X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=debugger%2Fcommon.php;h=d6e43fe017eb236d26fe631513ca0f3300bd208b;hb=526b0d2257ba1faa0cfcbdb0515d4f395f22ce2c;hp=ea389a65aeee675be6ec2cb571395960aabb5f1c;hpb=83bdd39e6807587c07a979b8b7a008322f639710;p=plcapi.git

diff --git a/debugger/common.php b/debugger/common.php
index ea389a6..d6e43fe 100644
--- a/debugger/common.php
+++ b/debugger/common.php
@@ -1,17 +1,55 @@
 <?php
 /**
  * @author Gaetano Giunta
- * @copyright (C) 2005-2015 G. Giunta
+ * @copyright (C) 2005-2021 G. Giunta
  * @license code licensed under the BSD License: see file license.txt
  *
  * Parses GET/POST variables
  *
  * @todo switch params for http compression from 0,1,2 to values to be used directly
  * @todo do some more sanitization of received parameters
+ * @todo move parameters away from global namespace
  */
 
+// handle class autoloading:
+if (file_exists(__DIR__.'/../vendor/autoload.php')) {
+    // if the debugger is installed as top-level project with Composer, allow finding classes from dependencies
+    include_once(__DIR__.'/../vendor/autoload.php');
+} else {
+    // assume this is either a standalone install, or installed as Composer dependency
+    /// @todo if the latter is true, should we just not skip using the custom Autoloader, and let a top-level
+    ///       debugger include this one, taking care of autoloading ?
+    include_once __DIR__ . "/../src/Autoloader.php";
+    PhpXmlRpc\Autoloader::register();
+}
+
+// work around register globals - @see https://www.php.net/manual/en/faq.misc.php#faq.misc.registerglobals
+if (ini_get('register_globals')) {
+    function unregister_globals()
+    {
+        // Might want to change this perhaps to a nicer error
+        if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS'])) {
+            die('GLOBALS overwrite attempt detected');
+        }
+
+        // Variables that shouldn't be unset
+        $noUnset = array('GLOBALS',  '_GET', '_POST', '_COOKIE', '_REQUEST', '_SERVER', '_ENV', '_FILES');
+
+        $input = array_merge($_GET, $_POST, $_COOKIE, $_SERVER, $_ENV, $_FILES,
+            isset($_SESSION) && is_array($_SESSION) ? $_SESSION : array()
+        );
+
+        foreach ($input as $k => $v) {
+            if (!in_array($k, $noUnset) && isset($GLOBALS[$k])) {
+                unset($GLOBALS[$k]);
+            }
+        }
+    }
+    unregister_globals();
+}
+
 // work around magic quotes
-if (get_magic_quotes_gpc()) {
+if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
     function stripslashes_deep($value)
     {
         $value = is_array($value) ?
@@ -28,15 +66,17 @@ $preferredEncodings = 'UTF-8, ASCII, ISO-8859-1, UTF-7, EUC-JP, SJIS, eucJP-win,
 $inputcharset = mb_detect_encoding(urldecode($_SERVER['REQUEST_URI']), $preferredEncodings);
 if (isset($_GET['usepost']) && $_GET['usepost'] === 'true') {
     $_GET = $_POST;
-    /// @bug this is not a perfect detection method - it will fail if eg. a latin1 character is in the method name
-    $inputcharset = mb_detect_encoding(urldecode(isset($_GET['methodpayload'])) ? $_GET['methodpayload'] : '', $preferredEncodings);
+    $inputcharset = mb_detect_encoding(implode('', $_GET), $preferredEncodings);
 }
 
+/// @todo if $inputcharset is not UTF8, we should probably re-encode $_GET to make it UTF-8
+
 // recover input parameters
+/// @todo instead of using globals, move them to an array. Also: use a class for this parsing...
 $debug = false;
 $protocol = 0;
 $run = false;
-$wstype = 0;
+$wstype = defined('DEFAULT_WSTYPE') ? DEFAULT_WSTYPE : 0;
 $id = '';
 if (isset($_GET['action'])) {
     if (isset($_GET['wstype']) && $_GET['wstype'] == '1') {