[BUGFIX] Fix XSS in admin pannel

[jirafeau_project.git] / lib / settings.php

diff --git a/lib/settings.php b/lib/settings.php
index 46f7c51cd1504b96e77a12fd705cc7534e7850c0..20a035b73a488fbf7d2585666b81e9bb86765947 100644 (file)
--- a/lib/settings.php
+++ b/lib/settings.php
@@ -14,27 +14,57 @@
  *  GNU Affero General Public License for more details.
  *
  *  You should have received a copy of the GNU Affero General Public License
- *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-/* Jirafeau constants */
-define ('JIRAFEAU_PACKAGE', 'Jirafeau');
-define ('JIRAFEAU_VERSION', '1.0');
+
+global $cfg;
+
+// Read config files
+require(JIRAFEAU_ROOT . 'lib/config.original.php');
+if (file_exists(JIRAFEAU_ROOT . 'lib/config.local.php')) {
+    // read local copy and merge with original values
+    $cfgOriginal = $cfg;
+    require(JIRAFEAU_ROOT . 'lib/config.local.php');
+    $cfg = array_merge($cfgOriginal, $cfg);
+    unset($cfgOriginal);
+}
+
+// Set constants
+
+/* Jirafeau package */
+define('JIRAFEAU_PACKAGE', 'Jirafeau');
+define('JIRAFEAU_VERSION', '3.4.0');
 
 /* Directories. */
-define ('VAR_FILES', $cfg['var_root'] . 'files/');
-define ('VAR_LINKS', $cfg['var_root'] . 'links/');
-define ('VAR_ASYNC', $cfg['var_root'] . 'async/');
+define('VAR_FILES', $cfg['var_root'] . 'files/');
+define('VAR_LINKS', $cfg['var_root'] . 'links/');
+define('VAR_ASYNC', $cfg['var_root'] . 'async/');
+
+// helping variable to build absolute link to
+// root of the domain without handling the URL scheme
+$absPrefix = parse_url($cfg['web_root'], PHP_URL_PATH);
+if (true === empty($absPrefix)) {
+    // fallback if installation isnt done yet: relative links to same level on the current page
+    $absPrefix = './';
+}
+define('JIRAFEAU_ABSPREFIX', $absPrefix);
 
 /* Useful constants. */
-if (!defined ('NL'))
-    define ('NL', "\n");
-
-define ('JIRAFEAU_INFINITY', -1);
-define ('JIRAFEAU_MINUTE', 60); // 60
-define ('JIRAFEAU_HOUR', 3600); // JIRAFEAU_MINUTE * 60
-define ('JIRAFEAU_DAY', 86400); // JIRAFEAU_HOUR * 24
-define ('JIRAFEAU_WEEK', 604800); // JIRAFEAU_DAY * 7
-define ('JIRAFEAU_MONTH', 2419200); // JIRAFEAU_WEEK * 4
-define ('JIRAFEAU_MONTH', 29030400); // JIRAFEAU_MONTH * 12
-
-?>
+if (!defined('NL')) {
+    define('NL', "\n");
+}
+if (!defined('QUOTE')) {
+    define('QUOTE', "'");
+}
+
+define('JIRAFEAU_INFINITY', -1);
+define('JIRAFEAU_MINUTE', 60); // 60
+define('JIRAFEAU_HOUR', 3600); // JIRAFEAU_MINUTE * 60
+define('JIRAFEAU_DAY', 86400); // JIRAFEAU_HOUR * 24
+define('JIRAFEAU_WEEK', 604800); // JIRAFEAU_DAY * 7
+define('JIRAFEAU_MONTH', 2419200); // JIRAFEAU_WEEK * 4
+define('JIRAFEAU_QUARTER', 7257600); // JIRAFEAU_MONTH * 3
+define('JIRAFEAU_YEAR', 29030400); // JIRAFEAU_MONTH * 12
+
+// set UTC as default timezone for all date/time functions
+date_default_timezone_set ('UTC');