function shurly_validate_long in ShURLy 6

Same name and namespace in other branches

1. 8 shurly.module \shurly_validate_long()
2. 7 shurly.module \shurly_validate_long()

Validate a long URL

Checks for:

• a valid URL
• it's not a link to an existing short URL
• it's not a link to itself

Parameters

$long url - the long URL entered by user: $custom - custom short URL entered by user

Return value

BOOLEAN - TRUE if valid, FALSE if invalid

2 calls to shurly_validate_long()

shurly_create_form_validate in ./shurly.module

shurly_shorten in ./shurly.module

API function to shorten a URL @arg $long_url - the long URL to shorten @arg $custom - optional custom short URL, user_access('enter custom URLs') should be checked prior to calling shurly_shorten()

File

./shurly.module, line 611

description http://www.youtube.com/watch?v=Qo7qoonzTCE

Code

function shurly_validate_long(&$long_url, $custom = NULL) {
  $return = TRUE;
  $match = FALSE;

  // if the person didn't remove the original http:// from the field, pull it out
  $long_url = preg_replace('!^http\\://(http\\://|https\\://)!i', '\\1', $long_url);
  $long_parse = parse_url($long_url);
  $base_parse = parse_url($GLOBALS['base_url']);
  $check_ip = variable_get('shurly_forbid_ips', FALSE);
  $check_localhost = variable_get('shurly_forbid_localhost', FALSE);
  $check_resolvability = variable_get('shurly_forbid_unresolvable_hosts', FALSE);
  $check_private_ip_ranges = variable_get('shurly_forbid_private_ips', FALSE);
  if ($long_parse === FALSE || !isset($long_parse['host'])) {

    // malformed URL
    // or no host in the URL
    shurly_set_error(t('Invalid URL.'), 'long_url');
    $return = FALSE;
  }
  elseif ($long_parse['scheme'] != 'http' && $long_parse['scheme'] != 'https') {
    shurly_set_error(t('Invalid URL. Only http:// and https:// URLs are allowed.'), 'long_url');
    $return = FALSE;
  }
  elseif ($check_ip && preg_match('/^\\d/', $long_parse['host'])) {

    // Host is given as IP address instead of a common hostname.
    $return = FALSE;

    // @todo Rework condition with respect to RFC 1123, which allows hostnames
    //       starting with a digit.
  }
  elseif ($check_localhost && shurly_host_is_local($long_parse['host'], TRUE)) {

    // Host seems to be the local host.
    $return = FALSE;
  }
  elseif ($check_resolvability && !shurly_host_is_resolveable($long_parse['host'], TRUE)) {

    // Host cannot be resolved (at least not by this server!).
    $return = FALSE;
  }
  elseif ($check_private_ip_ranges && shurly_host_is_private($long_parse['host'], TRUE)) {

    // Host refers to a private IP address.
    $return = FALSE;
  }
  else {
    if (variable_get('shurly_forbid_custom', FALSE)) {
      $custom_pattern = variable_get('shurly_custom_restriction', '');
      if (!empty($custom_pattern)) {
        if (preg_match($custom_pattern, $long_url)) {
          $return = FALSE;
        }
      }
    }
    $long_domain_parts = explode('.', $long_parse['host']);
    $base_domain_parts = explode('.', $base_parse['host']);

    // if last domain part of entered URL matches last part of this domain
    if (isset($base_domain_parts[count($long_domain_parts) - 1]) && $long_domain_parts[count($long_domain_parts) - 1] == $base_domain_parts[count($long_domain_parts) - 1]) {

      // and (if there's a 2nd to last)
      if (count($long_domain_parts) >= 2) {

        // check that 2nd to last matches
        if (isset($base_domain_parts[count($long_domain_parts) - 2]) && $long_domain_parts[count($long_domain_parts) - 2] == $base_domain_parts[count($long_domain_parts) - 2]) {

          // last 2 parts link to this domain
          $match = TRUE;
        }
      }
      else {

        // there's only one part, and it links here
        $match = TRUE;
      }

      // We only get down here if the long URL links to this domain
      // by the way, we're ignoring any subdomain...
      // so http://lbt.me/something and http://www.lbt.me/something are assumed to be the same
      if ($match) {

        // let's see if there's a $_GET['q'] in the long URL
        $query = $long_parse['query'];
        $query = html_entity_decode($query);
        $query_array = explode('&', $query);
        $queries = array();
        foreach ($query_array as $val) {
          $x = explode('=', $val);
          $queries[$x[0]] = $x[1];
        }
        if ($queries['q']) {

          // if there's a 'q' query, Drupal uses this instead of anything in the path
          $path = $queries['q'];
        }
        else {
          $path = $long_parse['path'];
        }

        // see if this is a link to an existing shortURL
        // remove the leading "/" from path, if it exists
        $path = explode('/', $path, 2);
        $path = array_pop($path);
        if ($path) {

          // get the base path of this Drupal install
          $base = explode('/', base_path(), 2);
          $base = array_pop($base);

          // remove the base from the path
          if ($base) {
            $path = preg_replace('!' . preg_quote($base, '!') . '!i', '', $path);
          }
          if (shurly_url_exists($path)) {

            // link to existing short URL
            shurly_set_error(t('Illegal URL'), 'long_url');
            $return = FALSE;
          }
          if ($custom && $custom == $path) {

            // they've created a link to itself
            shurly_set_error(t('Recursive URL'), 'short_url');
            $return = FALSE;
          }
        }
      }
    }
  }
  return $return;
}