| // | Christian Stocker | // | Modified by: Daniel Sabsay [Jan 2005] | // +----------------------------------------------------------------------+ // // $Id: Server.php,v 1.21 2004/04/14 21:44:26 hholzgra Exp $ // $dot = realpath('.').'/'; require_once $dot.'Tools/_parse_propfind.php'; require_once $dot.'Tools/_parse_proppatch.php'; require_once $dot.'Tools/_parse_lockinfo.php'; define('XHDR','\n"); /** * Virtual base class for implementing WebDAV servers * * WebDAV server base class, needs to be extended to do useful work * * @package HTTP_WebDAV_Server * @author Hartmut Holzgraefe * @version 0.99.1dev */ class HTTP_WebDAV_Server { // {{{ Member Variables /** * webserver method for this request * * @var string */ var $method; /** * webserver trigger pattern for this request * * @var string */ var $prefix; /** * URI path for this request * * @var string */ var $path; /** * Realm string to be used in authentification popups * * @var string */ var $http_auth_realm = "PHP WebDAV"; /** * String to be used in "X-Dav-Powered-By" header * * @var string */ var $dav_powered_by = 'Perforce'; /** * Remember parsed If: (RFC2518/9.4) header conditions * * @var array */ var $_if_header_uris = array(); /** * HTTP response status/message * * @var string */ var $_http_status = "200 OK"; /** * encoding of property values passed in * * @var string */ var $_prop_encoding = "utf-8"; // }}} // {{{ Constructor /** * Constructor * * @param void */ function HTTP_WebDAV_Server() { } // }}} // {{{ ServeRequest() /** * Serve WebDAV HTTP request * * dispatch WebDAV HTTP request to the apropriate method handler * * @param void * @return void */ function ServeRequest($method) { $this->method = $method; // identify ourselves if (empty($this->dav_powered_by)) { header("X-Dav-Powered-By: PHP class: ".get_class($this)); } else { header("X-Dav-Powered-By: ".$this->dav_powered_by ); } // set path $this->path = $this->_urldecode($this->path); // ***** if(ini_get("magic_quotes_gpc")) { // ***** $this->path = stripslashes($this->path); // ***** } // check authentication if (!$this->_check_auth()) { $this->http_status('401 Unauthorized'); // RFC2518 says we must use Digest instead of Basic // but Microsoft Clients do not support Digest // and we don't support NTLM and Kerberos // so we are stuck with Basic here header('WWW-Authenticate: Basic realm="'.$this->depot_host.'"'); return; } // check other conditions if (!$this->_check_if_header_conditions()) { $this->http_status("412 Precondition failed"); return; } $wrapper = "http_".$this->method; if (method_exists($this, $wrapper)) { $this->$wrapper(); // call method by name } else { // method not found/implemented if ($this->method == 'LOCK') { $this->http_status("412 Precondition failed"); } else { $this->http_status('405 Method '.$this->method.' not allowed'); header("Allow: ".join(", ", $this->_allow())); // tell client what's allowed } } if (!$this->_check_if_header_conditions()) { $this->http_status("412 Precondition failed"); return; } } // }}} // }}} // {{{ abstract WebDAV methods // {{{ GET() /** * GET implementation * * overload this method to retrieve resources from your server *
* * * @abstract * @param array &$params Array of input and output parameters *
input
    *
  • path - *
*
output
    *
  • size - *
* @returns int HTTP-Statuscode */ /* abstract function GET(&$params) { // dummy entry for PHPDoc } */ // }}} // {{{ PUT() /** * PUT implementation * * PUT implementation * * @abstract * @param array &$params * @returns int HTTP-Statuscode */ /* abstract function PUT() { // dummy entry for PHPDoc } */ // }}} // {{{ HEAD() /** * HEAD implementation * * overload this method to retrieve resources from your server *
* * * @abstract * @param array &$params Array of input and output parameters *
input
    *
  • path - *
*
output
    *
  • size - *
* @returns int HTTP-Statuscode */ /* abstract function HEAD(&$params) { // dummy entry for PHPDoc } */ // }}} // {{{ COPY() /** * COPY implementation * * COPY implementation * * @abstract * @param array &$params * @returns int HTTP-Statuscode */ /* abstract function COPY() { // dummy entry for PHPDoc } */ // }}} // {{{ MOVE() /** * MOVE implementation * * MOVE implementation * * @abstract * @param array &$params * @returns int HTTP-Statuscode */ /* abstract function MOVE() { // dummy entry for PHPDoc } */ // }}} // {{{ DELETE() /** * DELETE implementation * * DELETE implementation * * @abstract * @param array &$params * @returns int HTTP-Statuscode */ /* abstract function DELETE() { // dummy entry for PHPDoc } */ // }}} // {{{ PROPFIND() /** * PROPFIND implementation * * PROPFIND implementation * * @abstract * @param array &$params * @returns int HTTP-Statuscode */ /* abstract function PROPFIND() { // dummy entry for PHPDoc } */ // }}} // {{{ PROPPATCH() /** * PROPPATCH implementation * * PROPPATCH implementation * * @abstract * @param array &$params * @returns int HTTP-Statuscode */ /* abstract function PROPPATCH() { // dummy entry for PHPDoc } */ // }}} // {{{ LOCK() /** * LOCK implementation * * LOCK implementation * * @abstract * @param array &$params * @returns int HTTP-Statuscode */ /* abstract function LOCK() { // dummy entry for PHPDoc } */ // }}} // {{{ UNLOCK() /** * UNLOCK implementation * * UNLOCK implementation * * @abstract * @param array &$params * @returns int HTTP-Statuscode */ /* abstract function UNLOCK() { // dummy entry for PHPDoc } */ // }}} // }}} // {{{ other abstract methods // {{{ checklock() /** * check lock status for a resource * * overload this method to return shared and exclusive locks * active for this resource * * @abstract * @param string resource Resource path to check * @returns array An array of lock entries each consisting * of 'type' ('shared'/'exclusive'), 'token' and 'timeout' */ /* abstract function checklock($resource) { // dummy entry for PHPDoc } */ // }}} // }}} // {{{ WebDAV HTTP method wrappers // {{{ http_OPTIONS() /** * OPTIONS method handler * * The OPTIONS method handler creates a valid OPTIONS reply * including Dav: and Allowed: heaers * based on the implemented methods found in the actual instance * * @param void * @return void */ function http_OPTIONS() { // Microsoft clients default to the Frontpage protocol // unless we tell them to use WebDAV header("MS-Author-Via: DAV"); // get allowed methods $allow = $this->_allow(); // dav header $dav = array(1); // assume we are always dav class 1 compliant if (isset($allow['LOCK'])) { $dav[] = 2; // dav class 2 requires that locking is supported } // tell clients what we found header("DAV: " .join("," , $dav)); header("Allow: ".join(", ", $allow)); $this->http_status("200 OK"); } // }}} // {{{ http_PROPFIND() /** * PROPFIND method handler * * @param void * @return void */ function http_PROPFIND() { $xml = XHDR; $options = array(); $options['path'] = $this->path; // search depth from header (default is "infinity") if (isset($_SERVER['HTTP_DEPTH'])) { $options['depth'] = $_SERVER['HTTP_DEPTH']; } else { $options['depth'] = 'infinity'; } $xml_stream = 'php://input'; if ($this->logging>1) { $fr = fopen($xml_stream,'r'); $xml_stream = $this->base.uniqid('L'); $fw = fopen($xml_stream,'w'); while (!feof($fr)) { $input = fread($fr,4096); error_log($input); fwrite($fw,$input); } fclose($fr); fclose($fw); } // analyze request payload $propinfo = new _parse_propfind($xml_stream); if ($this->logging>1) unlink($xml_stream); if (!$propinfo->success) { $this->http_status('400 Error'); return; } $options['props'] = $propinfo->props; // CALL USER HANDLER $files = array(); $this->PROPFIND($options,$files); if (empty($files)) { $this->http_status('404 Not Found'); return false; } // collect namespaces here $ns_hash = array(); // Microsoft Clients need this special namespace for date and time values $ns_defs = 'xmlns:ns0="urn:uuid:c2f41010-65b3-11d1-a29f-00aa00c14882"'; // now we loop over all returned file entries foreach ($files['files'] as $filekey => $file) { $path = $file['path']; // nothing to do if no properties were returned for a file if (!isset($file["props"]) || !is_array($file["props"])) { continue; } // now loop over all returned properties foreach ($file['props'] as $key => $prop) { // as a convenience feature we do not require that user handlers // restrict returned properties to the requested ones // here we strip all unrequested entries out of the response switch($options['props']) { case "all": // nothing to remove break; case "names": // only the names of all existing properties were requested // so we remove all values unset($files["files"][$filekey]["props"][$key]["val"]); break; default: $found = false; // search property name in requested properties foreach((array)$options["props"] as $reqprop) { if ( ($reqprop["name"] == $prop["name"]) && ($reqprop["xmlns"] == $prop["ns"])) { $found = true; break; } } // unset property if not requested if (!$found) { $files["files"][$filekey]["props"][$key]=''; continue(2); } break; } // namespace handling if (empty($prop["ns"])) continue; // no namespace $ns = $prop["ns"]; if ($ns == "DAV:") continue; // default namespace if (isset($ns_hash[$ns])) continue; // already known // register namespace $ns_name = "ns".(count($ns_hash) + 1); $ns_hash[$ns] = $ns_name; $ns_defs .= " xmlns:".$ns_name.'="'.$ns.'"'; } // we also need to add empty entries for properties that were requested // but for which no values where returned by the user handler if (is_array($options['props'])) { foreach($options["props"] as $reqprop) { if($reqprop['name']=="") continue; // skip empty entries $found = false; // check if property exists in result foreach($file["props"] as $prop) { if ( $reqprop["name"] == $prop["name"] && $reqprop["xmlns"] == $prop["ns"]) { $found = true; break; } } if (!$found) { if($reqprop["xmlns"]==="DAV:" && $reqprop["name"]==="lockdiscovery") { // lockdiscovery is handled by the base class $files["files"][$filekey]["props"][] = $this->mkprop('DAV:','lockdiscovery' , $this->lockdiscovery($path)); } else { // add empty value for this property $files["files"][$filekey]["noprops"][] = $this->mkprop($reqprop["xmlns"], $reqprop["name"], ""); // register property namespace if not known yet if ($reqprop["xmlns"] != "DAV:" && !isset($ns_hash[$reqprop["xmlns"]])) { $ns_name = "ns".(count($ns_hash) + 1); $ns_hash[$reqprop["xmlns"]] = $ns_name; $ns_defs .= ' xmlns:'.$ns_name.'="'.$reqprop['xmlns'].'"'; } } } } } } // now we generate the reply header ... $this->http_status("207 Multi-Status"); header('Content-Type: text/xml; charset="utf-8"'); // ... and payload $xml .= "\n"; foreach($files['files'] as $file) { $path = $file['path']; // ignore empty or incomplete entries if(!is_array($file) || empty($file) || !isset($file["path"])) continue; $path = $file['path']; if(!is_string($path) || $path==="") continue; $xml .= " \n"; // $href = (@$_SERVER["HTTPS"] === "on") ? "https://" : "http://"; // $href .= $_SERVER['HTTP_HOST']; $href = $this->prefix.$path; //TODO make sure collection resource paths end in a trailing slash $xml .= " ".$href."\n"; // report all found properties and their values (if any) if (isset($file["props"]) && is_array($file["props"])) { $xml .= " \n"; $xml .= " \n"; foreach($file["props"] as $key => $prop) { if (!is_array($prop)) continue; if (!isset($prop["name"])) continue; if (!isset($prop["val"]) || $prop["val"] === "" || $prop["val"] === false) { // empty properties (cannot use empty() for check as "0" is a legal value here) if ($prop["ns"]=="DAV:") { $xml .= " \n"; } else if (!empty($prop["ns"])) { $xml .= " <". $ns_hash[$prop["ns"]].":".$prop['name']."/>\n"; } else { $xml .= " <".$prop['name']." xmlns=\"\"/>"; } } else if ($prop["ns"] == "DAV:") { // some WebDAV properties need special treatment switch ($prop["name"]) { case "creationdate": $xml .= " " . gmdate("Y-m-d\\TH:i:s\\Z",$prop['val']) . "\n"; break; case "getlastmodified": $xml .= " " . gmdate("D, d M Y H:i:s ", $prop['val']) . "GMT\n"; break; case "resourcetype": $type = ($prop['val']=='collection')? '':$prop['val']; $xml .= " ".$type."\n"; break; case "supportedlock": $xml .= " ".$prop['val']. "\n"; break; case "lockdiscovery": $xml .= " \n"; $xml .= $prop["val"]; $xml .= " \n"; break; default: $xml .= " " . $this->_prop_encode(htmlspecialchars($prop['val'])) . "\n"; break; } } else { // properties from namespaces != "DAV:" or without any namespace if ($prop["ns"]) { $xml .= " <" . $ns_hash[$prop["ns"]] . ":".$prop['name'].'>' . $this->_prop_encode(htmlspecialchars($prop['val'])) . "\n"; } else { $xml .= " <".$prop['name']." xmlns=\"\">" . $this->_prop_encode(htmlspecialchars($prop['val'])) . "\n"; } } } $xml .= " \n"; $xml .= " HTTP/1.1 200 OK\n"; $xml .= " \n"; } // now report all properties requested but not found if (isset($file["noprops"])) { $xml .= " \n"; $xml .= " \n"; foreach ($file["noprops"] as $key => $prop) { if ($prop["ns"] == "DAV:") { $xml .= " \n"; } else if ($prop["ns"] == "") { $xml .= " <".$prop['name']." xmlns=\"\"/>\n"; } else { $xml .= " <" . $ns_hash[$prop["ns"]] . ":".$prop['name']."/>\n"; } } $xml .= " \n"; $xml .= " HTTP/1.1 404 Not Found\n"; $xml .= " \n"; } $xml .= " \n"; } $xml .= "\n"; header('Content-length: '.strlen($xml)); echo $xml; if ($this->logging>1) error_log($xml); } // }}} // {{{ http_PROPPATCH() /** * PROPPATCH method handler * * @param void * @return void */ function http_PROPPATCH() { $xml = XHDR; if($this->_check_lock_status($this->path)) { $options = array(); $path = $this->path; $options["path"] = $path; $xml_stream = 'php://input'; if ($this->logging>1) { $fr = fopen($xml_stream,'r'); $xml_stream = $this->base.uniqid('L'); $fw = fopen($xml_stream,'w'); while (!feof($fr)) { $input = fread($fr,4096); error_log($input); fwrite($fw,$input); } fclose($fr); fclose($fw); } $propinfo = new _parse_proppatch($xml_stream); if ($this->logging>1) unlink($xml_stream); if (!$propinfo->success) { $this->http_status("400 Error"); return; } $options['props'] = $propinfo->props; $responsedescr = $this->PROPPATCH($options); $this->http_status("207 Multi-Status"); header('Content-Type: text/xml; charset="utf-8"'); $xml .= "\n"; $xml .= " \n"; // $href = (@$_SERVER["HTTPS"] === "on") ? "https://" : "http://"; // $href .= $_SERVER["HTTP_HOST"]; $href = $this->prefix.$path; $xml .= " ".$this->_urlencode($href)."\n"; foreach((array)$options["props"] as $prop) { $xml .= " \n"; $xml .= " <".$prop['name']." xmlns=\"". $prop['ns']."\"/>\n"; $xml .= " HTTP/1.1 ". $prop['status']."\n"; $xml .= " \n"; } if ($responsedescr) { $xml .= " ". $this->_prop_encode(htmlspecialchars($responsedescr)). "\n"; } $xml .= " \n"; $xml .= "\n"; header('Content-length: '.strlen($xml)); echo $xml; if ($this->logging>1) error_log($xml); } else { $this->http_status("423 Locked"); } } // }}} // {{{ http_MKCOL() /** * MKCOL method handler * * @param void * @return void */ function http_MKCOL() { $options = array(); $options["path"] = $this->path; $stat = $this->mkcol($options); $this->http_status($stat); } // }}} // {{{ http_GET() /** * GET method handler * * @param void * @returns void */ function http_GET() { // TODO check for invalid stream $options['path'] = $this->path; $this->_get_ranges($options); if (true === ($status = $this->GET($options))) { if (!headers_sent()) { $status = "200 OK"; if (!isset($options['mimetype'])) { $options['mimetype'] = "application/octet-stream"; } header("Content-type: ".$options['mimetype']); if (isset($options['mtime'])) { header("Last-modified:".gmdate("D, d M Y H:i:s ", $options['mtime'])."GMT"); } if (isset($options['stream'])) { // GET handler returned a stream if (!empty($options['ranges']) && (0===fseek($options['stream'], 0, SEEK_SET))) { // partial request and stream is seekable if (count($options['ranges']) === 1) { $range = $options['ranges'][0]; if (isset($range['start'])) { fseek($options['stream'], $range['start'], SEEK_SET); if (feof($options['stream'])) { http_status("416 Requested range not satisfiable"); exit; } if (isset($range['end'])) { $size = $range['end']-$range['start']+1; http_status("206 partial"); header("Content-length: ".$size); header("Content-range: ".$range['start'].'-'.$range['end'].'/' . (isset($options['size']) ? $options['size'] : "*")); while ($size && !feof($options['stream'])) { $buffer = fread($options['stream'], 4096); $size -= strlen($buffer); echo $buffer; } } else { http_status("206 partial"); if (isset($options['size'])) { header("Content-length: ".($options['size'] - $range['start'])); header("Content-range: ".$start.'-'.$end.'/' . (isset($options['size']) ? $options['size'] : "*")); } fpassthru($options['stream']); } } else { header("Content-length: ".$range['last']); fseek($options['stream'], -$range['last'], SEEK_END); fpassthru($options['stream']); } } else { $this->_multipart_byterange_header(); // init multipart foreach ($options['ranges'] as $range) { // TODO what if size unknown? 500? if (isset($range['start'])) { $from = $range['start']; $to = !empty($range['end']) ? $range['end'] : $options['size']-1; } else { $from = $options['size'] - $range['last']-1; $to = $options['size'] -1; } $total = isset($options['size']) ? $options['size'] : "*"; $size = $to - $from + 1; $this->_multipart_byterange_header($options['mimetype'], $from, $to, $total); fseek($options['stream'], $start, SEEK_SET); while ($size && !feof($options['stream'])) { $buffer = fread($options['stream'], 4096); $size -= strlen($buffer); echo $buffer; } } $this->_multipart_byterange_header(); // end multipart } } else { // normal request or stream isn't seekable, return full content if (isset($options['size'])) { header('Content-length: '.$options['size']); } fpassthru($options['stream']); if ($options['delete_path']) unlink($options['delete_path']); return; // no more headers } } elseif (isset($options['data'])) { if (is_array($options['data'])) { // reply to partial request } else { header("Content-length: ".strlen($options['data'])); echo $options['data']; } } } } if (false === $status) { $this->http_status("404 not found"); } $this->http_status($status); } /** * parse HTTP Range: header * * @param array options array to store result in * @return void */ function _get_ranges(&$options) { // process Range: header if present if (isset($_SERVER['HTTP_RANGE'])) { // we only support standard "bytes" range specifications for now if (ereg("bytes[[:space:]]*=[[:space:]]*(.+)", $_SERVER['HTTP_RANGE'], $matches)) { $options["ranges"] = array(); // ranges are comma separated foreach (explode(",", $matches[1]) as $range) { // ranges are either from-to pairs or just end positions list($start, $end) = explode("-", $range); $options["ranges"][] = ($start==="") ? array("last"=>$end) : array("start"=>$start, "end"=>$end); } } } } /** * generate separator headers for multipart response * * first and last call happen without parameters to generate * the initial header and closing sequence, all calls inbetween * require content mimetype, start and end byte position and * optionaly the total byte length of the requested resource * * @param string mimetype * @param int start byte position * @param int end byte position * @param int total resource byte size */ function _multipart_byterange_header($mimetype = false, $from = false, $to=false, $total=false) { if ($mimetype === false) { if (!isset($this->multipart_separator)) { // initial // a little naive, this sequence *might* be part of the content // but it's really not likely and rather expensive to check $this->multipart_separator = "SEPARATOR_".md5(microtime()); // generate HTTP header header("Content-type: multipart/byteranges; boundary=".$this->multipart_separator); } else { // final // generate closing multipart sequence echo "\n--{".$this->multipart_separator."}--"; } } else { // generate separator and header for next part echo "\n--{$this->multipart_separator}\n"; echo "Content-type: ".$mimetype."\n"; echo "Content-range: ".$from.'-'.$to.'"'. (($total === false) ? "*" : $total); echo "\n\n"; } } // }}} // {{{ http_HEAD() /** * HEAD method handler * * @param void * @return void */ function http_HEAD() { $status = false; $options = array(); $options['path'] = $this->path; $status = $this->HEAD($options); if ($status===true) $status = '200 OK'; if ($status===false) $status = '404 Not found'; $this->http_status($status); } // }}} // {{{ http_PUT() /** * PUT method handler * * @param void * @return void */ function http_PUT() { if ($this->_check_lock_status($this->path)) { $options = array(); $options['path'] = $this->path; $options['content_length'] = $_SERVER['CONTENT_LENGTH']; // get the Content-type if (isset($_SERVER['CONTENT_TYPE'])) { // for now we do not support any sort of multipart requests if (!strncmp($_SERVER['CONTENT_TYPE'], "multipart/", 10)) { $this->http_status('501 not implemented'); echo 'The service does not support mulipart PUT requests'; return; } $options['content_type'] = $_SERVER['CONTENT_TYPE']; } else { // default content type if none given $options['content_type'] = 'application/octet-stream'; } /* RFC 2616 2.6 says: "The recipient of the entity MUST NOT ignore any Content-* (e.g. Content-Range) headers that it does not understand or implement and MUST return a 501 (Not Implemented) response in such cases." */ foreach ($_SERVER as $key => $val) { if (strncmp($key,'HTTP_CONTENT', 11)) continue; switch ($key) { case 'HTTP_CONTENT_ENCODING': // RFC 2616 14.11 // TODO support this if ext/zlib filters are available $this->http_status("501 not implemented"); echo "The service does not support '$val' content encoding"; return; case 'HTTP_CONTENT_LANGUAGE': // RFC 2616 14.12 // we assume it is not critical if this one is ignored // in the actual PUT implementation ... $options["content_language"] = $value; break; case 'HTTP_CONTENT_LOCATION': // RFC 2616 14.14 /* The meaning of the Content-Location header in PUT or POST requests is undefined; servers are free to ignore it in those cases. */ break; case 'HTTP_CONTENT_RANGE': // RFC 2616 14.16 // single byte range requests are supported // the header format is also specified in RFC 2616 14.16 // TODO we have to ensure that implementations support this or send 501 instead if (!preg_match('@bytes\s+(\d+)-(\d+)/((\d+)|\*)@', $value, $matches)) { $this->http_status("400 bad request"); echo "The service does only support single byte ranges"; return; } $range = array("start"=>$matches[1], "end"=>$matches[2]); if (is_numeric($matches[3])) { $range["total_length"] = $matches[3]; } $option["ranges"][] = $range; // TODO make sure the implementation supports partial PUT // this has to be done in advance to avoid data being overwritten // on implementations that do not support this ... break; case 'HTTP_CONTENT_MD5': // RFC 2616 14.15 // TODO: maybe we can just pretend here? $this->http_status("501 not implemented"); echo 'The service does not support content MD5 checksum verification'; return; default: // any other unknown Content-* headers $this->http_status("501 not implemented"); echo "The service does not support '$key'"; return; } } $options['stream'] = fopen('php://input','r'); $stat = $this->PUT($options)? '201 Created' : '204 No Content'; $this->http_status($stat); } else { $this->http_status("423 Locked"); } } // }}} // {{{ http_DELETE() /** * DELETE method handler * * @param void * @return void */ function http_DELETE() { // check RFC 2518 Section 9.2, last paragraph if (isset($_SERVER["HTTP_DEPTH"])) { if ($_SERVER["HTTP_DEPTH"] != "infinity") { $this->http_status("400 Bad Request"); return; } } // check lock status if ($this->_check_lock_status($this->path)) { // ok, proceed $options = array(); $options["path"] = $this->path; $stat = $this->delete($options); $this->http_status($stat); } else { // sorry, its locked $this->http_status("423 Locked"); } } // }}} // {{{ http_COPY() /** * COPY method handler * * @param void * @return void */ function http_COPY() { // no need to check source lock status here // destination lock status is always checked by the helper method $this->_copymove('COPY'); } // }}} // {{{ http_MOVE() /** * MOVE method handler * * @param void * @return void */ function http_MOVE() { if ($this->_check_lock_status($this->path)) { // destination lock status is always checked by the helper method $this->_copymove('MOVE'); } else { $this->http_status("423 Locked"); } } // }}} // {{{ http_LOCK() /** * LOCK method handler * * @param void * @return void */ function http_LOCK() { $xml = XHDR; $options = array(); $options["path"] = $this->path; if (isset($_SERVER['HTTP_DEPTH'])) { $options["depth"] = $_SERVER["HTTP_DEPTH"]; } else { $options["depth"] = "infinity"; } if (isset($_SERVER["HTTP_TIMEOUT"])) { $options["timeout"] = explode(",", $_SERVER["HTTP_TIMEOUT"]); } if(empty($_SERVER['CONTENT_LENGTH']) && !empty($_SERVER['HTTP_IF'])) { // check if locking is possible if(!$this->_check_lock_status($this->path)) { $this->http_status("423 Locked"); return; } // refresh lock $options["update"] = substr($_SERVER['HTTP_IF'], 2, -2); $stat = $this->LOCK($options); } else { // extract lock request information from request XML payload $xml_stream = 'php://input'; if ($this->logging>1) { $fr = fopen($xml_stream,'r'); $xml_stream = $this->base.uniqid('L'); $fw = fopen($xml_stream,'w'); while (!feof($fr)) { $input = fread($fr,4096); error_log($input); fwrite($fw,$input); } fclose($fr); fclose($fw); } $lockinfo = new _parse_lockinfo($xml_stream); if ($this->logging>1) unlink($xml_stream); if (!$lockinfo->success) { $this->http_status("400 bad request"); } // check if locking is possible if(!$this->_check_lock_status($this->path, $lockinfo->lockscope === "shared")) { $this->http_status("423 Locked"); return; } // new lock $options["scope"] = $lockinfo->lockscope; $options["type"] = $lockinfo->locktype; $options["owner"] = $lockinfo->owner; $options["locktoken"] = $this->_new_locktoken(); $stat = $this->LOCK($options); } if(is_bool($stat)) { $http_stat = $stat ? "200 OK" : "423 Locked"; } else { $http_stat = $stat; } $this->http_status($http_stat); if ($http_stat{0} == 2) { // 2xx states are ok if($options["timeout"]) { // more than a million is considered an absolute timestamp // less is more likely a relative value if($options["timeout"]>1000000) { $timeout = "Second-".($options['timeout']-time()); } else { $timeout = "Second-".$options['timeout']; } } else { $timeout = "Infinite"; } header('Content-Type: text/xml; charset="utf-8"'); header("Lock-Token: <".$options['locktoken'].">"); $xml .= "\n"; $xml .= " \n"; $xml .= " \n"; $xml .= " \n"; $xml .= " \n"; $xml .= " ".$options['depth']."\n"; $xml .= " ".$options['owner']."\n"; $xml .= " ".$timeout."\n"; $xml .= " ". $options['locktoken']."\n"; $xml .= " \n"; $xml .= " \n"; $xml .= "\n\n"; header('Content-length: '.strlen($xml)); echo $xml; if ($this->logging>1) error_log($xml); } } // }}} // {{{ http_UNLOCK() /** * UNLOCK method handler * * @param void * @return void */ function http_UNLOCK() { $options = array(); $options["path"] = $this->path; if (isset($_SERVER['HTTP_DEPTH'])) { $options["depth"] = $_SERVER["HTTP_DEPTH"]; } else { $options["depth"] = "infinity"; } // strip surrounding <> $options["token"] = substr(trim($_SERVER["HTTP_LOCK_TOKEN"]), 1, -1); // call user method $stat = $this->UNLOCK($options); $this->http_status($stat); } // }}} // }}} // {{{ _copymove() function _copymove($what) { $options = array(); $options['path'] = $this->path; if (isset($_SERVER['HTTP_DEPTH'])) { $options['depth'] = $_SERVER['HTTP_DEPTH']; } else { $options['depth'] = 'infinity'; } extract(parse_url($_SERVER['HTTP_DESTINATION'])); $http_host = $host; if (isset($port) && $port != 80) $http_host .= ':'.$port; list($http_header_host,$http_header_port) = explode(':',$_SERVER['HTTP_HOST']); if (isset($http_header_port) && $http_header_port != 80) { $http_header_host .= ':'.$http_header_port; } if ($http_host == $http_header_host) { $options['dest'] = substr($path,strlen($this->prefix)); if (!$this->_check_lock_status($options['dest'])) { $this->http_status('423 Locked'); return; } } else { $options['dest_url'] = $_SERVER['HTTP_DESTINATION']; } // see RFC 2518 Sections 9.6, 8.8.4 and 8.9.3 if (isset($_SERVER['HTTP_OVERWRITE'])) { $options['overwrite'] = ($_SERVER['HTTP_OVERWRITE']=='T'); } else { $options['overwrite'] = true; } $stat = $this->$what($options); $this->http_status($stat); } // }}} // {{{ _allow() /** * check for implemented HTTP methods * * @param void * @return array something */ function _allow() { // OPTIONS is always there $allow = array("OPTIONS" =>"OPTIONS"); // all other METHODS need both a http_method() wrapper // and a method() implementation // the base class supplies wrappers only foreach (get_class_methods($this) as $method) { if (!strncmp("http_", $method, 5)) { $method = strtoupper(substr($method, 5)); if (method_exists($this, $method)) { $allow[$method] = $method; } } } // we can emulate a missing HEAD implemetation using GET if (isset($allow["GET"])) $allow["HEAD"] = "HEAD"; // no LOCK without checklok() if (!method_exists($this, "checklock")) { unset($allow["LOCK"]); unset($allow["UNLOCK"]); } return $allow; } // }}} /** * helper for property element creation * * @param string XML namespace (optional) * @param string property name * @param string property value * @return array property array */ function mkprop() { $args = func_get_args(); if (count($args) == 3) { return array("ns" => $args[0], "name" => $args[1], "val" => $args[2]); } else { return array("ns" => "DAV:", "name" => $args[0], "val" => $args[1]); } } // {{{ _check_auth /** * check authentication if check is implemented * * @param void * @return bool true if authentication succeded or not necessary */ function _check_auth($type,$user,$pass) { // dummy } // }}} // {{{ UUID stuff /** * generate Unique Universal IDentifier for lock token * * @param void * @return string a new UUID */ function _new_uuid() { // use uuid extension from PECL if available if (function_exists("uuid_create")) { return uuid_create(); } // fallback $uuid = md5(microtime().getmypid()); // this should be random enough for now // set variant and version fields for 'true' random uuid $uuid{12} = "4"; $n = 8 + (ord($uuid{16}) & 3); $hex = "0123456789abcdef"; $uuid{16} = $hex{$n}; // return formated uuid return substr($uuid, 0, 8)."-" . substr($uuid, 8, 4)."-" . substr($uuid, 12, 4)."-" . substr($uuid, 16, 4)."-" . substr($uuid, 20); } /** * create a new opaque lock token as defined in RFC2518 * * @param void * @return string new RFC2518 opaque lock token */ function _new_locktoken() { return "opaquelocktoken:".$this->_new_uuid(); } // }}} // {{{ WebDAV If: header parsing /** * * * @param string header string to parse * @param int current parsing position * @return array next token (type and value) */ function _if_header_lexer($string, &$pos) { // skip whitespace while (ctype_space(substr($string,$pos))) { ++$pos; } // already at end of string? if (strlen($string) <= $pos) { return false; } // get next character $c = $string{$pos++}; // now it depends on what we found switch ($c) { case "<": // URIs are enclosed in <...> $pos2 = strpos($string, ">", $pos); $uri = substr($string, $pos, $pos2 - $pos); $pos = $pos2 + 1; return array("URI", $uri); case "[": //Etags are enclosed in [...] if ($string{$pos} == "W") { $type = "ETAG_WEAK"; $pos += 2; } else { $type = "ETAG_STRONG"; } $pos2 = strpos($string, "]", $pos); $etag = substr($string, $pos + 1, $pos2 - $pos - 2); $pos = $pos2 + 1; return array($type, $etag); case "N": // "N" indicates negation $pos += 2; return array("NOT", "Not"); default: // anything else is passed verbatim char by char return array("CHAR", $c); } } /** * parse If: header * * @param string header string * @return array URIs and their conditions */ function _if_header_parser($str) { $pos = 0; $len = strlen($str); $uris = array(); // parser loop while ($pos < $len) { // get next token $token = $this->_if_header_lexer($str, $pos); // check for URI if ($token[0] == "URI") { $uri = $token[1]; // remember URI $token = $this->_if_header_lexer($str, $pos); // get next token } else { $uri = ""; } // sanity check if ($token[0] != "CHAR" || $token[1] != "(") { return false; } $list = array(); $level = 1; $not = ""; while ($level) { $token = $this->_if_header_lexer($str, $pos); if ($token[0] == "NOT") { $not = "!"; continue; } switch ($token[0]) { case "CHAR": switch ($token[1]) { case "(": $level++; break; case ")": $level--; break; default: return false; } break; case "URI": $list[] = $not."<".$token[1].">"; break; case "ETAG_WEAK": $list[] = $not."[W/'".$token[1]."']>"; break; case "ETAG_STRONG": $list[] = $not."['".$token[1]."']>"; break; default: return false; } $not = ""; } if (@is_array($uris[$uri])) { $uris[$uri] = array_merge($uris[$uri],$list); } else { $uris[$uri] = $list; } } return $uris; } /** * check if conditions from "If:" headers are met * * the "If:" header is an extension to HTTP/1.1 * defined in RFC 2518 section 9.4 * * @param void * @return void */ function _check_if_header_conditions() { if (isset($_SERVER["HTTP_IF"])) { $this->_if_header_uris = $this->_if_header_parser($_SERVER["HTTP_IF"]); foreach($this->_if_header_uris as $uri => $conditions) { if ($uri == "") { // default uri is the complete request uri $uri=(@$_SERVER["HTTPS"]==="on")? "https://":"http://"; $uri .= $this->$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"]; } // all must match $state = true; foreach($conditions as $condition) { // lock tokens may be free form (RFC2518 6.3) // but if opaquelocktokens are used (RFC2518 6.4) // we have to check the format (litmus tests this) if (!strncmp($condition, "$", $condition)) { return false; } } if (!$this->_check_uri_condition($uri, $condition)) { $state = false; break; } } // any match is ok if ($state == true) { return true; } } return false; } return true; } /** * Check a single URI condition parsed from an if-header * * Check a single URI condition parsed from an if-header * * @abstract * @param string $uri URI to check * @param string $condition Condition to check for this URI * @returns bool Condition check result */ function _check_uri_condition($uri, $condition) { // not really implemented here, // implementations must override return true; } /** * * * @param string path of resource to check * @param bool exclusive lock? */ function _check_lock_status($path, $exclusive_only = false) { // FIXME depth -> ignored for now if (method_exists($this, "checkLock")) { // is locked? $lock = $this->checkLock($path); // ... and lock is not owned? if (is_array($lock) && count($lock)) { // FIXME doesn't check uri restrictions yet if (!strstr($_SERVER["HTTP_IF"], $lock["token"])) { if (!$exclusive_only || ($lock["scope"] !== "shared")) return false; } } } return true; } // }}} /** * Generate lockdiscovery reply from checklock() result * * @param string resource path to check * @return string lockdiscovery response */ function lockdiscovery($path) { // no lock support without checklock() method if (!method_exists($this, "checklock")) { return ""; } // collect response here $activelocks = ""; // get checklock() reply $lock = $this->checklock($path); // generate block for returned data if (is_array($lock) && count($lock)) { // check for 'timeout' or 'expires' if (!empty($lock['expires'])) { $timeout = "Second-".($lock['expires'] - time()); } else if (!empty($lock['timeout'])) { $timeout = "Second-".$lock['timeout']; } else { $timeout = "Infinite"; } // genreate response block $activelocks .= ' '.$lock['depth'].' '.$lock['owner'].' '.$timeout.' '.$lock['token'].' '; } // return generated response return $activelocks; } /** * set HTTP return status and mirror it in a private header * * @param string status code and message * @return void */ function http_status($status) { // simplified success case if($status === true) { $status = "200 OK"; } // remember status $this->_http_status = $status; // generate HTTP status response header("HTTP/1.1 $status"); header("X-WebDAV-Status: $status", true); } /** * private minimalistic version of PHP urlencode() * * only blanks and XML special chars must be encoded here * full urlencode() encoding confuses some clients ... * * @param string URL to encode * @return string encoded URL */ function _urlencode($url) { return strtr($url, array(" "=>"%20", "&"=>"%26", "<"=>"%3C", ">"=>"%3E", )); } /** * private version of PHP urldecode * * not really needed but added for completenes * * @param string URL to decode * @return string decoded URL */ function _urldecode($path) { return urldecode($path); } /** * UTF-8 encode property values if not already done so * * @param string text to encode * @return string utf-8 encoded text */ function _prop_encode($text) { switch (strtolower($this->_prop_encoding)) { case "utf-8": return $text; case "iso-8859-1": case "iso-8859-15": case "latin-1": default: return utf8_encode($text); } } } /* * Local variables: * tab-width: 4 * c-basic-offset: 4 * End: */ ?>