started to refactor functions to classes and use PSR-4 autoloader and namespacing

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

lib/Froxlor/Database/class.Database.php

@@ -0,0 +1,517 @@
+<?php
+namespace Froxlor\Database;
+
+/**
+ * This file is part of the Froxlor project.
+ * Copyright (c) 2010 the Froxlor Team (see authors).
+ *
+ * For the full copyright and license information, please view the COPYING
+ * file that was distributed with this source code. You can also view the
+ * COPYING file online at http://files.froxlor.org/misc/COPYING.txt
+ *
+ * @copyright (c) the authors
+ * @author Michael Kaufmann <mkaufmann@nutime.de>
+ * @author Froxlor team <team@froxlor.org> (2010-)
+ * @license GPLv2 http://files.froxlor.org/misc/COPYING.txt
+ * @package Classes
+ *         
+ * @since 0.9.31
+ *       
+ */
+
+/**
+ * Class Database
+ *
+ * Wrapper-class for PHP-PDO
+ *
+ * @copyright (c) the authors
+ * @author Michael Kaufmann <mkaufmann@nutime.de>
+ * @author Froxlor team <team@froxlor.org> (2010-)
+ * @license GPLv2 http://files.froxlor.org/misc/COPYING.txt
+ * @package Classes
+ *         
+ * @method static \PDOStatement prepare($statement, array $driver_options = null) Prepares a statement for execution and returns a statement object
+ * @method static \PDOStatement query ($statement) Executes an SQL statement, returning a result set as a PDOStatement object
+ * @method static string lastInsertId ($name = null) Returns the ID of the last inserted row or sequence value
+ * @method static string quote ($string, $parameter_type = null) Quotes a string for use in a query.
+ */
+class Database
+{
+
+	/**
+	 * current database link
+	 *
+	 * @var object
+	 */
+	private static $_link = null;
+
+	/**
+	 * indicator whether to use root-connection or not
+	 */
+	private static $_needroot = false;
+
+	/**
+	 * indicator which database-server we're on (not really used)
+	 */
+	private static $_dbserver = 0;
+
+	/**
+	 * used database-name
+	 */
+	private static $_dbname = null;
+
+	/**
+	 * sql-access data
+	 */
+	private static $_needsqldata = false;
+
+	private static $_sqldata = null;
+
+	/**
+	 * Wrapper for PDOStatement::execute so we can catch the PDOException
+	 * and display the error nicely on the panel
+	 *
+	 * @param \PDOStatement $stmt
+	 * @param array $params
+	 *        	(optional)
+	 * @param bool $showerror
+	 *        	suppress errordisplay (default true)
+	 */
+	public static function pexecute(&$stmt, $params = null, $showerror = true, $json_response = false)
+	{
+		try {
+			$stmt->execute($params);
+		} catch (\PDOException $e) {
+			self::_showerror($e, $showerror, $json_response, $stmt);
+		}
+	}
+
+	/**
+	 * Wrapper for PDOStatement::execute so we can catch the PDOException
+	 * and display the error nicely on the panel - also fetches the
+	 * result from the statement and returns the resulting array
+	 *
+	 * @param \PDOStatement $stmt
+	 * @param array $params
+	 *        	(optional)
+	 * @param bool $showerror
+	 *        	suppress errordisplay (default true)
+	 *        	
+	 * @return array
+	 */
+	public static function pexecute_first(&$stmt, $params = null, $showerror = true, $json_response = false)
+	{
+		self::pexecute($stmt, $params, $showerror, $json_response);
+		return $stmt->fetch(\PDO::FETCH_ASSOC);
+	}
+
+	/**
+	 * returns the number of found rows of the last select query
+	 *
+	 * @return int
+	 */
+	public static function num_rows()
+	{
+		return Database::query("SELECT FOUND_ROWS()")->fetchColumn();
+	}
+
+	/**
+	 * returns the database-name which is used
+	 *
+	 * @return string
+	 */
+	public static function getDbName()
+	{
+		return self::$_dbname;
+	}
+
+	/**
+	 * enabled the usage of a root-connection to the database
+	 * Note: must be called *before* any prepare/query/etc.
+	 * and should be called again with 'false'-parameter to resume
+	 * the 'normal' database-connection
+	 *
+	 * @param bool $needroot
+	 * @param int $dbserver
+	 *        	optional
+	 */
+	public static function needRoot($needroot = false, $dbserver = 0)
+	{
+		// force re-connecting to the db with corresponding user
+		// and set the $dbserver (mostly to 0 = default)
+		self::_setServer($dbserver);
+		self::$_needroot = $needroot;
+	}
+
+	/**
+	 * enable the temporary access to sql-access data
+	 * note: if you want root-sqldata you need to
+	 * call needRoot(true) first.
+	 * Also, this will
+	 * only give you the data ONCE as it disable itself
+	 * after the first access to the data
+	 */
+	public static function needSqlData()
+	{
+		self::$_needsqldata = true;
+		self::$_sqldata = array();
+		self::$_link = null;
+		// we need a connection here because
+		// if getSqlData() is called RIGHT after
+		// this function and no "real" PDO
+		// function was called, getDB() wasn't
+		// involved and no data collected
+		self::getDB();
+	}
+
+	/**
+	 * returns the sql-access data as array using indeces
+	 * 'user', 'passwd' and 'host'.
+	 * Returns false if not enabled
+	 *
+	 * @return array|bool
+	 */
+	public static function getSqlData()
+	{
+		$return = false;
+		if (self::$_sqldata !== null && is_array(self::$_sqldata) && isset(self::$_sqldata['user'])) {
+			$return = self::$_sqldata;
+			// automatically disable sql-data
+			self::$_sqldata = null;
+			self::$_needsqldata = false;
+		}
+		return $return;
+	}
+
+	/**
+	 * let's us interact with the PDO-Object by using static
+	 * call like "Database::function()"
+	 *
+	 * @param string $name
+	 * @param mixed $args
+	 *
+	 * @return mixed
+	 */
+	public static function __callStatic($name, $args)
+	{
+		$callback = array(
+			self::getDB(),
+			$name
+		);
+		$result = null;
+		try {
+			$result = call_user_func_array($callback, $args);
+		} catch (\PDOException $e) {
+			self::_showerror($e);
+		}
+		return $result;
+	}
+
+	/**
+	 * set the database-server (relevant for root-connection)
+	 *
+	 * @param int $dbserver
+	 */
+	private static function _setServer($dbserver = 0)
+	{
+		self::$_dbserver = $dbserver;
+		self::$_link = null;
+	}
+
+	/**
+	 * function that will be called on every static call
+	 * which connects to the database if necessary
+	 *
+	 * @param bool $root
+	 *
+	 * @return object
+	 */
+	private static function getDB()
+	{
+		if (! extension_loaded('pdo') || in_array("mysql", \PDO::getAvailableDrivers()) == false) {
+			self::_showerror(new \Exception("The php PDO extension or PDO-MySQL driver is not available"));
+		}
+
+		// do we got a connection already?
+		if (self::$_link) {
+			// return it
+			return self::$_link;
+		}
+
+		// include userdata.inc.php
+		require FROXLOR_INSTALL_DIR . "/lib/userdata.inc.php";
+
+		// le format
+		if (self::$_needroot == true && isset($sql['root_user']) && isset($sql['root_password']) && (! isset($sql_root) || ! is_array($sql_root))) {
+			$sql_root = array(
+				0 => array(
+					'caption' => 'Default',
+					'host' => $sql['host'],
+					'socket' => (isset($sql['socket']) ? $sql['socket'] : null),
+					'user' => $sql['root_user'],
+					'password' => $sql['root_password']
+				)
+			);
+			unset($sql['root_user']);
+			unset($sql['root_password']);
+		}
+
+		// either root or unprivileged user
+		if (self::$_needroot) {
+			$caption = $sql_root[self::$_dbserver]['caption'];
+			$user = $sql_root[self::$_dbserver]['user'];
+			$password = $sql_root[self::$_dbserver]['password'];
+			$host = $sql_root[self::$_dbserver]['host'];
+			$socket = isset($sql_root[self::$_dbserver]['socket']) ? $sql_root[self::$_dbserver]['socket'] : null;
+			$port = isset($sql_root[self::$_dbserver]['port']) ? $sql_root[self::$_dbserver]['port'] : '3306';
+		} else {
+			$caption = 'localhost';
+			$user = $sql["user"];
+			$password = $sql["password"];
+			$host = $sql["host"];
+			$socket = isset($sql['socket']) ? $sql['socket'] : null;
+			$port = isset($sql['port']) ? $sql['port'] : '3306';
+		}
+
+		// save sql-access-data if needed
+		if (self::$_needsqldata) {
+			self::$_sqldata = array(
+				'user' => $user,
+				'passwd' => $password,
+				'host' => $host,
+				'port' => $port,
+				'socket' => $socket,
+				'db' => $sql["db"],
+				'caption' => $caption
+			);
+		}
+
+		// build up connection string
+		$driver = 'mysql';
+		$dsn = $driver . ":";
+		$options = array(
+			'PDO::MYSQL_ATTR_INIT_COMMAND' => 'SET names utf8'
+		);
+		$attributes = array(
+			'ATTR_ERRMODE' => 'ERRMODE_EXCEPTION'
+		);
+
+		$dbconf["dsn"] = array(
+			'dbname' => $sql["db"],
+			'charset' => 'utf8'
+		);
+
+		if ($socket != null) {
+			$dbconf["dsn"]['unix_socket'] = makeCorrectFile($socket);
+		} else {
+			$dbconf["dsn"]['host'] = $host;
+			$dbconf["dsn"]['port'] = $port;
+		}
+
+		self::$_dbname = $sql["db"];
+
+		// add options to dsn-string
+		foreach ($dbconf["dsn"] as $k => $v) {
+			$dsn .= $k . "=" . $v . ";";
+		}
+
+		// clean up
+		unset($dbconf);
+
+		// try to connect
+		try {
+			self::$_link = new \PDO($dsn, $user, $password, $options);
+		} catch (\PDOException $e) {
+			self::_showerror($e);
+		}
+
+		// set attributes
+		foreach ($attributes as $k => $v) {
+			self::$_link->setAttribute(constant("PDO::" . $k), constant("PDO::" . $v));
+		}
+
+		$version_server = self::$_link->getAttribute(\PDO::ATTR_SERVER_VERSION);
+		$sql_mode = 'NO_ENGINE_SUBSTITUTION';
+		if (version_compare($version_server, '8.0.11', '<')) {
+			$sql_mode .= ',NO_AUTO_CREATE_USER';
+		}
+		self::$_link->exec('SET sql_mode = "' . $sql_mode . '"');
+
+		// return PDO instance
+		return self::$_link;
+	}
+
+	/**
+	 * display a nice error if it occurs and log everything
+	 *
+	 * @param \PDOException $error
+	 * @param bool $showerror
+	 *        	if set to false, the error will be logged but we go on
+	 */
+	private static function _showerror($error, $showerror = true, $json_response = false, \PDOStatement $stmt = null)
+	{
+		global $userinfo, $theme, $linker;
+
+		// include userdata.inc.php
+		require FROXLOR_INSTALL_DIR . "/lib/userdata.inc.php";
+
+		// le format
+		if (isset($sql['root_user']) && isset($sql['root_password']) && (! isset($sql_root) || ! is_array($sql_root))) {
+			$sql_root = array(
+				0 => array(
+					'caption' => 'Default',
+					'host' => $sql['host'],
+					'socket' => (isset($sql['socket']) ? $sql['socket'] : null),
+					'user' => $sql['root_user'],
+					'password' => $sql['root_password']
+				)
+			);
+		}
+
+		$substitutions = array(
+			$sql['password'] => 'DB_UNPRIV_PWD',
+			$sql_root[0]['password'] => 'DB_ROOT_PWD'
+		);
+
+		// hide username/password in messages
+		$error_message = $error->getMessage();
+		$error_trace = $error->getTraceAsString();
+		// error-message
+		$error_message = self::_substitute($error_message, $substitutions);
+		// error-trace
+		$error_trace = self::_substitute($error_trace, $substitutions);
+
+		if ($error->getCode() == 2003) {
+			$error_message = "Unable to connect to database. Either the mysql-server is not running or your user/password is wrong.";
+			$error_trace = "";
+		}
+
+		/**
+		 * log to a file, so we can actually ask people for the error
+		 * (no one seems to find the stuff in the syslog)
+		 */
+		$sl_dir = makeCorrectDir(FROXLOR_INSTALL_DIR . "/logs/");
+		if (! file_exists($sl_dir)) {
+			@mkdir($sl_dir, 0755);
+		}
+		openlog("froxlor", LOG_PID | LOG_PERROR, LOG_LOCAL0);
+		syslog(LOG_WARNING, str_replace("\n", " ", $error_message));
+		syslog(LOG_WARNING, str_replace("\n", " ", "--- DEBUG: " . $error_trace));
+		closelog();
+
+		/**
+		 * log error for reporting
+		 */
+		$errid = substr(md5(microtime()), 5, 5);
+		$err_file = makeCorrectFile($sl_dir . "/" . $errid . "_sql-error.log");
+		$errlog = @fopen($err_file, 'w');
+		@fwrite($errlog, "|CODE " . $error->getCode() . "\n");
+		@fwrite($errlog, "|MSG " . $error_message . "\n");
+		@fwrite($errlog, "|FILE " . $error->getFile() . "\n");
+		@fwrite($errlog, "|LINE " . $error->getLine() . "\n");
+		@fwrite($errlog, "|TRACE\n" . $error_trace . "\n");
+		@fclose($errlog);
+
+		if (empty($sql['debug'])) {
+			$error_trace = '';
+		} elseif (! is_null($stmt)) {
+			$error_trace .= "<br><br>" . $stmt->queryString;
+		}
+
+		if ($showerror && $json_response) {
+			$exception_message = $error_message;
+			if (isset($sql['debug']) && $sql['debug'] == true) {
+				$exception_message .= "\n\n" . $error_trace;
+			}
+			throw new \Exception($exception_message, 500);
+		}
+
+		if ($showerror) {
+			// fallback
+			$theme = 'Sparkle';
+
+			// clean up sensitive data
+			unset($sql);
+			unset($sql_root);
+
+			if ((isset($theme) && $theme != '') && ! isset($_SERVER['SHELL']) || (isset($_SERVER['SHELL']) && $_SERVER['SHELL'] == '')) {
+				// if we're not on the shell, output a nice error
+				$_errtpl = dirname($sl_dir) . '/templates/' . $theme . '/misc/dberrornice.tpl';
+				if (file_exists($_errtpl)) {
+					$err_hint = file_get_contents($_errtpl);
+					// replace values
+					$err_hint = str_replace("<TEXT>", $error_message, $err_hint);
+					$err_hint = str_replace("<DEBUG>", $error_trace, $err_hint);
+					$err_hint = str_replace("<CURRENT_YEAR>", date('Y', time()), $err_hint);
+
+					$err_report_html = '';
+					if (is_array($userinfo) && (($userinfo['adminsession'] == '1' && \Froxlor\Settings::Get('system.allow_error_report_admin') == '1') || ($userinfo['adminsession'] == '0' && \Froxlor\Settings::Get('system.allow_error_report_customer') == '1'))) {
+						$err_report_html = '<a href="<LINK>" title="Click here to report error">Report error</a>';
+						$err_report_html = str_replace("<LINK>", $linker->getLink(array(
+							'section' => 'index',
+							'page' => 'send_error_report',
+							'errorid' => $errid
+						)), $err_report_html);
+					}
+					$err_hint = str_replace("<REPORT>", $err_report_html, $err_hint);
+
+					// show
+					die($err_hint);
+				}
+			}
+			die("We are sorry, but a MySQL - error occurred. The administrator may find more information in the syslog");
+		}
+	}
+
+	/**
+	 * Substitutes patterns in content.
+	 *
+	 * @param string $content
+	 * @param array $substitutions
+	 * @param int $minLength
+	 * @return string
+	 */
+	private static function _substitute($content, array $substitutions, $minLength = 6)
+	{
+		$replacements = array();
+
+		foreach ($substitutions as $search => $replace) {
+			$replacements = $replacements + self::_createShiftedSubstitutions($search, $replace, $minLength);
+		}
+
+		$content = str_replace(array_keys($replacements), array_values($replacements), $content);
+
+		return $content;
+	}
+
+	/**
+	 * Creates substitutions, shifted by length, e.g.
+	 *
+	 * _createShiftedSubstitutions('abcdefgh', 'value', 4):
+	 * array(
+	 * 'abcdefgh' => 'value',
+	 * 'abcdefg' => 'value',
+	 * 'abcdef' => 'value',
+	 * 'abcde' => 'value',
+	 * 'abcd' => 'value',
+	 * )
+	 *
+	 * @param string $search
+	 * @param string $replace
+	 * @param int $minLength
+	 * @return array
+	 */
+	private static function _createShiftedSubstitutions($search, $replace, $minLength)
+	{
+		$substitutions = array();
+		$length = strlen($search);
+
+		if ($length > $minLength) {
+			for ($shiftedLength = $length; $shiftedLength >= $minLength; $shiftedLength --) {
+				$substitutions[substr($search, 0, $shiftedLength)] = $replace;
+			}
+		}
+
+		return $substitutions;
+	}
+}

lib/Froxlor/FileDir.php

@@ -0,0 +1,356 @@
+<?php
+namespace Froxlor;
+
+use Froxlor\Database as Database;
+
+class FileDir
+{
+
+	/**
+	 * Wrapper around the exec command.
+	 *
+	 * @param string $exec_string
+	 *        	command to be executed
+	 * @param string $return_value
+	 *        	referenced variable where the output is stored
+	 * @param array $allowedChars
+	 *        	optional array of allowed characters in path/command
+	 *        	
+	 * @return string result of exec()
+	 */
+	public static function safe_exec($exec_string, &$return_value = false, $allowedChars = null)
+	{
+		$disallowed = array(
+			';',
+			'|',
+			'&',
+			'>',
+			'<',
+			'`',
+			'$',
+			'~',
+			'?'
+		);
+
+		$acheck = false;
+		if ($allowedChars != null && is_array($allowedChars) && count($allowedChars) > 0) {
+			$acheck = true;
+		}
+
+		foreach ($disallowed as $dc) {
+			if ($acheck && in_array($dc, $allowedChars))
+				continue;
+			// check for bad signs in execute command
+			if (stristr($exec_string, $dc)) {
+				die("SECURITY CHECK FAILED!\nThe execute string '" . $exec_string . "' is a possible security risk!\nPlease check your whole server for security problems by hand!\n");
+			}
+		}
+
+		// execute the command and return output
+		$return = '';
+
+		// -------------------------------------------------------------------------------
+		if ($return_value == false) {
+			exec($exec_string, $return);
+		} else {
+			exec($exec_string, $return, $return_value);
+		}
+
+		return $return;
+	}
+
+	/**
+	 * Creates a directory below a users homedir and sets all directories,
+	 * which had to be created below with correct Owner/Group
+	 * (Copied from cron_tasks.php:rev1189 as we'll need this more often in future)
+	 *
+	 * @param string $homeDir
+	 *        	The homedir of the user
+	 * @param string $dirToCreate
+	 *        	The dir which should be created
+	 * @param int $uid
+	 *        	The uid of the user
+	 * @param int $gid
+	 *        	The gid of the user
+	 * @param bool $placeindex
+	 *        	Place standard-index.html into the new folder
+	 * @param bool $allow_notwithinhomedir
+	 *        	Allow creating a directory out of the customers docroot
+	 *        	
+	 * @return bool true if everything went okay, false if something went wrong
+	 */
+	public static function mkDirWithCorrectOwnership($homeDir, $dirToCreate, $uid, $gid, $placeindex = false, $allow_notwithinhomedir = false)
+	{
+		if ($homeDir != '' && $dirToCreate != '') {
+			$homeDir = self::makeCorrectDir($homeDir);
+			$dirToCreate = self::makeCorrectDir($dirToCreate);
+
+			if (substr($dirToCreate, 0, strlen($homeDir)) == $homeDir) {
+				$subdir = substr($dirToCreate, strlen($homeDir) - 1);
+				$within_homedir = true;
+			} else {
+				$subdir = $dirToCreate;
+				$within_homedir = false;
+			}
+
+			$subdir = self::makeCorrectDir($subdir);
+			$subdirs = array();
+
+			if ($within_homedir || ! $allow_notwithinhomedir) {
+				$subdirlen = strlen($subdir);
+				$offset = 0;
+
+				while ($offset < $subdirlen) {
+					$offset = strpos($subdir, '/', $offset);
+					$subdirelem = substr($subdir, 0, $offset);
+					$offset ++;
+					array_push($subdirs, self::makeCorrectDir($homeDir . $subdirelem));
+				}
+			} else {
+				array_push($subdirs, $dirToCreate);
+			}
+
+			$subdirs = array_unique($subdirs);
+			sort($subdirs);
+			foreach ($subdirs as $sdir) {
+				if (! is_dir($sdir)) {
+					$sdir = self::makeCorrectDir($sdir);
+					self::safe_exec('mkdir -p ' . escapeshellarg($sdir));
+					// place index
+					if ($placeindex) {
+						// @fixme
+						$loginname = getLoginNameByUid($uid);
+						if ($loginname !== false) {
+							// @fixme
+							storeDefaultIndex($loginname, $sdir, null);
+						}
+					}
+					self::safe_exec('chown -R ' . (int) $uid . ':' . (int) $gid . ' ' . escapeshellarg($sdir));
+				}
+			}
+			return true;
+		}
+		return false;
+	}
+
+	/**
+	 * store the default index-file in a given destination folder
+	 *
+	 * @param string  $loginname   customers loginname
+	 * @param string  $destination path where to create the file
+	 * @param object  $logger      FroxlorLogger object
+	 * @param boolean $force       force creation whatever the settings say (needed for task #2, create new user)
+	 *
+	 * @return null
+	 */
+	public static function storeDefaultIndex($loginname = null, $destination = null, $logger = null, $force = false) {
+		
+		if ($force
+			|| (int)Settings::Get('system.store_index_file_subs') == 1
+			) {
+				$result_stmt = Database::prepare("
+			SELECT `t`.`value`, `c`.`email` AS `customer_email`, `a`.`email` AS `admin_email`, `c`.`loginname` AS `customer_login`, `a`.`loginname` AS `admin_login`
+			FROM `" . TABLE_PANEL_CUSTOMERS . "` AS `c` INNER JOIN `" . TABLE_PANEL_ADMINS . "` AS `a`
+			ON `c`.`adminid` = `a`.`adminid`
+			INNER JOIN `" . TABLE_PANEL_TEMPLATES . "` AS `t`
+			ON `a`.`adminid` = `t`.`adminid`
+			WHERE `varname` = 'index_html' AND `c`.`loginname` = :loginname");
+				Database::pexecute($result_stmt, array('loginname' => $loginname));
+				
+				if (Database::num_rows() > 0) {
+					
+					$template = $result_stmt->fetch(\PDO::FETCH_ASSOC);
+					
+					$replace_arr = array(
+						'SERVERNAME' => Settings::Get('system.hostname'),
+						'CUSTOMER' => $template['customer_login'],
+						'ADMIN' => $template['admin_login'],
+						'CUSTOMER_EMAIL' => $template['customer_email'],
+						'ADMIN_EMAIL' => $template['admin_email']
+					);
+					
+					// @fixme replace_variables
+					$htmlcontent = PhpHelper::replace_variables($template['value'], $replace_arr);
+					$indexhtmlpath = self::makeCorrectFile($destination . '/index.' . Settings::Get('system.index_file_extension'));
+					$index_html_handler = fopen($indexhtmlpath, 'w');
+					fwrite($index_html_handler, $htmlcontent);
+					fclose($index_html_handler);
+					if ($logger !== null) {
+						$logger->logAction(CRON_ACTION, LOG_NOTICE, 'Creating \'index.' . Settings::Get('system.index_file_extension') . '\' for Customer \'' . $template['customer_login'] . '\' based on template in directory ' . escapeshellarg($indexhtmlpath));
+					}
+					
+				} else {
+					$destination = self::makeCorrectDir($destination);
+					if ($logger !== null) {
+						$logger->logAction(CRON_ACTION, LOG_NOTICE, 'Running: cp -a ' . FROXLOR_INSTALL_DIR . '/templates/misc/standardcustomer/* ' . escapeshellarg($destination));
+					}
+					self::safe_exec('cp -a ' . FROXLOR_INSTALL_DIR . '/templates/misc/standardcustomer/* ' . escapeshellarg($destination));
+				}
+			}
+			return;
+	}
+
+	/**
+	 * Function which returns a correct filename, means to add a slash at the beginning if there wasn't one
+	 *
+	 * @param string $filename
+	 *        	the filename
+	 *        	
+	 * @return string the corrected filename
+	 */
+	public static function makeCorrectFile($filename)
+	{
+		if (! isset($filename) || trim($filename) == '') {
+			$error = 'Given filename for function ' . __FUNCTION__ . ' is empty.' . "\n";
+			$error .= 'This is very dangerous and should not happen.' . "\n";
+			$error .= 'Please inform the Froxlor team about this issue so they can fix it.';
+			echo $error;
+			// so we can see WHERE this happened
+			debug_print_backtrace();
+			die();
+		}
+
+		if (substr($filename, 0, 1) != '/') {
+			$filename = '/' . $filename;
+		}
+
+		$filename = self::makeSecurePath($filename);
+		return $filename;
+	}
+
+	/**
+	 * Function which returns a correct dirname, means to add slashes at the beginning and at the end if there weren't some
+	 *
+	 * @param string $path
+	 *        	the path to correct
+	 *        	
+	 * @throws \Exception
+	 * @return string the corrected path
+	 */
+	public static function makeCorrectDir($dir)
+	{
+		if (is_string($dir) && strlen($dir) > 0) {
+			$dir = trim($dir);
+			if (substr($dir, - 1, 1) != '/') {
+				$dir .= '/';
+			}
+			if (substr($dir, 0, 1) != '/') {
+				$dir = '/' . $dir;
+			}
+			return self::makeSecurePath($dir);
+		}
+		throw new \Exception("Cannot validate directory in " . __FUNCTION__ . " which is very dangerous.");
+	}
+
+	/**
+	 * Function which returns a secure path, means to remove all multiple dots and slashes
+	 *
+	 * @param string $path
+	 *        	the path to secure
+	 *        	
+	 * @return string the corrected path
+	 */
+	public static function makeSecurePath($path)
+	{
+
+		// check for bad characters, some are allowed with escaping
+		// but we generally don't want them in our directory-names,
+		// thx to aaronmueller for this snipped
+		$badchars = array(
+			':',
+			';',
+			'|',
+			'&',
+			'>',
+			'<',
+			'`',
+			'$',
+			'~',
+			'?',
+			"\0"
+		);
+		foreach ($badchars as $bc) {
+			$path = str_replace($bc, "", $path);
+		}
+
+		$search = array(
+			'#/+#',
+			'#\.+#'
+		);
+		$replace = array(
+			'/',
+			'.'
+		);
+		$path = preg_replace($search, $replace, $path);
+		// don't just replace a space with an escaped space
+		// it might be escaped already
+		$path = str_replace("\ ", " ", $path);
+		$path = str_replace(" ", "\ ", $path);
+
+		return $path;
+	}
+
+	/**
+	 * check if the system is FreeBSD (if exact)
+	 * or BSD-based (NetBSD, OpenBSD, etc.
+	 * if exact = false [default])
+	 *
+	 * @param boolean $exact
+	 *        	whether to check explicitly for FreeBSD or *BSD
+	 *        	
+	 * @return boolean
+	 */
+	public static function isFreeBSD($exact = false)
+	{
+		if (($exact && PHP_OS == 'FreeBSD') || (! $exact && stristr(PHP_OS, 'BSD'))) {
+			return true;
+		}
+		return false;
+	}
+
+	/**
+	 * set the immutable flag for a file
+	 *
+	 * @param string $filename
+	 *        	the file to set the flag for
+	 *        	
+	 * @return boolean
+	 */
+	public static function setImmutable($filename = null)
+	{
+		safe_exec(self::getImmutableFunction(false) . escapeshellarg($filename));
+	}
+
+	/**
+	 * removes the immutable flag for a file
+	 *
+	 * @param string $filename
+	 *        	the file to set the flag for
+	 *        	
+	 * @return boolean
+	 */
+	public static function removeImmutable($filename = null)
+	{
+		safe_exec(self::getImmutableFunction(true) . escapeshellarg($filename));
+	}
+
+	/**
+	 * internal function to check whether
+	 * to use chattr (Linux) or chflags (FreeBSD)
+	 *
+	 * @param boolean $remove
+	 *        	whether to use +i|schg (false) or -i|noschg (true)
+	 *        	
+	 * @return string functionname + parameter (not the file)
+	 */
+	private static function getImmutableFunction($remove = false)
+	{
+		if (self::isFreeBSD()) {
+			// FreeBSD style
+			return 'chflags ' . (($remove === true) ? 'noschg ' : 'schg ');
+		} else {
+			// Linux style
+			return 'chattr ' . (($remove === true) ? '-i ' : '+i ');
+		}
+	}
+}

lib/Froxlor/PhpHelper.php

@@ -0,0 +1,147 @@
+<?php
+namespace Froxlor;
+
+class PhpHelper
+{
+
+	/**
+	 * ipv6 aware gethostbynamel function
+	 *
+	 * @param string $host
+	 * @param boolean $try_a
+	 *        	default true
+	 * @return boolean|array
+	 */
+	public static function gethostbynamel6($host, $try_a = true)
+	{
+		$dns6 = dns_get_record($host, DNS_AAAA);
+		if ($try_a == true) {
+			$dns4 = dns_get_record($host, DNS_A);
+			$dns = array_merge($dns4, $dns6);
+		} else {
+			$dns = $dns6;
+		}
+		$ips = array();
+		foreach ($dns as $record) {
+			if ($record["type"] == "A") {
+				$ips[] = $record["ip"];
+			}
+			if ($record["type"] == "AAAA") {
+				$ips[] = $record["ipv6"];
+			}
+		}
+		if (count($ips) < 1) {
+			return false;
+		} else {
+			return $ips;
+		}
+	}
+
+	/**
+	 * Return human readable sizes
+	 *
+	 * @param int $size
+	 *        	size in bytes
+	 * @param string $max
+	 *        	maximum unit
+	 * @param string $system
+	 *        	'si' for SI, 'bi' for binary prefixes
+	 *
+	 * @param string
+	 */
+	public static function size_readable($size, $max = null, $system = 'si', $retstring = '%01.2f %s')
+	{
+		// Pick units
+		$systems = array(
+			'si' => array(
+				'prefix' => array(
+					'B',
+					'KB',
+					'MB',
+					'GB',
+					'TB',
+					'PB'
+				),
+				'size' => 1000
+			),
+			'bi' => array(
+				'prefix' => array(
+					'B',
+					'KiB',
+					'MiB',
+					'GiB',
+					'TiB',
+					'PiB'
+				),
+				'size' => 1024
+			)
+		);
+		$sys = isset($systems[$system]) ? $systems[$system] : $systems['si'];
+
+		// Max unit to display
+		$depth = count($sys['prefix']) - 1;
+		if ($max && false !== $d = array_search($max, $sys['prefix'])) {
+			$depth = $d;
+		}
+		// Loop
+		$i = 0;
+		while ($size >= $sys['size'] && $i < $depth) {
+			$size /= $sys['size'];
+			$i ++;
+		}
+
+		return sprintf($retstring, $size, $sys['prefix'][$i]);
+	}
+
+	/**
+	 * Replaces all occurrences of variables defined in the second argument
+	 * in the first argument with their values.
+	 *
+	 * @param string $text
+	 *        	The string that should be searched for variables
+	 * @param array $vars
+	 *        	The array containing the variables with their values
+	 *        	
+	 * @return string The submitted string with the variables replaced.
+	 */
+	public static function replace_variables($text, $vars)
+	{
+		$pattern = "/\{([a-zA-Z0-9\-_]+)\}/";
+		$matches = array();
+
+		if (count($vars) > 0 && preg_match_all($pattern, $text, $matches)) {
+			for ($i = 0; $i < count($matches[1]); $i ++) {
+				$current = $matches[1][$i];
+
+				if (isset($vars[$current])) {
+					$var = $vars[$current];
+					$text = str_replace("{" . $current . "}", $var, $text);
+				}
+			}
+		}
+
+		$text = str_replace('\n', "\n", $text);
+		return $text;
+	}
+
+	/**
+	 * Returns array with all empty-values removed
+	 *
+	 * @param array $source
+	 *        	The array to trim
+	 * @return array The trim'med array
+	 */
+	function array_trim($source)
+	{
+		$returnval = array();
+		if (is_array($source)) {
+			$source = array_map('trim', $source);
+			$source = array_filter($source, function ($value) {
+				return $value !== '';
+			});
+		} else {
+			$returnval = $source;
+		}
+		return $returnval;
+	}
+}

lib/Froxlor/Settings.php

@@ -0,0 +1,291 @@
+<?php
+
+namespace Froxlor;
+
+use Froxlor\Database as Database;
+
+/**
+ * This file is part of the Froxlor project.
+ * Copyright (c) 2010 the Froxlor Team (see authors).
+ *
+ * For the full copyright and license information, please view the COPYING
+ * file that was distributed with this source code. You can also view the
+ * COPYING file online at http://files.froxlor.org/misc/COPYING.txt
+ *
+ * @copyright  (c) the authors
+ * @author     Michael Kaufmann <mkaufmann@nutime.de>
+ * @author     Froxlor team <team@froxlor.org> (2010-)
+ * @license    GPLv2 http://files.froxlor.org/misc/COPYING.txt
+ * @package    Classes
+ *
+ * @since      0.9.31
+ *
+ */
+
+/**
+ * Class Settings
+ *
+ * Interaction with settings from the db
+ *
+ * @copyright  (c) the authors
+ * @author     Michael Kaufmann <mkaufmann@nutime.de>
+ * @author     Froxlor team <team@froxlor.org> (2010-)
+ * @license    GPLv2 http://files.froxlor.org/misc/COPYING.txt
+ * @package    Classes
+ * 
+ * @method static mixed Get ($setting = null) return a setting-value by its group and varname separated by a dot (group.varname)
+ * @method static boolean Set ($setting = null, $value = null, $instant_save = true) update a setting / set a new value
+ * @method static boolean IsInList ($setting = null, $entry = null) tests if a setting-value that i s a comma separated list contains an entry
+ * @method static boolean AddNew ($setting = null, $value = null) add a new setting to the database (mainly used in updater)
+ * @method static boolean Flush () Store all un-saved changes to the database and re-read in all settings
+ * @method static void Stash () forget all un-saved changes to settings
+ */
+class Settings {
+
+	/**
+	 * current settings object
+	 *
+	 * @var object
+	 */
+	private static $_obj = null;
+
+	/**
+	 * settings data
+	 *
+	 * @var array
+	 */
+	private static $_data = null;
+
+	/**
+	 * changed and unsaved settings data
+	 *
+	 * @var array
+	 */
+	private static $_updatedata = null;
+
+	/**
+	 * prepared statement for updating the
+	 * settings table
+	 *
+	 * @var \PDOStatement
+	 */
+	private static $_updstmt = null;
+
+	/**
+	 * private constructor, reads in all settings
+	 */
+	private function __construct() {
+		$this->_readSettings();
+		self::$_updatedata = array();
+		// prepare statement
+		self::$_updstmt = Database::prepare("
+				UPDATE `".TABLE_PANEL_SETTINGS."` SET `value` = :value
+				WHERE `settinggroup` = :group AND `varname` = :varname
+				");
+	}
+
+	/**
+	 * Read in all settings from the database
+	 * and set the internal $_data array
+	 */
+	private function _readSettings() {
+		$result_stmt = Database::query("
+				SELECT `settingid`, `settinggroup`, `varname`, `value`
+				FROM `" . TABLE_PANEL_SETTINGS . "`
+				");
+		self::$_data = array();
+		while ($row = $result_stmt->fetch(\PDO::FETCH_ASSOC)) {
+			self::$_data[$row['settinggroup']][$row['varname']] = $row['value'];
+		}
+		return true;
+	}
+
+	/**
+	 * update a value in the database
+	 *
+	 * @param string $group
+	 * @param string $varname
+	 * @param string $value
+	 */
+	private function _storeSetting($group = null, $varname = null, $value = null) {
+		$upd_data = array(
+				'group' => $group,
+				'varname' => $varname,
+				'value' => $value
+		);
+		Database::pexecute(self::$_updstmt, $upd_data);
+	}
+
+	/**
+	 * return a setting-value by its group and varname
+	 *
+	 * @param string $setting a group and a varname separated by a dot (group.varname)
+	 *
+	 * @return mixed
+	 */
+	public function pGet($setting = null) {
+		$sstr = explode(".", $setting);
+		// no separator - do'h
+		if (!isset($sstr[1])) {
+			return null;
+		}
+		$result = null;
+		if (isset(self::$_data[$sstr[0]][$sstr[1]])) {
+			$result = self::$_data[$sstr[0]][$sstr[1]];
+		}
+		return $result;
+	}
+
+	/**
+	 * tests if a setting-value that i s a comma separated list contains an entry
+	 *
+	 * @param string $setting a group and a varname separated by a dot (group.varname)
+	 * @param string $entry the entry that is expected to be in the list
+	 *
+	 * @return boolean true, if the list contains $entry
+	 */
+	public function pIsInList($setting = null, $entry = null) {
+		$s=Settings::Get($setting);
+		if ($s==null) {
+			return false;
+		}
+		$slist = explode(",",$s);
+		return in_array($entry, $slist);
+	}
+
+	/**
+	 * update a setting / set a new value
+	 *
+	 * @param string $setting a group and a varname separated by a dot (group.varname)
+	 * @param string $value
+	 * @param boolean $instant_save
+	 *
+	 * @return bool
+	 */
+	public function pSet($setting = null, $value = null, $instant_save = true) {
+		// check whether the setting exists
+		if (Settings::Get($setting) !== null) {
+			// set new value in array
+			$sstr = explode(".", $setting);
+			if (!isset($sstr[1])) {
+				return false;
+			}
+			self::$_data[$sstr[0]][$sstr[1]] = $value;
+			// should we store to db instantly?
+			if ($instant_save) {
+				$this->_storeSetting($sstr[0], $sstr[1], $value);
+			} else {
+				// set temporary data for usage
+				if (!isset(self::$_data[$sstr[0]]) || !is_array(self::$_data[$sstr[0]])) {
+					self::$_data[$sstr[0]] = array();
+				}
+				self::$_data[$sstr[0]][$sstr[1]] = $value;
+				// set update-data when invoking Flush()
+				if (!isset(self::$_updatedata[$sstr[0]]) || !is_array(self::$_updatedata[$sstr[0]])) {
+					self::$_updatedata[$sstr[0]] = array();
+				}
+				self::$_updatedata[$sstr[0]][$sstr[1]] = $value;
+			}
+			return true;
+		}
+		return false;
+	}
+
+	/**
+	 * add a new setting to the database (mainly used in updater)
+	 *
+	 * @param string $setting a group and a varname separated by a dot (group.varname)
+	 * @param string $value
+	 *
+	 * @return boolean
+	 */
+	public function pAddNew($setting = null, $value = null) {
+
+		// first check if it doesn't exist
+		if (Settings::Get($setting) === null) {
+			// validate parameter
+			$sstr = explode(".", $setting);
+			if (!isset($sstr[1])) {
+				return false;
+			}
+			// prepare statement
+			$ins_stmt = Database::prepare("
+					INSERT INTO `".TABLE_PANEL_SETTINGS."` SET
+					`settinggroup` = :group,
+					`varname` = :varname,
+					`value` = :value
+					");
+			$ins_data = array(
+					'group' => $sstr[0],
+					'varname' => $sstr[1],
+					'value' => $value
+			);
+			Database::pexecute($ins_stmt, $ins_data);
+			// also set new value to internal array and make it available
+			self::$_data[$sstr[0]][$sstr[1]] = $value;
+			return true;
+		}
+		return false;
+	}
+
+	/**
+	 * Store all un-saved changes to the database and
+	 * re-read in all settings
+	 */
+	public function pFlush() {
+		if (is_array(self::$_updatedata) && count(self::$_updatedata) > 0) {
+			// save all un-saved changes to the settings
+			foreach (self::$_updatedata as $group => $vargroup) {
+				foreach ($vargroup as $varname => $value) {
+					$this->_storeSetting($group, $varname, $value);
+				}
+			}
+			// now empty the array
+			self::$_updatedata = array();
+			// re-read in all settings
+			return $this->_readSettings();
+		}
+		return false;
+	}
+
+	/**
+	 * forget all un-saved changes to settings
+	 */
+	public function pStash() {
+		// empty update array
+		self::$_updatedata = array();
+	}
+
+	/**
+	 * create new object and return instance
+	 *
+	 * @return object
+	 */
+	private static function getInstance() {
+		// do we got an object already?
+		if (self::$_obj == null) {
+			self::$_obj = new self();
+		}
+		// return it
+		return self::$_obj;
+	}
+
+	/**
+	 * let's us interact with the settings-Object by using static
+	 * call like "Settings::function()"
+	 *
+	 * @param string $name
+	 * @param mixed $args
+	 *
+	 * @return mixed
+	 */
+	public static function __callStatic($name, $args) {
+		// as our functions are not static and therefore cannot
+		// be called statically, we prefix a 'p' to all of
+		// our public functions so we can use Settings::functionname()
+		// which looks cooler and is easier to use
+		$callback = array(self::getInstance(), "p".$name);
+		$result = call_user_func_array($callback, $args);
+		return $result;
+	}
+}