<?php

// $Id: bootstrap.inc,v 1.206.2.12 2009/04/30 00:13:30 goba Exp $

/**

 * @file

 * Functions that need to be loaded on every Drupal request.

 */

/**

 * Indicates that the item should never be removed unless explicitly told to

 * using cache_clear_all() with a cache ID.

 */

define('CACHE_PERMANENT', 0);

/**

 * Indicates that the item should be removed at the next general cache wipe.

 */

define('CACHE_TEMPORARY', -1);

/**

 * Indicates that page caching is disabled.

 */

define('CACHE_DISABLED', 0);

/**

 * Indicates that page caching is enabled, using "normal" mode.

 */

define('CACHE_NORMAL', 1);

/**

 * Indicates that page caching is using "aggressive" mode. This bypasses

 * loading any modules for additional speed, which may break functionality in

 * modules that expect to be run on each page load.

 */

define('CACHE_AGGRESSIVE', 2);

/**

 *

 * Severity levels, as defined in RFC 3164 http://www.faqs.org/rfcs/rfc3164.html

 * @see watchdog()

 * @see watchdog_severity_levels()

 */

define('WATCHDOG_EMERG',    0); // Emergency: system is unusable

define('WATCHDOG_ALERT',    1); // Alert: action must be taken immediately

define('WATCHDOG_CRITICAL', 2); // Critical: critical conditions

define('WATCHDOG_ERROR',    3); // Error: error conditions

define('WATCHDOG_WARNING',  4); // Warning: warning conditions

define('WATCHDOG_NOTICE',   5); // Notice: normal but significant condition

define('WATCHDOG_INFO',     6); // Informational: informational messages

define('WATCHDOG_DEBUG',    7); // Debug: debug-level messages

/**

 * First bootstrap phase: initialize configuration.

 */

define('DRUPAL_BOOTSTRAP_CONFIGURATION', 0);

/**

 * Second bootstrap phase: try to call a non-database cache

 * fetch routine.

 */

define('DRUPAL_BOOTSTRAP_EARLY_PAGE_CACHE', 1);

/**

 * Third bootstrap phase: initialize database layer.

 */

define('DRUPAL_BOOTSTRAP_DATABASE', 2);

/**

 * Fourth bootstrap phase: identify and reject banned hosts.

 */

define('DRUPAL_BOOTSTRAP_ACCESS', 3);

/**

 * Fifth bootstrap phase: initialize session handling.

 */

define('DRUPAL_BOOTSTRAP_SESSION', 4);

/**

 * Sixth bootstrap phase: load bootstrap.inc and module.inc, start

 * the variable system and try to serve a page from the cache.

 */

define('DRUPAL_BOOTSTRAP_LATE_PAGE_CACHE', 5);

/**

 * Seventh bootstrap phase: find out language of the page.

 */

define('DRUPAL_BOOTSTRAP_LANGUAGE', 6);

/**

 * Eighth bootstrap phase: set $_GET['q'] to Drupal path of request.

 */

define('DRUPAL_BOOTSTRAP_PATH', 7);

/**

 * Final bootstrap phase: Drupal is fully loaded; validate and fix

 * input data.

 */

define('DRUPAL_BOOTSTRAP_FULL', 8);

/**

 * Role ID for anonymous users; should match what's in the "role" table.

 */

define('DRUPAL_ANONYMOUS_RID', 1);

/**

 * Role ID for authenticated users; should match what's in the "role" table.

 */

define('DRUPAL_AUTHENTICATED_RID', 2);

/**

 * No language negotiation. The default language is used.

 */

define('LANGUAGE_NEGOTIATION_NONE', 0);

/**

 * Path based negotiation with fallback to default language

 * if no defined path prefix identified.

 */

define('LANGUAGE_NEGOTIATION_PATH_DEFAULT', 1);

/**

 * Path based negotiation with fallback to user preferences

 * and browser language detection if no defined path prefix

 * identified.

 */

define('LANGUAGE_NEGOTIATION_PATH', 2);

/**

 * Domain based negotiation with fallback to default language

 * if no language identified by domain.

 */

define('LANGUAGE_NEGOTIATION_DOMAIN', 3);

/**

 * Language written left to right. Possible value of $language->direction.

 */

define('LANGUAGE_LTR', 0);

/**

 * Language written right to left. Possible value of $language->direction.

 */

define('LANGUAGE_RTL', 1);

/**

 * Start the timer with the specified name. If you start and stop

 * the same timer multiple times, the measured intervals will be

 * accumulated.

 *

 * @param name

 *   The name of the timer.

 */

function timer_start($name) {

  global $timers;

  list($usec, $sec) = explode(' ', microtime());

  $timers[$name]['start'] = (float)$usec + (float)$sec;

  $timers[$name]['count'] = isset($timers[$name]['count']) ? ++$timers[$name]['count'] : 1;

}

/**

 * Read the current timer value without stopping the timer.

 *

 * @param name

 *   The name of the timer.

 * @return

 *   The current timer value in ms.

 */

function timer_read($name) {

  global $timers;

  if (isset($timers[$name]['start'])) {

    list($usec, $sec) = explode(' ', microtime());

    $stop = (float)$usec + (float)$sec;

    $diff = round(($stop - $timers[$name]['start']) * 1000, 2);

    if (isset($timers[$name]['time'])) {

      $diff += $timers[$name]['time'];

    }

    return $diff;

  }

}

/**

 * Stop the timer with the specified name.

 *

 * @param name

 *   The name of the timer.

 * @return

 *   A timer array. The array contains the number of times the

 *   timer has been started and stopped (count) and the accumulated

 *   timer value in ms (time).

 */

function timer_stop($name) {

  global $timers;

  $timers[$name]['time'] = timer_read($name);

  unset($timers[$name]['start']);

  return $timers[$name];

}

/**

 * Find the appropriate configuration directory.

 *

 * Try finding a matching configuration directory by stripping the website's

 * hostname from left to right and pathname from right to left. The first

 * configuration file found will be used; the remaining will ignored. If no

 * configuration file is found, return a default value '$confdir/default'.

 *

 * Example for a fictitious site installed at

 * http://www.drupal.org:8080/mysite/test/ the 'settings.php' is searched in

 * the following directories:

 *

 *  1. $confdir/8080.www.drupal.org.mysite.test

 *  2. $confdir/www.drupal.org.mysite.test

 *  3. $confdir/drupal.org.mysite.test

 *  4. $confdir/org.mysite.test

 *

 *  5. $confdir/8080.www.drupal.org.mysite

 *  6. $confdir/www.drupal.org.mysite

 *  7. $confdir/drupal.org.mysite

 *  8. $confdir/org.mysite

 *

 *  9. $confdir/8080.www.drupal.org

 * 10. $confdir/www.drupal.org

 * 11. $confdir/drupal.org

 * 12. $confdir/org

 *

 * 13. $confdir/default

 *

 * @param $require_settings

 *   Only configuration directories with an existing settings.php file

 *   will be recognized. Defaults to TRUE. During initial installation,

 *   this is set to FALSE so that Drupal can detect a matching directory,

 *   then create a new settings.php file in it.

 * @param reset

 *   Force a full search for matching directories even if one had been

 *   found previously.

 * @return

 *   The path of the matching directory.

 */

function conf_path($require_settings = TRUE, $reset = FALSE) {

  static $conf = '';

  if ($conf && !$reset) {

    return $conf;

  }

  $confdir = 'sites';

  $uri = explode('/', $_SERVER['SCRIPT_NAME'] ? $_SERVER['SCRIPT_NAME'] : $_SERVER['SCRIPT_FILENAME']);

  $server = explode('.', implode('.', array_reverse(explode(':', rtrim($_SERVER['HTTP_HOST'], '.')))));

  for ($i = count($uri) - 1; $i > 0; $i--) {

    for ($j = count($server); $j > 0; $j--) {

      $dir = implode('.', array_slice($server, -$j)) . implode('.', array_slice($uri, 0, $i));

      if (file_exists("$confdir/$dir/settings.php") || (!$require_settings && file_exists("$confdir/$dir"))) {

        $conf = "$confdir/$dir";

        return $conf;

      }

    }

  }

  $conf = "$confdir/default";

  return $conf;

}

/**

 * Unsets all disallowed global variables. See $allowed for what's allowed.

 */

function drupal_unset_globals() {

  if (ini_get('register_globals')) {

    $allowed = array('_ENV' => 1, '_GET' => 1, '_POST' => 1, '_COOKIE' => 1, '_FILES' => 1, '_SERVER' => 1, '_REQUEST' => 1, 'GLOBALS' => 1);

    foreach ($GLOBALS as $key => $value) {

      if (!isset($allowed[$key])) {

        unset($GLOBALS[$key]);

      }

    }

  }

}

/**

 * Validate that a hostname (for example $_SERVER['HTTP_HOST']) is safe.

 *

 * As $_SERVER['HTTP_HOST'] is user input, ensure it only contains characters

 * allowed in hostnames.  See RFC 952 (and RFC 2181). $_SERVER['HTTP_HOST'] is

 * lowercased.

 *

 * @return

 *  TRUE if only containing valid characters, or FALSE otherwise.

 */

function drupal_valid_http_host($host) {

  return preg_match('/^\[?(?:[a-z0-9-:\]_]+\.?)+$/', $host);

}

/**

 * Loads the configuration and sets the base URL, cookie domain, and

 * session name correctly.

 */

function conf_init() {

  global $base_url, $base_path, $base_root;

  // Export the following settings.php variables to the global namespace

  global $db_url, $db_prefix, $cookie_domain, $conf, $installed_profile, $update_free_access;

  $conf = array();

  if (isset($_SERVER['HTTP_HOST'])) {

    // As HTTP_HOST is user input, ensure it only contains characters allowed

    // in hostnames. See RFC 952 (and RFC 2181).

    // $_SERVER['HTTP_HOST'] is lowercased here per specifications.

    $_SERVER['HTTP_HOST'] = strtolower($_SERVER['HTTP_HOST']);

    if (!drupal_valid_http_host($_SERVER['HTTP_HOST'])) {

      // HTTP_HOST is invalid, e.g. if containing slashes it may be an attack.

      header('HTTP/1.1 400 Bad Request');

      exit;

    }

  }

  else {

    // Some pre-HTTP/1.1 clients will not send a Host header. Ensure the key is

    // defined for E_ALL compliance.

    $_SERVER['HTTP_HOST'] = '';

  }

  if (file_exists('./'. conf_path() .'/settings.php')) {

    include_once './'. conf_path() .'/settings.php';

  }

  // Ignore the placeholder url from default.settings.php.

  if (isset($db_url) && $db_url == 'mysql://username:password@localhost/databasename') {

    $db_url = '';

  }

  if (isset($base_url)) {

    // Parse fixed base URL from settings.php.

    $parts = parse_url($base_url);

    if (!isset($parts['path'])) {

      $parts['path'] = '';

    }

    $base_path = $parts['path'] .'/';

    // Build $base_root (everything until first slash after "scheme://").

    $base_root = substr($base_url, 0, strlen($base_url) - strlen($parts['path']));

  }

  else {

    // Create base URL

    $base_root = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? 'https' : 'http';

    $base_url = $base_root .= '://'. $_SERVER['HTTP_HOST'];

    // $_SERVER['SCRIPT_NAME'] can, in contrast to $_SERVER['PHP_SELF'], not

    // be modified by a visitor.

    if ($dir = trim(dirname($_SERVER['SCRIPT_NAME']), '\,/')) {

      $base_path = "/$dir";

      $base_url .= $base_path;

      $base_path .= '/';

    }

    else {

      $base_path = '/';

    }

  }

  if ($cookie_domain) {

    // If the user specifies the cookie domain, also use it for session name.

    $session_name = $cookie_domain;

  }

  else {

    // Otherwise use $base_url as session name, without the protocol

    // to use the same session identifiers across http and https.

    list( , $session_name) = explode('://', $base_url, 2);

    // We escape the hostname because it can be modified by a visitor.

    if (!empty($_SERVER['HTTP_HOST'])) {

      $cookie_domain = check_plain($_SERVER['HTTP_HOST']);

    }

  }

  // To prevent session cookies from being hijacked, a user can configure the

  // SSL version of their website to only transfer session cookies via SSL by

  // using PHP's session.cookie_secure setting. The browser will then use two

  // separate session cookies for the HTTPS and HTTP versions of the site. So we

  // must use different session identifiers for HTTPS and HTTP to prevent a

  // cookie collision.

  if (ini_get('session.cookie_secure')) {

    $session_name .= 'SSL';

  }

  // Strip leading periods, www., and port numbers from cookie domain.

  $cookie_domain = ltrim($cookie_domain, '.');

  if (strpos($cookie_domain, 'www.') === 0) {

    $cookie_domain = substr($cookie_domain, 4);

  }

  $cookie_domain = explode(':', $cookie_domain);

  $cookie_domain = '.'. $cookie_domain[0];

  // Per RFC 2109, cookie domains must contain at least one dot other than the

  // first. For hosts such as 'localhost' or IP Addresses we don't set a cookie domain.

  if (count(explode('.', $cookie_domain)) > 2 && !is_numeric(str_replace('.', '', $cookie_domain))) {

    ini_set('session.cookie_domain', $cookie_domain);

  }

  session_name('SESS'. md5($session_name));

}

/**

 * Returns and optionally sets the filename for a system item (module,

 * theme, etc.). The filename, whether provided, cached, or retrieved

 * from the database, is only returned if the file exists.

 *

 * This function plays a key role in allowing Drupal's resources (modules

 * and themes) to be located in different places depending on a site's

 * configuration. For example, a module 'foo' may legally be be located

 * in any of these three places:

 *

 * modules/foo/foo.module

 * sites/all/modules/foo/foo.module

 * sites/example.com/modules/foo/foo.module

 *

 * Calling drupal_get_filename('module', 'foo') will give you one of

 * the above, depending on where the module is located.

 *

 * @param $type

 *   The type of the item (i.e. theme, theme_engine, module).

 * @param $name

 *   The name of the item for which the filename is requested.

 * @param $filename

 *   The filename of the item if it is to be set explicitly rather

 *   than by consulting the database.

 *

 * @return

 *   The filename of the requested item.

 */

function drupal_get_filename($type, $name, $filename = NULL) {

  static $files = array();

  if (!isset($files[$type])) {

    $files[$type] = array();

  }

  if (!empty($filename) && file_exists($filename)) {

    $files[$type][$name] = $filename;

  }

  elseif (isset($files[$type][$name])) {

    // nothing

  }

  // Verify that we have an active database connection, before querying

  // the database.  This is required because this function is called both

  // before we have a database connection (i.e. during installation) and

  // when a database connection fails.