diff --git a/index.php b/index.php index 63e42aac..8431e826 100755 --- a/index.php +++ b/index.php @@ -406,7 +406,7 @@ SpotTiming::stop('total'); # enable of disable de timer - if (($settings->get('enable_timing')) && (!in_array(SpotReq::getDef('page', ''), array('catsjson', 'statics', 'getnzb', 'getnzbmobile', 'markallasread', 'rss', 'newznabapi')))) { + if (($settings->get('enable_timing')) && (!in_array($req->getDef('page', ''), array('catsjson', 'statics', 'getnzb', 'getnzbmobile', 'markallasread', 'rss', 'newznabapi')))) { SpotTiming::display(); } # if } diff --git a/lib/SpotReq.php b/lib/SpotReq.php index c9cdda56..31eb3317 100755 --- a/lib/SpotReq.php +++ b/lib/SpotReq.php @@ -1,22 +1,22 @@ get('xsrfsecret'); - self::$_settings = $settings; + $this->_merged = array_merge_recursive($_POST, $_GET); + $this->_xsrfsecret = $settings->get('xsrfsecret'); + $this->_settings = $settings; } function get($varName, $escapeType = 'none') { if( is_array($varName) ) { - return self::escape(self::$_merged[$varName[0]][$varName[1]], $escapeType); + return $this->escape($this->_merged[$varName[0]][$varName[1]], $escapeType); } else { - return self::escape(self::$_merged[$varName], $escapeType); + return $this->escape($this->_merged[$varName], $escapeType); } } @@ -63,7 +63,7 @@ function getHttpReferer() { if (isset($_SERVER['HTTP_REFERER'])) { return $_SERVER['HTTP_REFERER']; } else { - return self::$_settings->get('spotweburl'); + return $this->_settings->get('spotweburl'); } # else } # getHttpReferer @@ -104,12 +104,12 @@ static function isXsrfValid($form) { } # if # if the cookie is for another userid, its not valid either - if ($xsrfVals[2] != self::$_userid) { + if ($xsrfVals[2] != $this->_userid) { return false; } # if # and check the hash so any of the values above couldn't be faked - if (sha1($xsrfVals[0] . ':' . $xsrfVals[1] . ':' . $xsrfVals[2] . self::$_xsrfsecret) != $xsrfVals[3]) { + if (sha1($xsrfVals[0] . ':' . $xsrfVals[1] . ':' . $xsrfVals[2] . $this->_xsrfsecret) != $xsrfVals[3]) { return false; } # if @@ -122,32 +122,32 @@ static function generateXsrfCookie($action) { # 2 - formname (for example, 'loginform' or 'postcommentform') # 3 - Userid # 4 - sha1 of the preceding 3 strings including ':', but the secret key appended as salt - $xsrfCookie = time() . ':' . $action . ':' . self::$_userid; - $xsrfCookie .= ':' . sha1($xsrfCookie . self::$_xsrfsecret); + $xsrfCookie = time() . ':' . $action . ':' . $this->_userid; + $xsrfCookie .= ':' . sha1($xsrfCookie . $this->_xsrfsecret); return $xsrfCookie; } # generateXsrfCookie function doesExist($varName) { if( is_array($varName) ) { - return isset(self::$_merged[$varName[0]][$varName[1]]); + return isset($this->_merged[$varName[0]][$varName[1]]); } else { - return isset(self::$_merged[$varName]); + return isset($this->_merged[$varName]); } } function getDef($varName, $defValue, $escapeType = 'none') { - if( !isset(self::$_merged[$varName]) ) { + if( !isset($this->_merged[$varName]) ) { return $defValue; } else { - return self::get($varName, $escapeType); + return $this->get($varName, $escapeType); } } function getSrvVar($varName, $defValue = '', $escapeType = 'none') { if( isset($_SERVER[$varName]) ) { - return self::escape($_SERVER[$varName], $escapeType); + return $this->escape($_SERVER[$varName], $escapeType); } else { return $defValue; } @@ -156,7 +156,7 @@ function getSrvVar($varName, $defValue = '', $escapeType = 'none') { function escape($var, $escapeType) { if( is_array($var) ) { foreach($var as $key => $value) { - $var[$key] = self::escape($value, $escapeType); + $var[$key] = $this->escape($value, $escapeType); } return $var; @@ -175,6 +175,6 @@ function escape($var, $escapeType) { } function setUserId($i) { - self::$_userid = $i; + $this->_userid = $i; } // #setUserId }