<?php

/*

 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between

 * Copyright (C) 2006-2009 Dan Fuhry

 *

 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

 */

function db_error_handler($errno, $errstr, $errfile = false, $errline = false, $errcontext = Array() )

{

  if ( !defined('ENANO_DEBUG') )

    return;

  $e = error_reporting(0);

  error_reporting($e);

  if ( $e < $errno )

    return;

  $errtype = 'Notice';

  switch ( $errno )

  {

    case E_ERROR: case E_USER_ERROR: case E_CORE_ERROR: case E_COMPILE_ERROR: $errtype = 'Error'; break;

    case E_WARNING: case E_USER_WARNING: case E_CORE_WARNING: case E_COMPILE_WARNING: $errtype = 'Warning'; break;

  }

  $debug = debug_backtrace();

  if ( !isset($debug[0]['file']) )

    return false;

  $debug = $debug[0]['file'] . ', line ' . $debug[0]['line'];

  echo "<b>$errtype:</b> $errstr<br />Error source:<pre>$debug</pre>";

}

global $db_sql_parse_time;

$db_sql_parse_time = 0;

class mysql {

  var $num_queries, $query_backtrace, $query_times, $query_sources, $latest_result, $latest_query, $_conn, $sql_stack_fields, $sql_stack_values, $debug;

  var $row = array();

	var $rowset = array();

  var $errhandler;

  var $dbms_name = 'MySQL';

  function sql_backtrace()

  {

    return implode("\n-------------------------------------------------------------------\n", $this->query_backtrace);

  }

  function ensure_connection()

  {

    if(!$this->_conn)

    {

      $this->connect();

    }

  }

    if ( defined('ENANO_HEADERS_SENT') )

      ob_clean();

    exit;

  }

  function die_json($loc = false)

  {

    $q = str_replace("\n", "\\n", addslashes($this->latest_query));

    $loc = ( $loc ) ? addslashes("\n\nDescription or location of error: $loc") : "";

    $loc .= "\n\nPlease report the full text of this error to the administrator of the site. If you believe that this is a bug with the software, please contact support@enanocms.org.";

    $loc = str_replace("\n", "\\n", $loc);

    die($t);

  }

  function connect($manual_credentials = false, $dbhost = false, $dbuser = false, $dbpasswd = false, $dbname = false, $dbport = false)

  {

    if ( !defined('ENANO_SQL_CONSTANTS') )

    {

      define('ENANO_SQL_CONSTANTS', '');

      define('ENANO_DBLAYER', 'MYSQL');

      define('ENANO_SQLFUNC_LOWERCASE', 'lcase');

      define('ENANO_SQL_MULTISTRING_PRFIX', '');

      define('ENANO_SQL_BOOLEAN_TRUE', 'true');

      define('ENANO_SQL_BOOLEAN_FALSE', 'false');

    }

    if ( !$manual_credentials )

    {

      if ( defined('IN_ENANO_INSTALL') && !defined('IN_ENANO_UPGRADE') && !defined('ENANO_INSTALLED') )

      {

        @include(ENANO_ROOT.'/config.new.php');

      }

      else

      {

        @include(ENANO_ROOT.'/config.php');

      }

      if ( isset($crypto_key) )

        unset($crypto_key); // Get this sucker out of memory fast

      if ( empty($dbport) )

        $dbport = 3306;

      if ( !defined('ENANO_INSTALLED') && !defined('MIDGET_INSTALLED') && !defined('IN_ENANO_INSTALL') )

      {

        // scriptPath isn't set yet - we need to autodetect it to avoid infinite redirects

        if ( !defined('scriptPath') )

        {

          if ( isset($_SERVER['PATH_INFO']) && !preg_match('/index\.php$/', $_SERVER['PATH_INFO']) )

          {

            $_SERVER['REQUEST_URI'] = preg_replace(';' . preg_quote($_SERVER['PATH_INFO']) . '$;', '', $_SERVER['REQUEST_URI']);

          }

          if ( !preg_match('/\.php$/', $_SERVER['REQUEST_URI']) )

          {

            // user requested http://foo/enano as opposed to http://foo/enano/index.php

            $_SERVER['REQUEST_URI'] .= '/index.php';

          }

          $sp = dirname($_SERVER['REQUEST_URI']);

          if($sp == '/' || $sp == '\\') $sp = '';

          define('scriptPath', $sp);

          define('contentPath', "$sp/index.php?title=");

        }

        $loc = scriptPath . '/install/index.php';

        define('IN_ENANO_INSTALL', 1);

        $GLOBALS['lang'] = new Language('eng');

        global $lang;

        $lang->load_file('./language/english/core.json');

        $lang->load_file('./language/english/install.json');

        // header("Location: $loc");

        redirect($loc, 'Enano not installed', 'We can\'t seem to find an Enano installation (valid config file). You will be transferred to the installation wizard momentarily...', 0);

        exit;

      }

    }

    if ( !$dbport )

      $dbport = 3306;

    if ( $dbhost && !empty($dbport) && $dbport != 3306 )

      $dbhost = '127.0.0.1';

    $host_line = ( preg_match('/^:/', $dbhost) ) ? $dbhost : "{$dbhost}:{$dbport}";

    $this->_conn = @mysql_connect($host_line, $dbuser, $dbpasswd);

    unset($dbuser);

    unset($dbpasswd); // Security

    if ( !$this->_conn && !$manual_credentials )

    {

      grinding_halt('Enano is having a problem', '<p>Error: couldn\'t connect to MySQL.<br />'.mysql_error().'</p>');

    }

    else if ( !$this->_conn && $manual_credentials )

    {

      return false;

    }

    // Reset some variables

    $this->query_backtrace = array();

    $this->query_times = array();

    $this->query_sources = array();

    $this->num_queries = 0;

    $this->debug = ( defined('ENANO_DEBUG') );

    $q = @mysql_select_db($dbname);

    if ( !$q )

    {

      if ( $manual_credentials )

        return false;

      $this->_die('The database could not be selected.');

    }

    // We're in!

    return true;

  }

  function sql_query($q, $log_query = true)

  {

    if ( $this->debug && function_exists('debug_backtrace') )

    {

      $backtrace = @debug_backtrace();

      if ( is_array($backtrace) )

      {

        $bt = $backtrace[0];

        if ( isset($backtrace[1]['class']) )

        {

          if ( $backtrace[1]['class'] == 'sessionManager' )

          {

            $bt = $backtrace[1];

          }

        }

        $this->query_sources[$q] = substr($bt['file'], strlen(ENANO_ROOT) + 1) . ', line ' . $bt['line'];

      }

      unset($backtrace);

    }

    $this->num_queries++;

    if ( $log_query || defined('ENANO_DEBUG') )

    {

      $this->query_backtrace[] = $q;

      $this->latest_query = $q;

    }

    // First make sure we have a connection

    if ( !$this->_conn )

    {

      $this->_die('A database connection has not yet been established.');

    }

    // Start the timer

    if ( $log_query || defined('ENANO_DEBUG') )

      $time_start = microtime_float();

    // Does this query look malicious?

    if ( $log_query || defined('ENANO_DEBUG') )

    {

      if ( !$this->check_query($q) )

      {

        $this->report_query($q);

        $debug = ( defined('ENANO_DEBUG') ) ? '<p>Query was:</p><pre>'.htmlspecialchars($q).'</pre>' : '';

        grinding_halt('SQL Injection attempt', '<p>Enano has caught and prevented an SQL injection attempt. Your IP address has been recorded and the administrator has been notified.</p>' . $debug);

      }

    }

    $r = mysql_query($q, $this->_conn);

    if ( $log_query )

      $this->query_times[$q] = microtime_float() - $time_start;

    $this->latest_result = $r;

    return $r;

  }

  function sql_unbuffered_query($q, $log_query = true)

  {

    $this->num_queries++;

    if ( $log_query || defined('ENANO_DEBUG') )

      $this->query_backtrace[] = '(UNBUFFERED) ' . $q;

    $this->latest_query = $q;

    // First make sure we have a connection

    if ( !$this->_conn )

    {

      $this->_die('A database connection has not yet been established.');

    }

    // Does this query look malicious?

    if ( !$this->check_query($q) )

    {

      $this->report_query($q);

      $debug = ( defined('ENANO_DEBUG') ) ? '<p>Query was:</p><pre>'.htmlspecialchars($q).'</pre>' : '';

      grinding_halt('SQL Injection attempt', '<p>Enano has caught and prevented an SQL injection attempt. Your IP address has been recorded and the administrator has been notified.</p>' . $debug);

    }

    $time_start = microtime_float();

    $r = @mysql_unbuffered_query($q, $this->_conn);

    $this->query_times[$q] = microtime_float() - $time_start;

    $this->latest_result = $r;

    return $r;

  }

  /**

   * Performs heuristic analysis on a SQL query to check for known attack patterns.

   * @param string $q the query to check

   * @return bool true if query passed check, otherwise false

   */

  function check_query($q, $debug = false)

  {

    global $db_sql_parse_time;

    $ts = microtime_float();

    // remove properly escaped quotes

    $q = str_replace('\\\\', '', $q);

    $q = str_replace(array("\\\"", "\\'"), '', $q);

    // make sure quotes match

    foreach ( array("'", '"') as $quote )

    {

      $n_quotes = get_char_count($q, $quote);

      if ( $n_quotes % 2 == 1 )

      {

        // mismatched quotes

        if ( $debug ) echo "Found mismatched quotes in query; parsed:\n$q\n";

        return false;

      }

      // this quote is now confirmed to be matching; we can safely move all quoted strings out and replace with a token

      $q = preg_replace("/$quote(.*?)$quote/s", 'SAFE_QUOTE', $q);

    }

    $q = preg_replace("/(SAFE_QUOTE)+/", 'SAFE_QUOTE', $q);

    // quotes are now matched out. does this string have a comment marker in it?

    if ( strstr($q, '--') )

    {

      return false;

    }

    if ( preg_match('/[\s]+(SAFE_QUOTE|[\S]+)=\\1($|[\s]+)/', $q, $match) )

    {

      if ( $debug ) echo 'Found always-true test in query, injection attempt caught, match:<br />' . '<pre>' . print_r($match, true) . '</pre>';

      return false;

    }

    $ts = microtime_float() - $ts;

    $db_sql_parse_time += $ts;

    return true;

  }

  /**

   * Set the internal result pointer to X

   * @param int $pos The number of the row

   * @param resource $result The MySQL result resource - if not given, the latest cached query is assumed

   * @return true on success, false on failure

   */

  function sql_data_seek($pos, $result = false)

  {

      $result = $this->latest_result;

      return false;

  }

  /**

   * Reports a bad query to the admin

   * @param string $query the naughty query

   * @access private

   */

  function report_query($query)

  {

    global $session;

      $username = $session->username;

    else

      $username = 'Unavailable';

    $query = $this->escape($query);

    $q = $this->sql_query('INSERT INTO '.table_prefix.'logs(log_type,     action,         time_id,    date_string, page_text,      author,            edit_summary)

                                                     VALUES(\'security\', \'sql_inject\', '.time().', \'\',        \''.$query.'\', \''.$username.'\', \''.$_SERVER['REMOTE_ADDR'].'\');');

  }

  /**

   * Returns the ID of the row last inserted.

   * @return int

   */

  function insert_id()

  {

    return @mysql_insert_id();

  }

    if ( !$this->_conn )

      return false;

    if ( !$r )

      $r = $this->latest_result;

    if ( !$r )

      $this->_die('$db->fetchrow(): an invalid MySQL resource was passed.');

    $row = mysql_fetch_assoc($r);

    return integerize_array($row);

  }

    $row = mysql_fetch_row($r);

    return integerize_array($row);

  }

  }

  function escape($str)