No OneTemporary
Actions

Size

83 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/src/aphront/AphrontRequest.php b/src/aphront/AphrontRequest.php
	index 6045c0d728..ea0313e2a3 100644
	--- a/src/aphront/AphrontRequest.php
	+++ b/src/aphront/AphrontRequest.php
	@@ -1,827 +1,829 @@
	<?php

	/**
	* @task data Accessing Request Data
	* @task cookie Managing Cookies
	* @task cluster Working With a Phabricator Cluster
	*/
	final class AphrontRequest extends Phobject {

	// NOTE: These magic request-type parameters are automatically included in
	// certain requests (e.g., by phabricator_form(), JX.Request,
	// JX.Workflow, and ConduitClient) and help us figure out what sort of
	// response the client expects.

	const TYPE_AJAX = '__ajax__';
	const TYPE_FORM = '__form__';
	const TYPE_CONDUIT = '__conduit__';
	const TYPE_WORKFLOW = '__wflow__';
	const TYPE_CONTINUE = '__continue__';
	const TYPE_PREVIEW = '__preview__';
	const TYPE_HISEC = '__hisec__';
	const TYPE_QUICKSAND = '__quicksand__';

	private $host;
	private $path;
	private $requestData;
	private $user;
	private $applicationConfiguration;
	private $site;
	private $controller;
	private $uriData = array();
	private $cookiePrefix;

	public function __construct($host, $path) {
	$this->host = $host;
	$this->path = $path;
	}

	public function setURIMap(array $uri_data) {
	$this->uriData = $uri_data;
	return $this;
	}

	public function getURIMap() {
	return $this->uriData;
	}

	public function getURIData($key, $default = null) {
	return idx($this->uriData, $key, $default);
	}

	public function setApplicationConfiguration(
	$application_configuration) {
	$this->applicationConfiguration = $application_configuration;
	return $this;
	}

	public function getApplicationConfiguration() {
	return $this->applicationConfiguration;
	}

	public function setPath($path) {
	$this->path = $path;
	return $this;
	}

	public function getPath() {
	return $this->path;
	}

	public function getHost() {
	// The "Host" header may include a port number, or may be a malicious
	// header in the form "realdomain.com:ignored@evil.com". Invoke the full
	// parser to extract the real domain correctly. See here for coverage of
	// a similar issue in Django:
	//
	// https://www.djangoproject.com/weblog/2012/oct/17/security/
	$uri = new PhutilURI('http://'.$this->host);
	return $uri->getDomain();
	}

	public function setSite(AphrontSite $site) {
	$this->site = $site;
	return $this;
	}

	public function getSite() {
	return $this->site;
	}

	public function setController(AphrontController $controller) {
	$this->controller = $controller;
	return $this;
	}

	public function getController() {
	return $this->controller;
	}


	/* -( Accessing Request Data )--------------------------------------------- */


	/**
	* @task data
	*/
	public function setRequestData(array $request_data) {
	$this->requestData = $request_data;
	return $this;
	}


	/**
	* @task data
	*/
	public function getRequestData() {
	return $this->requestData;
	}


	/**
	* @task data
	*/
	public function getInt($name, $default = null) {
	if (isset($this->requestData[$name])) {
	// Converting from array to int is "undefined". Don't rely on whatever
	// PHP decides to do.
	if (is_array($this->requestData[$name])) {
	return $default;
	}
	return (int)$this->requestData[$name];
	} else {
	return $default;
	}
	}


	/**
	* @task data
	*/
	public function getBool($name, $default = null) {
	if (isset($this->requestData[$name])) {
	if ($this->requestData[$name] === 'true') {
	return true;
	} else if ($this->requestData[$name] === 'false') {
	return false;
	} else {
	return (bool)$this->requestData[$name];
	}
	} else {
	return $default;
	}
	}


	/**
	* @task data
	*/
	public function getStr($name, $default = null) {
	if (isset($this->requestData[$name])) {
	$str = (string)$this->requestData[$name];
	// Normalize newline craziness.
	$str = str_replace(
	array("\r\n", "\r"),
	array("\n", "\n"),
	$str);
	return $str;
	} else {
	return $default;
	}
	}


	/**
	* @task data
	*/
	public function getArr($name, $default = array()) {
	if (isset($this->requestData[$name]) &&
	is_array($this->requestData[$name])) {
	return $this->requestData[$name];
	} else {
	return $default;
	}
	}


	/**
	* @task data
	*/
	public function getStrList($name, $default = array()) {
	if (!isset($this->requestData[$name])) {
	return $default;
	}
	$list = $this->getStr($name);
	$list = preg_split('/[\s,]+/', $list, $limit = -1, PREG_SPLIT_NO_EMPTY);
	return $list;
	}


	/**
	* @task data
	*/
	public function getExists($name) {
	return array_key_exists($name, $this->requestData);
	}

	public function getFileExists($name) {
	return isset($_FILES[$name]) &&
	(idx($_FILES[$name], 'error') !== UPLOAD_ERR_NO_FILE);
	}

	public function isHTTPGet() {
	return ($_SERVER['REQUEST_METHOD'] == 'GET');
	}

	public function isHTTPPost() {
	return ($_SERVER['REQUEST_METHOD'] == 'POST');
	}

	public function isAjax() {
	return $this->getExists(self::TYPE_AJAX) && !$this->isQuicksand();
	}

	public function isWorkflow() {
	return $this->getExists(self::TYPE_WORKFLOW) && !$this->isQuicksand();
	}

	public function isQuicksand() {
	return $this->getExists(self::TYPE_QUICKSAND);
	}

	public function isConduit() {
	return $this->getExists(self::TYPE_CONDUIT);
	}

	public static function getCSRFTokenName() {
	return '__csrf__';
	}

	public static function getCSRFHeaderName() {
	return 'X-Phabricator-Csrf';
	}

	public static function getViaHeaderName() {
	return 'X-Phabricator-Via';
	}

	public function validateCSRF() {
	$token_name = self::getCSRFTokenName();
	$token = $this->getStr($token_name);

	// No token in the request, check the HTTP header which is added for Ajax
	// requests.
	if (empty($token)) {
	$token = self::getHTTPHeader(self::getCSRFHeaderName());
	}

	$valid = $this->getUser()->validateCSRFToken($token);
	if (!$valid) {

	// Add some diagnostic details so we can figure out if some CSRF issues
	// are JS problems or people accessing Ajax URIs directly with their
	// browsers.
	$info = array();

	$info[] = pht(
	'You are trying to save some data to Phabricator, but the request '.
	'your browser made included an incorrect token. Reload the page '.
	'and try again. You may need to clear your cookies.');

	if ($this->isAjax()) {
	$info[] = pht('This was an Ajax request.');
	} else {
	$info[] = pht('This was a Web request.');
	}

	if ($token) {
	$info[] = pht('This request had an invalid CSRF token.');
	} else {
	$info[] = pht('This request had no CSRF token.');
	}

	// Give a more detailed explanation of how to avoid the exception
	// in developer mode.
	if (PhabricatorEnv::getEnvConfig('phabricator.developer-mode')) {
	// TODO: Clean this up, see T1921.
	$info[] = pht(
	"To avoid this error, use %s to construct forms. If you are already ".
	"using %s, make sure the form 'action' uses a relative URI (i.e., ".
	"begins with a '%s'). Forms using absolute URIs do not include CSRF ".
	"tokens, to prevent leaking tokens to external sites.\n\n".
	"If this page performs writes which do not require CSRF protection ".
	"(usually, filling caches or logging), you can use %s to ".
	"temporarily bypass CSRF protection while writing. You should use ".
	"this only for writes which can not be protected with normal CSRF ".
	"mechanisms.\n\n".
	"Some UI elements (like %s) also have methods which will allow you ".
	"to render links as forms (like %s).",
	'phabricator_form()',
	'phabricator_form()',
	'/',
	'AphrontWriteGuard::beginScopedUnguardedWrites()',
	'PhabricatorActionListView',
	'setRenderAsForm(true)');
	}

	$message = implode("\n", $info);

	// This should only be able to happen if you load a form, pull your
	// internet for 6 hours, and then reconnect and immediately submit,
	// but give the user some indication of what happened since the workflow
	// is incredibly confusing otherwise.
	throw new AphrontMalformedRequestException(
	pht('Invalid Request (CSRF)'),
	$message,
	true);
	}

	return true;
	}

	public function isFormPost() {
	$post = $this->getExists(self::TYPE_FORM) &&
	!$this->getExists(self::TYPE_HISEC) &&
	$this->isHTTPPost();

	if (!$post) {
	return false;
	}

	return $this->validateCSRF();
	}

	public function isFormOrHisecPost() {
	$post = $this->getExists(self::TYPE_FORM) &&
	$this->isHTTPPost();

	if (!$post) {
	return false;
	}

	return $this->validateCSRF();
	}


	public function setCookiePrefix($prefix) {
	$this->cookiePrefix = $prefix;
	return $this;
	}

	private function getPrefixedCookieName($name) {
	if (strlen($this->cookiePrefix)) {
	return $this->cookiePrefix.'_'.$name;
	} else {
	return $name;
	}
	}

	public function getCookie($name, $default = null) {
	$name = $this->getPrefixedCookieName($name);
	$value = idx($_COOKIE, $name, $default);

	// Internally, PHP deletes cookies by setting them to the value 'deleted'
	// with an expiration date in the past.

	// At least in Safari, the browser may send this cookie anyway in some
	// circumstances. After logging out, the 302'd GET to /login/ consistently
	// includes deleted cookies on my local install. If a cookie value is
	// literally 'deleted', pretend it does not exist.

	if ($value === 'deleted') {
	return null;
	}

	return $value;
	}

	public function clearCookie($name) {
	$this->setCookieWithExpiration($name, '', time() - (60 * 60 * 24 * 30));
	unset($_COOKIE[$name]);
	}

	/**
	* Get the domain which cookies should be set on for this request, or null
	* if the request does not correspond to a valid cookie domain.
	*
	* @return PhutilURI\|null Domain URI, or null if no valid domain exists.
	*
	* @task cookie
	*/
	private function getCookieDomainURI() {
	if (PhabricatorEnv::getEnvConfig('security.require-https') &&
	!$this->isHTTPS()) {
	return null;
	}

	$host = $this->getHost();

	// If there's no base domain configured, just use whatever the request
	// domain is. This makes setup easier, and we'll tell administrators to
	// configure a base domain during the setup process.
	$base_uri = PhabricatorEnv::getEnvConfig('phabricator.base-uri');
	if (!strlen($base_uri)) {
	return new PhutilURI('http://'.$host.'/');
	}

	$alternates = PhabricatorEnv::getEnvConfig('phabricator.allowed-uris');
	$allowed_uris = array_merge(
	array($base_uri),
	$alternates);

	foreach ($allowed_uris as $allowed_uri) {
	$uri = new PhutilURI($allowed_uri);
	if ($uri->getDomain() == $host) {
	return $uri;
	}
	}

	return null;
	}

	/**
	* Determine if security policy rules will allow cookies to be set when
	* responding to the request.
	*
	* @return bool True if setCookie() will succeed. If this method returns
	* false, setCookie() will throw.
	*
	* @task cookie
	*/
	public function canSetCookies() {
	return (bool)$this->getCookieDomainURI();
	}


	/**
	* Set a cookie which does not expire for a long time.
	*
	* To set a temporary cookie, see @{method:setTemporaryCookie}.
	*
	* @param string Cookie name.
	* @param string Cookie value.
	* @return this
	* @task cookie
	*/
	public function setCookie($name, $value) {
	$far_future = time() + (60 * 60 * 24 * 365 * 5);
	return $this->setCookieWithExpiration($name, $value, $far_future);
	}


	/**
	* Set a cookie which expires soon.
	*
	* To set a durable cookie, see @{method:setCookie}.
	*
	* @param string Cookie name.
	* @param string Cookie value.
	* @return this
	* @task cookie
	*/
	public function setTemporaryCookie($name, $value) {
	return $this->setCookieWithExpiration($name, $value, 0);
	}


	/**
	* Set a cookie with a given expiration policy.
	*
	* @param string Cookie name.
	* @param string Cookie value.
	* @param int Epoch timestamp for cookie expiration.
	* @return this
	* @task cookie
	*/
	private function setCookieWithExpiration(
	$name,
	$value,
	$expire) {

	$is_secure = false;

	$base_domain_uri = $this->getCookieDomainURI();
	if (!$base_domain_uri) {
	$configured_as = PhabricatorEnv::getEnvConfig('phabricator.base-uri');
	$accessed_as = $this->getHost();

	throw new AphrontMalformedRequestException(
	pht('Bad Host Header'),
	pht(
	'This Phabricator install is configured as "%s", but you are '.
	'using the domain name "%s" to access a page which is trying to '.
	'set a cookie. Access Phabricator on the configured primary '.
	'domain or a configured alternate domain. Phabricator will not '.
	'set cookies on other domains for security reasons.',
	$configured_as,
	$accessed_as),
	true);
	}

	$base_domain = $base_domain_uri->getDomain();
	$is_secure = ($base_domain_uri->getProtocol() == 'https');

	$name = $this->getPrefixedCookieName($name);

	if (php_sapi_name() == 'cli') {
	// Do nothing, to avoid triggering "Cannot modify header information"
	// warnings.

	// TODO: This is effectively a test for whether we're running in a unit
	// test or not. Move this actual call to HTTPSink?
	} else {
	setcookie(
	$name,
	$value,
	$expire,
	$path = '/',
	$base_domain,
	$is_secure,
	$http_only = true);
	}

	$_COOKIE[$name] = $value;

	return $this;
	}

	public function setUser($user) {
	$this->user = $user;
	return $this;
	}

	public function getUser() {
	return $this->user;
	}

	public function getViewer() {
	return $this->user;
	}

	public function getRequestURI() {
	$get = $_GET;
	unset($get['__path__']);
	$path = phutil_escape_uri($this->getPath());
	return id(new PhutilURI($path))->setQueryParams($get);
	}

	public function getAbsoluteRequestURI() {
	$uri = $this->getRequestURI();
	$uri->setDomain($this->getHost());
	$uri->setProtocol($this->isHTTPS() ? 'https' : 'http');
	return $uri;
	}

	public function isDialogFormPost() {
	return $this->isFormPost() && $this->getStr('__dialog__');
	}

	public function getRemoteAddress() {
	- $address = $_SERVER['REMOTE_ADDR'];
	- if (!strlen($address)) {
	+ $address = PhabricatorEnv::getRemoteAddress();
	+
	+ if (!$address) {
	return null;
	}
	- return substr($address, 0, 64);
	+
	+ return $address->getAddress();
	}

	public function isHTTPS() {
	if (empty($_SERVER['HTTPS'])) {
	return false;
	}
	if (!strcasecmp($_SERVER['HTTPS'], 'off')) {
	return false;
	}
	return true;
	}

	public function isContinueRequest() {
	return $this->isFormPost() && $this->getStr('__continue__');
	}

	public function isPreviewRequest() {
	return $this->isFormPost() && $this->getStr('__preview__');
	}

	/**
	* Get application request parameters in a flattened form suitable for
	* inclusion in an HTTP request, excluding parameters with special meanings.
	* This is primarily useful if you want to ask the user for more input and
	* then resubmit their request.
	*
	* @return dict<string, string> Original request parameters.
	*/
	public function getPassthroughRequestParameters($include_quicksand = false) {
	return self::flattenData(
	$this->getPassthroughRequestData($include_quicksand));
	}

	/**
	* Get request data other than "magic" parameters.
	*
	* @return dict<string, wild> Request data, with magic filtered out.
	*/
	public function getPassthroughRequestData($include_quicksand = false) {
	$data = $this->getRequestData();

	// Remove magic parameters like __dialog__ and __ajax__.
	foreach ($data as $key => $value) {
	if ($include_quicksand && $key == self::TYPE_QUICKSAND) {
	continue;
	}
	if (!strncmp($key, '__', 2)) {
	unset($data[$key]);
	}
	}

	return $data;
	}


	/**
	* Flatten an array of key-value pairs (possibly including arrays as values)
	* into a list of key-value pairs suitable for submitting via HTTP request
	* (with arrays flattened).
	*
	* @param dict<string, wild> Data to flatten.
	* @return dict<string, string> Flat data suitable for inclusion in an HTTP
	* request.
	*/
	public static function flattenData(array $data) {
	$result = array();
	foreach ($data as $key => $value) {
	if (is_array($value)) {
	foreach (self::flattenData($value) as $fkey => $fvalue) {
	$fkey = '['.preg_replace('/(?=\[)\|$/', ']', $fkey, $limit = 1);
	$result[$key.$fkey] = $fvalue;
	}
	} else {
	$result[$key] = (string)$value;
	}
	}

	ksort($result);

	return $result;
	}


	/**
	* Read the value of an HTTP header from `$_SERVER`, or a similar datasource.
	*
	* This function accepts a canonical header name, like `"Accept-Encoding"`,
	* and looks up the appropriate value in `$_SERVER` (in this case,
	* `"HTTP_ACCEPT_ENCODING"`).
	*
	* @param string Canonical header name, like `"Accept-Encoding"`.
	* @param wild Default value to return if header is not present.
	* @param array? Read this instead of `$_SERVER`.
	* @return string\|wild Header value if present, or `$default` if not.
	*/
	public static function getHTTPHeader($name, $default = null, $data = null) {
	// PHP mangles HTTP headers by uppercasing them and replacing hyphens with
	// underscores, then prepending 'HTTP_'.
	$php_index = strtoupper($name);
	$php_index = str_replace('-', '_', $php_index);

	$try_names = array();

	$try_names[] = 'HTTP_'.$php_index;
	if ($php_index == 'CONTENT_TYPE' \|\| $php_index == 'CONTENT_LENGTH') {
	// These headers may be available under alternate names. See
	// http://www.php.net/manual/en/reserved.variables.server.php#110763
	$try_names[] = $php_index;
	}

	if ($data === null) {
	$data = $_SERVER;
	}

	foreach ($try_names as $try_name) {
	if (array_key_exists($try_name, $data)) {
	return $data[$try_name];
	}
	}

	return $default;
	}


	/* -( Working With a Phabricator Cluster )--------------------------------- */


	/**
	* Is this a proxied request originating from within the Phabricator cluster?
	*
	* IMPORTANT: This means the request is dangerous!
	*
	* These requests are more dangerous than normal requests (they can not
	* be safely proxied, because proxying them may cause a loop). Cluster
	* requests are not guaranteed to come from a trusted source, and should
	* never be treated as safer than normal requests. They are strictly less
	* safe.
	*/
	public function isProxiedClusterRequest() {
	return (bool)self::getHTTPHeader('X-Phabricator-Cluster');
	}


	/**
	* Build a new @{class:HTTPSFuture} which proxies this request to another
	* node in the cluster.
	*
	* IMPORTANT: This is very dangerous!
	*
	* The future forwards authentication information present in the request.
	* Proxied requests must only be sent to trusted hosts. (We attempt to
	* enforce this.)
	*
	* This is not a general-purpose proxying method; it is a specialized
	* method with niche applications and severe security implications.
	*
	* @param string URI identifying the host we are proxying the request to.
	* @return HTTPSFuture New proxy future.
	*
	* @phutil-external-symbol class PhabricatorStartup
	*/
	public function newClusterProxyFuture($uri) {
	$uri = new PhutilURI($uri);

	$domain = $uri->getDomain();
	$ip = gethostbyname($domain);
	if (!$ip) {
	throw new Exception(
	pht(
	'Unable to resolve domain "%s"!',
	$domain));
	}

	if (!PhabricatorEnv::isClusterAddress($ip)) {
	throw new Exception(
	pht(
	'Refusing to proxy a request to IP address ("%s") which is not '.
	'in the cluster address block (this address was derived by '.
	'resolving the domain "%s").',
	$ip,
	$domain));
	}

	$uri->setPath($this->getPath());
	$uri->setQueryParams(self::flattenData($_GET));

	$input = PhabricatorStartup::getRawInput();

	$future = id(new HTTPSFuture($uri))
	->addHeader('Host', self::getHost())
	->addHeader('X-Phabricator-Cluster', true)
	->setMethod($_SERVER['REQUEST_METHOD'])
	->write($input);

	if (isset($_SERVER['PHP_AUTH_USER'])) {
	$future->setHTTPBasicAuthCredentials(
	$_SERVER['PHP_AUTH_USER'],
	new PhutilOpaqueEnvelope(idx($_SERVER, 'PHP_AUTH_PW', '')));
	}

	$headers = array();
	$seen = array();

	// NOTE: apache_request_headers() might provide a nicer way to do this,
	// but isn't available under FCGI until PHP 5.4.0.
	foreach ($_SERVER as $key => $value) {
	if (!preg_match('/^HTTP_/', $key)) {
	continue;
	}

	// Unmangle the header as best we can.
	$key = substr($key, strlen('HTTP_'));
	$key = str_replace('_', ' ', $key);
	$key = strtolower($key);
	$key = ucwords($key);
	$key = str_replace(' ', '-', $key);

	// By default, do not forward headers.
	$should_forward = false;

	// Forward "X-Hgarg-..." headers.
	if (preg_match('/^X-Hgarg-/', $key)) {
	$should_forward = true;
	}

	if ($should_forward) {
	$headers[] = array($key, $value);
	$seen[$key] = true;
	}
	}

	// In some situations, this may not be mapped into the HTTP_X constants.
	// CONTENT_LENGTH is similarly affected, but we trust cURL to take care
	// of that if it matters, since we're handing off a request body.
	if (empty($seen['Content-Type'])) {
	if (isset($_SERVER['CONTENT_TYPE'])) {
	$headers[] = array('Content-Type', $_SERVER['CONTENT_TYPE']);
	}
	}

	foreach ($headers as $header) {
	list($key, $value) = $header;
	switch ($key) {
	case 'Host':
	case 'Authorization':
	// Don't forward these headers, we've already handled them elsewhere.
	unset($headers[$key]);
	break;
	default:
	break;
	}
	}

	foreach ($headers as $header) {
	list($key, $value) = $header;
	$future->addHeader($key, $value);
	}

	return $future;
	}


	}
	diff --git a/src/aphront/configuration/AphrontApplicationConfiguration.php b/src/aphront/configuration/AphrontApplicationConfiguration.php
	index bcbc325b87..bbfcaf0b46 100644
	--- a/src/aphront/configuration/AphrontApplicationConfiguration.php
	+++ b/src/aphront/configuration/AphrontApplicationConfiguration.php
	@@ -1,686 +1,694 @@
	<?php

	/**
	* @task routing URI Routing
	* @task response Response Handling
	* @task exception Exception Handling
	*/
	abstract class AphrontApplicationConfiguration extends Phobject {

	private $request;
	private $host;
	private $path;
	private $console;

	abstract public function buildRequest();
	abstract public function build404Controller();
	abstract public function buildRedirectController($uri, $external);

	final public function setRequest(AphrontRequest $request) {
	$this->request = $request;
	return $this;
	}

	final public function getRequest() {
	return $this->request;
	}

	final public function getConsole() {
	return $this->console;
	}

	final public function setConsole($console) {
	$this->console = $console;
	return $this;
	}

	final public function setHost($host) {
	$this->host = $host;
	return $this;
	}

	final public function getHost() {
	return $this->host;
	}

	final public function setPath($path) {
	$this->path = $path;
	return $this;
	}

	final public function getPath() {
	return $this->path;
	}

	public function willBuildRequest() {}


	/**
	* @phutil-external-symbol class PhabricatorStartup
	*/
	public static function runHTTPRequest(AphrontHTTPSink $sink) {
	PhabricatorStartup::beginStartupPhase('multimeter');
	$multimeter = MultimeterControl::newInstance();
	$multimeter->setEventContext('<http-init>');
	$multimeter->setEventViewer('<none>');

	// Build a no-op write guard for the setup phase. We'll replace this with a
	// real write guard later on, but we need to survive setup and build a
	// request object first.
	$write_guard = new AphrontWriteGuard('id');

	PhabricatorStartup::beginStartupPhase('preflight');

	$response = PhabricatorSetupCheck::willPreflightRequest();
	if ($response) {
	return self::writeResponse($sink, $response);
	}

	PhabricatorStartup::beginStartupPhase('env.init');

	try {
	PhabricatorEnv::initializeWebEnvironment();
	$database_exception = null;
	} catch (PhabricatorClusterStrandedException $ex) {
	$database_exception = $ex;
	}

	if ($database_exception) {
	$issue = PhabricatorSetupIssue::newDatabaseConnectionIssue(
	$database_exception,
	true);
	$response = PhabricatorSetupCheck::newIssueResponse($issue);
	return self::writeResponse($sink, $response);
	}

	$multimeter->setSampleRate(
	PhabricatorEnv::getEnvConfig('debug.sample-rate'));

	$debug_time_limit = PhabricatorEnv::getEnvConfig('debug.time-limit');
	if ($debug_time_limit) {
	PhabricatorStartup::setDebugTimeLimit($debug_time_limit);
	}

	// This is the earliest we can get away with this, we need env config first.
	PhabricatorStartup::beginStartupPhase('log.access');
	PhabricatorAccessLog::init();
	$access_log = PhabricatorAccessLog::getLog();
	PhabricatorStartup::setAccessLog($access_log);
	+
	+ $address = PhabricatorEnv::getRemoteAddress();
	+ if ($address) {
	+ $address_string = $address->getAddress();
	+ } else {
	+ $address_string = '-';
	+ }
	+
	$access_log->setData(
	array(
	'R' => AphrontRequest::getHTTPHeader('Referer', '-'),
	- 'r' => idx($_SERVER, 'REMOTE_ADDR', '-'),
	+ 'r' => $address_string,
	'M' => idx($_SERVER, 'REQUEST_METHOD', '-'),
	));

	DarkConsoleXHProfPluginAPI::hookProfiler();

	// We just activated the profiler, so we don't need to keep track of
	// startup phases anymore: it can take over from here.
	PhabricatorStartup::beginStartupPhase('startup.done');

	DarkConsoleErrorLogPluginAPI::registerErrorHandler();

	$response = PhabricatorSetupCheck::willProcessRequest();
	if ($response) {
	return self::writeResponse($sink, $response);
	}

	$host = AphrontRequest::getHTTPHeader('Host');
	$path = $_REQUEST['__path__'];

	switch ($host) {
	default:
	$config_key = 'aphront.default-application-configuration-class';
	$application = PhabricatorEnv::newObjectFromConfig($config_key);
	break;
	}

	$application->setHost($host);
	$application->setPath($path);
	$application->willBuildRequest();
	$request = $application->buildRequest();

	// Now that we have a request, convert the write guard into one which
	// actually checks CSRF tokens.
	$write_guard->dispose();
	$write_guard = new AphrontWriteGuard(array($request, 'validateCSRF'));

	// Build the server URI implied by the request headers. If an administrator
	// has not configured "phabricator.base-uri" yet, we'll use this to generate
	// links.

	$request_protocol = ($request->isHTTPS() ? 'https' : 'http');
	$request_base_uri = "{$request_protocol}://{$host}/";
	PhabricatorEnv::setRequestBaseURI($request_base_uri);

	$access_log->setData(
	array(
	'U' => (string)$request->getRequestURI()->getPath(),
	));

	$processing_exception = null;
	try {
	$response = $application->processRequest(
	$request,
	$access_log,
	$sink,
	$multimeter);
	$response_code = $response->getHTTPResponseCode();
	} catch (Exception $ex) {
	$processing_exception = $ex;
	$response_code = 500;
	}

	$write_guard->dispose();

	$access_log->setData(
	array(
	'c' => $response_code,
	'T' => PhabricatorStartup::getMicrosecondsSinceStart(),
	));

	$multimeter->newEvent(
	MultimeterEvent::TYPE_REQUEST_TIME,
	$multimeter->getEventContext(),
	PhabricatorStartup::getMicrosecondsSinceStart());

	$access_log->write();

	$multimeter->saveEvents();

	DarkConsoleXHProfPluginAPI::saveProfilerSample($access_log);

	// Add points to the rate limits for this request.
	if (isset($_SERVER['REMOTE_ADDR'])) {
	$user_ip = $_SERVER['REMOTE_ADDR'];

	// The base score for a request allows users to make 30 requests per
	// minute.
	$score = (1000 / 30);

	// If the user was logged in, let them make more requests.
	if ($request->getUser() && $request->getUser()->getPHID()) {
	$score = $score / 5;
	}

	PhabricatorStartup::addRateLimitScore($user_ip, $score);
	}

	if ($processing_exception) {
	throw $processing_exception;
	}
	}


	public function processRequest(
	AphrontRequest $request,
	PhutilDeferredLog $access_log,
	AphrontHTTPSink $sink,
	MultimeterControl $multimeter) {

	$this->setRequest($request);

	list($controller, $uri_data) = $this->buildController();

	$controller_class = get_class($controller);
	$access_log->setData(
	array(
	'C' => $controller_class,
	));
	$multimeter->setEventContext('web.'.$controller_class);

	$request->setController($controller);
	$request->setURIMap($uri_data);

	$controller->setRequest($request);

	// If execution throws an exception and then trying to render that
	// exception throws another exception, we want to show the original
	// exception, as it is likely the root cause of the rendering exception.
	$original_exception = null;
	try {
	$response = $controller->willBeginExecution();

	if ($request->getUser() && $request->getUser()->getPHID()) {
	$access_log->setData(
	array(
	'u' => $request->getUser()->getUserName(),
	'P' => $request->getUser()->getPHID(),
	));
	$multimeter->setEventViewer('user.'.$request->getUser()->getPHID());
	}

	if (!$response) {
	$controller->willProcessRequest($uri_data);
	$response = $controller->handleRequest($request);
	$this->validateControllerResponse($controller, $response);
	}
	} catch (Exception $ex) {
	$original_exception = $ex;
	$response = $this->handleException($ex);
	}

	try {
	$response = $this->produceResponse($request, $response);
	$response = $controller->willSendResponse($response);
	$response->setRequest($request);

	self::writeResponse($sink, $response);
	} catch (Exception $ex) {
	if ($original_exception) {
	throw $original_exception;
	}
	throw $ex;
	}

	return $response;
	}

	private static function writeResponse(
	AphrontHTTPSink $sink,
	AphrontResponse $response) {

	$unexpected_output = PhabricatorStartup::endOutputCapture();
	if ($unexpected_output) {
	$unexpected_output = pht(
	"Unexpected output:\n\n%s",
	$unexpected_output);

	phlog($unexpected_output);

	if ($response instanceof AphrontWebpageResponse) {
	echo phutil_tag(
	'div',
	array(
	'style' =>
	'background: #eeddff;'.
	'white-space: pre-wrap;'.
	'z-index: 200000;'.
	'position: relative;'.
	'padding: 8px;'.
	'font-family: monospace',
	),
	$unexpected_output);
	}
	}

	$sink->writeResponse($response);
	}


	/* -( URI Routing )-------------------------------------------------------- */


	/**
	* Build a controller to respond to the request.
	*
	* @return pair<AphrontController,dict> Controller and dictionary of request
	* parameters.
	* @task routing
	*/
	final private function buildController() {
	$request = $this->getRequest();

	// If we're configured to operate in cluster mode, reject requests which
	// were not received on a cluster interface.
	//
	// For example, a host may have an internal address like "170.0.0.1", and
	// also have a public address like "51.23.95.16". Assuming the cluster
	// is configured on a range like "170.0.0.0/16", we want to reject the
	// requests received on the public interface.
	//
	// Ideally, nodes in a cluster should only be listening on internal
	// interfaces, but they may be configured in such a way that they also
	// listen on external interfaces, since this is easy to forget about or
	// get wrong. As a broad security measure, reject requests received on any
	// interfaces which aren't on the whitelist.

	$cluster_addresses = PhabricatorEnv::getEnvConfig('cluster.addresses');
	if ($cluster_addresses) {
	$server_addr = idx($_SERVER, 'SERVER_ADDR');
	if (!$server_addr) {
	if (php_sapi_name() == 'cli') {
	// This is a command line script (probably something like a unit
	// test) so it's fine that we don't have SERVER_ADDR defined.
	} else {
	throw new AphrontMalformedRequestException(
	pht('No %s', 'SERVER_ADDR'),
	pht(
	'Phabricator is configured to operate in cluster mode, but '.
	'%s is not defined in the request context. Your webserver '.
	'configuration needs to forward %s to PHP so Phabricator can '.
	'reject requests received on external interfaces.',
	'SERVER_ADDR',
	'SERVER_ADDR'));
	}
	} else {
	if (!PhabricatorEnv::isClusterAddress($server_addr)) {
	throw new AphrontMalformedRequestException(
	pht('External Interface'),
	pht(
	'Phabricator is configured in cluster mode and the address '.
	'this request was received on ("%s") is not whitelisted as '.
	'a cluster address.',
	$server_addr));
	}
	}
	}

	$site = $this->buildSiteForRequest($request);

	if ($site->shouldRequireHTTPS()) {
	if (!$request->isHTTPS()) {

	// Don't redirect intracluster requests: doing so drops headers and
	// parameters, imposes a performance penalty, and indicates a
	// misconfiguration.
	if ($request->isProxiedClusterRequest()) {
	throw new AphrontMalformedRequestException(
	pht('HTTPS Required'),
	pht(
	'This request reached a site which requires HTTPS, but the '.
	'request is not marked as HTTPS.'));
	}

	$https_uri = $request->getRequestURI();
	$https_uri->setDomain($request->getHost());
	$https_uri->setProtocol('https');

	// In this scenario, we'll be redirecting to HTTPS using an absolute
	// URI, so we need to permit an external redirect.
	return $this->buildRedirectController($https_uri, true);
	}
	}

	$maps = $site->getRoutingMaps();
	$path = $request->getPath();

	$result = $this->routePath($maps, $path);
	if ($result) {
	return $result;
	}

	// If we failed to match anything but don't have a trailing slash, try
	// to add a trailing slash and issue a redirect if that resolves.

	// NOTE: We only do this for GET, since redirects switch to GET and drop
	// data like POST parameters.
	if (!preg_match('@/$@', $path) && $request->isHTTPGet()) {
	$result = $this->routePath($maps, $path.'/');
	if ($result) {
	$target_uri = $request->getAbsoluteRequestURI();

	// We need to restore URI encoding because the webserver has
	// interpreted it. For example, this allows us to redirect a path
	// like `/tag/aa%20bb` to `/tag/aa%20bb/`, which may eventually be
	// resolved meaningfully by an application.
	$target_path = phutil_escape_uri($path.'/');
	$target_uri->setPath($target_path);
	$target_uri = (string)$target_uri;

	return $this->buildRedirectController($target_uri, true);
	}
	}

	$result = $site->new404Controller($request);
	if ($result) {
	return array($result, array());
	}

	return $this->build404Controller();
	}

	/**
	* Map a specific path to the corresponding controller. For a description
	* of routing, see @{method:buildController}.
	*
	* @param list<AphrontRoutingMap> List of routing maps.
	* @param string Path to route.
	* @return pair<AphrontController,dict> Controller and dictionary of request
	* parameters.
	* @task routing
	*/
	private function routePath(array $maps, $path) {
	foreach ($maps as $map) {
	$result = $map->routePath($path);
	if ($result) {
	return array($result->getController(), $result->getURIData());
	}
	}
	}

	private function buildSiteForRequest(AphrontRequest $request) {
	$sites = PhabricatorSite::getAllSites();

	$site = null;
	foreach ($sites as $candidate) {
	$site = $candidate->newSiteForRequest($request);
	if ($site) {
	break;
	}
	}

	if (!$site) {
	$path = $request->getPath();
	$host = $request->getHost();
	throw new AphrontMalformedRequestException(
	pht('Site Not Found'),
	pht(
	'This request asked for "%s" on host "%s", but no site is '.
	'configured which can serve this request.',
	$path,
	$host),
	true);
	}

	$request->setSite($site);

	return $site;
	}


	/* -( Response Handling )-------------------------------------------------- */


	/**
	* Tests if a response is of a valid type.
	*
	* @param wild Supposedly valid response.
	* @return bool True if the object is of a valid type.
	* @task response
	*/
	private function isValidResponseObject($response) {
	if ($response instanceof AphrontResponse) {
	return true;
	}

	if ($response instanceof AphrontResponseProducerInterface) {
	return true;
	}

	return false;
	}


	/**
	* Verifies that the return value from an @{class:AphrontController} is
	* of an allowed type.
	*
	* @param AphrontController Controller which returned the response.
	* @param wild Supposedly valid response.
	* @return void
	* @task response
	*/
	private function validateControllerResponse(
	AphrontController $controller,
	$response) {

	if ($this->isValidResponseObject($response)) {
	return;
	}

	throw new Exception(
	pht(
	'Controller "%s" returned an invalid response from call to "%s". '.
	'This method must return an object of class "%s", or an object '.
	'which implements the "%s" interface.',
	get_class($controller),
	'handleRequest()',
	'AphrontResponse',
	'AphrontResponseProducerInterface'));
	}


	/**
	* Verifies that the return value from an
	* @{class:AphrontResponseProducerInterface} is of an allowed type.
	*
	* @param AphrontResponseProducerInterface Object which produced
	* this response.
	* @param wild Supposedly valid response.
	* @return void
	* @task response
	*/
	private function validateProducerResponse(
	AphrontResponseProducerInterface $producer,
	$response) {

	if ($this->isValidResponseObject($response)) {
	return;
	}

	throw new Exception(
	pht(
	'Producer "%s" returned an invalid response from call to "%s". '.
	'This method must return an object of class "%s", or an object '.
	'which implements the "%s" interface.',
	get_class($producer),
	'produceAphrontResponse()',
	'AphrontResponse',
	'AphrontResponseProducerInterface'));
	}


	/**
	* Verifies that the return value from an
	* @{class:AphrontRequestExceptionHandler} is of an allowed type.
	*
	* @param AphrontRequestExceptionHandler Object which produced this
	* response.
	* @param wild Supposedly valid response.
	* @return void
	* @task response
	*/
	private function validateErrorHandlerResponse(
	AphrontRequestExceptionHandler $handler,
	$response) {

	if ($this->isValidResponseObject($response)) {
	return;
	}

	throw new Exception(
	pht(
	'Exception handler "%s" returned an invalid response from call to '.
	'"%s". This method must return an object of class "%s", or an object '.
	'which implements the "%s" interface.',
	get_class($handler),
	'handleRequestException()',
	'AphrontResponse',
	'AphrontResponseProducerInterface'));
	}


	/**
	* Resolves a response object into an @{class:AphrontResponse}.
	*
	* Controllers are permitted to return actual responses of class
	* @{class:AphrontResponse}, or other objects which implement
	* @{interface:AphrontResponseProducerInterface} and can produce a response.
	*
	* If a controller returns a response producer, invoke it now and produce
	* the real response.
	*
	* @param AphrontRequest Request being handled.
	* @param AphrontResponse\|AphrontResponseProducerInterface Response, or
	* response producer.
	* @return AphrontResponse Response after any required production.
	* @task response
	*/
	private function produceResponse(AphrontRequest $request, $response) {
	$original = $response;

	// Detect cycles on the exact same objects. It's still possible to produce
	// infinite responses as long as they're all unique, but we can only
	// reasonably detect cycles, not guarantee that response production halts.

	$seen = array();
	while (true) {
	// NOTE: It is permissible for an object to be both a response and a
	// response producer. If so, being a producer is "stronger". This is
	// used by AphrontProxyResponse.

	// If this response is a valid response, hand over the request first.
	if ($response instanceof AphrontResponse) {
	$response->setRequest($request);
	}

	// If this isn't a producer, we're all done.
	if (!($response instanceof AphrontResponseProducerInterface)) {
	break;
	}

	$hash = spl_object_hash($response);
	if (isset($seen[$hash])) {
	throw new Exception(
	pht(
	'Failure while producing response for object of class "%s": '.
	'encountered production cycle (identical object, of class "%s", '.
	'was produced twice).',
	get_class($original),
	get_class($response)));
	}

	$seen[$hash] = true;

	$new_response = $response->produceAphrontResponse();
	$this->validateProducerResponse($response, $new_response);
	$response = $new_response;
	}

	return $response;
	}


	/* -( Error Handling )----------------------------------------------------- */


	/**
	* Convert an exception which has escaped the controller into a response.
	*
	* This method delegates exception handling to available subclasses of
	* @{class:AphrontRequestExceptionHandler}.
	*
	* @param Exception Exception which needs to be handled.
	* @return wild Response or response producer, or null if no available
	* handler can produce a response.
	* @task exception
	*/
	private function handleException(Exception $ex) {
	$handlers = AphrontRequestExceptionHandler::getAllHandlers();

	$request = $this->getRequest();
	foreach ($handlers as $handler) {
	if ($handler->canHandleRequestException($request, $ex)) {
	$response = $handler->handleRequestException($request, $ex);
	$this->validateErrorHandlerResponse($handler, $response);
	return $response;
	}
	}

	throw $ex;
	}


	}
	diff --git a/src/applications/people/storage/PhabricatorUserLog.php b/src/applications/people/storage/PhabricatorUserLog.php
	index 9727c81c63..82819f8f5b 100644
	--- a/src/applications/people/storage/PhabricatorUserLog.php
	+++ b/src/applications/people/storage/PhabricatorUserLog.php
	@@ -1,213 +1,223 @@
	<?php

	final class PhabricatorUserLog extends PhabricatorUserDAO
	implements PhabricatorPolicyInterface {

	const ACTION_LOGIN = 'login';
	const ACTION_LOGIN_PARTIAL = 'login-partial';
	const ACTION_LOGIN_FULL = 'login-full';
	const ACTION_LOGOUT = 'logout';
	const ACTION_LOGIN_FAILURE = 'login-fail';
	const ACTION_LOGIN_LEGALPAD = 'login-legalpad';
	const ACTION_RESET_PASSWORD = 'reset-pass';

	const ACTION_CREATE = 'create';
	const ACTION_EDIT = 'edit';

	const ACTION_ADMIN = 'admin';
	const ACTION_SYSTEM_AGENT = 'system-agent';
	const ACTION_MAILING_LIST = 'mailing-list';
	const ACTION_DISABLE = 'disable';
	const ACTION_APPROVE = 'approve';
	const ACTION_DELETE = 'delete';

	const ACTION_CONDUIT_CERTIFICATE = 'conduit-cert';
	const ACTION_CONDUIT_CERTIFICATE_FAILURE = 'conduit-cert-fail';

	const ACTION_EMAIL_PRIMARY = 'email-primary';
	const ACTION_EMAIL_REMOVE = 'email-remove';
	const ACTION_EMAIL_ADD = 'email-add';
	const ACTION_EMAIL_VERIFY = 'email-verify';
	const ACTION_EMAIL_REASSIGN = 'email-reassign';

	const ACTION_CHANGE_PASSWORD = 'change-password';
	const ACTION_CHANGE_USERNAME = 'change-username';

	const ACTION_ENTER_HISEC = 'hisec-enter';
	const ACTION_EXIT_HISEC = 'hisec-exit';
	const ACTION_FAIL_HISEC = 'hisec-fail';

	const ACTION_MULTI_ADD = 'multi-add';
	const ACTION_MULTI_REMOVE = 'multi-remove';

	protected $actorPHID;
	protected $userPHID;
	protected $action;
	protected $oldValue;
	protected $newValue;
	protected $details = array();
	protected $remoteAddr;
	protected $session;

	public static function getActionTypeMap() {
	return array(
	self::ACTION_LOGIN => pht('Login'),
	self::ACTION_LOGIN_PARTIAL => pht('Login: Partial Login'),
	self::ACTION_LOGIN_FULL => pht('Login: Upgrade to Full'),
	self::ACTION_LOGIN_FAILURE => pht('Login: Failure'),
	self::ACTION_LOGIN_LEGALPAD =>
	pht('Login: Signed Required Legalpad Documents'),
	self::ACTION_LOGOUT => pht('Logout'),
	self::ACTION_RESET_PASSWORD => pht('Reset Password'),
	self::ACTION_CREATE => pht('Create Account'),
	self::ACTION_EDIT => pht('Edit Account'),
	self::ACTION_ADMIN => pht('Add/Remove Administrator'),
	self::ACTION_SYSTEM_AGENT => pht('Add/Remove System Agent'),
	self::ACTION_MAILING_LIST => pht('Add/Remove Mailing List'),
	self::ACTION_DISABLE => pht('Enable/Disable'),
	self::ACTION_APPROVE => pht('Approve Registration'),
	self::ACTION_DELETE => pht('Delete User'),
	self::ACTION_CONDUIT_CERTIFICATE
	=> pht('Conduit: Read Certificate'),
	self::ACTION_CONDUIT_CERTIFICATE_FAILURE
	=> pht('Conduit: Read Certificate Failure'),
	self::ACTION_EMAIL_PRIMARY => pht('Email: Change Primary'),
	self::ACTION_EMAIL_ADD => pht('Email: Add Address'),
	self::ACTION_EMAIL_REMOVE => pht('Email: Remove Address'),
	self::ACTION_EMAIL_VERIFY => pht('Email: Verify'),
	self::ACTION_EMAIL_REASSIGN => pht('Email: Reassign'),
	self::ACTION_CHANGE_PASSWORD => pht('Change Password'),
	self::ACTION_CHANGE_USERNAME => pht('Change Username'),
	self::ACTION_ENTER_HISEC => pht('Hisec: Enter'),
	self::ACTION_EXIT_HISEC => pht('Hisec: Exit'),
	self::ACTION_FAIL_HISEC => pht('Hisec: Failed Attempt'),
	self::ACTION_MULTI_ADD => pht('Multi-Factor: Add Factor'),
	self::ACTION_MULTI_REMOVE => pht('Multi-Factor: Remove Factor'),
	);
	}


	public static function initializeNewLog(
	PhabricatorUser $actor = null,
	$object_phid = null,
	$action = null) {

	$log = new PhabricatorUserLog();

	if ($actor) {
	$log->setActorPHID($actor->getPHID());
	if ($actor->hasSession()) {
	$session = $actor->getSession();

	// NOTE: This is a hash of the real session value, so it's safe to
	// store it directly in the logs.
	$log->setSession($session->getSessionKey());
	}
	}

	$log->setUserPHID((string)$object_phid);
	$log->setAction($action);

	- $log->remoteAddr = (string)idx($_SERVER, 'REMOTE_ADDR', '');
	+ $address = PhabricatorEnv::getRemoteAddress();
	+ if ($address) {
	+ $log->remoteAddr = $address->getAddress();
	+ } else {
	+ $log->remoteAddr = '';
	+ }

	return $log;
	}

	public static function loadRecentEventsFromThisIP($action, $timespan) {
	+ $address = PhabricatorEnv::getRemoteAddress();
	+ if (!$address) {
	+ return array();
	+ }
	+
	return id(new PhabricatorUserLog())->loadAllWhere(
	'action = %s AND remoteAddr = %s AND dateCreated > %d
	ORDER BY dateCreated DESC',
	$action,
	- idx($_SERVER, 'REMOTE_ADDR'),
	- time() - $timespan);
	+ $address->getAddress(),
	+ PhabricatorTime::getNow() - $timespan);
	}

	public function save() {
	$this->details['host'] = php_uname('n');
	$this->details['user_agent'] = AphrontRequest::getHTTPHeader('User-Agent');

	return parent::save();
	}

	protected function getConfiguration() {
	return array(
	self::CONFIG_SERIALIZATION => array(
	'oldValue' => self::SERIALIZATION_JSON,
	'newValue' => self::SERIALIZATION_JSON,
	'details' => self::SERIALIZATION_JSON,
	),
	self::CONFIG_COLUMN_SCHEMA => array(
	'actorPHID' => 'phid?',
	'action' => 'text64',
	'remoteAddr' => 'text64',
	'session' => 'bytes40?',
	),
	self::CONFIG_KEY_SCHEMA => array(
	'actorPHID' => array(
	'columns' => array('actorPHID', 'dateCreated'),
	),
	'userPHID' => array(
	'columns' => array('userPHID', 'dateCreated'),
	),
	'action' => array(
	'columns' => array('action', 'dateCreated'),
	),
	'dateCreated' => array(
	'columns' => array('dateCreated'),
	),
	'remoteAddr' => array(
	'columns' => array('remoteAddr', 'dateCreated'),
	),
	'session' => array(
	'columns' => array('session', 'dateCreated'),
	),
	),
	) + parent::getConfiguration();
	}


	/* -( PhabricatorPolicyInterface )----------------------------------------- */


	public function getCapabilities() {
	return array(
	PhabricatorPolicyCapability::CAN_VIEW,
	);
	}

	public function getPolicy($capability) {
	switch ($capability) {
	case PhabricatorPolicyCapability::CAN_VIEW:
	return PhabricatorPolicies::POLICY_NOONE;
	}
	}

	public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
	if ($viewer->getIsAdmin()) {
	return true;
	}

	$viewer_phid = $viewer->getPHID();
	if ($viewer_phid) {
	$user_phid = $this->getUserPHID();
	if ($viewer_phid == $user_phid) {
	return true;
	}

	$actor_phid = $this->getActorPHID();
	if ($viewer_phid == $actor_phid) {
	return true;
	}
	}

	return false;
	}

	public function describeAutomaticCapability($capability) {
	return array(
	pht('Users can view their activity and activity that affects them.'),
	pht('Administrators can always view all activity.'),
	);
	}

	}
	diff --git a/src/infrastructure/env/PhabricatorEnv.php b/src/infrastructure/env/PhabricatorEnv.php
	index 15873a7f9c..b50c85c0f0 100644
	--- a/src/infrastructure/env/PhabricatorEnv.php
	+++ b/src/infrastructure/env/PhabricatorEnv.php
	@@ -1,927 +1,940 @@
	<?php

	/**
	* Manages the execution environment configuration, exposing APIs to read
	* configuration settings and other similar values that are derived directly
	* from configuration settings.
	*
	*
	* = Reading Configuration =
	*
	* The primary role of this class is to provide an API for reading
	* Phabricator configuration, @{method:getEnvConfig}:
	*
	* $value = PhabricatorEnv::getEnvConfig('some.key', $default);
	*
	* The class also handles some URI construction based on configuration, via
	* the methods @{method:getURI}, @{method:getProductionURI},
	* @{method:getCDNURI}, and @{method:getDoclink}.
	*
	* For configuration which allows you to choose a class to be responsible for
	* some functionality (e.g., which mail adapter to use to deliver email),
	* @{method:newObjectFromConfig} provides a simple interface that validates
	* the configured value.
	*
	*
	* = Unit Test Support =
	*
	* In unit tests, you can use @{method:beginScopedEnv} to create a temporary,
	* mutable environment. The method returns a scope guard object which restores
	* the environment when it is destroyed. For example:
	*
	* public function testExample() {
	* $env = PhabricatorEnv::beginScopedEnv();
	* $env->overrideEnv('some.key', 'new-value-for-this-test');
	*
	* // Some test which depends on the value of 'some.key'.
	*
	* }
	*
	* Your changes will persist until the `$env` object leaves scope or is
	* destroyed.
	*
	* You should //not// use this in normal code.
	*
	*
	* @task read Reading Configuration
	* @task uri URI Validation
	* @task test Unit Test Support
	* @task internal Internals
	*/
	final class PhabricatorEnv extends Phobject {

	private static $sourceStack;
	private static $repairSource;
	private static $overrideSource;
	private static $requestBaseURI;
	private static $cache;
	private static $localeCode;
	private static $readOnly;
	private static $readOnlyReason;

	const READONLY_CONFIG = 'config';
	const READONLY_UNREACHABLE = 'unreachable';
	const READONLY_SEVERED = 'severed';
	const READONLY_MASTERLESS = 'masterless';

	/**
	* @phutil-external-symbol class PhabricatorStartup
	*/
	public static function initializeWebEnvironment() {
	self::initializeCommonEnvironment(false);
	}

	public static function initializeScriptEnvironment($config_optional) {
	self::initializeCommonEnvironment($config_optional);

	// NOTE: This is dangerous in general, but we know we're in a script context
	// and are not vulnerable to CSRF.
	AphrontWriteGuard::allowDangerousUnguardedWrites(true);

	// There are several places where we log information (about errors, events,
	// service calls, etc.) for analysis via DarkConsole or similar. These are
	// useful for web requests, but grow unboundedly in long-running scripts and
	// daemons. Discard data as it arrives in these cases.
	PhutilServiceProfiler::getInstance()->enableDiscardMode();
	DarkConsoleErrorLogPluginAPI::enableDiscardMode();
	DarkConsoleEventPluginAPI::enableDiscardMode();
	}


	private static function initializeCommonEnvironment($config_optional) {
	PhutilErrorHandler::initialize();

	self::resetUmask();
	self::buildConfigurationSourceStack($config_optional);

	// Force a valid timezone. If both PHP and Phabricator configuration are
	// invalid, use UTC.
	$tz = self::getEnvConfig('phabricator.timezone');
	if ($tz) {
	@date_default_timezone_set($tz);
	}
	$ok = @date_default_timezone_set(date_default_timezone_get());
	if (!$ok) {
	date_default_timezone_set('UTC');
	}

	// Prepend '/support/bin' and append any paths to $PATH if we need to.
	$env_path = getenv('PATH');
	$phabricator_path = dirname(phutil_get_library_root('phabricator'));
	$support_path = $phabricator_path.'/support/bin';
	$env_path = $support_path.PATH_SEPARATOR.$env_path;
	$append_dirs = self::getEnvConfig('environment.append-paths');
	if (!empty($append_dirs)) {
	$append_path = implode(PATH_SEPARATOR, $append_dirs);
	$env_path = $env_path.PATH_SEPARATOR.$append_path;
	}
	putenv('PATH='.$env_path);

	// Write this back into $_ENV, too, so ExecFuture picks it up when creating
	// subprocess environments.
	$_ENV['PATH'] = $env_path;


	// If an instance identifier is defined, write it into the environment so
	// it's available to subprocesses.
	$instance = self::getEnvConfig('cluster.instance');
	if (strlen($instance)) {
	putenv('PHABRICATOR_INSTANCE='.$instance);
	$_ENV['PHABRICATOR_INSTANCE'] = $instance;
	}

	PhabricatorEventEngine::initialize();

	// TODO: Add a "locale.default" config option once we have some reasonable
	// defaults which aren't silly nonsense.
	self::setLocaleCode('en_US');
	}

	public static function beginScopedLocale($locale_code) {
	return new PhabricatorLocaleScopeGuard($locale_code);
	}

	public static function getLocaleCode() {
	return self::$localeCode;
	}

	public static function setLocaleCode($locale_code) {
	if (!$locale_code) {
	return;
	}

	if ($locale_code == self::$localeCode) {
	return;
	}

	try {
	$locale = PhutilLocale::loadLocale($locale_code);
	$translations = PhutilTranslation::getTranslationMapForLocale(
	$locale_code);

	$override = self::getEnvConfig('translation.override');
	if (!is_array($override)) {
	$override = array();
	}

	PhutilTranslator::getInstance()
	->setLocale($locale)
	->setTranslations($override + $translations);

	self::$localeCode = $locale_code;
	} catch (Exception $ex) {
	// Just ignore this; the user likely has an out-of-date locale code.
	}
	}

	private static function buildConfigurationSourceStack($config_optional) {
	self::dropConfigCache();

	$stack = new PhabricatorConfigStackSource();
	self::$sourceStack = $stack;

	$default_source = id(new PhabricatorConfigDefaultSource())
	->setName(pht('Global Default'));
	$stack->pushSource($default_source);

	$env = self::getSelectedEnvironmentName();
	if ($env) {
	$stack->pushSource(
	id(new PhabricatorConfigFileSource($env))
	->setName(pht("File '%s'", $env)));
	}

	$stack->pushSource(
	id(new PhabricatorConfigLocalSource())
	->setName(pht('Local Config')));

	// If the install overrides the database adapter, we might need to load
	// the database adapter class before we can push on the database config.
	// This config is locked and can't be edited from the web UI anyway.
	foreach (self::getEnvConfig('load-libraries') as $library) {
	phutil_load_library($library);
	}

	// Drop any class map caches, since they will have generated without
	// any classes from libraries. Without this, preflight setup checks can
	// cause generation of a setup check cache that omits checks defined in
	// libraries, for example.
	PhutilClassMapQuery::deleteCaches();

	// If custom libraries specify config options, they won't get default
	// values as the Default source has already been loaded, so we get it to
	// pull in all options from non-phabricator libraries now they are loaded.
	$default_source->loadExternalOptions();

	// If this install has site config sources, load them now.
	$site_sources = id(new PhutilClassMapQuery())
	->setAncestorClass('PhabricatorConfigSiteSource')
	->setSortMethod('getPriority')
	->execute();

	foreach ($site_sources as $site_source) {
	$stack->pushSource($site_source);
	}

	$masters = PhabricatorDatabaseRef::getMasterDatabaseRefs();
	if (!$masters) {
	self::setReadOnly(true, self::READONLY_MASTERLESS);
	} else {
	// If any master is severed, we drop to readonly mode. In theory we
	// could try to continue if we're only missing some applications, but
	// this is very complex and we're unlikely to get it right.

	foreach ($masters as $master) {
	// Give severed masters one last chance to get healthy.
	if ($master->isSevered()) {
	$master->checkHealth();
	}

	if ($master->isSevered()) {
	self::setReadOnly(true, self::READONLY_SEVERED);
	break;
	}
	}
	}

	try {
	$stack->pushSource(
	id(new PhabricatorConfigDatabaseSource('default'))
	->setName(pht('Database')));
	} catch (AphrontSchemaQueryException $exception) {
	// If the database is not available, just skip this configuration
	// source. This happens during `bin/storage upgrade`, `bin/conf` before
	// schema setup, etc.
	} catch (PhabricatorClusterStrandedException $ex) {
	// This means we can't connect to any database host. That's fine as
	// long as we're running a setup script like `bin/storage`.
	if (!$config_optional) {
	throw $ex;
	}
	}
	}

	public static function repairConfig($key, $value) {
	if (!self::$repairSource) {
	self::$repairSource = id(new PhabricatorConfigDictionarySource(array()))
	->setName(pht('Repaired Config'));
	self::$sourceStack->pushSource(self::$repairSource);
	}
	self::$repairSource->setKeys(array($key => $value));
	self::dropConfigCache();
	}

	public static function overrideConfig($key, $value) {
	if (!self::$overrideSource) {
	self::$overrideSource = id(new PhabricatorConfigDictionarySource(array()))
	->setName(pht('Overridden Config'));
	self::$sourceStack->pushSource(self::$overrideSource);
	}
	self::$overrideSource->setKeys(array($key => $value));
	self::dropConfigCache();
	}

	public static function getUnrepairedEnvConfig($key, $default = null) {
	foreach (self::$sourceStack->getStack() as $source) {
	if ($source === self::$repairSource) {
	continue;
	}
	$result = $source->getKeys(array($key));
	if ($result) {
	return $result[$key];
	}
	}
	return $default;
	}

	public static function getSelectedEnvironmentName() {
	$env_var = 'PHABRICATOR_ENV';

	$env = idx($_SERVER, $env_var);

	if (!$env) {
	$env = getenv($env_var);
	}

	if (!$env) {
	$env = idx($_ENV, $env_var);
	}

	if (!$env) {
	$root = dirname(phutil_get_library_root('phabricator'));
	$path = $root.'/conf/local/ENVIRONMENT';
	if (Filesystem::pathExists($path)) {
	$env = trim(Filesystem::readFile($path));
	}
	}

	return $env;
	}


	/* -( Reading Configuration )---------------------------------------------- */


	/**
	* Get the current configuration setting for a given key.
	*
	* If the key is not found, then throw an Exception.
	*
	* @task read
	*/
	public static function getEnvConfig($key) {
	if (!self::$sourceStack) {
	throw new Exception(
	pht(
	'Trying to read configuration "%s" before configuration has been '.
	'initialized.',
	$key));
	}

	if (isset(self::$cache[$key])) {
	return self::$cache[$key];
	}

	if (array_key_exists($key, self::$cache)) {
	return self::$cache[$key];
	}

	$result = self::$sourceStack->getKeys(array($key));
	if (array_key_exists($key, $result)) {
	self::$cache[$key] = $result[$key];
	return $result[$key];
	} else {
	throw new Exception(
	pht(
	"No config value specified for key '%s'.",
	$key));
	}
	}

	/**
	* Get the current configuration setting for a given key. If the key
	* does not exist, return a default value instead of throwing. This is
	* primarily useful for migrations involving keys which are slated for
	* removal.
	*
	* @task read
	*/
	public static function getEnvConfigIfExists($key, $default = null) {
	try {
	return self::getEnvConfig($key);
	} catch (Exception $ex) {
	return $default;
	}
	}


	/**
	* Get the fully-qualified URI for a path.
	*
	* @task read
	*/
	public static function getURI($path) {
	return rtrim(self::getAnyBaseURI(), '/').$path;
	}


	/**
	* Get the fully-qualified production URI for a path.
	*
	* @task read
	*/
	public static function getProductionURI($path) {
	// If we're passed a URI which already has a domain, simply return it
	// unmodified. In particular, files may have URIs which point to a CDN
	// domain.
	$uri = new PhutilURI($path);
	if ($uri->getDomain()) {
	return $path;
	}

	$production_domain = self::getEnvConfig('phabricator.production-uri');
	if (!$production_domain) {
	$production_domain = self::getAnyBaseURI();
	}
	return rtrim($production_domain, '/').$path;
	}

	public static function getAllowedURIs($path) {
	$uri = new PhutilURI($path);
	if ($uri->getDomain()) {
	return $path;
	}

	$allowed_uris = self::getEnvConfig('phabricator.allowed-uris');
	$return = array();
	foreach ($allowed_uris as $allowed_uri) {
	$return[] = rtrim($allowed_uri, '/').$path;
	}

	return $return;
	}


	/**
	* Get the fully-qualified production URI for a static resource path.
	*
	* @task read
	*/
	public static function getCDNURI($path) {
	$alt = self::getEnvConfig('security.alternate-file-domain');
	if (!$alt) {
	$alt = self::getAnyBaseURI();
	}
	$uri = new PhutilURI($alt);
	$uri->setPath($path);
	return (string)$uri;
	}


	/**
	* Get the fully-qualified production URI for a documentation resource.
	*
	* @task read
	*/
	public static function getDoclink($resource, $type = 'article') {
	$uri = new PhutilURI('https://secure.phabricator.com/diviner/find/');
	$uri->setQueryParam('name', $resource);
	$uri->setQueryParam('type', $type);
	$uri->setQueryParam('jump', true);
	return (string)$uri;
	}


	/**
	* Build a concrete object from a configuration key.
	*
	* @task read
	*/
	public static function newObjectFromConfig($key, $args = array()) {
	$class = self::getEnvConfig($key);
	return newv($class, $args);
	}

	public static function getAnyBaseURI() {
	$base_uri = self::getEnvConfig('phabricator.base-uri');

	if (!$base_uri) {
	$base_uri = self::getRequestBaseURI();
	}

	if (!$base_uri) {
	throw new Exception(
	pht(
	"Define '%s' in your configuration to continue.",
	'phabricator.base-uri'));
	}

	return $base_uri;
	}

	public static function getRequestBaseURI() {
	return self::$requestBaseURI;
	}

	public static function setRequestBaseURI($uri) {
	self::$requestBaseURI = $uri;
	}

	public static function isReadOnly() {
	if (self::$readOnly !== null) {
	return self::$readOnly;
	}
	return self::getEnvConfig('cluster.read-only');
	}

	public static function setReadOnly($read_only, $reason) {
	self::$readOnly = $read_only;
	self::$readOnlyReason = $reason;
	}

	public static function getReadOnlyMessage() {
	$reason = self::getReadOnlyReason();
	switch ($reason) {
	case self::READONLY_MASTERLESS:
	return pht(
	'Phabricator is in read-only mode (no writable database '.
	'is configured).');
	case self::READONLY_UNREACHABLE:
	return pht(
	'Phabricator is in read-only mode (unreachable master).');
	case self::READONLY_SEVERED:
	return pht(
	'Phabricator is in read-only mode (major interruption).');
	}

	return pht('Phabricator is in read-only mode.');
	}

	public static function getReadOnlyURI() {
	return urisprintf(
	'/readonly/%s/',
	self::getReadOnlyReason());
	}

	public static function getReadOnlyReason() {
	if (!self::isReadOnly()) {
	return null;
	}

	if (self::$readOnlyReason !== null) {
	return self::$readOnlyReason;
	}

	return self::READONLY_CONFIG;
	}


	/* -( Unit Test Support )-------------------------------------------------- */


	/**
	* @task test
	*/
	public static function beginScopedEnv() {
	return new PhabricatorScopedEnv(self::pushTestEnvironment());
	}


	/**
	* @task test
	*/
	private static function pushTestEnvironment() {
	self::dropConfigCache();
	$source = new PhabricatorConfigDictionarySource(array());
	self::$sourceStack->pushSource($source);
	return spl_object_hash($source);
	}


	/**
	* @task test
	*/
	public static function popTestEnvironment($key) {
	self::dropConfigCache();
	$source = self::$sourceStack->popSource();
	$stack_key = spl_object_hash($source);
	if ($stack_key !== $key) {
	self::$sourceStack->pushSource($source);
	throw new Exception(
	pht(
	'Scoped environments were destroyed in a different order than they '.
	'were initialized.'));
	}
	}


	/* -( URI Validation )----------------------------------------------------- */


	/**
	* Detect if a URI satisfies either @{method:isValidLocalURIForLink} or
	* @{method:isValidRemoteURIForLink}, i.e. is a page on this server or the
	* URI of some other resource which has a valid protocol. This rejects
	* garbage URIs and URIs with protocols which do not appear in the
	* `uri.allowed-protocols` configuration, notably 'javascript:' URIs.
	*
	* NOTE: This method is generally intended to reject URIs which it may be
	* unsafe to put in an "href" link attribute.
	*
	* @param string URI to test.
	* @return bool True if the URI identifies a web resource.
	* @task uri
	*/
	public static function isValidURIForLink($uri) {
	return self::isValidLocalURIForLink($uri) \|\|
	self::isValidRemoteURIForLink($uri);
	}


	/**
	* Detect if a URI identifies some page on this server.
	*
	* NOTE: This method is generally intended to reject URIs which it may be
	* unsafe to issue a "Location:" redirect to.
	*
	* @param string URI to test.
	* @return bool True if the URI identifies a local page.
	* @task uri
	*/
	public static function isValidLocalURIForLink($uri) {
	$uri = (string)$uri;

	if (!strlen($uri)) {
	return false;
	}

	if (preg_match('/\s/', $uri)) {
	// PHP hasn't been vulnerable to header injection attacks for a bunch of
	// years, but we can safely reject these anyway since they're never valid.
	return false;
	}

	// Chrome (at a minimum) interprets backslashes in Location headers and the
	// URL bar as forward slashes. This is probably intended to reduce user
	// error caused by confusion over which key is "forward slash" vs "back
	// slash".
	//
	// However, it means a URI like "/\evil.com" is interpreted like
	// "//evil.com", which is a protocol relative remote URI.
	//
	// Since we currently never generate URIs with backslashes in them, reject
	// these unconditionally rather than trying to figure out how browsers will
	// interpret them.
	if (preg_match('/\\\\/', $uri)) {
	return false;
	}

	// Valid URIs must begin with '/', followed by the end of the string or some
	// other non-'/' character. This rejects protocol-relative URIs like
	// "//evil.com/evil_stuff/".
	return (bool)preg_match('@^/([^/]\|$)@', $uri);
	}


	/**
	* Detect if a URI identifies some valid linkable remote resource.
	*
	* @param string URI to test.
	* @return bool True if a URI idenfies a remote resource with an allowed
	* protocol.
	* @task uri
	*/
	public static function isValidRemoteURIForLink($uri) {
	try {
	self::requireValidRemoteURIForLink($uri);
	return true;
	} catch (Exception $ex) {
	return false;
	}
	}


	/**
	* Detect if a URI identifies a valid linkable remote resource, throwing a
	* detailed message if it does not.
	*
	* A valid linkable remote resource can be safely linked or redirected to.
	* This is primarily a protocol whitelist check.
	*
	* @param string URI to test.
	* @return void
	* @task uri
	*/
	public static function requireValidRemoteURIForLink($raw_uri) {
	$uri = new PhutilURI($raw_uri);

	$proto = $uri->getProtocol();
	if (!strlen($proto)) {
	throw new Exception(
	pht(
	'URI "%s" is not a valid linkable resource. A valid linkable '.
	'resource URI must specify a protocol.',
	$raw_uri));
	}

	$protocols = self::getEnvConfig('uri.allowed-protocols');
	if (!isset($protocols[$proto])) {
	throw new Exception(
	pht(
	'URI "%s" is not a valid linkable resource. A valid linkable '.
	'resource URI must use one of these protocols: %s.',
	$raw_uri,
	implode(', ', array_keys($protocols))));
	}

	$domain = $uri->getDomain();
	if (!strlen($domain)) {
	throw new Exception(
	pht(
	'URI "%s" is not a valid linkable resource. A valid linkable '.
	'resource URI must specify a domain.',
	$raw_uri));
	}
	}


	/**
	* Detect if a URI identifies a valid fetchable remote resource.
	*
	* @param string URI to test.
	* @param list<string> Allowed protocols.
	* @return bool True if the URI is a valid fetchable remote resource.
	* @task uri
	*/
	public static function isValidRemoteURIForFetch($uri, array $protocols) {
	try {
	self::requireValidRemoteURIForFetch($uri, $protocols);
	return true;
	} catch (Exception $ex) {
	return false;
	}
	}


	/**
	* Detect if a URI identifies a valid fetchable remote resource, throwing
	* a detailed message if it does not.
	*
	* A valid fetchable remote resource can be safely fetched using a request
	* originating on this server. This is a primarily an address check against
	* the outbound address blacklist.
	*
	* @param string URI to test.
	* @param list<string> Allowed protocols.
	* @return pair<string, string> Pre-resolved URI and domain.
	* @task uri
	*/
	public static function requireValidRemoteURIForFetch(
	$raw_uri,
	array $protocols) {

	$uri = new PhutilURI($raw_uri);

	$proto = $uri->getProtocol();
	if (!strlen($proto)) {
	throw new Exception(
	pht(
	'URI "%s" is not a valid fetchable resource. A valid fetchable '.
	'resource URI must specify a protocol.',
	$raw_uri));
	}

	$protocols = array_fuse($protocols);
	if (!isset($protocols[$proto])) {
	throw new Exception(
	pht(
	'URI "%s" is not a valid fetchable resource. A valid fetchable '.
	'resource URI must use one of these protocols: %s.',
	$raw_uri,
	implode(', ', array_keys($protocols))));
	}

	$domain = $uri->getDomain();
	if (!strlen($domain)) {
	throw new Exception(
	pht(
	'URI "%s" is not a valid fetchable resource. A valid fetchable '.
	'resource URI must specify a domain.',
	$raw_uri));
	}

	$addresses = gethostbynamel($domain);
	if (!$addresses) {
	throw new Exception(
	pht(
	'URI "%s" is not a valid fetchable resource. The domain "%s" could '.
	'not be resolved.',
	$raw_uri,
	$domain));
	}

	foreach ($addresses as $address) {
	if (self::isBlacklistedOutboundAddress($address)) {
	throw new Exception(
	pht(
	'URI "%s" is not a valid fetchable resource. The domain "%s" '.
	'resolves to the address "%s", which is blacklisted for '.
	'outbound requests.',
	$raw_uri,
	$domain,
	$address));
	}
	}

	$resolved_uri = clone $uri;
	$resolved_uri->setDomain(head($addresses));

	return array($resolved_uri, $domain);
	}


	/**
	* Determine if an IP address is in the outbound address blacklist.
	*
	* @param string IP address.
	* @return bool True if the address is blacklisted.
	*/
	public static function isBlacklistedOutboundAddress($address) {
	$blacklist = self::getEnvConfig('security.outbound-blacklist');

	return PhutilCIDRList::newList($blacklist)->containsAddress($address);
	}

	public static function isClusterRemoteAddress() {
	$cluster_addresses = self::getEnvConfig('cluster.addresses');
	if (!$cluster_addresses) {
	return false;
	}

	- $address = idx($_SERVER, 'REMOTE_ADDR');
	+ $address = self::getRemoteAddress();
	if (!$address) {
	throw new Exception(
	pht(
	'Unable to test remote address against cluster whitelist: '.
	- 'REMOTE_ADDR is not defined.'));
	+ 'REMOTE_ADDR is not defined or not valid.'));
	}

	return self::isClusterAddress($address);
	}

	public static function isClusterAddress($address) {
	$cluster_addresses = self::getEnvConfig('cluster.addresses');
	if (!$cluster_addresses) {
	throw new Exception(
	pht(
	'Phabricator is not configured to serve cluster requests. '.
	'Set `cluster.addresses` in the configuration to whitelist '.
	'cluster hosts before sending requests that use a cluster '.
	'authentication mechanism.'));
	}

	return PhutilCIDRList::newList($cluster_addresses)
	->containsAddress($address);
	}

	+ public static function getRemoteAddress() {
	+ $address = idx($_SERVER, 'REMOTE_ADDR');
	+ if (!$address) {
	+ return null;
	+ }
	+
	+ try {
	+ return PhutilIPAddress::newAddress($address);
	+ } catch (Exception $ex) {
	+ return null;
	+ }
	+ }
	+
	/* -( Internals )---------------------------------------------------------- */


	/**
	* @task internal
	*/
	public static function envConfigExists($key) {
	return array_key_exists($key, self::$sourceStack->getKeys(array($key)));
	}


	/**
	* @task internal
	*/
	public static function getAllConfigKeys() {
	return self::$sourceStack->getAllKeys();
	}

	public static function getConfigSourceStack() {
	return self::$sourceStack;
	}

	/**
	* @task internal
	*/
	public static function overrideTestEnvConfig($stack_key, $key, $value) {
	$tmp = array();

	// If we don't have the right key, we'll throw when popping the last
	// source off the stack.
	do {
	$source = self::$sourceStack->popSource();
	array_unshift($tmp, $source);
	if (spl_object_hash($source) == $stack_key) {
	$source->setKeys(array($key => $value));
	break;
	}
	} while (true);

	foreach ($tmp as $source) {
	self::$sourceStack->pushSource($source);
	}

	self::dropConfigCache();
	}

	private static function dropConfigCache() {
	self::$cache = array();
	}

	private static function resetUmask() {
	// Reset the umask to the common standard umask. The umask controls default
	// permissions when files are created and propagates to subprocesses.

	// "022" is the most common umask, but sometimes it is set to something
	// unusual by the calling environment.

	// Since various things rely on this umask to work properly and we are
	// not aware of any legitimate reasons to adjust it, unconditionally
	// normalize it until such reasons arise. See T7475 for discussion.
	umask(022);
	}


	/**
	* Get the path to an empty directory which is readable by all of the system
	* user accounts that Phabricator acts as.
	*
	* In some cases, a binary needs some valid HOME or CWD to continue, but not
	* all user accounts have valid home directories and even if they do they
	* may not be readable after a `sudo` operation.
	*
	* @return string Path to an empty directory suitable for use as a CWD.
	*/
	public static function getEmptyCWD() {
	$root = dirname(phutil_get_library_root('phabricator'));
	return $root.'/support/empty/';
	}


	}
	diff --git a/src/infrastructure/ssh/PhabricatorSSHWorkflow.php b/src/infrastructure/ssh/PhabricatorSSHWorkflow.php
	index beee356951..b6af62d35a 100644
	--- a/src/infrastructure/ssh/PhabricatorSSHWorkflow.php
	+++ b/src/infrastructure/ssh/PhabricatorSSHWorkflow.php
	@@ -1,101 +1,107 @@
	<?php

	abstract class PhabricatorSSHWorkflow extends PhabricatorManagementWorkflow {

	private $user;
	private $iochannel;
	private $errorChannel;
	private $isClusterRequest;
	private $originalArguments;

	public function isExecutable() {
	return false;
	}

	public function setErrorChannel(PhutilChannel $error_channel) {
	$this->errorChannel = $error_channel;
	return $this;
	}

	public function getErrorChannel() {
	return $this->errorChannel;
	}

	public function setUser(PhabricatorUser $user) {
	$this->user = $user;
	return $this;
	}

	public function getUser() {
	return $this->user;
	}

	public function setIOChannel(PhutilChannel $channel) {
	$this->iochannel = $channel;
	return $this;
	}

	public function getIOChannel() {
	return $this->iochannel;
	}

	public function readAllInput() {
	$channel = $this->getIOChannel();
	while ($channel->update()) {
	PhutilChannel::waitForAny(array($channel));
	if (!$channel->isOpenForReading()) {
	break;
	}
	}
	return $channel->read();
	}

	public function writeIO($data) {
	$this->getIOChannel()->write($data);
	return $this;
	}

	public function writeErrorIO($data) {
	$this->getErrorChannel()->write($data);
	return $this;
	}

	protected function newPassthruCommand() {
	return id(new PhabricatorSSHPassthruCommand())
	->setErrorChannel($this->getErrorChannel());
	}

	public function setIsClusterRequest($is_cluster_request) {
	$this->isClusterRequest = $is_cluster_request;
	return $this;
	}

	public function getIsClusterRequest() {
	return $this->isClusterRequest;
	}

	public function setOriginalArguments(array $original_arguments) {
	$this->originalArguments = $original_arguments;
	return $this;
	}

	public function getOriginalArguments() {
	return $this->originalArguments;
	}

	public function getSSHRemoteAddress() {
	$ssh_client = getenv('SSH_CLIENT');
	if (!strlen($ssh_client)) {
	return null;
	}

	// TODO: When commands are proxied, the original remote address should
	// also be proxied.

	// This has the format "<ip> <remote-port> <local-port>". Grab the IP.
	$remote_address = head(explode(' ', $ssh_client));

	- return $remote_address;
	+ try {
	+ $address = PhutilIPAddress::newAddress($remote_address);
	+ } catch (Exception $ex) {
	+ return null;
	+ }
	+
	+ return $address->getAddress();
	}

	}

File Metadata

Mime Type: text/x-diff
Expires: Mon, Apr 28, 3:20 AM (9 h, 8 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 107716
Default Alt Text: (83 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions