#3756 Improvements

inc/classes/BxDolLanguages.php

@@ -396,8 +396,8 @@ class BxDolLanguages extends BxDolFactory implements iBxDolSingleton
             $oAccountQuery->updateLanguage($iAccountId, $iLangId);
         }
 
-        setcookie( 'lang', '',     time() - 60*60*24,    '/' );
-        setcookie( 'lang', $sLang, time() + 60*60*24*365, '/' );
+        bx_setcookie('lang', '',     time() - 60*60*24);
+        bx_setcookie('lang', $sLang, time() + 60*60*24*365);
     }
 }
 

inc/classes/BxDolSession.php

@@ -91,9 +91,7 @@ class BxDolSession extends BxDolFactory implements iBxDolSingleton
 		if (!$this->sId)
             $this->sId = genRndPwd(32, true);
 
-        $aUrl = parse_url(BX_DOL_URL_ROOT);
-        $sPath = isset($aUrl['path']) && !empty($aUrl['path']) ? $aUrl['path'] : '/';
-        setcookie(BX_DOL_SESSION_COOKIE, $this->sId, 0, $sPath, '', false, true);
+        bx_setcookie(BX_DOL_SESSION_COOKIE, $this->sId, 0, 'auto', '', 'auto', true);
 
         $this->save();
         return true;
@@ -102,9 +100,7 @@ class BxDolSession extends BxDolFactory implements iBxDolSingleton
     function destroy($bDeleteCookies = true)
     {
         if ($bDeleteCookies) {
-            $aUrl = parse_url(BX_DOL_URL_ROOT);
-            $sPath = isset($aUrl['path']) && !empty($aUrl['path']) ? $aUrl['path'] : '/';
-            setcookie(BX_DOL_SESSION_COOKIE, '', time() - 86400, $sPath, '', false, true);
+            bx_setcookie(BX_DOL_SESSION_COOKIE, '', time() - 86400, 'auto', '', 'auto', true);
             unset($_COOKIE[BX_DOL_SESSION_COOKIE]);
         }
 

inc/classes/BxDolStorage.php

@@ -194,6 +194,7 @@ abstract class BxDolStorage extends BxDolFactory implements iBxDolFactoryObject
     protected $_aParams; ///< custom params
     protected $_iErrorCode; ///< last error code
     protected $_oDb; ///< database relates function are in this object
+    protected $_aMimeTypesViewable = ['audio/', 'image/', 'video/']; ///< file types (by mime type) to allow view file in browser instead of downloading
 
     /**
      * constructor
@@ -652,7 +653,7 @@ abstract class BxDolStorage extends BxDolFactory implements iBxDolFactoryObject
      * @param array $aFile downloading file info.
      * @param boolean $bForceDownloadDialog if downloading to a local file system first is required and/or send the outout as attachment rather than inline.
      */
-    public function download ($aFile, $sToken = false, $bForceDownloadDialog = false)
+    public function download ($aFile, $sToken = false, $bForceDownloadDialog = 'auto')
     {
     	$bRet = true;
         bx_alert($this->_aObject['object'], 'file_downloaded', $aFile['id'], bx_get_logged_profile_id(), array(

inc/classes/BxDolStorageLocal.php

@@ -46,7 +46,7 @@ class BxDolStorageLocal extends BxDolStorage
     /**
      * Start file downloading by remote id. If file is private then token is checked.
      */
-    public function download ($sRemoteId, $sToken = false, $bForceDownloadDialog = false)
+    public function download ($sRemoteId, $sToken = false, $mixedForceDownloadDialog = 'auto')
     {
         $this->setErrorCode(BX_DOL_STORAGE_ERR_OK);
 
@@ -66,6 +66,20 @@ class BxDolStorageLocal extends BxDolStorage
             return false;
         }
 
+        if ('auto' === $mixedForceDownloadDialog) {
+            $bForceDownloadDialog = true;
+            foreach ($this->_aMimeTypesViewable as $sType) {
+                if (0 === strpos($aFile['mime_type'], $sType)) {
+                    $bForceDownloadDialog = false;
+                    break;
+                }
+            }
+        } 
+        else {
+            $bForceDownloadDialog = $mixedForceDownloadDialog;
+        }
+        
+
         if (!bx_smart_readfile($sFileLocation, $aFile['file_name'], $aFile['mime_type'], $aFile['private'] && $this->_iCacheControl > $this->_aObject['token_life'] ? $this->_aObject['token_life'] : $this->_iCacheControl, $aFile['private'] ? 'private' : 'public', $bForceDownloadDialog ? 'attachment' : 'inline')) {
             $this->setErrorCode(BX_DOL_STORAGE_ERR_ENGINE_GET);
             return false;

inc/classes/BxDolStorageS3.php

@@ -77,7 +77,7 @@ class BxDolStorageS3 extends BxDolStorage
     /**
      * Start file downloading by remote id. If file is private then token is checked.
      */
-    public function download ($sRemoteId, $sToken = false, $bForceDownloadDialog = false)
+    public function download ($sRemoteId, $sToken = false, $bForceDownloadDialog = 'auto')
     {
         $this->setErrorCode(BX_DOL_STORAGE_ERR_OK);
 
@@ -94,7 +94,7 @@ class BxDolStorageS3 extends BxDolStorage
 
         $sUrl = $this->getFileUrlById($aFile['id']);
 
-        if ($bForceDownloadDialog) {
+        if ($bForceDownloadDialog && $bForceDownloadDialog !== 'auto') {
             // download remote file to tmp
             $sTmpFilePath = BX_DIRECTORY_PATH_TMP . 'dwnld_'.$sRemoteId;
             if (!file_exists($sTmpFilePath)) {

inc/classes/BxDolTemplate.php

@@ -362,10 +362,7 @@ class BxDolTemplate extends BxDolFactory implements iBxDolSingleton
             if(!$bSetCookie || bx_get('preview'))
                 return $aResult;
 
-            $aUrl = parse_url(BX_DOL_URL_ROOT);
-            $sPath = isset($aUrl['path']) && !empty($aUrl['path']) ? $aUrl['path'] : '/';
-
-            setcookie($sCodeKey, $sCode, time() + 60*60*24*365, $sPath);
+            bx_setcookie($sCodeKey, $sCode, time() + 60*60*24*365);
 
             return $aResult;
         };
@@ -382,10 +379,7 @@ class BxDolTemplate extends BxDolFactory implements iBxDolSingleton
             if(!$bSetCookie)
                 return $iMix;
 
-            $aUrl = parse_url(BX_DOL_URL_ROOT);
-            $sPath = isset($aUrl['path']) && !empty($aUrl['path']) ? $aUrl['path'] : '/';
-
-            setcookie($sMixKey, $iMix, time() + 60*60*24*365, $sPath);
+            bx_setcookie($sMixKey, $iMix, time() + 60*60*24*365);
 
             return $iMix;
         };

inc/profiles.inc.php

@@ -100,13 +100,10 @@ function bx_login($iId, $bRememberMe = false)
     if (!$sPassword)
         return false;
 
-    $aUrl = parse_url(BX_DOL_URL_ROOT);
-    $sPath = isset($aUrl['path']) && !empty($aUrl['path']) ? $aUrl['path'] : '/';
-    $sHost = '';
     $iCookieTime = $bRememberMe ? time() + 60 * getParam('sys_session_lifetime_in_min') : 0;
-    setcookie("memberID", $iId, $iCookieTime, $sPath, $sHost);
+    bx_setcookie("memberID", $iId, $iCookieTime, 'auto');
     $_COOKIE['memberID'] = $iId;
-    setcookie("memberPassword", $sPassword, $iCookieTime, $sPath, $sHost, false, true /* http only */);
+    bx_setcookie("memberPassword", $sPassword, $iCookieTime, 'auto', '', 'auto', true /* http only */);
     $_COOKIE['memberPassword'] = $sPassword;
 
     BxDolSession::getInstance()->setUserId($iId);
@@ -139,12 +136,9 @@ function bx_logout($bNotify = true)
         '_sys_audit_action_account_logout',  
         array('content_title' => '', 'data' => ['display_info' => ['User agent' => $_SERVER["HTTP_USER_AGENT"]]])
     );
-    
-    $aUrl = parse_url(BX_DOL_URL_ROOT);
-    $sPath = isset($aUrl['path']) && !empty($aUrl['path']) ? $aUrl['path'] : '/';
 
-    setcookie('memberID', '', time() - 96 * 3600, $sPath);
-    setcookie('memberPassword', '', time() - 96 * 3600, $sPath);
+    bx_setcookie('memberID', '', time() - 96 * 3600);
+    bx_setcookie('memberPassword', '', time() - 96 * 3600, 'auto', '', 'auto', true /* http only */);
 
     unset($_COOKIE['memberID']);
     unset($_COOKIE['memberPassword']);
@@ -177,8 +171,10 @@ function check_logged()
         }
     }
 
-    if($bID && $bPassword && $bLogged)
+    if($bID && $bPassword && $bLogged) {
+        header("Cache-Control: no-cache, no-store, must-revalidate");
         bx_alert('account', 'logged', getLoggedId());
+    }
 
     if(($bID || $bPassword) && !$bLogged)
         bx_logout(false);

inc/utils.inc.php

@@ -941,17 +941,19 @@ function bx_file_get_contents($sFileUrl, $aParams = array(), $sMethod = 'get', $
         if ($aHeaders)
             curl_setopt($rConnect, CURLOPT_HTTPHEADER, $aHeaders);
 
-        $sAllCookies = '';
-        foreach($_COOKIE as $sKey => $mValue){
-            if(is_array($mValue)){
-                foreach ($mValue as $k => $v)
-                    $sAllCookies .= "{$sKey}[{$k}]={$v};";
-            }
-            else{
-                $sAllCookies .= $sKey . '=' . $mValue . ';';
+        if (0 === strpos($sFileUrl, BX_DOL_URL_ROOT)) {
+            $sAllCookies = '';
+            foreach($_COOKIE as $sKey => $mValue){
+                if(is_array($mValue)){
+                    foreach ($mValue as $k => $v)
+                        $sAllCookies .= "{$sKey}[{$k}]={$v};";
+                }
+                else{
+                    $sAllCookies .= $sKey . '=' . $mValue . ';';
+                }
             }
+            curl_setopt($rConnect, CURLOPT_COOKIE, $sAllCookies);
         }
-        curl_setopt($rConnect, CURLOPT_COOKIE, $sAllCookies);
 
         if ($aCustomCurlParams)
             foreach ($aCustomCurlParams as $sName => $mixedValue)
@@ -2133,4 +2135,25 @@ function bx_birthday2age($sBirthday)
     return $iResult;
 }
 
+function bx_setcookie($sName, $sValue = "", $oExpiresOrOptions = 0, $sPath = 'auto', $sDomain = '', $bSecure = 'auto', $bHttpOnly = false)
+{
+    $aUrl = 'auto' === $sPath || 'auto' === $bSecure ? parse_url(BX_DOL_URL_ROOT) : [];
+
+    if ('auto' === $sPath)
+        $sPath = isset($aUrl['path']) && !empty($aUrl['path']) ? $aUrl['path'] : '/';
+
+    if ('auto' === $bSecure)
+        $bSecure = 0 === strcasecmp('https', $aUrl['scheme']);
+    
+    return setcookie($sName, $sValue, $oExpiresOrOptions, $sPath, $sDomain, $bSecure, $bHttpOnly);
+}
+
+function is_private_ip ($sIp)
+{
+    if (filter_var($sIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_IPV6) !== $sIp)
+        return false;
+
+    return filter_var($sIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_IPV6 | FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== $sIp;
+}
+
 /** @} */

modules/base/text/classes/BxBaseModTextModule.php

@@ -698,6 +698,9 @@ class BxBaseModTextModule extends BxBaseModGeneralModule implements iBxDolConten
 
         $iContentId = (int)$oForm->getCleanValue('content_id');
         $sLink = rtrim($oForm->getCleanValue('url'), '/');
+        $sHost = parse_url($sLink, PHP_URL_HOST);
+        if (is_private_ip(gethostbyname($sHost)))
+            return array('message' => _t('_sys_txt_error_occured'));
 
         $aMatches = array();
         preg_match($this->_oConfig->getPregPattern('url'), $sLink, $aMatches);

modules/boonex/new_comments/classes/BxNewCommentsAlertsResponse.php

@@ -37,9 +37,9 @@ class BxNewCommentsAlertsResponse extends BxDolAlertsResponse
         $iCookieTime = time() + 24 * 3600;
         $iLastVistit = time();
         if ($iLastVistit - $this->getPrevSession() > 60 * getParam('bx_new_comments_session_interval')){
-            setcookie("bxNewCommentsPrevSession", $iLastVistit, $iCookieTime, '/', $_SERVER['HTTP_HOST']);
+            bx_setcookie("bxNewCommentsPrevSession", $iLastVistit, $iCookieTime);
         }
-        setcookie("bxNewCommentsCurrentSession", $iLastVistit, $iCookieTime, '/', $_SERVER['HTTP_HOST']);
+        bx_setcookie("bxNewCommentsCurrentSession", $iLastVistit, $iCookieTime);
     }
     
     private function getPrevSession()

modules/boonex/tasks/classes/BxTasksModule.php

@@ -87,13 +87,11 @@ class BxTasksModule extends BxBaseModTextModule implements iBxDolCalendarService
 		if (isset($_COOKIE[$CNF['COOKIE_SETTING_KEY']]))
 			$aTmp =	json_decode($_COOKIE[$CNF['COOKIE_SETTING_KEY']], true);
 			
-		$aUrl = parse_url(BX_DOL_URL_ROOT);
-		$sPath = isset($aUrl['path']) && !empty($aUrl['path']) ? $aUrl['path'] : '/';
 		if ($sValue != '')
 			$aTmp[$iListId] = $sValue;
 		else
 			unset($aTmp[$iListId]);
-        setcookie($CNF['COOKIE_SETTING_KEY'], json_encode($aTmp), time() + 60*60*24*365, $sPath);
+        bx_setcookie($CNF['COOKIE_SETTING_KEY'], json_encode($aTmp), time() + 60*60*24*365);
 	}
 	
 	public function actionProcessTaskListForm($iContextId, $iId)