST noticeboard', // view noticeboard - '/noticeboard/delete/(\d+)' => 'secure noticeboard_delete', // delete from noticeboard - - '/edit/(\%b)' => 'secure_POST edit_board', // edit board details - '/new-board' => 'secure_POST new_board', // create a new board - - '/rebuild' => 'secure_POST rebuild', // rebuild static files - '/reports' => 'reports', // report queue - '/reports/(\d+)/dismiss(all)?' => 'secure report_dismiss', // dismiss a report - - '/IP/([\w.:]+)' => 'secure_POST ip', // view ip address - '/IP/([\w.:]+)/remove_note/(\d+)' => 'secure ip_remove_note', // remove note from ip address - - '/ban' => 'secure_POST ban', // new ban - '/bans' => 'secure_POST bans', // ban list - '/bans.json' => 'secure bans_json', // ban list JSON - '/ban-appeals' => 'secure_POST ban_appeals', // view ban appeals - - '/recent/(\d+)' => 'recent_posts', // view recent posts - '/recent/(\d+)/([\w,]+?)' => 'recent_posts', // view recent posts - '/recent/(\d+)/([\w,]+?)/(json)?' => 'recent_posts', // view recent posts JSON - - '/search' => 'search_redirect', // search - '/search/(posts|IP_notes|bans|log)/(.+)/(\d+)' => 'search', // search - '/search/(posts|IP_notes|bans|log)/(.+)' => 'search', // search - - '/(\%b)/warning/(\d+)' => 'secure_POST warning_post', // warn poster - '/(\%b)/ban(&delete)?/(\d+)' => 'secure_POST ban_post', // ban poster - '/(\%b)/move/(\d+)' => 'secure_POST move', // move thread - '/(\%b)/move_reply/(\d+)' => 'secure_POST move_reply', // move reply - '/(\%b)/merge/(\d+)' => 'secure_POST merge', // merge thread - '/(\%b)/edit(_raw)?/(\d+)' => 'secure_POST edit_post', // edit post - '/(\%b)/delete/(\d+)' => 'secure delete', // delete post - '/(\%b)/deletefile/(\d+)/(\d+)' => 'secure deletefile', // delete file from post - '/(\%b+)/spoiler/(\d+)/(\d+)' => 'secure spoiler_image', // spoiler file - '/(\%b)/deletebyip/(\d+)(/global)?' => 'secure deletebyip', // delete all posts by IP address - '/(\%b)/(un)?lock/(\d+)' => 'secure lock', // lock thread - '/(\%b)/(un)?sticky/(\d+)' => 'secure sticky', // sticky thread - '/(\%b)/(un)?cycle/(\d+)' => 'secure cycle', // cycle thread - '/(\%b)/bump(un)?lock/(\d+)' => 'secure bumplock', // "bumplock" thread - - '/themes' => 'themes_list', // manage themes - '/themes/(\w+)' => 'secure_POST theme_configure', // configure/reconfigure theme - '/themes/(\w+)/rebuild' => 'secure theme_rebuild', // rebuild theme - '/themes/(\w+)/uninstall' => 'secure theme_uninstall', // uninstall theme - - '/config' => 'secure_POST config', // config editor - '/config/(\%b)' => 'secure_POST config', // config editor - - // these pages aren't listed in the dashboard without $config['debug'] - '/debug/antispam' => 'debug_antispam', - '/debug/recent' => 'debug_recent_posts', - '/debug/apc' => 'debug_apc', - '/debug/sql' => 'secure_POST debug_sql', - - // This should always be at the end: - '/(\%b)/' => 'view_board', - '/(\%b)/' . preg_quote($config['file_index'], '!') => 'view_board', - '/(\%b)/' . str_replace('%d', '(\d+)', preg_quote($config['file_page'], '!')) => 'view_board', - '/(\%b)/' . preg_quote($config['dir']['res'], '!') . - str_replace('%d', '(\d+)', preg_quote($config['file_page50'], '!')) => 'view_thread50', - '/(\%b)/' . preg_quote($config['dir']['res'], '!') . - str_replace('%d', '(\d+)', preg_quote($config['file_page'], '!')) => 'view_thread', - - '/(\%b)/' . preg_quote($config['dir']['res'], '!') . - str_replace(array('%d','%s'), array('(\d+)', '[a-z0-9-]+'), preg_quote($config['file_page50_slug'], '!')) => 'view_thread50', - '/(\%b)/' . preg_quote($config['dir']['res'], '!') . - str_replace(array('%d','%s'), array('(\d+)', '[a-z0-9-]+'), preg_quote($config['file_page_slug'], '!')) => 'view_thread', -); +$pages = [ + '' => ':?/', + // redirect to dashboard + '/' => 'dashboard', + // dashboard + '/confirm/(.+)' => 'confirm', + // confirm action (if javascript didn't work) + '/logout' => 'secure logout', + // logout + '/users' => 'users', + // manage users + '/users/(\d+)/(promote|demote)' => 'secure user_promote', + // prmote/demote user + '/users/(\d+)' => 'secure_POST user', + // edit user + '/users/new' => 'secure_POST user_new', + // create a new user + '/new_PM/([^/]+)' => 'secure_POST new_pm', + // create a new pm + '/PM/(\d+)(/reply)?' => 'pm', + // read a pm + '/inbox' => 'inbox', + // pm inbox + '/log' => 'log', + // modlog + '/log/(\d+)' => 'log', + // modlog + '/log:([^/:]+)' => 'user_log', + // modlog + '/log:([^/:]+)/(\d+)' => 'user_log', + // modlog + '/log:b:([^/]+)' => 'board_log', + // modlog + '/log:b:([^/]+)/(\d+)' => 'board_log', + // modlog + '/edit_news' => 'secure_POST news', + // view news + '/edit_news/(\d+)' => 'secure_POST news', + // view news + '/edit_news/delete/(\d+)' => 'secure news_delete', + // delete from news + '/edit_pages(?:/?(\%b)?)' => 'secure_POST pages', + '/edit_page/(\d+)' => 'secure_POST edit_page', + '/edit_pages/delete/([a-z0-9]+)' => 'secure delete_page', + '/edit_pages/delete/([a-z0-9]+)/(\%b)' => 'secure delete_page_board', + '/noticeboard' => 'secure_POST noticeboard', + // view noticeboard + '/noticeboard/(\d+)' => 'secure_POST noticeboard', + // view noticeboard + '/noticeboard/delete/(\d+)' => 'secure noticeboard_delete', + // delete from noticeboard + '/edit/(\%b)' => 'secure_POST edit_board', + // edit board details + '/new-board' => 'secure_POST new_board', + // create a new board + '/rebuild' => 'secure_POST rebuild', + // rebuild static files + '/reports' => 'reports', + // report queue + '/reports/(\d+)/dismiss(all)?' => 'secure report_dismiss', + // dismiss a report + '/IP/([\w.:]+)' => 'secure_POST ip', + // view ip address + '/IP/([\w.:]+)/remove_note/(\d+)' => 'secure ip_remove_note', + // remove note from ip address + '/ban' => 'secure_POST ban', + // new ban + '/bans' => 'secure_POST bans', + // ban list + '/bans.json' => 'secure bans_json', + // ban list JSON + '/ban-appeals' => 'secure_POST ban_appeals', + // view ban appeals + '/recent/(\d+)' => 'recent_posts', + // view recent posts + '/recent/(\d+)/([\w,]+?)' => 'recent_posts', + // view recent posts + '/recent/(\d+)/([\w,]+?)/(json)?' => 'recent_posts', + // view recent posts JSON + '/search' => 'search_redirect', + // search + '/search/(posts|IP_notes|bans|log)/(.+)/(\d+)' => 'search', + // search + '/search/(posts|IP_notes|bans|log)/(.+)' => 'search', + // search + '/(\%b)/warning/(\d+)' => 'secure_POST warning_post', + // warn poster + '/(\%b)/ban(&delete)?/(\d+)' => 'secure_POST ban_post', + // ban poster + '/(\%b)/move/(\d+)' => 'secure_POST move', + // move thread + '/(\%b)/move_reply/(\d+)' => 'secure_POST move_reply', + // move reply + '/(\%b)/merge/(\d+)' => 'secure_POST merge', + // merge thread + '/(\%b)/edit(_raw)?/(\d+)' => 'secure_POST edit_post', + // edit post + '/(\%b)/delete/(\d+)' => 'secure delete', + // delete post + '/(\%b)/deletefile/(\d+)/(\d+)' => 'secure deletefile', + // delete file from post + '/(\%b+)/spoiler/(\d+)/(\d+)' => 'secure spoiler_image', + // spoiler file + '/(\%b)/deletebyip/(\d+)(/global)?' => 'secure deletebyip', + // delete all posts by IP address + '/(\%b)/(un)?lock/(\d+)' => 'secure lock', + // lock thread + '/(\%b)/(un)?sticky/(\d+)' => 'secure sticky', + // sticky thread + '/(\%b)/(un)?cycle/(\d+)' => 'secure cycle', + // cycle thread + '/(\%b)/bump(un)?lock/(\d+)' => 'secure bumplock', + // "bumplock" thread + '/themes' => 'themes_list', + // manage themes + '/themes/(\w+)' => 'secure_POST theme_configure', + // configure/reconfigure theme + '/themes/(\w+)/rebuild' => 'secure theme_rebuild', + // rebuild theme + '/themes/(\w+)/uninstall' => 'secure theme_uninstall', + // uninstall theme + '/config' => 'secure_POST config', + // config editor + '/config/(\%b)' => 'secure_POST config', + // config editor + // these pages aren't listed in the dashboard without $config['debug'] + '/debug/antispam' => 'debug_antispam', + '/debug/recent' => 'debug_recent_posts', + '/debug/apc' => 'debug_apc', + '/debug/sql' => 'secure_POST debug_sql', + // This should always be at the end: + '/(\%b)/' => 'view_board', + '/(\%b)/' . preg_quote((string) $config['file_index'], '!') => 'view_board', + '/(\%b)/' . str_replace('%d', '(\d+)', preg_quote((string) $config['file_page'], '!')) => 'view_board', + '/(\%b)/' . preg_quote((string) $config['dir']['res'], '!') . + str_replace('%d', '(\d+)', preg_quote((string) $config['file_page50'], '!')) => 'view_thread50', + '/(\%b)/' . preg_quote((string) $config['dir']['res'], '!') . + str_replace('%d', '(\d+)', preg_quote((string) $config['file_page'], '!')) => 'view_thread', + '/(\%b)/' . preg_quote((string) $config['dir']['res'], '!') . + str_replace(['%d', '%s'], ['(\d+)', '[a-z0-9-]+'], preg_quote((string) $config['file_page50_slug'], '!')) => 'view_thread50', + '/(\%b)/' . preg_quote((string) $config['dir']['res'], '!') . + str_replace(['%d', '%s'], ['(\d+)', '[a-z0-9-]+'], preg_quote((string) $config['file_page_slug'], '!')) => 'view_thread', +]; if (!$mod) { - $pages = array('!^(.+)?$!' => 'login'); + $pages = ['!^(.+)?$!' => 'login']; } elseif (isset($_GET['status'], $_GET['r'])) { header('Location: ' . $_GET['r'], true, (int)$_GET['status']); exit; @@ -136,11 +178,11 @@ if (isset($config['mod']['custom_pages'])) { $pages = array_merge($pages, $config['mod']['custom_pages']); } -$new_pages = array(); +$new_pages = []; foreach ($pages as $key => $callback) { if (is_string($callback) && preg_match('/^secure /', $callback)) $key .= '(/(?P<token>[a-f0-9]{8}))?'; - $key = str_replace('\%b', '?P<board>' . sprintf(substr($config['board_path'], 0, -1), $config['board_regex']), $key); + $key = str_replace('\%b', '?P<board>' . sprintf(substr((string) $config['board_path'], 0, -1), $config['board_regex']), $key); $new_pages[@$key[0] == '!' ? $key : '!^' . $key . '(?:&[^&=]+=[^&]*)*$!u'] = $callback; } $pages = $new_pages; @@ -153,7 +195,7 @@ foreach ($pages as $uri => $handler) { $board_match = $matches['board']; unset($matches['board']); $key = array_search($board_match, $matches); - if (preg_match('/^' . sprintf(substr($config['board_path'], 0, -1), '(' . $config['board_regex'] . ')') . '$/u', $matches[$key], $board_match)) { + if (preg_match('/^' . sprintf(substr((string) $config['board_path'], 0, -1), '(' . $config['board_regex'] . ')') . '$/u', (string) $matches[$key], $board_match)) { $matches[$key] = $board_match[1]; } } @@ -161,7 +203,7 @@ foreach ($pages as $uri => $handler) { if (is_string($handler) && preg_match('/^secure(_POST)? /', $handler, $m)) { $secure_post_only = isset($m[1]); if (!$secure_post_only || $_SERVER['REQUEST_METHOD'] == 'POST') { - $token = isset($matches['token']) ? $matches['token'] : (isset($_POST['token']) ? $_POST['token'] : false); + $token = $matches['token'] ?? $_POST['token'] ?? false; if ($token === false) { if ($secure_post_only) @@ -182,11 +224,7 @@ foreach ($pages as $uri => $handler) { } if ($config['debug']) { - $debug['mod_page'] = array( - 'req' => $query, - 'match' => $uri, - 'handler' => $handler, - ); + $debug['mod_page'] = ['req' => $query, 'match' => $uri, 'handler' => $handler]; $debug['time']['parse_mod_req'] = '~' . round((microtime(true) - $parse_start_time) * 1000, 2) . 'ms'; } |