<?php

/**

 * Webserver class

 * 

 * Greyhound - real web management for Amarok

 * Copyright (C) 2008 Dan Fuhry

 *

 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

 */

/**

 * Version of the server

 * @const string

 */

define('HTTPD_VERSION', '0.1b1');

/**

 * Webserver system icons

 */

define('HTTPD_ICON_SCRIPT', 'iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAQAAAC1+jfqAAAABGdBTUEAAK/INwWK6QAAABl0RVh0U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGSSURBVCjPVVFNSwJhEF78Ad79Cf6PvXQRsotUlzKICosuRYmR2RJR0KE6lBFFZVEbpFBSqKu2rum6llFS9HHI4iUhT153n6ZtIWMOM+/MM88z7wwH7s9Ub16SJcnbmrNcxVm2q7Z8/QPvEOtntpj92NkCqITLepEpjix7xQtiLOoQ2b6+E7YAN/5nfOEJ2WbKqOIOJ4bYVMEQx4LfBBQDsvFMhUcCVU1/CxVXmDBGA5ZETrhDCQVcYAPbyEJBhvrnBVPiSpNr6cYDNCQwo4zzU/ySckkgDYuNuVpI42T9k4gLKGMPs/xPzzovQiY2hQYe0jlJfyNNhTqiWDYBq/wBMcSRpnyPzu1oS7WtxjVBSthU1vgVksiQ3Dn6Gp5ah2YOKQo5GiuHPA6xT1EKpxQNCNYejgIR457KKio0S56YckjSa9jo//3mrj+BV0QQagqGTOo+Y7gZIf1puP3WHoLhEb2PjTlCTCWGXtbp8DCX3hZuOdaIc9A+aQvWk4ihq95p67a7nP+u+Ws+r0dql9z/zv0NCYhdCPKZ7oYAAAAASUVORK5CYII=');

define('HTTPD_ICON_FOLDER', 'iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAGrSURBVDjLxZO7ihRBFIa/6u0ZW7GHBUV0UQQTZzd3QdhMQxOfwMRXEANBMNQX0MzAzFAwEzHwARbNFDdwEd31Mj3X7a6uOr9BtzNjYjKBJ6nicP7v3KqcJFaxhBVtZUAK8OHlld2st7Xl3DJPVONP+zEUV4HqL5UDYHr5xvuQAjgl/Qs7TzvOOVAjxjlC+ePSwe6DfbVegLVuT4r14eTr6zvA8xSAoBLzx6pvj4l+DZIezuVkG9fY2H7YRQIMZIBwycmzH1/s3F8AapfIPNF3kQk7+kw9PWBy+IZOdg5Ug3mkAATy/t0usovzGeCUWTjCz0B+Sj0ekfdvkZ3abBv+U4GaCtJ1iEm6ANQJ6fEzrG/engcKw/wXQvEKxSEKQxRGKE7Izt+DSiwBJMUSm71rguMYhQKrBygOIRStf4TiFFRBvbRGKiQLWP29yRSHKBTtfdBmHs0BUpgvtgF4yRFR+NUKi0XZcYjCeCG2smkzLAHkbRBmP0/Uk26O5YnUActBp1GsAI+S5nRJJJal5K1aAMrq0d6Tm9uI6zjyf75dAe6tx/SsWeD//o2/Ab6IH3/h25pOAAAAAElFTkSuQmCC');

define('HTTPD_ICON_FILE', 'iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAAK/INwWK6QAAABl0RVh0U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAINSURBVBgZBcG/r55zGAfg6/4+z3va01NHlYgzEfE7MdCIGISFgS4Gk8ViYyM2Mdlsko4GSf8Do0FLRCIkghhYJA3aVBtEz3nP89wf11VJvPDepdd390+8Nso5nESBQoq0pfvXm9fzWf19453LF85vASqJlz748vInb517dIw6EyYBIIG49u+xi9/c9MdvR//99MPPZ7+4cP4IZhhTPbwzT2d+vGoaVRRp1rRliVvHq+cfvM3TD82+7mun0o/ceO7NT+/4/KOXjwZU1ekk0840bAZzMQ2mooqh0A72d5x/6sB9D5zYnff3PoYBoWBgFKPKqDKqjCpjKr//dcu9p489dra88cydps30KswACfNEKanSaxhlntjJ8Mv12Paie+vZ+0+oeSwwQ0Iw1xAR1CiFNJkGO4wu3ZMY1AAzBI0qSgmCNJsJUEOtJSMaCTBDLyQ0CknAGOgyTyFFiLI2awMzdEcSQgSAAKVUmAeNkxvWJWCGtVlDmgYQ0GFtgg4pNtOwbBcwQy/Rife/2yrRRVI0qYCEBly8Z+P4qMEMy7JaVw72N568e+iwhrXoECQkfH91kY7jwwXMsBx1L93ZruqrK6uuiAIdSnTIKKPLPFcvay8ww/Hh+ufeznTXu49v95IMoQG3784gYXdTqvRmqn/Wpa/ADFX58MW3L71SVU9ETgEIQQQIOOzub+fhIvwPRDgeVjWDahIAAAAASUVORK5CYII=');

/**

 * @package Amarok

 * @subpackage WebControl

 * @author Dan Fuhry

 * @license GNU General Public License <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>

 */

class WebServer

{

  /**

   * IP address we're bound to

   * @var string

   */

  var $bind_address = '127.0.0.1';

  /**

   * Socket resource

   * @var resource

   */

  var $sock = null;

  /**

   * Server string

   * @var string

   */

  var $server_string = 'PhpHttpd';

  /**

   * Default document (well default handler)

   * @var string

   */

  var $default_document = false;

  /**

   * List of filenames or handlers used when a directory listing is requested

   * @var array

   */

  var $directory_index = array('index.html', 'index.htm', 'index', 'default.html', 'default.htm');

  /**

   * HTTP response code set by the handler function

   * @var int

   */

  var $response_code = 0;

  /**

   * Content type set by the current handler function

   * @var string

   */

  var $content_type = '';

  /**

   * Response headers to send back to the client

   * @var array

   */

  var $response_headers = array();

  /**

   * List of handlers

   * @var array

   */

  var $handlers = array();

  /**

   * Switch to control if directory listing is enabled

   * @var bool

   */

  var $allow_dir_list = false;

  /**

   * Switch to control forking support.

   * @var bool

   */

  var $allow_fork = true;

  /**

   * Keep-alive support uses this to track what the client requested.

   * Only used if $allow_fork is set to true.

   * @var bool

   */

  var $in_keepalive = false;

  /**

   * UUID for this server instance

   * @var string

   */

  var $uuid = '00000000-0000-0000-0000-000000000000';

  /**

   * Switch to track whether a scriptlet is running. If it is, send_http_error() does more than normal.

   * @var bool

   */

  var $in_scriptlet = false;

  /**

   * Switch to track whether headers have been sent or not.

   * @var bool

   */

  var $headers_sent = false;

  /**

   * Switch to track if the socket is bound and thus needs to be freed or not

   * @var bool

   */

  var $socket_initted = false;

  /**

   * Constructor.

   * @param string IPv4 address to bind to

   * @param int Port number

   * @param int If port is under 1024, specify a user ID/name to switch to here

   * @param int If port is under 1024, specify a group ID/name to switch to here

   */

  function __construct($address = '127.0.0.1', $port = 8080, $targetuser = null, $targetgroup = null)

  {

    @set_time_limit(0);

    @ini_set('memory_limit', '128M');

    // do we have socket functions?

    if ( !function_exists('socket_create') )

    {

      burnout('System does not support socket functions. Please rebuild your PHP or install an appropriate extension.');

    }

    // make sure we're not running as root

    // note that if allow_root is true, you must specify a UID/GID (or user/group) to switch to once the socket is bound

    $allow_root = ( $port < 1024 ) ? true : false;

    if ( function_exists('posix_geteuid') )

    {

      $euid = posix_geteuid();

      $egid = posix_getegid();

      $username = posix_getpwuid($euid);

      $username = $username['name'];

      $group = posix_getgrgid($egid);

      $group = $group['name'];

      if ( $euid == 0 && !$allow_root )

      {

        // running as root but not on a privileged port - die for security

        burnout("Running as superuser (user \"$username\" and group \"$group\"). This is not allowed for security reasons.");

      }

      else if ( $euid == 0 && $allow_root )

      {

        // running as root and port below 1024, so notify of the switch and verify that a target UID and GID were passed

        if ( $targetuser === null || $targetgroup === null )

        {

          // no target user/group specified

          burnout("Must specify a target user and group when running server as root");

        }

        // get info about target user/group

        if ( is_string($targetuser) )

        {

          $targetuser = posix_getpwnam($targetuser);

          $targetuser = $targetuser['uid'];

        }

        if ( is_string($targetgroup) )

        {

          $targetgroup = posix_getgrnam($targetgroup);

          $targetgroup = $targetgroup['uid'];

        }

        // make sure all info is valid

        if ( !is_int($targetuser) || !is_int($targetgroup) )

        {

          burnout('Invalid user or group specified');

        }

        $userinfo = posix_getpwuid($targetuser);

        $groupinfo = posix_getgrgid($targetgroup);

        if ( function_exists('status') )

          status("Will switch to user \"{$userinfo['name']}\" and group \"{$groupinfo['name']}\" shortly after binding to socket");

      }

      else if ( $allow_root && $euid > 0 )

      {

        burnout("Must be superuser to bind to ports below 1024");

      }

    }

    $socket_do_root = ( $allow_root ) ? function_exists('posix_geteuid') : false;

    $this->sock = @socket_create(AF_INET, SOCK_STREAM, getprotobyname('tcp'));

    if ( !$this->sock )

      throw new Exception('Could not create socket');

    $result = @socket_bind($this->sock, $address, $port);

    if ( !$result )

      throw new Exception("Could not bind to $address:$port");

    $this->socket_initted = true;

    $result = @socket_listen($this->sock, SOMAXCONN);

    if ( !$result )

      throw new Exception("Could not listen for connections $address:$port");

    // if running as root and we made it here, switch credentials

    if ( $socket_do_root )

    {

      posix_setuid($targetuser);

      posix_setgid($targetgroup);

      posix_setegid($targetgroup);

      posix_seteuid($targetuser);

      if ( function_exists('status') )

        status('Successfully switched user ID');

    }

    $this->bind_address = $address;

    $this->server_string = "PhpHttpd/" . HTTPD_VERSION . " PHP/" . PHP_VERSION . "\r\n";

    // create a UUID

    $uuid_base = md5(microtime() . ( function_exists('mt_rand') ? mt_rand() : rand() ));

    $this->uuid = substr($uuid_base, 0,  8) . '-' .

                  substr($uuid_base, 8,  4) . '-' .

                  substr($uuid_base, 12, 4) . '-' .

                  substr($uuid_base, 16, 4) . '-' .

                  substr($uuid_base, 20, 20);

  }

  /**

   * Destructor.

   */

  function __destruct()

  {

    if ( !defined('HTTPD_WS_CHILD') && $this->socket_initted )

    {

      if ( function_exists('status') )

        status('WebServer: destroying socket');

      // http://us3.php.net/manual/en/function.socket-bind.php

      if ( !@socket_set_option($this->sock, SOL_SOCKET, SO_REUSEADDR, 1) )

      {

        echo socket_strerror(socket_last_error($sock)) . "\n";

      }

      @socket_shutdown($this->sock, 2);

      @socket_close($this->sock);

    }

  }

  /**

   * Main server loop

   */

  function serve()

  {

    while ( true )

    {

      // if this is a child process, we're finished - close up shop

      if ( defined('HTTPD_WS_CHILD') && !$this->in_keepalive )

      {

        if ( function_exists('status') )

          status('Exiting child process');

        @socket_shutdown($remote);

        @socket_close($remote);

        exit(0);

      }

      // wait for connection...

      // trick from http://us.php.net/manual/en/function.socket-accept.php

      if ( !defined('HTTPD_WS_CHILD') )

      {

        $remote = false;

        $timeout = 5;

        switch(@socket_select($r = array($this->sock), $w = array($this->sock), $e = array($this->sock), $timeout)) {

          case 2:

            break;

          case 1:

            $remote = @socket_accept($this->sock);

            break;

          case 0:

            break;

        }

      }

      if ( !$remote )

      {

        $this->in_keepalive = false;

        continue;

      }

      // fork off if possible

      if ( function_exists('pcntl_fork') && $this->allow_fork && !$this->in_keepalive )

      {

        $pid = pcntl_fork();

        if ( $pid == -1 )

        {

          // do nothing; continue responding to request in single-threaded mode

        }

        else if ( $pid )

        {

          // we are the parent, continue listening

          socket_close($remote);

          continue;

        }

        else

        {

          // this is the child

          define('HTTPD_WS_CHILD', 1);

          @socket_set_option($this->sock, SOL_SOCKET, SO_REUSEADDR, 1);

          socket_close($this->sock);

        }

      }

      $this->in_keepalive = false;

      $this->headers_sent = false;

      $this->in_scriptlet = false;

      // read request

      $last_line = '';

      $client_headers = '';

      while ( $line = @socket_read($remote, 1024, PHP_NORMAL_READ) )

      {

        $line = str_replace("\r", "", $line);

        if ( empty($line) )

          continue;

        if ( $line == "\n" && $last_line == "\n" )

          break;

        $client_headers .= $line;

        $last_line = $line;

      }

      // parse request

      $client_headers = trim($client_headers);

      $client_headers = explode("\n", $client_headers);

      // first line

      $request = $client_headers[0];

      if ( !preg_match('/^(GET|POST) \/([^ ]*) HTTP\/1\.[01]$/', $request, $match) )

      {

        $this->send_http_error($remote, 400, 'Your client issued a malformed or illegal request.');

        continue;

      }

      $method =& $match[1];

      $uri =& $match[2];

      // set client headers

      unset($client_headers[0]);

      foreach ( $client_headers as $line )

      {

        if ( !preg_match('/^([A-z0-9-]+): (.+)$/is', $line, $match) )

          continue;

        $key = 'HTTP_' . strtoupper(str_replace('-', '_', $match[1]));

        $_SERVER[$key] = $match[2];

      }

      // enable keep-alive if requested

      if ( isset($_SERVER['HTTP_CONNECTION']) && defined('HTTPD_WS_CHILD') )

      {

        $this->in_keepalive = ( strtolower($_SERVER['HTTP_CONNECTION']) === 'keep-alive' );

      }

      // parse authorization, if any

      if ( isset($_SERVER['PHP_AUTH_USER']) )

      {

        unset($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']);

      }

      if ( isset($_SERVER['HTTP_AUTHORIZATION']) )

      {

        $data = $_SERVER['HTTP_AUTHORIZATION'];

        $data = substr(strstr($data, ' '), 1);

        $data = base64_decode($data);

        $_SERVER['PHP_AUTH_USER'] = substr($data, 0, strpos($data, ':'));

        $_SERVER['PHP_AUTH_PW'] = substr(strstr($data, ':'), 1);

      }

      // anything on POST?

      $postdata = '';

      $_POST = array();

      $_FILES = array();

      if ( $method == 'POST' )

      {

        // read POST data

        if ( isset($_SERVER['HTTP_CONTENT_TYPE']) && preg_match('#^multipart/form-data; ?boundary=([A-z0-9_-]+)$#i', $_SERVER['HTTP_CONTENT_TYPE'], $match) )

        {

          // this is a multipart request

          $boundary =& $match[1];

          $mode = 'data';

          $last_line = '';

          $i = 0;

          while ( $data = socket_read($remote, 8388608, PHP_NORMAL_READ) )

          {

            $data_trim = trim($data, "\r\n");

            if ( $mode != 'data' )

            {

              $data = str_replace("\r", '', $data);

            }

            if ( ( $data_trim === "--$boundary" || $data_trim === "--$boundary--" ) && $i > 0 )

            {

              // trim off the first LF and the last CRLF

              $currval_data = substr($currval_data, 1, strlen($currval_data)-3);

              // this is the end of a part of the message; parse it into either $_POST or $_FILES

              if ( is_string($have_a_file) )

              {

                // write data to a temporary file

                $errcode = UPLOAD_ERR_OK;

                $tempfile = tempnam('phpupload', ( function_exists('sys_get_temp_dir') ? sys_get_temp_dir() : '/tmp' ));

                if ( $fh = @fopen($tempfile, 'w') )

                {

                  if ( empty($have_a_file) )

                  {

                    $errcode = UPLOAD_ERR_NO_FILE;

                  }

                  else

                  {

                    fwrite($fh, $currval_data);

                  }

                  fclose($fh);

                }

                else

                {

                  $errcode = UPLOAD_ERR_CANT_WRITE;

                }

                $_FILES[$currval_name] = array(

                    'name' => $have_a_file,

                    'type' => $currval_type,

                    'size' => filesize($tempfile),

                    'tmp_name' => $tempfile,

                    'error' => $errcode

                  );

              }

              else

              {

                $_POST[$currval_name] = $currval_data;

              }

            }

            if ( $data_trim === "--$boundary" )

            {

              // switch from "data" mode to "headers" mode

              $currval_name = '';

              $currval_data = '';

              $currval_type = '';

              $have_a_file = false;

              $mode = 'headers';

            }

            else if ( $data_trim === "--$boundary--" )

            {

              // end of request

              break;

            }

            else if ( ( empty($data_trim) && empty($last_line) ) && $mode == 'headers' )

            {

              // start of data

              $mode = 'data';

            }

            else if ( $mode == 'headers' )

            {

              // read header

              // we're only looking for Content-Disposition and Content-Type

              if ( preg_match('#^Content-Disposition: form-data; name="([^"\a\t\r\n]+)"(?:; filename="([^"\a\t\r\n]+)")?#i', $data_trim, $match) )

              {

                // content-disposition header, set name and mode.

                $currval_name = $match[1];

                if ( isset($match[2]) )

                {

                  $have_a_file = $match[2];

                }

                else

                {

                  $have_a_file = false;