graph.php

<?php
	// SECURITY: $func used to be interpolated straight into the shell_exec()
	// command below, unescaped. Anything after a ';' in ?func= ran as a shell
	// command on the server. grapher.py does int(sys.argv[2]) and only handles
	// selectors 0-4, so the correct value is an integer and nothing else.
	$func = filter_input(INPUT_GET, 'func', FILTER_VALIDATE_INT);
	if ($func === false || $func === null || $func < 0 || $func > 4) {
		header('HTTP/1.0 404 Not Found');
		readfile('vos.html');
		exit();
	}

	// ?tokens=foo (a string rather than tokens[]=foo) used to fatal here.
	$r_tokens = $_GET['tokens'] ?? [];
	if (!is_array($r_tokens)) {
		$r_tokens = [$r_tokens];
	}
	$tokens = "";
	foreach ($r_tokens as $value) {
		if (!is_string($value)) {
			continue;   // tokens[][]=x would otherwise concatenate an array
		}
		$tokens = $tokens . " " . $value;
	}
	if (!trim($tokens)) {
		header('HTTP/1.0 404 Not Found');
		readfile('vos.html');
		exit();
	}

    function _uniord($c) {
        if (ord($c[0]) >=0 && ord($c[0]) <= 127)
            return ord($c[0]);
        if (ord($c[0]) >= 192 && ord($c[0]) <= 223)
            return (ord($c[0])-192)*64 + (ord($c[1])-128);
        if (ord($c[0]) >= 224 && ord($c[0]) <= 239)
            return (ord($c[0])-224)*4096 + (ord($c[1])-128)*64 + (ord($c[2])-128);
        if (ord($c[0]) >= 240 && ord($c[0]) <= 247)
            return (ord($c[0])-240)*262144 + (ord($c[1])-128)*4096 + (ord($c[2])-128)*64 + (ord($c[3])-128);
        if (ord($c[0]) >= 248 && ord($c[0]) <= 251)
            return (ord($c[0])-248)*16777216 + (ord($c[1])-128)*262144 + (ord($c[2])-128)*4096 + (ord($c[3])-128)*64 + (ord($c[4])-128);
        if (ord($c[0]) >= 252 && ord($c[0]) <= 253)
            return (ord($c[0])-252)*1073741824 + (ord($c[1])-128)*16777216 + (ord($c[2])-128)*262144 + (ord($c[3])-128)*4096 + (ord($c[4])-128)*64 + (ord($c[5])-128);
        if (ord($c[0]) >= 254 && ord($c[0]) <= 255)    //  error
            return FALSE;
        return 0;
    }
    
    function char_check($c_val) {
        if (($c_val >= 1424 && $c_val <= 1535) || $c_val == 32 || $c_val == 45 || ($c_val >= 8192 && $c_val <= 8303) || $c_val == 95 || ($c_val >= 48 && $c_val <= 57) ||($c_val >= 97 && $c_val <= 122)) {
            return TRUE;
        } else {
            return FALSE;
        }
    }

    /* function quote($t) {
        #10075/6 are already gone at this point
        $quotes = [8216, 8217, 8219, 10076, 10075];
        for ($i = 0, $j = count($quotes); $i < $j; $i++) {
            $q = mb_convert_encoding('&#'.intval($quotes[$i]).';', 'UTF-8', 'HTML-ENTITIES');
            $t = str_replace($q, "'\"'\"'", $t);
        }
        return '"' . $t . '"';
    } */
    
    function t_escape($t) {
        $t_array = preg_split('//u', $t, -1, PREG_SPLIT_NO_EMPTY);
        for ($i = 0, $j = count($t_array); $i < $j; $i++) {
            if (!char_check(_uniord($t_array[$i]))) {
                $t = str_replace($t_array[$i], "", $t);
            }
        }
        return $t;
    }
    
    $tokens = t_escape($tokens);
    if (!trim($tokens)) {          // t_escape can strip everything away
        header('HTTP/1.0 404 Not Found');
        readfile('vos.html');
        exit();
    }
    $tmpfname = tempnam(getcwd() . "/", "grf");
    chmod($tmpfname, 0644);

	@include_once $_SERVER['DOCUMENT_ROOT'] . '/section.php';
	$graphGenre = (isset($GENRE) && $GENRE === 'story') ? 'story' : 'poem';

	$args = [escapeshellarg($tmpfname), (string)$func,
	         '--genre', escapeshellarg($graphGenre)];
	foreach (preg_split('/\s+/u', trim($tokens), -1, PREG_SPLIT_NO_EMPTY) as $tok) {
		$args[] = escapeshellarg($tok);
	}
	
	$pythons = [];
	$cfgFile = '/home/raphi/config/media_config.php';   // shared config dir
	$cfgDir  = dirname($cfgFile);
	if (is_file($cfgDir . '/python_path')) {
		$p = trim((string)file_get_contents($cfgDir . '/python_path'));
		if ($p !== '') { $pythons[] = $p; }
	}
	array_push($pythons, 'python3', 'python');

	$scriptDir = __DIR__;
	$lastErr   = '';
	$ok        = false;

	foreach ($pythons as $py) {
		$cmd = escapeshellarg($py) . ' ' . escapeshellarg($scriptDir . '/grapher.py')
		     . ' ' . implode(' ', $args);
		$pipes = [];
		$proc  = @proc_open($cmd,
			[1 => ['pipe', 'w'], 2 => ['pipe', 'w']], $pipes, $scriptDir);
		if (!is_resource($proc)) {
			$lastErr = "could not start $py";
			continue;
		}
		$out = stream_get_contents($pipes[1]); fclose($pipes[1]);
		$err = stream_get_contents($pipes[2]); fclose($pipes[2]);
		$rc  = proc_close($proc);

		if ($rc === 0 && filesize($tmpfname) > 0) { $ok = true; break; }

		// 127 is "command not found" — try the next interpreter rather than
		// reporting a Python problem that is really a missing Python.
		$lastErr = "$py exited $rc"
		         . ($err !== '' ? "\n" . trim($err) : '')
		         . ($out !== '' ? "\nstdout: " . trim($out) : '');
		if ($rc !== 127) { break; }
		clearstatcache(true, $tmpfname);
	}

	if (!$ok) {
		error_log("graph.php: grapher.py failed for func=$func — $lastErr");
		header('HTTP/1.0 404 Not Found');
		readfile('vos.html');
		@unlink($tmpfname);
		exit();
	}
	readfile($tmpfname);
	unlink($tmpfname);
	exit();
    
?>