/** * @return mixed|null * @throws \Exception */ public static function getConfiguration() { $config = null; $configFile = PIMCORE_CONFIGURATION_DIRECTORY . "/hybridauth.php"; if (is_file($configFile)) { $config = (include $configFile); $config["base_url"] = "http://" . \Pimcore\Tool::getHostname() . "/hybridauth/endpoint"; } else { throw new \Exception("HybridAuth configuration not found. Please place it into this file: {$configFile}"); } return $config; }
/** * @param \Zend_Controller_Request_Abstract $request */ public function routeStartup(\Zend_Controller_Request_Abstract $request) { // this is a filter which checks for common used files (by browser, crawlers, ...) and prevent the default // error page, because this is more resource-intensive than exiting right here $found = false; foreach (self::$files as $pattern) { if (preg_match($pattern, $request->getPathInfo())) { $found = true; break; } } if ($found) { if ($request->getPathInfo() == "/robots.txt") { // check for site try { $domain = Tool::getHostname(); $site = Site::getByDomain($domain); } catch (\Exception $e) { } $siteSuffix = ""; if ($site instanceof Site) { $siteSuffix = "-" . $site->getId(); } // send correct headers header("Content-Type: text/plain; charset=utf8"); while (@ob_end_flush()) { } // check for configured robots.txt in pimcore $robotsPath = PIMCORE_CONFIGURATION_DIRECTORY . "/robots" . $siteSuffix . ".txt"; if (is_file($robotsPath)) { readfile($robotsPath); } else { echo "User-agent: *\nDisallow:"; // default behavior } exit; } // if no other rule matches, exit anyway with a 404, to prevent the error page to be shown header('HTTP/1.1 404 Not Found'); echo "HTTP/1.1 404 Not Found\nFiltered by common files filter"; exit; } }
/** * @static * @throws \Exception * @return User */ public static function authenticateHttpBasic() { // we're using Sabre\HTTP for basic auth $request = \Sabre\HTTP\Sapi::getRequest(); $response = new \Sabre\HTTP\Response(); $auth = new \Sabre\HTTP\Auth\Basic(Tool::getHostname(), $request, $response); $result = $auth->getCredentials(); if (is_array($result)) { list($username, $password) = $result; $user = self::authenticatePlaintext($username, $password); if ($user) { return $user; } } $auth->requireLogin(); $response->setBody("Authentication required"); \Logger::error("Authentication Basic (WebDAV) required"); \Sabre\HTTP\Sapi::sendResponse($response); die; }
/** * @param $path * @param bool $partial * @return array|bool */ public function match($path, $partial = false) { // this allows the usage of UTF8 URLs and within static routes $path = urldecode($path); $front = \Zend_Controller_Front::getInstance(); $matchFound = false; $config = Config::getSystemConfig(); $routeingDefaults = Tool::getRoutingDefaults(); $params = array_merge($_GET, $_POST); $params = array_merge($routeingDefaults, $params); // set the original path $originalPath = $path; // check for password protection (http auth) if ($config->general->http_auth) { $username = $config->general->http_auth->username; $password = $config->general->http_auth->password; if ($username && $password) { $adapter = new \Zend_Auth_Adapter_Http(array("accept_schemes" => "basic", "realm" => $_SERVER["HTTP_HOST"])); $basicResolver = new \Pimcore\Helper\Auth\Adapter\Http\ResolverStatic($username, $password); $adapter->setBasicResolver($basicResolver); $adapter->setRequest($front->getRequest()); $adapter->setResponse($front->getResponse()); $result = $adapter->authenticate(); if (!$result->isValid()) { // Bad userame/password, or canceled password prompt echo "Authentication Required"; $front->getResponse()->sendResponse(); exit; } } } // check for a registered site try { // do not initialize a site if it is a "special" admin request if (!Tool::isFrontentRequestByAdmin()) { $domain = Tool::getHostname(); $site = \Zend_Registry::isRegistered("pimcore_site") ? \Zend_Registry::get("pimcore_site") : Site::getByDomain($domain); $path = $site->getRootPath() . $path; \Zend_Registry::set("pimcore_site", $site); } } catch (\Exception $e) { } // test if there is a suitable redirect with override = all (=> priority = 99) if (!$matchFound) { $this->checkForRedirect(true); } // do not allow requests including /index.php/ => SEO // this is after the first redirect check, to allow redirects in index.php?xxx if (preg_match("@^/index.php(.*)@", $_SERVER["REQUEST_URI"], $matches) && strtolower($_SERVER["REQUEST_METHOD"]) == "get") { $redirectUrl = $matches[1]; $redirectUrl = ltrim($redirectUrl, "/"); $redirectUrl = "/" . $redirectUrl; header("Location: " . $redirectUrl, true, 301); exit; } // redirect to the main domain if specified try { $hostRedirect = null; if ($config->general->redirect_to_maindomain && $config->general->domain && $config->general->domain != Tool::getHostname() && !Site::isSiteRequest() && !Tool::isFrontentRequestByAdmin()) { $hostRedirect = $config->general->domain; } if (Site::isSiteRequest()) { $site = Site::getCurrentSite(); if ($site->getRedirectToMainDomain() && $site->getMainDomain() != Tool::getHostname()) { $hostRedirect = $site->getMainDomain(); } } if ($hostRedirect && !isset($_GET["pimcore_disable_host_redirect"])) { $url = ($front->getRequest()->isSecure() ? "https" : "http") . "://" . $hostRedirect . $_SERVER["REQUEST_URI"]; header("HTTP/1.1 301 Moved Permanently"); header("Location: " . $url, true, 301); // log all redirects to the redirect log \Pimcore\Log\Simple::log("redirect", Tool::getAnonymizedClientIp() . " \t Host-Redirect Source: " . $_SERVER["REQUEST_URI"] . " -> " . $url); exit; } } catch (\Exception $e) { } // check for direct definition of controller/action if (!empty($_REQUEST["controller"]) && !empty($_REQUEST["action"])) { $matchFound = true; //$params["document"] = $this->getNearestDocumentByPath($path); } // you can also call a page by it's ID /?pimcore_document=XXXX if (!$matchFound) { if (!empty($params["pimcore_document"]) || !empty($params["pdid"])) { $doc = Document::getById($params["pimcore_document"] ? $params["pimcore_document"] : $params["pdid"]); if ($doc instanceof Document) { $path = $doc->getFullPath(); } } } // test if there is a suitable page if (!$matchFound) { try { $document = Document::getByPath($path); // check for a pretty url inside a site if (!$document && Site::isSiteRequest()) { $documentService = new Document\Service(); $sitePrettyDocId = $documentService->getDocumentIdByPrettyUrlInSite(Site::getCurrentSite(), $originalPath); if ($sitePrettyDocId) { if ($sitePrettyDoc = Document::getById($sitePrettyDocId)) { $document = $sitePrettyDoc; // undo the modification of the path by the site detection (prefixing with site root path) // this is not necessary when using pretty-urls and will cause problems when validating the // prettyUrl later (redirecting to the prettyUrl in the case the page was called by the real path) $path = $originalPath; } } } // check for a parent hardlink with childs if (!$document instanceof Document) { $hardlinkedParentDocument = $this->getNearestDocumentByPath($path, true); if ($hardlinkedParentDocument instanceof Document\Hardlink) { if ($hardLinkedDocument = Document\Hardlink\Service::getChildByPath($hardlinkedParentDocument, $path)) { $document = $hardLinkedDocument; } } } // check for direct hardlink if ($document instanceof Document\Hardlink) { $hardlinkParentDocument = $document; $document = Document\Hardlink\Service::wrap($hardlinkParentDocument); } if ($document instanceof Document) { if (in_array($document->getType(), self::getDirectRouteDocumentTypes())) { if (Tool::isFrontentRequestByAdmin() || $document->isPublished()) { // check for a pretty url, and if the document is called by that, otherwise redirect to pretty url if ($document instanceof Document\Page && !$document instanceof Document\Hardlink\Wrapper\WrapperInterface && $document->getPrettyUrl() && !Tool::isFrontentRequestByAdmin()) { if (rtrim(strtolower($document->getPrettyUrl()), " /") != rtrim(strtolower($originalPath), "/")) { $redirectUrl = $document->getPrettyUrl(); if ($_SERVER["QUERY_STRING"]) { $redirectUrl .= "?" . $_SERVER["QUERY_STRING"]; } header("Location: " . $redirectUrl, true, 301); exit; } } $params["document"] = $document; if ($controller = $document->getController()) { $params["controller"] = $controller; $params["action"] = "index"; } if ($action = $document->getAction()) { $params["action"] = $action; } if ($module = $document->getModule()) { $params["module"] = $module; } // check for a trailing slash in path, if exists, redirect to this page without the slash // the only reason for this is: SEO, Analytics, ... there is no system specific reason, pimcore would work also with a trailing slash without problems // use $originalPath because of the sites // only do redirecting with GET requests if (strtolower($_SERVER["REQUEST_METHOD"]) == "get") { if ($config->documents->allowtrailingslash) { if ($config->documents->allowtrailingslash == "no") { if (substr($originalPath, strlen($originalPath) - 1, 1) == "/" && $originalPath != "/") { $redirectUrl = rtrim($originalPath, "/"); if ($_SERVER["QUERY_STRING"]) { $redirectUrl .= "?" . $_SERVER["QUERY_STRING"]; } header("Location: " . $redirectUrl, true, 301); exit; } } } if ($config->documents->allowcapitals) { if ($config->documents->allowcapitals == "no") { if (strtolower($originalPath) != $originalPath) { $redirectUrl = strtolower($originalPath); if ($_SERVER["QUERY_STRING"]) { $redirectUrl .= "?" . $_SERVER["QUERY_STRING"]; } header("Location: " . $redirectUrl, true, 301); exit; } } } } $matchFound = true; } } else { if ($document->getType() == "link") { // if the document is a link just redirect to the location/href of the link header("Location: " . $document->getHref(), true, 301); exit; } } } } catch (\Exception $e) { // no suitable page found $foo = "bar"; } } // test if there is a suitable static route if (!$matchFound) { try { $cacheKey = "system_route_staticroute"; if (!($routes = Cache::load($cacheKey))) { $list = new Staticroute\Listing(); $list->setOrderKey("priority"); $list->setOrder("DESC"); $routes = $list->load(); Cache::save($routes, $cacheKey, array("system", "staticroute", "route"), null, 998); } foreach ($routes as $route) { if (!$matchFound) { $routeParams = $route->match($originalPath, $params); if ($routeParams) { $params = $routeParams; // try to get nearest document to the route $document = $this->getNearestDocumentByPath($path, false, array("page", "snippet", "hardlink")); if ($document instanceof Document\Hardlink) { $document = Document\Hardlink\Service::wrap($document); } $params["document"] = $document; $matchFound = true; Staticroute::setCurrentRoute($route); // add the route object also as parameter to the request object, this is needed in // Pimcore_Controller_Action_Frontend::getRenderScript() // to determine if a call to an action was made through a staticroute or not // more on that infos see Pimcore_Controller_Action_Frontend::getRenderScript() $params["pimcore_request_source"] = "staticroute"; break; } } } } catch (\Exception $e) { // no suitable route found } } // test if there is a suitable redirect if (!$matchFound) { $this->checkForRedirect(false); } if (!$matchFound) { return false; } // remove pimcore magic parameters unset($params["pimcore_outputfilters_disabled"]); unset($params["pimcore_document"]); unset($params["nocache"]); return $params; }
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /> <meta name="apple-mobile-web-app-capable" content="yes" /> <link rel="icon" type="image/png" href="/pimcore/static6/img/favicon/favicon-32x32.png" /> <meta name="google" value="notranslate"> <style type="text/css"> body { /* this stops the loading indicator from hopping around */ margin: 0; padding: 0; } </style> <title><?php echo htmlentities(\Pimcore\Tool::getHostname(), ENT_QUOTES, 'UTF-8'); ?> :: Pimcore</title> <!-- load in head because of the progress bar at loading --> <link rel="stylesheet" type="text/css" href="/pimcore/static/css/admin.css?_dc=<?php echo \Pimcore\Version::$revision; ?> " /> </head> <body> <div id="pimcore_logo" style="display: none;"> <img src="/pimcore/static6/img/logo-white.svg"/> </div>
/** * @static * @throws Exception|\Zend_Controller_Router_Exception */ public static function run() { self::setSystemRequirements(); // detect frontend (website) $frontend = Tool::isFrontend(); // enable the output-buffer, why? see in self::outputBufferStart() //if($frontend) { self::outputBufferStart(); //} self::initAutoloader(); self::initConfiguration(); self::setupFramework(); // config is loaded now init the real logger self::initLogger(); // initialize cache Cache::init(); // load plugins and modules (=core plugins) self::initModules(); self::initPlugins(); // init front controller $front = \Zend_Controller_Front::getInstance(); $conf = Config::getSystemConfig(); if (!$conf) { // redirect to installer if configuration isn't present if (!preg_match("/^\\/install.*/", $_SERVER["REQUEST_URI"])) { header("Location: /install/"); exit; } } if (self::inDebugMode() && $frontend && !$conf->general->disable_whoops && !defined("HHVM_VERSION")) { $whoops = new \Whoops\Run(); $whoops->pushHandler(new \Whoops\Handler\PrettyPageHandler()); $jsonErrorHandler = new \Whoops\Handler\JsonResponseHandler(); $jsonErrorHandler->onlyForAjaxRequests(true); $whoops->pushHandler($jsonErrorHandler); $whoops->register(); // add event handler before Pimcore::shutdown() to ensure fatal errors are handled by Whoops self::getEventManager()->attach("system.shutdown", array($whoops, "handleShutdown"), 10000); } $front->registerPlugin(new Controller\Plugin\ErrorHandler(), 1); $front->registerPlugin(new Controller\Plugin\Maintenance(), 2); // register general pimcore plugins for frontend if ($frontend) { $front->registerPlugin(new Controller\Plugin\Thumbnail(), 795); $front->registerPlugin(new Controller\Plugin\Less(), 799); $front->registerPlugin(new Controller\Plugin\AdminButton(), 806); } if (Tool::useFrontendOutputFilters(new \Zend_Controller_Request_Http())) { $front->registerPlugin(new Controller\Plugin\HybridAuth(), 792); $front->registerPlugin(new Controller\Plugin\QrCode(), 793); $front->registerPlugin(new Controller\Plugin\CommonFilesFilter(), 794); $front->registerPlugin(new Controller\Plugin\WysiwygAttributes(), 796); $front->registerPlugin(new Controller\Plugin\Webmastertools(), 797); $front->registerPlugin(new Controller\Plugin\Analytics(), 798); $front->registerPlugin(new Controller\Plugin\TagManagement(), 804); $front->registerPlugin(new Controller\Plugin\Targeting(), 805); $front->registerPlugin(new Controller\Plugin\EuCookieLawNotice(), 807); $front->registerPlugin(new Controller\Plugin\HttpErrorLog(), 850); $front->registerPlugin(new Controller\Plugin\Cache(), 901); // for caching } self::initControllerFront($front); // set router $router = $front->getRouter(); $routeAdmin = new \Zend_Controller_Router_Route('admin/:controller/:action/*', array('module' => 'admin', "controller" => "index", "action" => "index")); $routeInstall = new \Zend_Controller_Router_Route('install/:controller/:action/*', array('module' => 'install', "controller" => "index", "action" => "index")); $routeUpdate = new \Zend_Controller_Router_Route('admin/update/:controller/:action/*', array('module' => 'update', "controller" => "index", "action" => "index")); $routePlugins = new \Zend_Controller_Router_Route('admin/plugin/:controller/:action/*', array('module' => 'pluginadmin', "controller" => "index", "action" => "index")); $routeExtensions = new \Zend_Controller_Router_Route('admin/extensionmanager/:controller/:action/*', array('module' => 'extensionmanager', "controller" => "index", "action" => "index")); $routeReports = new \Zend_Controller_Router_Route('admin/reports/:controller/:action/*', array('module' => 'reports', "controller" => "index", "action" => "index")); $routePlugin = new \Zend_Controller_Router_Route('plugin/:module/:controller/:action/*', array("controller" => "index", "action" => "index")); $routeWebservice = new \Zend_Controller_Router_Route('webservice/:controller/:action/*', array("module" => "webservice", "controller" => "index", "action" => "index")); $routeSearchAdmin = new \Zend_Controller_Router_Route('admin/search/:controller/:action/*', array("module" => "searchadmin", "controller" => "index", "action" => "index")); // website route => custom router which check for a suitable document $routeFrontend = new Controller\Router\Route\Frontend(); $router->addRoute('default', $routeFrontend); // only do this if not frontend => performance issue if (!$frontend) { $router->addRoute("install", $routeInstall); $router->addRoute('plugin', $routePlugin); $router->addRoute('admin', $routeAdmin); $router->addRoute('update', $routeUpdate); $router->addRoute('plugins', $routePlugins); $router->addRoute('extensionmanager', $routeExtensions); $router->addRoute('reports', $routeReports); $router->addRoute('searchadmin', $routeSearchAdmin); if ($conf instanceof \Zend_Config and $conf->webservice and $conf->webservice->enabled) { $router->addRoute('webservice', $routeWebservice); } // check if this request routes into a plugin, if so check if the plugin is enabled if (preg_match("@^/plugin/([^/]+)/.*@", $_SERVER["REQUEST_URI"], $matches)) { $pluginName = $matches[1]; if (!Pimcore\ExtensionManager::isEnabled("plugin", $pluginName)) { \Pimcore\Tool::exitWithError("Plugin is disabled. To use this plugin please enable it in the extension manager!"); } } // force the main (default) domain for "admin" requests if ($conf->general->domain && $conf->general->domain != Tool::getHostname()) { $url = ($_SERVER['HTTPS'] == "on" ? "https" : "http") . "://" . $conf->general->domain . $_SERVER["REQUEST_URI"]; header("HTTP/1.1 301 Moved Permanently"); header("Location: " . $url, true, 301); exit; } } // check if webdav is configured and add router if ($conf instanceof \Zend_Config) { if ($conf->assets->webdav->hostname) { $routeWebdav = new \Zend_Controller_Router_Route_Hostname($conf->assets->webdav->hostname, array("module" => "admin", 'controller' => 'asset', 'action' => 'webdav')); $router->addRoute('webdav', $routeWebdav); } } $front->setRouter($router); self::getEventManager()->trigger("system.startup", $front); // throw exceptions also when in preview or in editmode (documents) to see it immediately when there's a problem with this page $throwExceptions = false; if (Tool::isFrontentRequestByAdmin()) { $user = \Pimcore\Tool\Authentication::authenticateSession(); if ($user instanceof User) { $throwExceptions = true; } } // run dispatcher // this is also standard for /admin/ requests -> error handling is done in Pimcore_Controller_Action_Admin if (!PIMCORE_DEBUG && !$throwExceptions && !PIMCORE_DEVMODE) { @ini_set("display_errors", "Off"); @ini_set("display_startup_errors", "Off"); $front->dispatch(); } else { @ini_set("display_errors", "On"); @ini_set("display_startup_errors", "On"); $front->throwExceptions(true); try { $front->dispatch(); } catch (\Zend_Controller_Router_Exception $e) { if (!headers_sent()) { header("HTTP/1.0 404 Not Found"); } \Logger::err($e); throw new \Zend_Controller_Router_Exception("No route, document, custom route or redirect is matching the request: " . $_SERVER["REQUEST_URI"] . " | \n" . "Specific ERROR: " . $e->getMessage()); } catch (\Exception $e) { if (!headers_sent()) { header("HTTP/1.0 500 Internal Server Error"); } throw $e; } } }
/** * @param $queryHits * * @return array */ private function getValidHits($queryHits) { $validHits = []; if ($this->ownHostOnly && $queryHits !== NULL) { //get rid of hits from other hosts $currentHost = \Pimcore\Tool::getHostname(); foreach ($queryHits as $hit) { $url = $hit->getDocument()->getField('url'); if (strpos($url->value, '://' . $currentHost) !== FALSE) { $validHits[] = $hit; } } } else { $validHits = $queryHits; } return $validHits; }
/** * @param \Zend_Controller_Request_Abstract $request * @return bool|void */ public function routeStartup(\Zend_Controller_Request_Abstract $request) { $requestUri = $request->getRequestUri(); $excludePatterns = []; // only enable GET method if (!$request->isGet()) { return $this->disable(); } // disable the output-cache if browser wants the most recent version // unfortunately only Chrome + Firefox if not using SSL if (!$request->isSecure()) { if (isset($_SERVER["HTTP_CACHE_CONTROL"]) && $_SERVER["HTTP_CACHE_CONTROL"] == "no-cache") { return $this->disable("HTTP Header Cache-Control: no-cache was sent"); } if (isset($_SERVER["HTTP_PRAGMA"]) && $_SERVER["HTTP_PRAGMA"] == "no-cache") { return $this->disable("HTTP Header Pragma: no-cache was sent"); } } try { $conf = \Pimcore\Config::getSystemConfig(); if ($conf->cache) { $conf = $conf->cache; if (!$conf->enabled) { return $this->disable(); } if (\Pimcore::inDebugMode()) { return $this->disable("in debug mode"); } if ($conf->lifetime) { $this->setLifetime((int) $conf->lifetime); } if ($conf->excludePatterns) { $confExcludePatterns = explode(",", $conf->excludePatterns); if (!empty($confExcludePatterns)) { $excludePatterns = $confExcludePatterns; } } if ($conf->excludeCookie) { $cookies = explode(",", strval($conf->excludeCookie)); foreach ($cookies as $cookie) { if (!empty($cookie) && isset($_COOKIE[trim($cookie)])) { return $this->disable("exclude cookie in system-settings matches"); } } } // output-cache is always disabled when logged in at the admin ui if (isset($_COOKIE["pimcore_admin_sid"])) { return $this->disable("backend user is logged in"); } } else { return $this->disable(); } } catch (\Exception $e) { Logger::error($e); return $this->disable("ERROR: Exception (see debug.log)"); } foreach ($excludePatterns as $pattern) { if (@preg_match($pattern, $requestUri)) { return $this->disable("exclude path pattern in system-settings matches"); } } $deviceDetector = Tool\DeviceDetector::getInstance(); $device = $deviceDetector->getDevice(); $deviceDetector->setWasUsed(false); $appendKey = ""; // this is for example for the image-data-uri plugin if (isset($_REQUEST["pimcore_cache_tag_suffix"])) { $tags = $_REQUEST["pimcore_cache_tag_suffix"]; if (is_array($tags)) { $appendKey = "_" . implode("_", $tags); } } $this->defaultCacheKey = "output_" . md5(\Pimcore\Tool::getHostname() . $requestUri . $appendKey); $cacheKeys = [$this->defaultCacheKey . "_" . $device, $this->defaultCacheKey]; $cacheItem = null; foreach ($cacheKeys as $cacheKey) { $cacheItem = CacheManager::load($cacheKey, true); if ($cacheItem) { break; } } if (is_array($cacheItem) && !empty($cacheItem)) { header("X-Pimcore-Output-Cache-Tag: " . $cacheKey, true, 200); header("X-Pimcore-Output-Cache-Date: " . $cacheItem["date"]); foreach ($cacheItem["rawHeaders"] as $header) { header($header); } foreach ($cacheItem["headers"] as $header) { header($header['name'] . ': ' . $header['value'], $header['replace']); } echo $cacheItem["content"]; exit; } else { // set headers to tell the client to not cache the contents // this can/will be overwritten in $this->dispatchLoopShutdown() if the cache is enabled $date = new \DateTime(); $date->setTimestamp(1); $this->getResponse()->setHeader("Expires", $date->format(\DateTime::RFC1123), true); $this->getResponse()->setHeader("Cache-Control", "max-age=0, no-cache", true); } }