Si vous constatez la perte de tickets, de commentaires ou de projets, veuillez consulter la page https://status.framasoft.org/incident/626.

Commit 75752833 authored by Thomas Citharel's avatar Thomas Citharel 🌲

Up-to-date project

* Remove bundled Fat-Free, use composer version instead and update
Fat-Free version
* Remove no-longer existent F3-Falsum
* Handle errors properly
Signed-off-by: Thomas Citharel's avatarThomas Citharel <tcit@tcit.fr>
parent 99c51ee8
vendor
tmp
app/config/config.ini
sites/*
\ No newline at end of file
......@@ -15,7 +15,7 @@ class Controller
//on viens récuperer les info a partir du info.json
$siteConfigPath = $this->f3->get('SitesFolder') . $this->siteName . '/config.json';
if (!file_exists($siteConfigPath)) {
$this->f3->error(404);
$this->f3->error(404, "Erreur 404: Site non trouvé");
}
$siteConfig = json_decode(
file_get_contents($siteConfigPath),
......
<!DOCTYPE html>
<html lang="fr">
<include href="./base/includes/head.htm" />
<body>
{* ajout des boutons supérieurs si l'utilisateur est connecté en tant qu'admin*}
<include if="{{ @isAdmin }}" href="./base/includes/adminButtons.htm" />
<include href="./base/nav/nav.htm" />
<div class="row" style="min-height: 100vh; padding-top: 50px;">
<h3 class="center-align">{{ @ERROR_TITLE }}</h3>
<a href="/" class="center-align"><h5>Retour à la page d'accueil</h5></a>
<div class="row" style="margin-top: 50px !important;">
<div class="col s12 m6 offset-m3 l4 offset-l4">
<p>{{ @ERROR_DESC }}</p>
<pre>{{ @ERROR.text }}</pre>
<pre>{{ @ERROR.trace }}</pre>
</div>
</div>
</div>
<include href="./base/footer/footer.htm" />
<!-- Scripts-->
<include href="./base/includes/scripts.htm" />
</body>
</html>
\ No newline at end of file
{
"name": "robinc/prettynoemiecms",
"description": "A powerful yet easy-to-use PHP micro-framework designed to help you build dynamic and robust Web applications - fast!",
"homepage": "http://fatfreeframework.com/",
"description": "CMS offrant à ses utilisateurs une solution ergonomique, simple et élégante pour construire en un rien de temps des sites vitrines responsives au design moderne.",
"homepage": "https://frama.site",
"license": "GPL-3.0",
"require": {
"php": ">=5.4",
"rafamds/f3-falsum": "^2.6",
"ezyang/htmlpurifier":"^4.9"
"ezyang/htmlpurifier":"^4.9",
"bcosca/fatfree": "^3.6"
},
"repositories": [
{
"type": "vcs",
"url": "https://github.com/bcosca/fatfree"
"url": "https://framagit.org/framasoft/PrettyNoemieCMS"
}
],
"autoload": {
"files": ["lib/base.php"]
}
]
}
{
"_readme": [
"This file locks the dependencies of your project to a known state",
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file",
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
"This file is @generated automatically"
],
"hash": "6f4fde07fe878891a289d1a9e05ed979",
"content-hash": "1ef912308340cf7a67df0cc8eeeb02d2",
"content-hash": "46a55517ef87474f25ec4c3b6e1a3eb1",
"packages": [
{
"name": "ezyang/htmlpurifier",
"version": "v4.9.3",
"name": "bcosca/fatfree",
"version": "3.6.4",
"source": {
"type": "git",
"url": "https://github.com/ezyang/htmlpurifier.git",
"reference": "95e1bae3182efc0f3422896a3236e991049dac69"
"url": "https://github.com/bcosca/fatfree.git",
"reference": "dee4d73918a42076d5ac7db64d6d39706c7f328a"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/ezyang/htmlpurifier/zipball/95e1bae3182efc0f3422896a3236e991049dac69",
"reference": "95e1bae3182efc0f3422896a3236e991049dac69",
"url": "https://api.github.com/repos/bcosca/fatfree/zipball/dee4d73918a42076d5ac7db64d6d39706c7f328a",
"reference": "dee4d73918a42076d5ac7db64d6d39706c7f328a",
"shasum": ""
},
"require": {
"php": ">=5.2"
},
"require-dev": {
"simpletest/simpletest": "^1.1"
"php": ">=5.4"
},
"type": "library",
"autoload": {
"psr-0": {
"HTMLPurifier": "library/"
},
"files": [
"library/HTMLPurifier.composer.php"
"lib/base.php"
]
},
"notification-url": "https://packagist.org/downloads/",
"license": [
"LGPL"
],
"authors": [
{
"name": "Edward Z. Yang",
"email": "admin@htmlpurifier.org",
"homepage": "http://ezyang.com"
}
],
"description": "Standards compliant HTML filter written in PHP",
"homepage": "http://htmlpurifier.org/",
"keywords": [
"html"
"GPL-3.0"
],
"time": "2017-06-03 02:28:16"
"description": "A powerful yet easy-to-use PHP micro-framework designed to help you build dynamic and robust Web applications - fast!",
"homepage": "http://fatfreeframework.com/",
"support": {
"source": "https://github.com/bcosca/fatfree/tree/3.6.4",
"issues": "https://github.com/bcosca/fatfree/issues"
},
"time": "2018-04-19T17:23:25+00:00"
},
{
"name": "rafamds/f3-falsum",
"version": "v2.6",
"name": "ezyang/htmlpurifier",
"version": "v4.10.0",
"source": {
"type": "git",
"url": "https://github.com/rafamds/f3-falsum.git",
"reference": "630b749fd0d436340a87eaeeea86f8644ab8f4de"
"url": "https://github.com/ezyang/htmlpurifier.git",
"reference": "d85d39da4576a6934b72480be6978fb10c860021"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/rafamds/f3-falsum/zipball/630b749fd0d436340a87eaeeea86f8644ab8f4de",
"reference": "630b749fd0d436340a87eaeeea86f8644ab8f4de",
"url": "https://api.github.com/repos/ezyang/htmlpurifier/zipball/d85d39da4576a6934b72480be6978fb10c860021",
"reference": "d85d39da4576a6934b72480be6978fb10c860021",
"shasum": ""
},
"require": {
"php": ">=5.5.9"
"php": ">=5.2"
},
"suggest": {
"symfony/var-dumper": "Pretty print complex values better with var-dumper available"
"require-dev": {
"simpletest/simpletest": "^1.1"
},
"type": "library",
"autoload": {
"psr-4": {
"Falsum\\": "src/Falsum/"
}
"psr-0": {
"HTMLPurifier": "library/"
},
"files": [
"library/HTMLPurifier.composer.php"
]
},
"notification-url": "https://packagist.org/downloads/",
"license": [
"MIT"
"LGPL"
],
"authors": [
{
"name": "Rafael Morais dos Santos",
"homepage": "https://ra.fael.ml",
"role": "Developer"
"name": "Edward Z. Yang",
"email": "admin@htmlpurifier.org",
"homepage": "http://ezyang.com"
}
],
"description": "Pretty error handling for Fat-Free Framework",
"homepage": "https://github.com/rooftoprafa/f3-falsum",
"description": "Standards compliant HTML filter written in PHP",
"homepage": "http://htmlpurifier.org/",
"keywords": [
"F3",
"error",
"exception",
"falsum",
"fat-free framework",
"handling",
"library"
"html"
],
"time": "2017-01-30 13:35:08"
"time": "2018-02-23T01:58:20+00:00"
}
],
"packages-dev": [],
......
......@@ -2,8 +2,24 @@
require_once("vendor/autoload.php");
// Kickstart the framework
$f3 = Base::instance();
//debugger
Falsum\Run::handler();
$f3->set('ONERROR', function($f3) {
$error = $f3->get('ERROR');
switch($error["code"]) {
case 404:
$f3->set('ERROR_TITLE', "Page non trouvée");
$f3->set('ERROR_DESC', "Hélas, la page que vous cherchez n'a pas été trouvée. Voici les détails techniques que vous pouvez transmettre afin de chercher à corriger le problème.");
echo (new Template())->render('errors/error.htm');
break;
case 500:
default:
$f3->set('ERROR_TITLE', "Quelque chose s'est mal passé");
$f3->set('ERROR_DESC', "Pas de panique, les informations ci-dessous devraient donner plus de détails pour aider à corriger le problème.");
echo (new Template())->render('errors/error.htm');
break;
}
});
// Load configuration
$f3->config('app/config/config.ini');
// Define routes
......
This diff is collapsed.
This diff is collapsed.
<?php
/*
Copyright (c) 2009-2017 F3::Factory/Bong Cosca, All rights reserved.
This file is part of the Fat-Free Framework (http://fatfreeframework.com).
This is free software: you can redistribute it and/or modify it under the
terms of the GNU General Public License as published by the Free Software
Foundation, either version 3 of the License, or later.
Fat-Free Framework is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
You should have received a copy of the GNU General Public License along
with Fat-Free Framework. If not, see <http://www.gnu.org/licenses/>.
*/
//! Data validator
class Audit extends Prefab {
//@{ User agents
const
UA_Mobile='android|blackberry|phone|ipod|palm|windows\s+ce',
UA_Desktop='bsd|linux|os\s+[x9]|solaris|windows',
UA_Bot='bot|crawl|slurp|spider';
//@}
/**
* Return TRUE if string is a valid URL
* @return bool
* @param $str string
**/
function url($str) {
return is_string(filter_var($str,FILTER_VALIDATE_URL));
}
/**
* Return TRUE if string is a valid e-mail address;
* Check DNS MX records if specified
* @return bool
* @param $str string
* @param $mx boolean
**/
function email($str,$mx=TRUE) {
$hosts=[];
return is_string(filter_var($str,FILTER_VALIDATE_EMAIL)) &&
(!$mx || getmxrr(substr($str,strrpos($str,'@')+1),$hosts));
}
/**
* Return TRUE if string is a valid IPV4 address
* @return bool
* @param $addr string
**/
function ipv4($addr) {
return (bool)filter_var($addr,FILTER_VALIDATE_IP,FILTER_FLAG_IPV4);
}
/**
* Return TRUE if string is a valid IPV6 address
* @return bool
* @param $addr string
**/
function ipv6($addr) {
return (bool)filter_var($addr,FILTER_VALIDATE_IP,FILTER_FLAG_IPV6);
}
/**
* Return TRUE if IP address is within private range
* @return bool
* @param $addr string
**/
function isprivate($addr) {
return !(bool)filter_var($addr,FILTER_VALIDATE_IP,
FILTER_FLAG_IPV4|FILTER_FLAG_IPV6|FILTER_FLAG_NO_PRIV_RANGE);
}
/**
* Return TRUE if IP address is within reserved range
* @return bool
* @param $addr string
**/
function isreserved($addr) {
return !(bool)filter_var($addr,FILTER_VALIDATE_IP,
FILTER_FLAG_IPV4|FILTER_FLAG_IPV6|FILTER_FLAG_NO_RES_RANGE);
}
/**
* Return TRUE if IP address is neither private nor reserved
* @return bool
* @param $addr string
**/
function ispublic($addr) {
return (bool)filter_var($addr,FILTER_VALIDATE_IP,
FILTER_FLAG_IPV4|FILTER_FLAG_IPV6|
FILTER_FLAG_NO_PRIV_RANGE|FILTER_FLAG_NO_RES_RANGE);
}
/**
* Return TRUE if user agent is a desktop browser
* @return bool
* @param $agent string
**/
function isdesktop($agent=NULL) {
if (!isset($agent))
$agent=Base::instance()->AGENT;
return (bool)preg_match('/('.self::UA_Desktop.')/i',$agent) &&
!$this->ismobile($agent);
}
/**
* Return TRUE if user agent is a mobile device
* @return bool
* @param $agent string
**/
function ismobile($agent=NULL) {
if (!isset($agent))
$agent=Base::instance()->AGENT;
return (bool)preg_match('/('.self::UA_Mobile.')/i',$agent);
}
/**
* Return TRUE if user agent is a Web bot
* @return bool
* @param $agent string
**/
function isbot($agent=NULL) {
if (!isset($agent))
$agent=Base::instance()->AGENT;
return (bool)preg_match('/('.self::UA_Bot.')/i',$agent);
}
/**
* Return TRUE if specified ID has a valid (Luhn) Mod-10 check digit
* @return bool
* @param $id string
**/
function mod10($id) {
if (!ctype_digit($id))
return FALSE;
$id=strrev($id);
$sum=0;
for ($i=0,$l=strlen($id);$i<$l;$i++)
$sum+=$id[$i]+$i%2*(($id[$i]>4)*-4+$id[$i]%5);
return !($sum%10);
}
/**
* Return credit card type if number is valid
* @return string|FALSE
* @param $id string
**/
function card($id) {
$id=preg_replace('/[^\d]/','',$id);
if ($this->mod10($id)) {
if (preg_match('/^3[47][0-9]{13}$/',$id))
return 'American Express';
if (preg_match('/^3(?:0[0-5]|[68][0-9])[0-9]{11}$/',$id))
return 'Diners Club';
if (preg_match('/^6(?:011|5[0-9][0-9])[0-9]{12}$/',$id))
return 'Discover';
if (preg_match('/^(?:2131|1800|35\d{3})\d{11}$/',$id))
return 'JCB';
if (preg_match('/^5[1-5][0-9]{14}$|'.
'^(222[1-9]|2[3-6]\d{2}|27[0-1]\d|2720)\d{12}$/',$id))
return 'MasterCard';
if (preg_match('/^4[0-9]{12}(?:[0-9]{3})?$/',$id))
return 'Visa';
}
return FALSE;
}
/**
* Return entropy estimate of a password (NIST 800-63)
* @return int|float
* @param $str string
**/
function entropy($str) {
$len=strlen($str);
return 4*min($len,1)+($len>1?(2*(min($len,8)-1)):0)+
($len>8?(1.5*(min($len,20)-8)):0)+($len>20?($len-20):0)+
6*(bool)(preg_match(
'/[A-Z].*?[0-9[:punct:]]|[0-9[:punct:]].*?[A-Z]/',$str));
}
}
<?php
/*
Copyright (c) 2009-2017 F3::Factory/Bong Cosca, All rights reserved.
This file is part of the Fat-Free Framework (http://fatfreeframework.com).
This is free software: you can redistribute it and/or modify it under the
terms of the GNU General Public License as published by the Free Software
Foundation, either version 3 of the License, or later.
Fat-Free Framework is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
You should have received a copy of the GNU General Public License along
with Fat-Free Framework. If not, see <http://www.gnu.org/licenses/>.
*/
//! Authorization/authentication plug-in
class Auth {
//@{ Error messages
const
E_LDAP='LDAP connection failure',
E_SMTP='SMTP connection failure';
//@}
protected
//! Auth storage
$storage,
//! Mapper object
$mapper,
//! Storage options
$args;
/**
* Jig storage handler
* @return bool
* @param $id string
* @param $pw string
* @param $realm string
**/
protected function _jig($id,$pw,$realm) {
return (bool)
call_user_func_array(
[$this->mapper,'load'],
[
array_merge(
[
'@'.$this->args['id'].'==? AND '.
'@'.$this->args['pw'].'==?'.
(isset($this->args['realm'])?
(' AND @'.$this->args['realm'].'==?'):''),
$id,$pw
],
(isset($this->args['realm'])?[$realm]:[])
)
]
);
}
/**
* MongoDB storage handler
* @return bool
* @param $id string
* @param $pw string
* @param $realm string
**/
protected function _mongo($id,$pw,$realm) {
return (bool)
$this->mapper->load(
[
$this->args['id']=>$id,
$this->args['pw']=>$pw
]+
(isset($this->args['realm'])?
[$this->args['realm']=>$realm]:[])
);
}
/**
* SQL storage handler
* @return bool
* @param $id string
* @param $pw string
* @param $realm string
**/
protected function _sql($id,$pw,$realm) {
return (bool)
call_user_func_array(
[$this->mapper,'load'],
[
array_merge(
[
$this->args['id'].'=? AND '.
$this->args['pw'].'=?'.
(isset($this->args['realm'])?
(' AND '.$this->args['realm'].'=?'):''),
$id,$pw
],
(isset($this->args['realm'])?[$realm]:[])
)
]
);
}
/**
* LDAP storage handler
* @return bool
* @param $id string
* @param $pw string
**/
protected function _ldap($id,$pw) {
$port=(int)($this->args['port']?:389);
$filter=$this->args['filter']=$this->args['filter']?:"uid=".$id;
$this->args['attr']=$this->args['attr']?:["uid"];
array_walk($this->args['attr'],
function($attr)use(&$filter,$id) {
$filter=str_ireplace($attr."=*",$attr."=".$id,$filter);});
$dc=@ldap_connect($this->args['dc'],$port);
if ($dc &&
ldap_set_option($dc,LDAP_OPT_PROTOCOL_VERSION,3) &&
ldap_set_option($dc,LDAP_OPT_REFERRALS,0) &&
ldap_bind($dc,$this->args['rdn'],$this->args['pw']) &&
($result=ldap_search($dc,$this->args['base_dn'],
$filter,$this->args['attr'])) &&
ldap_count_entries($dc,$result) &&
($info=ldap_get_entries($dc,$result)) &&
$info['count']==1 &&
@ldap_bind($dc,$info[0]['dn'],$pw) &&
@ldap_close($dc)) {
return in_array($id,(array_map(function($value){return $value[0];},
array_intersect_key($info[0],
array_flip($this->args['attr'])))),TRUE);
}
user_error(self::E_LDAP,E_USER_ERROR);
}
/**
* SMTP storage handler
* @return bool
* @param $id string
* @param $pw string
**/
protected function _smtp($id,$pw) {
$socket=@fsockopen(
(strtolower($this->args['scheme'])=='ssl'?
'ssl://':'').$this->args['host'],
$this->args['port']);
$dialog=function($cmd=NULL) use($socket) {
if (!is_null($cmd))
fputs($socket,$cmd."\r\n");
$reply='';
while (!feof($socket) &&
($info=stream_get_meta_data($socket)) &&
!$info['timed_out'] && $str=fgets($socket,4096)) {
$reply.=$str;
if (preg_match('/(?:^|\n)\d{3} .+\r\n/s',
$reply))
break;
}
return $reply;
};
if ($socket) {
stream_set_blocking($socket,TRUE);
$dialog();
$fw=Base::instance();
$dialog('EHLO '.$fw->HOST);
if (strtolower($this->args['scheme'])=='tls') {
$dialog('STARTTLS');
stream_socket_enable_crypto(
$socket,TRUE,STREAM_CRYPTO_METHOD_TLS_CLIENT);
$dialog('EHLO '.$fw->HOST);
}
// Authenticate
$dialog('AUTH LOGIN');
$dialog(base64_encode($id));
$reply=$dialog(base64_encode($pw));
$dialog('QUIT');
fclose($socket);
return (bool)preg_match('/^235 /',$reply);
}
user_error(self::E_SMTP,E_USER_ERROR);
}
/**
* Login auth mechanism
* @return bool
* @param $id string
* @param $pw string
* @param $realm string
**/
function login($id,$pw,$realm=NULL) {
return $this->{'_'.$this->storage}($id,$pw,$realm);
}
/**
* HTTP basic auth mechanism
* @return bool
* @param $func callback
**/
function basic($func=NULL) {
$fw=Base::instance();
$realm=$fw->REALM;
$hdr=NULL;
if (isset($_SERVER['HTTP_AUTHORIZATION']))
$hdr=$_SERVER['HTTP_AUTHORIZATION'];
elseif (isset($_SERVER['REDIRECT_HTTP_AUTHORIZATION']))
$hdr=$_SERVER['REDIRECT_HTTP_AUTHORIZATION'];
if (!empty($hdr))
list($_SERVER['PHP_AUTH_USER'],$_SERVER['PHP_AUTH_PW'])=
explode(':',base64_decode(substr($hdr,6)));
if (isset($_SERVER['PHP_AUTH_USER'],$_SERVER['PHP_AUTH_PW']) &&
$this->login(
$_SERVER['PHP_AUTH_USER'],
$func?
$fw->call($func,$_SERVER['PHP_AUTH_PW']):
$_SERVER['PHP_AUTH_PW'],
$realm
))
return TRUE;
if (PHP_SAPI!='cli')
header('WWW-Authenticate: Basic realm="'.$realm.'"');
$fw->status(401);
return FALSE;
}
/**
* Instantiate class
* @return object
* @param $storage string|object
* @param $args array
**/
function __construct($storage,array $args=NULL) {
if (is_object