init.php

<?php

require_once __DIR__ . "/includes/sanitize.php";

if((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on') || (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO']=='https'))  {
    $urlmode = 'https://';
} else {
    $urlmode = 'http://';
}

// Load site config.
if (!file_exists(__DIR__ . "/config.php")) {
	header('Location: ' . Sanitize::url($urlmode . $_SERVER['HTTP_HOST'] . rtrim(dirname($_SERVER['PHP_SELF']), '/\\') . "/install.php?r=" . Sanitize::randomQueryStringParam()));
}

require_once __DIR__ . "/config.php";

require_once __DIR__ . "/i18n/i18n.php";

//Look to see if a hook file is defined, and include if it is
if (isset($CFG['hooks']['init'])) {
	require_once $CFG['hooks']['init'];
}

$lastvueupdate = '20251206';

// setup session stuff
if (!function_exists('disallowsSameSiteNone')) {
function disallowsSameSiteNone () {
	// based on https://devblogs.microsoft.com/aspnet/upcoming-samesite-cookie-changes-in-asp-net-and-asp-net-core/
	if (!isset($_SERVER['HTTP_USER_AGENT'])) { return false; }
    $userAgent = $_SERVER['HTTP_USER_AGENT'];
	if (strpos($userAgent, "CPU iPhone OS 12") !== false ||
		strpos($userAgent, "iPad; CPU OS 12") !== false
	) {
		return true;
	}
	if (strpos($userAgent, "Macintosh; Intel Mac OS X 10_14") !== false &&
		strpos($userAgent, "Version/") !== false &&
		strpos($userAgent, "Safari") !== false
	) {
		return true;
	}
	if (strpos($userAgent, "Chrome/5") !== false ||
		strpos($userAgent, "Chrome/6") !== false
	) {
		return true;
	}

	return false;
}
}
if (isset($sessionpath)) { session_save_path($sessionpath);}
ini_set('session.gc_maxlifetime', $CFG['GEN']['sessionmaxlife'] ?? 432000);
if (isset($CFG['GEN']['gc_divisor'])) {
    ini_set('session.gc_divisor', $CFG['GEN']['gc_divisor']);
}
if (isset($CFG['MySQL_ver']) && $CFG['MySQL_ver'] >= 8) {
    define('MYSQL_LEFT_WRDBND', '\\b');
    define('MYSQL_RIGHT_WRDBND', '\\b');
} else {
    define('MYSQL_LEFT_WRDBND', '[[:<:]]');
    define('MYSQL_RIGHT_WRDBND', '[[:>:]]');
}

$hostdomain = explode(':', Sanitize::domainNameWithPort($_SERVER['HTTP_HOST']));
$hostparts = explode('.', $hostdomain[0]);
if ((!function_exists('isDevEnvironment') || !isDevEnvironment())
    && $hostdomain[0] != 'localhost'
    && !is_numeric($hostparts[count($hostparts)-1])
) {
	$path = $imasroot == '' ? '/' : $imasroot;
	$sess_cookie_domain = '.'.implode('.',array_slice($hostparts,isset($CFG['GEN']['domainlevel'])?$CFG['GEN']['domainlevel']:-2));
	if (disallowsSameSiteNone()) {
		session_set_cookie_params(0, $path, $sess_cookie_domain, false, true);
	} else {
		session_set_cookie_params(array(
			'lifetime' => 0,
			'path' => $path,
			'domain' => $sess_cookie_domain,
            'secure' => true,
            'httponly' => true,
			'samesite'=>'None'
		));
  }
}
if (!function_exists('setsecurecookie')) {
function setsecurecookie($name, $value, $expires=0, $httponly=true) {
	global $imasroot;
	if ($_SERVER['HTTP_HOST'] == 'localhost' || disallowsSameSiteNone()) {
		setcookie($name, $value, $expires, $imasroot == '' ? '/' : $imasroot, '', false, $httponly);
	} else {
		setcookie($name, $value, array(
			'expires' => $expires,
			'secure' => true,
			'samesite'=>'None',
			'httponly'=>$httponly,
			'path' => ($imasroot == '' ? '/' : $imasroot)
		));
	}
	$_COOKIE[$name] = $value;
}
}

// prevent errors in PHP < 7.2
if (!defined('JSON_INVALID_UTF8_IGNORE')) {
	define('JSON_INVALID_UTF8_IGNORE', 0);
}

// Store PHP sessions in the database.
if (!isset($use_local_sessions)) {
  if (!empty($CFG['redis'])) {
		$redispath = $CFG['redis'] . ((strpos($CFG['redis'], '?')===false)?'?':'&')
			. 'prefix='.preg_replace('/\W/','',$installname);
  	ini_set('session.save_handler', 'redis');
  	ini_set('session.save_path', $redispath);
  } else {
	require_once __DIR__ . "/includes/session.php";
	session_set_save_handler(new SessionDBHandler(), true);
  }
}

$staticroot = $imasroot;

// Load validate.php?
if (!isset($init_skip_validate) || (isset($init_skip_validate) && false == $init_skip_validate)) {
	require_once __DIR__ . "/validate.php";
} else if (!empty($init_session_start)) {
	session_start();
}
if (isset($CFG['static_server']) && !empty($_SESSION['static_ok'])) {
    $staticroot = $CFG['static_server'];
}
/*
if (isset($_SESSION['ratelimiter']) && isset($CFG['GEN']['ratelimit']) &&
	$_SERVER['REQUEST_METHOD'] === 'POST' &&
	microtime(true)-$_SESSION['ratelimiter'] < $CFG['GEN']['ratelimit']
) {
	echo "Slow down: ".(microtime(true)-$_SESSION['ratelimiter']);
	$_SESSION['ratelimiter'] = microtime(true);
	exit;
} else {
	$_SESSION['ratelimiter'] = microtime(true);
}
*/