2015-09-27 14:34:39 -04:00
|
|
|
<?php
|
|
|
|
/**
|
2016-07-11 05:58:15 -04:00
|
|
|
* PrivateBin
|
2015-09-27 14:34:39 -04:00
|
|
|
*
|
|
|
|
* a zero-knowledge paste bin
|
|
|
|
*
|
2016-07-11 05:58:15 -04:00
|
|
|
* @link https://github.com/PrivateBin/PrivateBin
|
2015-09-27 14:34:39 -04:00
|
|
|
* @copyright 2012 Sébastien SAUVAGE (sebsauvage.net)
|
2016-07-19 07:56:52 -04:00
|
|
|
* @license https://www.opensource.org/licenses/zlib-license.php The zlib/libpng License
|
2016-08-25 03:53:31 -04:00
|
|
|
* @version 1.0
|
2015-09-27 14:34:39 -04:00
|
|
|
*/
|
|
|
|
|
2016-07-21 11:09:48 -04:00
|
|
|
namespace PrivateBin;
|
|
|
|
|
2015-09-27 14:34:39 -04:00
|
|
|
/**
|
2016-08-09 05:54:42 -04:00
|
|
|
* Request
|
2015-09-27 14:34:39 -04:00
|
|
|
*
|
|
|
|
* parses request parameters and provides helper functions for routing
|
2016-08-15 10:45:47 -04:00
|
|
|
*/
|
2016-08-09 05:54:42 -04:00
|
|
|
class Request
|
2015-09-27 14:34:39 -04:00
|
|
|
{
|
2016-04-08 17:29:44 -04:00
|
|
|
/**
|
|
|
|
* MIME type for JSON
|
|
|
|
*
|
|
|
|
* @const string
|
|
|
|
*/
|
|
|
|
const MIME_JSON = 'application/json';
|
|
|
|
|
|
|
|
/**
|
|
|
|
* MIME type for HTML
|
|
|
|
*
|
|
|
|
* @const string
|
|
|
|
*/
|
|
|
|
const MIME_HTML = 'text/html';
|
|
|
|
|
|
|
|
/**
|
|
|
|
* MIME type for XHTML
|
|
|
|
*
|
|
|
|
* @const string
|
|
|
|
*/
|
|
|
|
const MIME_XHTML = 'application/xhtml+xml';
|
|
|
|
|
2015-09-27 14:34:39 -04:00
|
|
|
/**
|
|
|
|
* Input stream to use for PUT parameter parsing.
|
|
|
|
*
|
|
|
|
* @access private
|
|
|
|
* @var string
|
|
|
|
*/
|
2015-10-11 12:50:48 -04:00
|
|
|
private static $_inputStream = 'php://input';
|
2015-09-27 14:34:39 -04:00
|
|
|
|
|
|
|
/**
|
|
|
|
* Operation to perform.
|
|
|
|
*
|
|
|
|
* @access private
|
|
|
|
* @var string
|
|
|
|
*/
|
|
|
|
private $_operation = 'view';
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Request parameters.
|
|
|
|
*
|
|
|
|
* @access private
|
|
|
|
* @var array
|
|
|
|
*/
|
|
|
|
private $_params = array();
|
|
|
|
|
|
|
|
/**
|
|
|
|
* If we are in a JSON API context.
|
|
|
|
*
|
|
|
|
* @access private
|
|
|
|
* @var bool
|
|
|
|
*/
|
|
|
|
private $_isJsonApi = false;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Constructor.
|
|
|
|
*
|
|
|
|
* @access public
|
|
|
|
* @return void
|
|
|
|
*/
|
|
|
|
public function __construct()
|
|
|
|
{
|
|
|
|
// in case stupid admin has left magic_quotes enabled in php.ini (for PHP < 5.4)
|
2016-08-09 05:54:42 -04:00
|
|
|
if (version_compare(PHP_VERSION, '5.4.0') < 0 && get_magic_quotes_gpc()) {
|
|
|
|
$_POST = array_map('PrivateBin\\Filter::stripslashesDeep', $_POST);
|
|
|
|
$_GET = array_map('PrivateBin\\Filter::stripslashesDeep', $_GET);
|
|
|
|
$_COOKIE = array_map('PrivateBin\\Filter::stripslashesDeep', $_COOKIE);
|
2015-09-27 14:34:39 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
// decide if we are in JSON API or HTML context
|
2016-04-08 17:29:44 -04:00
|
|
|
$this->_isJsonApi = $this->_detectJsonRequest();
|
2015-09-27 14:34:39 -04:00
|
|
|
|
|
|
|
// parse parameters, depending on request type
|
2016-07-26 02:19:35 -04:00
|
|
|
switch (array_key_exists('REQUEST_METHOD', $_SERVER) ? $_SERVER['REQUEST_METHOD'] : 'GET') {
|
2015-10-11 15:22:00 -04:00
|
|
|
case 'DELETE':
|
2015-09-27 14:34:39 -04:00
|
|
|
case 'PUT':
|
2015-10-11 12:50:48 -04:00
|
|
|
parse_str(file_get_contents(self::$_inputStream), $this->_params);
|
2015-09-27 14:34:39 -04:00
|
|
|
break;
|
|
|
|
case 'POST':
|
|
|
|
$this->_params = $_POST;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
$this->_params = $_GET;
|
|
|
|
}
|
2015-10-15 16:04:57 -04:00
|
|
|
if (
|
|
|
|
!array_key_exists('pasteid', $this->_params) &&
|
2015-10-18 08:37:58 -04:00
|
|
|
!array_key_exists('jsonld', $this->_params) &&
|
2015-10-15 16:04:57 -04:00
|
|
|
array_key_exists('QUERY_STRING', $_SERVER) &&
|
|
|
|
!empty($_SERVER['QUERY_STRING'])
|
2016-07-26 02:19:35 -04:00
|
|
|
) {
|
2015-10-11 15:22:00 -04:00
|
|
|
$this->_params['pasteid'] = $_SERVER['QUERY_STRING'];
|
|
|
|
}
|
2015-09-27 14:34:39 -04:00
|
|
|
|
2015-10-11 15:22:00 -04:00
|
|
|
// prepare operation, depending on current parameters
|
2015-09-27 14:34:39 -04:00
|
|
|
if (
|
|
|
|
(array_key_exists('data', $this->_params) && !empty($this->_params['data'])) ||
|
|
|
|
(array_key_exists('attachment', $this->_params) && !empty($this->_params['attachment']))
|
2016-07-26 02:19:35 -04:00
|
|
|
) {
|
2015-09-27 14:34:39 -04:00
|
|
|
$this->_operation = 'create';
|
2016-07-26 02:19:35 -04:00
|
|
|
} elseif (array_key_exists('pasteid', $this->_params) && !empty($this->_params['pasteid'])) {
|
|
|
|
if (array_key_exists('deletetoken', $this->_params) && !empty($this->_params['deletetoken'])) {
|
2015-10-11 15:22:00 -04:00
|
|
|
$this->_operation = 'delete';
|
2016-07-26 02:19:35 -04:00
|
|
|
} else {
|
2015-10-11 15:22:00 -04:00
|
|
|
$this->_operation = 'read';
|
|
|
|
}
|
2016-07-26 02:19:35 -04:00
|
|
|
} elseif (array_key_exists('jsonld', $this->_params) && !empty($this->_params['jsonld'])) {
|
2015-10-18 08:37:58 -04:00
|
|
|
$this->_operation = 'jsonld';
|
|
|
|
}
|
2015-09-27 14:34:39 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Get current operation.
|
|
|
|
*
|
|
|
|
* @access public
|
|
|
|
* @return string
|
|
|
|
*/
|
|
|
|
public function getOperation()
|
|
|
|
{
|
|
|
|
return $this->_operation;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Get a request parameter.
|
|
|
|
*
|
|
|
|
* @access public
|
|
|
|
* @param string $param
|
|
|
|
* @param string $default
|
|
|
|
* @return string
|
|
|
|
*/
|
|
|
|
public function getParam($param, $default = '')
|
|
|
|
{
|
|
|
|
return array_key_exists($param, $this->_params) ? $this->_params[$param] : $default;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* If we are in a JSON API context.
|
|
|
|
*
|
|
|
|
* @access public
|
|
|
|
* @return bool
|
|
|
|
*/
|
|
|
|
public function isJsonApiCall()
|
|
|
|
{
|
|
|
|
return $this->_isJsonApi;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
2015-10-11 12:50:48 -04:00
|
|
|
* Override the default input stream source, used for unit testing.
|
2015-09-27 14:34:39 -04:00
|
|
|
*
|
2015-11-09 15:39:42 -05:00
|
|
|
* @param string $input
|
2015-09-27 14:34:39 -04:00
|
|
|
*/
|
2015-10-11 12:50:48 -04:00
|
|
|
public static function setInputStream($input)
|
2015-09-27 14:34:39 -04:00
|
|
|
{
|
2015-10-11 12:50:48 -04:00
|
|
|
self::$_inputStream = $input;
|
2015-09-27 14:34:39 -04:00
|
|
|
}
|
2016-04-08 17:29:44 -04:00
|
|
|
|
|
|
|
/**
|
|
|
|
* detect the clients supported media type and decide if its a JSON API call or not
|
|
|
|
*
|
2016-07-19 07:56:52 -04:00
|
|
|
* Adapted from: https://stackoverflow.com/questions/3770513/detect-browser-language-in-php#3771447
|
2016-04-08 17:29:44 -04:00
|
|
|
*
|
|
|
|
* @access private
|
|
|
|
* @return bool
|
|
|
|
*/
|
|
|
|
private function _detectJsonRequest()
|
|
|
|
{
|
|
|
|
$hasAcceptHeader = array_key_exists('HTTP_ACCEPT', $_SERVER);
|
2016-08-15 10:45:47 -04:00
|
|
|
$acceptHeader = $hasAcceptHeader ? $_SERVER['HTTP_ACCEPT'] : '';
|
2016-04-08 17:29:44 -04:00
|
|
|
|
|
|
|
// simple cases
|
|
|
|
if (
|
|
|
|
(array_key_exists('HTTP_X_REQUESTED_WITH', $_SERVER) &&
|
|
|
|
$_SERVER['HTTP_X_REQUESTED_WITH'] == 'JSONHttpRequest') ||
|
|
|
|
($hasAcceptHeader &&
|
|
|
|
strpos($acceptHeader, self::MIME_JSON) !== false &&
|
|
|
|
strpos($acceptHeader, self::MIME_HTML) === false &&
|
|
|
|
strpos($acceptHeader, self::MIME_XHTML) === false)
|
2016-07-26 02:19:35 -04:00
|
|
|
) {
|
2016-04-08 17:29:44 -04:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
// advanced case: media type negotiation
|
|
|
|
$mediaTypes = array();
|
2016-07-26 02:19:35 -04:00
|
|
|
if ($hasAcceptHeader) {
|
2016-04-08 17:29:44 -04:00
|
|
|
$mediaTypeRanges = explode(',', trim($acceptHeader));
|
2016-07-26 02:19:35 -04:00
|
|
|
foreach ($mediaTypeRanges as $mediaTypeRange) {
|
2016-04-08 17:29:44 -04:00
|
|
|
if (preg_match(
|
|
|
|
'#(\*/\*|[a-z\-]+/[a-z\-+*]+(?:\s*;\s*[^q]\S*)*)(?:\s*;\s*q\s*=\s*(0(?:\.\d{0,3})|1(?:\.0{0,3})))?#',
|
|
|
|
trim($mediaTypeRange), $match
|
2016-07-26 02:19:35 -04:00
|
|
|
)) {
|
|
|
|
if (!isset($match[2])) {
|
2016-04-08 17:29:44 -04:00
|
|
|
$match[2] = '1.0';
|
2016-07-26 02:19:35 -04:00
|
|
|
} else {
|
2016-04-08 17:29:44 -04:00
|
|
|
$match[2] = (string) floatval($match[2]);
|
|
|
|
}
|
2016-07-26 02:19:35 -04:00
|
|
|
if (!isset($mediaTypes[$match[2]])) {
|
2016-04-08 17:29:44 -04:00
|
|
|
$mediaTypes[$match[2]] = array();
|
|
|
|
}
|
|
|
|
$mediaTypes[$match[2]][] = strtolower($match[1]);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
krsort($mediaTypes);
|
2016-07-26 02:19:35 -04:00
|
|
|
foreach ($mediaTypes as $acceptedQuality => $acceptedValues) {
|
|
|
|
if ($acceptedQuality === 0.0) {
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
foreach ($acceptedValues as $acceptedValue) {
|
2016-04-08 17:29:44 -04:00
|
|
|
if (
|
|
|
|
strpos($acceptedValue, self::MIME_HTML) === 0 ||
|
|
|
|
strpos($acceptedValue, self::MIME_XHTML) === 0
|
2016-07-26 02:19:35 -04:00
|
|
|
) {
|
2016-04-08 17:29:44 -04:00
|
|
|
return false;
|
2016-07-26 02:19:35 -04:00
|
|
|
} elseif (strpos($acceptedValue, self::MIME_JSON) === 0) {
|
2016-04-08 17:29:44 -04:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return false;
|
|
|
|
}
|
2016-07-11 08:15:20 -04:00
|
|
|
}
|