MediaWiki PHP Cross Reference Collaborative Wikis

Source: /includes/WebStart.php - 154 lines - 4900 bytes - Summary - Text - Print

Description: This does the initial setup for a web request. It does some security checks, starts the profiler and loads the configuration, and optionally loads Setup.php depending on whether MW_NO_SETUP is defined.

   1  <?php
   2  /**
   3   * This does the initial setup for a web request.
   4   * It does some security checks, starts the profiler and loads the
   5   * configuration, and optionally loads Setup.php depending on whether
   6   * MW_NO_SETUP is defined.
   7   *
   8   * This program is free software; you can redistribute it and/or modify
   9   * it under the terms of the GNU General Public License as published by
  10   * the Free Software Foundation; either version 2 of the License, or
  11   * (at your option) any later version.
  12   *
  13   * This program is distributed in the hope that it will be useful,
  14   * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16   * GNU General Public License for more details.
  17   *
  18   * You should have received a copy of the GNU General Public License along
  19   * with this program; if not, write to the Free Software Foundation, Inc.,
  20   * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  21   * http://www.gnu.org/copyleft/gpl.html
  22   *
  23   * @file
  24   */
  25  
  26  # Protect against register_globals
  27  # This must be done before any globals are set by the code
  28  if ( ini_get( 'register_globals' ) ) {
  29      if ( isset( $_REQUEST['GLOBALS'] ) || isset( $_FILES['GLOBALS'] ) ) {
  30          die( '<a href="http://www.hardened-php.net/globals-problem">$GLOBALS overwrite vulnerability</a>' );
  31      }
  32      $verboten = array(
  33          'GLOBALS',
  34          '_SERVER',
  35          'HTTP_SERVER_VARS',
  36          '_GET',
  37          'HTTP_GET_VARS',
  38          '_POST',
  39          'HTTP_POST_VARS',
  40          '_COOKIE',
  41          'HTTP_COOKIE_VARS',
  42          '_FILES',
  43          'HTTP_POST_FILES',
  44          '_ENV',
  45          'HTTP_ENV_VARS',
  46          '_REQUEST',
  47          '_SESSION',
  48          'HTTP_SESSION_VARS'
  49      );
  50      foreach ( $_REQUEST as $name => $value ) {
  51          if ( in_array( $name, $verboten ) ) {
  52              header( "HTTP/1.1 500 Internal Server Error" );
  53              echo "register_globals security paranoia: trying to overwrite superglobals, aborting.";
  54              die( -1 );
  55          }
  56          unset( $GLOBALS[$name] );
  57      }
  58  }
  59  
  60  # bug 15461: Make IE8 turn off content sniffing. Everybody else should ignore this
  61  # We're adding it here so that it's *always* set, even for alternate entry
  62  # points and when $wgOut gets disabled or overridden.
  63  header( 'X-Content-Type-Options: nosniff' );
  64  
  65  $wgRequestTime = microtime( true );
  66  # getrusage() does not exist on the Microsoft Windows platforms, catching this
  67  if ( function_exists ( 'getrusage' ) ) {
  68      $wgRUstart = getrusage();
  69  } else {
  70      $wgRUstart = array();
  71  }
  72  unset( $IP );
  73  
  74  # Valid web server entry point, enable includes.
  75  # Please don't move this line to includes/Defines.php. This line essentially
  76  # defines a valid entry point. If you put it in includes/Defines.php, then
  77  # any script that includes it becomes an entry point, thereby defeating
  78  # its purpose.
  79  define( 'MEDIAWIKI', true );
  80  
  81  # Full path to working directory.
  82  # Makes it possible to for example to have effective exclude path in apc.
  83  # __DIR__ breaks symlinked includes, but realpath() returns false
  84  # if we don't have permissions on parent directories.
  85  $IP = getenv( 'MW_INSTALL_PATH' );
  86  if ( $IP === false ) {
  87      if ( realpath( '.' ) ) {
  88          $IP = realpath( '.' );
  89      } else {
  90          $IP = dirname( __DIR__ );
  91      }
  92  }
  93  
  94  # Start the autoloader, so that extensions can derive classes from core files
  95  require_once "$IP/includes/AutoLoader.php";
  96  
  97  # Load the profiler
  98  require_once "$IP/includes/profiler/Profiler.php";
  99  
 100  # Load up some global defines.
 101  require_once "$IP/includes/Defines.php";
 102  
 103  # Start the profiler
 104  $wgProfiler = array();
 105  if ( file_exists( "$IP/StartProfiler.php" ) ) {
 106      require "$IP/StartProfiler.php";
 107  }
 108  
 109  wfProfileIn( 'WebStart.php-conf' );
 110  
 111  # Load default settings
 112  require_once "$IP/includes/DefaultSettings.php";
 113  
 114  # Load composer's autoloader if present
 115  if ( is_readable( "$IP/vendor/autoload.php" ) ) {
 116      require_once "$IP/vendor/autoload.php";
 117  }
 118  
 119  if ( defined( 'MW_CONFIG_CALLBACK' ) ) {
 120      # Use a callback function to configure MediaWiki
 121      call_user_func( MW_CONFIG_CALLBACK );
 122  } else {
 123      if ( !defined( 'MW_CONFIG_FILE' ) ) {
 124          define( 'MW_CONFIG_FILE', "$IP/LocalSettings.php" );
 125      }
 126  
 127      # LocalSettings.php is the per site customization file. If it does not exist
 128      # the wiki installer needs to be launched or the generated file uploaded to
 129      # the root wiki directory
 130      if ( !file_exists( MW_CONFIG_FILE ) ) {
 131          require_once "$IP/includes/templates/NoLocalSettings.php";
 132          die();
 133      }
 134  
 135      # Include site settings. $IP may be changed (hopefully before the AutoLoader is invoked)
 136      require_once MW_CONFIG_FILE;
 137  }
 138  
 139  wfProfileOut( 'WebStart.php-conf' );
 140  
 141  wfProfileIn( 'WebStart.php-ob_start' );
 142  # Initialise output buffering
 143  # Check that there is no previous output or previously set up buffers, because
 144  # that would cause us to potentially mix gzip and non-gzip output, creating a
 145  # big mess.
 146  if ( !defined( 'MW_NO_OUTPUT_BUFFER' ) && ob_get_level() == 0 ) {
 147      require_once "$IP/includes/OutputHandler.php";
 148      ob_start( 'wfOutputHandler' );
 149  }
 150  wfProfileOut( 'WebStart.php-ob_start' );
 151  
 152  if ( !defined( 'MW_NO_SETUP' ) ) {
 153      require_once "$IP/includes/Setup.php";
 154  }

title

Description

title

Description

title

Description

title

title

Body