224 lines
7.1 KiB
PHP
224 lines
7.1 KiB
PHP
<?php
|
|
/*
|
|
+--------------------------------------------------------------------------
|
|
| CubeCart 4
|
|
| ========================================
|
|
| CubeCart is a registered trade mark of Devellion Limited
|
|
| Copyright Devellion Limited 2006. All rights reserved.
|
|
| Devellion Limited,
|
|
| 5 Bridge Street,
|
|
| Bishops Stortford,
|
|
| HERTFORDSHIRE.
|
|
| CM23 2JU
|
|
| UNITED KINGDOM
|
|
| http://www.devellion.com
|
|
| UK Private Limited Company No. 5323904
|
|
| ========================================
|
|
| Web: http://www.cubecart.com
|
|
| Email: info (at) cubecart (dot) com
|
|
| License Type: CubeCart is NOT Open Source Software and Limitations Apply
|
|
| Licence Info: http://www.cubecart.com/site/faq/license.php
|
|
+--------------------------------------------------------------------------
|
|
| ini.inc.php
|
|
| ========================================
|
|
| Initialization at start of script
|
|
+--------------------------------------------------------------------------
|
|
*/
|
|
|
|
if (version_compare(PHP_VERSION, '4.3.0', '<')) {
|
|
die('You need to upgrade to PHP Version 4.3.0 or better to use CubeCart. You are currently running PHP Version '.PHP_VERSION);
|
|
}
|
|
|
|
## Enable Script Profiling
|
|
#if (extension_loaded('APD')) apd_set_pprof_trace('cache');
|
|
#if (extension_loaded('XDebug')) xdebug_start_trace('test', 4);
|
|
|
|
## Set error reporting to all but notices
|
|
error_reporting(E_ALL ^ E_NOTICE);
|
|
## display errors
|
|
ini_set('display_errors', true);
|
|
## Disable 'Register Globals' for security
|
|
ini_set('register_globals', false);
|
|
## Disable '<?' style php short tags for xml happiness
|
|
ini_set('short_open_tag', false);
|
|
## Set argument separator to & from & for XHTML validity
|
|
ini_set('arg_separator.output', '&');
|
|
## Automatically detect line endings
|
|
ini_set('auto_detect_line_endings', true);
|
|
## turn off magic quotes if on
|
|
ini_set('magic_quotes_gpc', false);
|
|
set_magic_quotes_runtime(false);
|
|
|
|
## NEW - Let's enable page compression by default, if output_buffering is not enabled
|
|
if (!ini_get('output_buffering')) {
|
|
ini_set('zlib.output_compression', true);
|
|
ini_set('zlib.output_compression_level', 5);
|
|
}
|
|
|
|
## Windows/IIS can be a pain in CGI mode - this tries to alleviate our suffering...
|
|
if (strtolower(substr(PHP_OS, 0, 3)) === 'win' && strtolower(php_sapi_name()) === 'cgi') {
|
|
ini_set('cgi.rfc2616_headers', true);
|
|
}
|
|
|
|
if (version_compare(PHP_VERSION, '5.1.0', '>=')) {
|
|
date_default_timezone_set('Europe/London');
|
|
}
|
|
|
|
|
|
/************* START INITIAL SECURITY CHECKS *************/
|
|
|
|
## Check for possible global overwrite and end script execution if detected
|
|
|
|
function unset_globals() {
|
|
if (ini_get('register_globals')) {
|
|
if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS'])) {
|
|
$die = "<h1 style='font-family: Arial, Helvetica, sans-serif; color: red;'>Security Warning</h1><p style='font-family: Arial, Helvetica, sans-serif; color: #000000;'>\nGLOBALS overwrite attempt detected! Script execution has been terminated.</p>\n";
|
|
die($die);
|
|
}
|
|
|
|
## Variables that shouldn't be unset
|
|
$skip = array('GLOBALS', '_GET', '_POST', '_COOKIE', '_REQUEST', '_SERVER', '_ENV', '_FILES');
|
|
$input = array_merge($_GET, $_POST, $_COOKIE, $_SERVER, $_ENV, $_FILES, isset($_SESSION) && is_array($_SESSION) ? $_SESSION : array());
|
|
foreach ($input as $key => $value) {
|
|
if (!in_array($key, $skip) && isset($GLOBALS[$key])) {
|
|
unset($GLOBALS[$key]);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
## Run the function
|
|
unset_globals();
|
|
|
|
|
|
function has_zend_optimizer() {
|
|
# Detect Zend Optimizer
|
|
ob_start();
|
|
phpinfo(INFO_GENERAL);
|
|
$info = ob_get_contents();
|
|
ob_end_clean();
|
|
|
|
$info = str_replace(' ', ' ', $info);
|
|
return eregi('Zend Optimizer', $info);
|
|
}
|
|
|
|
function has_ioncube_loader() {
|
|
# Detect ionCube
|
|
return extension_loaded('ionCube Loader');
|
|
}
|
|
|
|
class clean_data {
|
|
function clean_data(&$data) {
|
|
## keys to skip
|
|
$skipKeys = array('FCKeditor');
|
|
if (isset($_GET['_g']) && urldecode($_GET['_g']) == 'filemanager/language') {
|
|
$skipKeys[] = 'custom';
|
|
}
|
|
|
|
if (is_array($data)) {
|
|
foreach ($data as $key => $val) {
|
|
/*
|
|
The keys should usually not contain any meta characters in their names.
|
|
If so this is possibly an attack attempt.
|
|
*/
|
|
if (preg_match('#([^a-z0-9\-\_\:\@\|])#i', urldecode($key))) {
|
|
echo urldecode($key);
|
|
$die = "<h1 style='font-family: Arial, Helvetica, sans-serif; color: red;'>Security Warning</h1><p style='font-family: Arial, Helvetica, sans-serif; color: #000000;'>\nParsed array keys can not contain illegal characters! Script execution has been halted.</p><p style='font-family: Arial, Helvetica, sans-serif; color: #000000;'>It may be possible to fix this error by deleting your browsers cookies and refresh this page.</p>\n";
|
|
die($die);
|
|
}
|
|
|
|
## Multi dimentional arrays.. dig deeper.
|
|
if (is_array($val) && !in_array($key, $skipKeys)) {
|
|
$this->clean_data($data[$key]);
|
|
} else if (!empty($val) && !in_array($key, $skipKeys)) {
|
|
$data[$key] = $this->safety($val);
|
|
}
|
|
|
|
return true;
|
|
}
|
|
} else {
|
|
$data = $this->safety($data);
|
|
return true;
|
|
}
|
|
}
|
|
|
|
function safety($val) {
|
|
## strip null bytes
|
|
$val = str_replace("\0", '', $val);
|
|
## add slashes if magic quotes is off
|
|
$val = (!get_magic_quotes_gpc()) ? addslashes($val) : $val;
|
|
return strip_tags($val);
|
|
}
|
|
}
|
|
|
|
$clean = new clean_data($data);
|
|
|
|
$clean->clean_data($_GET);
|
|
$clean->clean_data($_POST);
|
|
$clean->clean_data($_COOKIE);
|
|
$clean->clean_data($_REQUEST);
|
|
|
|
/************* END INITIAL SECURITY CHECKS *************/
|
|
|
|
## Version Number
|
|
$ini['ver'] = '4.1.0RC2'; ## CubeCart version number
|
|
|
|
## Brute Force Protection
|
|
$ini['bfattempts'] = 5; ## Allowed number of login attempts
|
|
$ini['bftime'] = 600; ## Number of seconds to prevent login for
|
|
|
|
define('CC_SESSION_NAME', 'ccUser'); ## Default session name is ccUser, this can be changed
|
|
define('CC_ADMIN_SESSION_NAME', 'ccAdmin'); ## Default admin session name is ccAdmin, this can be changed
|
|
|
|
## Pages which need to run under SSL if enabled/forced
|
|
$sslPages = array(
|
|
"unsubscribe" => true,
|
|
"login" => true,
|
|
"logout" => true,
|
|
"forgotPass" => true,
|
|
"account" => true,
|
|
"profile" => true,
|
|
"changePass" => true,
|
|
"newsletter" => true,
|
|
"cart" => true,
|
|
"step1" => true,
|
|
"step2" => true,
|
|
"step3" => true,
|
|
"reg" => true,
|
|
"viewOrders" => true,
|
|
"viewOrder" => true,
|
|
"confirmed" => true,
|
|
);
|
|
|
|
if (!empty($_GET[CC_SESSION_NAME])){
|
|
$GLOBALS[CC_SESSION_NAME] = $_GET[CC_SESSION_NAME];
|
|
|
|
} else if (!empty($_COOKIE[CC_SESSION_NAME])){
|
|
$GLOBALS[CC_SESSION_NAME] = $_COOKIE[CC_SESSION_NAME];
|
|
}
|
|
|
|
if (!empty($_GET[CC_ADMIN_SESSION_NAME])){
|
|
$GLOBALS[CC_ADMIN_SESSION_NAME] = $_GET[CC_ADMIN_SESSION_NAME];
|
|
|
|
} else if (!empty($_COOKIE[CC_ADMIN_SESSION_NAME])) {
|
|
$GLOBALS[CC_ADMIN_SESSION_NAME] = $_COOKIE[CC_ADMIN_SESSION_NAME];
|
|
}
|
|
|
|
## Stop includes, etc from being executed outside of the main application
|
|
define('CC_INI_SET', NULL);
|
|
|
|
## Define a few environmental variables
|
|
define('CC_DS', DIRECTORY_SEPARATOR);
|
|
define('CC_PS', PATH_SEPARATOR); # Is this needed?
|
|
define('CC_ROOT_DIR', dirname(__FILE__));
|
|
|
|
## Define the order statuses as constants
|
|
define('ORDER_PENDING', 1);
|
|
define('ORDER_PROCESS', 2);
|
|
define('ORDER_COMPLETE', 3);
|
|
define('ORDER_DECLINED', 4);
|
|
define('ORDER_FAILED', 5);
|
|
define('ORDER_CANCELLED', 6);
|
|
|
|
?>
|