<?php

/*

 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between

 * Version 1.1.1

 * Copyright (C) 2006-2007 Dan Fuhry

 * install.php - handles everything related to installation and initial configuration

 *

 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

 */

@include('config.php');

if( ( defined('ENANO_INSTALLED') || defined('MIDGET_INSTALLED') ) && ((isset($_GET['mode']) && ($_GET['mode']!='finish' && $_GET['mode']!='css') && $_GET['mode']!='showlicense') || !isset($_GET['mode'])))

{

  $_GET['title'] = 'Enano:Installation_locked';

  require('includes/common.php');

  die_friendly('Installation locked', '<p>The Enano installer has found a Enano installation in this directory. You MUST delete config.php if you want to re-install Enano.</p><p>If you wish to upgrade an older Enano installation to this version, please use the <a href="upgrade.php">upgrade script</a>.</p>');

  exit;

}

define('IN_ENANO_INSTALL', 'true');

define('ENANO_VERSION', '1.1.1');

define('ENANO_CODE_NAME', 'Germination');

// In beta versions, define ENANO_BETA_VERSION here

// This is required to make installation work right

define("ENANO_ALLOW_LOAD_NOLANG", 1);

if(!defined('scriptPath')) {

  $sp = dirname($_SERVER['REQUEST_URI']);

  if($sp == '/' || $sp == '\\') $sp = '';

  define('scriptPath', $sp);

}

if(!defined('contentPath')) {

  $sp = dirname($_SERVER['REQUEST_URI']);

  if($sp == '/' || $sp == '\\') $sp = '';

  define('contentPath', $sp);

}

global $_starttime, $this_page, $sideinfo;

$_starttime = microtime(true);

global $db;

// Determine directory (special case for development servers)

if ( strpos(__FILE__, '/repo/') && file_exists('.enanodev') )

{

  $filename = str_replace('/repo/', '/', __FILE__);

}

else

{

  $filename = __FILE__;

}

define('ENANO_ROOT', dirname($filename));

function is_page($p)

{

  return true;

}

require('includes/wikiformat.php');

require('includes/constants.php');

require('includes/rijndael.php');

require('includes/functions.php');

require('includes/dbal.php');

require('includes/lang.php');

require('includes/json.php');

strip_magic_quotes_gpc();

//

// INSTALLER LIBRARY

//

$neutral_color = 'C';

function run_installer_stage($stage_id, $stage_name, $function, $failure_explanation, $allow_skip = true)

{

  static $resumed = false;

  static $resume_stack = array();

  if ( empty($resume_stack) && isset($_POST['resume_stack']) && preg_match('/[a-z_]+((\|[a-z_]+)+)/', $_POST['resume_stack']) )

  {

    $resume_stack = explode('|', $_POST['resume_stack']);

  }

  $already_run = false;

  if ( in_array($stage_id, $resume_stack) )

  {

    $already_run = true;

  }

  if ( !$resumed )

  {

    if ( !isset($_GET['stage']) )

      $resumed = true;

    if ( isset($_GET['stage']) && $_GET['stage'] == $stage_id )

    {

      $resumed = true;

    }

  }

  if ( !$resumed && $allow_skip )

  {

    echo_stage_success($stage_id, $stage_name);

    return false;

  }

  if ( !function_exists($function) )

    die('libenanoinstall: CRITICAL: function "' . $function . '" for ' . $stage_id . ' doesn\'t exist');

  $result = @call_user_func($function, false, $already_run);

  if ( $result )

  {

    echo_stage_success($stage_id, $stage_name);

    $resume_stack[] = $stage_id;

    return true;

  }

  else

  {

    echo_stage_failure($stage_id, $stage_name, $failure_explanation, $resume_stack);

    return false;

  }

}

function start_install_table()

{

  echo '<table border="0" cellspacing="0" cellpadding="0" style="margin-top: 10px;">' . "\n";

  ob_start();

}

function close_install_table()

{

  echo '</table>' . "\n\n";

  ob_end_flush();

}

function echo_stage_success($stage_id, $stage_name)

{

  global $neutral_color;

  $neutral_color = ( $neutral_color == 'A' ) ? 'C' : 'A';

  echo '<tr><td style="width: 500px; background-color: #' . "{$neutral_color}{$neutral_color}FF{$neutral_color}{$neutral_color}" . '; padding: 0 5px;">' . htmlspecialchars($stage_name) . '</td><td style="padding: 0 5px;"><img alt="Done" src="images/good.gif" /></td></tr>' . "\n";

  ob_flush();

}

function echo_stage_failure($stage_id, $stage_name, $failure_explanation, $resume_stack)

{

  global $neutral_color;

  global $lang;

  $neutral_color = ( $neutral_color == 'A' ) ? 'C' : 'A';

  echo '<tr><td style="width: 500px; background-color: #' . "FF{$neutral_color}{$neutral_color}{$neutral_color}{$neutral_color}" . '; padding: 0 5px;">' . htmlspecialchars($stage_name) . '</td><td style="padding: 0 5px;"><img alt="Failed" src="images/bad.gif" /></td></tr>' . "\n";

  ob_flush();

  close_install_table();

  $post_data = '';

  $mysql_error = mysql_error();

  foreach ( $_POST as $key => $value )

  {

    // FIXME: These should really also be sanitized for double quotes

    $value = htmlspecialchars($value);

    $key = htmlspecialchars($key);

    $post_data .= "          <input type=\"hidden\" name=\"$key\" value=\"$value\" />\n";

  }

  echo '<form action="install.php?mode=install&amp;stage=' . $stage_id . '" method="post">

          ' . $post_data . '

          <input type="hidden" name="resume_stack" value="' . htmlspecialchars(implode('|', $resume_stack)) . '" />

          <h3>' . $lang->get('meta_msg_err_stagefailed_title') . '</h3>

           <p>' . $failure_explanation . '</p>

           ' . ( !empty($mysql_error) ? "<p>" . $lang->get('meta_msg_err_stagefailed_mysqlerror') . " $mysql_error</p>" : '' ) . '

           <p>' . $lang->get('meta_msg_err_stagefailed_body') . '</p>

           <p style="text-align: center;"><input type="submit" value="' . $lang->get('meta_btn_retry_installation') . '" /></p>

        </form>';

  global $template, $template_bak;

  if ( is_object($template_bak) )

    $template_bak->footer();

  else

    $template->footer();

  exit;

}

//

// INSTALLER STAGES

//

function stg_mysql_connect($act_get = false)

{

  global $db;

  $db = new mysql();

  static $conn = false;

  if ( $act_get )

    return $conn;

  $db_user =& $_POST['db_user'];

  $db_pass =& $_POST['db_pass'];

  $db_name =& $_POST['db_name'];

  if ( !preg_match('/^[a-z0-9_-]+$/', $db_name) )

  {

    $db_name = htmlspecialchars($db_name);

    die("<p>SECURITY: malformed database name \"$db_name\"</p>");

  }

  // First, try to connect using the normal credentials

  $conn = @mysql_connect($_POST['db_host'], $_POST['db_user'], $_POST['db_pass']);

  if ( !$conn )

  {

    // Connection failed. Do we have the root username and password?

    if ( !empty($_POST['db_root_user']) && !empty($_POST['db_root_pass']) )

    {

      $conn_root = @mysql_connect($_POST['db_host'], $_POST['db_root_user'], $_POST['db_root_pass']);

      if ( !$conn_root )

      {

        // Couldn't connect using either set of credentials. Bail out.

        return false;

      }

      unset($db_user, $db_pass);

      $db_user = mysql_real_escape_string($_POST['db_user']);

      $db_pass = mysql_real_escape_string($_POST['db_pass']);

      // Create the user account

      $q = @mysql_query("GRANT ALL PRIVILEGES ON test.* TO '{$db_user}'@'localhost' IDENTIFIED BY '$db_pass' WITH GRANT OPTION;", $conn_root);

      if ( !$q )

      {

        return false;

      }

      // Revoke privileges from test, we don't need them

      $q = @mysql_query("REVOKE ALL PRIVILEGES ON test.* FROM '{$db_user}'@'localhost';", $conn_root);

      if ( !$q )

      {

        return false;

      }

      if ( $_POST['db_host'] != 'localhost' && $_POST['db_host'] != '127.0.0.1' && $_POST['db_host'] != '::1' )

      {

        // If not connecting to a server running on localhost, allow from any host

        // this is safer than trying to detect the hostname of the webserver, but less secure

        $q = @mysql_query("GRANT ALL PRIVILEGES ON test.* TO '{$db_user}'@'%' IDENTIFIED BY '$db_pass' WITH GRANT OPTION;", $conn_root);

        if ( !$q )

        {

          return false;

        }

        // Revoke privileges from test, we don't need them

        $q = @mysql_query("REVOKE ALL PRIVILEGES ON test.* FROM '{$db_user}'@'%';", $conn_root);

        if ( !$q )

        {

          return false;

        }

      }

      mysql_close($conn_root);

      $conn = @mysql_connect($_POST['db_host'], $_POST['db_user'], $_POST['db_pass']);

      if ( !$conn )

      {

        // This should honestly never happen.

        return false;

      }

    }

  }

  $q = @mysql_query("USE `$db_name`;", $conn);

  if ( !$q )

  {

    // access denied to the database; try the whole root schenanegan again

    if ( !empty($_POST['db_root_user']) && !empty($_POST['db_root_pass']) )

    {

      $conn_root = @mysql_connect($_POST['db_host'], $_POST['db_root_user'], $_POST['db_root_pass']);

      if ( !$conn_root )

      {

        // Couldn't connect as root; bail out

        return false;

      }

      // create the database, if it doesn't exist

      $q = @mysql_query("CREATE DATABASE IF NOT EXISTS `$db_name`;", $conn_root);

      if ( !$q )

      {

        // this really should never fail, so don't give any tolerance to it

        return false;

      }

      unset($db_user, $db_pass);

      $db_user = mysql_real_escape_string($_POST['db_user']);

      $db_pass = mysql_real_escape_string($_POST['db_pass']);

      // we're in with root rights; grant access to the database

      $q = @mysql_query("GRANT ALL PRIVILEGES ON `$db_name`.* TO '{$db_user}'@'localhost';", $conn_root);

      if ( !$q )

      {

        return false;

      }

      if ( $_POST['db_host'] != 'localhost' && $_POST['db_host'] != '127.0.0.1' && $_POST['db_host'] != '::1' )

      {

        $q = @mysql_query("GRANT ALL PRIVILEGES ON `$db_name`.* TO '{$db_user}'@'%';", $conn_root);

        if ( !$q )

        {

          return false;

        }

      }

      mysql_close($conn_root);

      // grant tables have hopefully been flushed, kill and reconnect our regular user connection

      mysql_close($conn);

      $conn = @mysql_connect($_POST['db_host'], $_POST['db_user'], $_POST['db_pass']);

      if ( !$conn )

      {

        return false;

      }

    }

    else

    {

      return false;

    }

    // try again

    $q = @mysql_query("USE `$db_name`;", $conn);

    if ( !$q )

    {

      // really failed this time; bail out

      return false;

    }

  }

  // initialize DBAL

  $db->connect(true, $_POST['db_host'], $db_user, $db_pass, $db_name);

  // connected and database exists

  return true;

}

function stg_pgsql_connect($act_get = false)

{

  global $db;

  $db = new postgresql();

  static $conn = false;

  if ( $act_get )

    return $conn;

  $db_user =& $_POST['db_user'];

  $db_pass =& $_POST['db_pass'];

  $db_name =& $_POST['db_name'];

  if ( !preg_match('/^[a-z0-9_-]+$/', $db_name) )

  {

    $db_name = htmlspecialchars($db_name);

    die("<p>SECURITY: malformed database name \"$db_name\"</p>");

  }

  // First, try to connect using the normal credentials

  $conn = @pg_connect("host={$_POST['db_host']} port=5432 user={$_POST['db_user']} password={$_POST['db_pass']}");

  if ( !$conn )

  {

    // Connection failed. Do we have the root username and password?

    if ( !empty($_POST['db_root_user']) && !empty($_POST['db_root_pass']) )

    {

      $conn_root = @pg_connect("host={$_POST['db_host']} port=5432 user={$_POST['db_root_user']} password={$_POST['db_root_pass']}");

      if ( !$conn_root )

      {

        // Couldn't connect using either set of credentials. Bail out.

        return false;

      }

      unset($db_user, $db_pass);

      $db_user = pg_escape_string($_POST['db_user']);

      $db_pass = pg_escape_string($_POST['db_pass']);

      // Create the user account

      $q = @pg_query("CREATE ROLE '$db_user' WITH NOSUPERUSER UNENCRYPTED PASSWORD '$db_pass';", $conn_root);

      if ( !$q )

      {

        return false;

      }

      pg_close($conn_root);

      $conn = @pg_connect("host={$_POST['db_host']} port=5432 user={$_POST['db_user']} password={$_POST['db_pass']}");

      if ( !$conn )

      {

        // This should honestly never happen.

        return false;

      }

    }

  }

  if ( !$q )

  {

    // access denied to the database; try the whole root schenanegan again

    if ( !empty($_POST['db_root_user']) && !empty($_POST['db_root_pass']) )

    {

      $conn_root = @pg_connect("host={$_POST['db_host']} port=5432 user={$_POST['db_root_user']} password={$_POST['db_root_pass']}");

      if ( !$conn_root )

      {

        // Couldn't connect as root; bail out

        return false;

      }

      unset($db_user, $db_pass);

      $db_user = pg_escape_string($_POST['db_user']);

      $db_pass = pg_escape_string($_POST['db_pass']);

      // create the database, if it doesn't exist

      $q = @mysql_query("CREATE DATABASE $db_name WITH OWNER $db_user;", $conn_root);

      if ( !$q )

      {

        // this really should never fail, so don't give any tolerance to it

        return false;

      }

      // Setting the owner to $db_user should grant all the rights we need

      pg_close($conn_root);

      // grant tables have hopefully been flushed, kill and reconnect our regular user connection

      pg_close($conn);

      $conn = @pg_connect("host={$_POST['db_host']} port=5432 user={$_POST['db_user']} password={$_POST['db_pass']}");

      if ( !$conn )

      {

        return false;

      }

    }

    else

    {

      return false;

    }

    // try again

    $q = @mysql_query("USE `$db_name`;", $conn);

    if ( !$q )

    {

      // really failed this time; bail out

      return false;

    }

  }

  // initialize DBAL

  $db->connect(true, $_POST['db_host'], $db_user, $db_pass, $db_name);

  // connected and database exists

  return true;

}

function stg_drop_tables()

{

  global $db;

  // Our list of tables included in Enano

  $tables = Array( 'categories', 'comments', 'config', 'logs', 'page_text', 'session_keys', 'pages', 'users', 'users_extra', 'themes', 'buddies', 'banlist', 'files', 'privmsgs', 'sidebar', 'hits', 'search_index', 'groups', 'group_members', 'acl', 'tags', 'page_groups', 'page_group_members' );

  // Drop each table individually; if it fails, it probably means we're trying to drop a

  // table that didn't exist in the Enano version we're deleting the database for.

  foreach ( $tables as $table )

  {

    // Remember that table_prefix is sanitized.

    $table = "{$_POST['table_prefix']}$table";

    $db->sql_query("DROP TABLE $table;", $conn);

  }

  return true;

}

function stg_decrypt_admin_pass($act_get = false)

{

  static $decrypted_pass = false;

  if ( $act_get )

    return $decrypted_pass;

  $aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);

  if ( !empty($_POST['crypt_data']) )

  {

    require('config.new.php');

    if ( !isset($cryptkey) )

    {

      return false;

    }

    define('_INSTRESUME_AES_KEYBACKUP', $key);

    $key = hexdecode($cryptkey);

    $decrypted_pass = $aes->decrypt($_POST['crypt_data'], $key, ENC_HEX);

  }

  else

  {

    $decrypted_pass = $_POST['admin_pass'];

  }

  if ( empty($decrypted_pass) )

    return false;

  return true;

}

function stg_generate_aes_key($act_get = false)

{

  static $key = false;

  if ( $act_get )