Difference between revisions for Users / Eo Ny / dev




← Previous edit
Revision 3 as of 05/05/2026 19:10 ▼
3 05/05/2026 19:10 EoNy 2 05/05/2026 19:08 EoNy 1 05/05/2026 19:06 EoNy

(17.4 KiB)
EoNy
 Next edit →
Revision 4 as of 05/05/2026 19:10 ▼
18 05/21/2026 16:12 WikiAdmin 17 05/18/2026 15:15 WikiAdmin 16 05/18/2026 05:05 WikiAdmin 15 05/18/2026 05:04 WikiAdmin 14 05/17/2026 21:10 WikiAdmin 13 05/05/2026 19:29 EoNy 12 05/05/2026 19:28 WikiAdmin 11 05/05/2026 19:28 WikiAdmin 10 05/05/2026 19:27 WikiAdmin 9 05/05/2026 19:25 WikiAdmin 8 05/05/2026 19:24 WikiAdmin 7 05/05/2026 19:23 WikiAdmin 6 05/05/2026 19:21 EoNy 5 05/05/2026 19:11 EoNy 4 05/05/2026 19:10 EoNy

(19.7 KiB) +2,418
EoNy

#== HTTP Class Technical Documentation
## ==
=== Overview ===
The `Http` Http class (`src/class/http.php`) (src/class/http.php) is a core component of the WackoWiki system responsible for handling HTTP request/response processing, session management, caching, and security features. This class acts as a bridge between the web server and the wiki engine.
File Location: `src/class/http.php`** src/class/http.php Language: PHP
Dependencies: Database class, Session classes, Utility classes (`Ut`), (Ut), Diagnostics class (`Diag`)

## (Diag)

=== Class Properties

### ===

Public Properties ====
*| Property | Type | Description | |
|
|
| | `$tls_session`* || $tls_session | bool | Indicates if the current session uses HTTPS/TLS encryption | | `$request_uri` $request_uri | string | Normalized REQUEST_URI (e.g., 'PageOfNoReturn/show?a=1') | | `$ip` $ip | string | Client's real IP address (accounts for proxies) | | `$sess` $sess | Session | Reference to the Session object | | `$method` $method | string | Current HTTP method/request type | ### ==== Private Properties |==== Property | Type | Description
| |
|
|
|
 | `$db`
$db | object | Database connection reference | | `$tls_mark` $tls_mark | string | Cookie name for TLS session marking | | `$page` $page | string | Current page name being processed | | `$hash` $hash | string | SHA1 hash of the page name | | `$query` $query | string | Encoded query string | | `$lang` $lang | string | Current language code | | `$file` $file | string | Cache file path | | `$caching` $caching | int | Flag indicating if page should be cached (0 or 1) |
##
=== Constructor 
`php<!--markup:1:end--> <!--markup:2:begin-->=== ||
|| %%php<!--markup:2:end-->
public function __construct(&$db)
<!--markup:1:begin-->
` 
 ||
||<!--markup:2:end--> **Purpose:** Initializes the Http object and sets up HTTP session handling. <!--markup:2:begin-->||
||<!--markup:2:end--> **Parameters:** <!--markup:2:begin-->||
||<!--markup:2:end--> - <!--markup:1:begin-->`$db`<!--markup:1:end--> <!--markup:2:begin-->##$db##<!--markup:2:end--> - Database object reference <!--markup:2:begin-->||
||<!--markup:2:end--> **Initialization Steps:** <!--markup:2:begin-->||
||<!--markup:2:end--> 1. Stores database reference <!--markup:2:begin-->||
||<!--markup:2:end--> 2. Extracts and normalizes REQUEST_URI <!--markup:2:begin-->||
||<!--markup:2:end--> 3. Detects TLS/HTTPS session status <!--markup:2:begin-->||
||<!--markup:2:end--> 4. Determines client's real IP address <!--markup:2:begin-->||
||<!--markup:2:end--> 5. Sets up TLS mark cookie name <!--markup:2:begin-->||
||<!--markup:2:end--> 6. Enforces TLS session upgrade if needed <!--markup:2:begin-->||
||<!--markup:2:end--> **Example:**
<!--markup:1:begin-->```php<!--markup:1:end-->** <!--markup:2:begin-->||
||
php $http = new Http($db); 
`

---

##<!--markup:1:end-->
<!--markup:2:begin-->%% ||
|| ---- ||
|| ===<!--markup:2:end--> Core Methods

<!--markup:1:begin-->###<!--markup:1:end--> <!--markup:2:begin-->=== ||
|| ====<!--markup:2:end--> Session Management

<!--markup:1:begin-->#### `session($route): void`<!--markup:1:end--> <!--markup:2:begin-->==== ||
|| ===== ##session($route): void## ===== ||
||<!--markup:2:end--> Initializes the session handler (file-based or database-based). <!--markup:2:begin-->||
||<!--markup:2:end--> **Parameters:** <!--markup:2:begin-->||
||<!--markup:2:end--> - <!--markup:1:begin-->`$route`<!--markup:1:end--> <!--markup:2:begin-->##$route##<!--markup:2:end--> (int) - Routing flag: <!--markup:2:begin-->||
||<!--markup:2:end--> - Bit 2 <!--markup:1:begin-->(`$route<!--markup:1:end--> <!--markup:2:begin-->(##$route<!--markup:2:end--> & <!--markup:1:begin-->2`):<!--markup:1:end--> <!--markup:2:begin-->2##):<!--markup:2:end--> Enable static mode for files/freecap (disables replay prevention and ID regeneration) <!--markup:2:begin-->||
||<!--markup:2:end--> **Features:** <!--markup:2:begin-->||
||<!--markup:2:end--> - Selects storage backend (file or database) <!--markup:2:begin-->||
||<!--markup:2:end--> - Configures cookie settings (security, path, httponly) <!--markup:2:begin-->||
||<!--markup:2:end--> - Binds IP and TLS validation <!--markup:2:begin-->||
||<!--markup:2:end--> - Recovers diagnostic logs from previous session <!--markup:2:begin-->||
||<!--markup:2:end--> **Example:**
<!--markup:1:begin-->
`php** 
php<!--markup:2:end-->
$http->session(0);  // Normal session
$http->session(2);  // Static file serving mode
<!--markup:1:begin-->```

---

###<!--markup:1:end-->
<!--markup:2:begin-->
==== Caching System `check_cache($page,==== ===== ##check_cache($page, $method): void`void## ===== Determines if a page can be cached and prepares the cache check. Parameters: - `$page`$page (string) - Page name to cache - `$method`$method (string) - Request method/action (e.g., 'show', 'edit') Caching Rules: - ✅ Enabled for GET requests only - ✅ Disabled for POST requests - ❌ Never cached for 'edit' or 'watch' methods - ✅ Only cached for anonymous users (no logged-in users) Example: 
`php<!--markup:1:end-->** <!--markup:2:begin-->||
|| %%php<!--markup:2:end-->
$http->check_cache('HomePage', 'show');
<!--markup:1:begin-->
`
`store_cache(): void` 
 ||
|| ---- ||
|| ===== ##store_cache(): void## ===== ||
||<!--markup:2:end--> Saves the generated page content to cache file. <!--markup:2:begin-->||
||<!--markup:2:end--> **Features:** <!--markup:2:begin-->||
||<!--markup:2:end--> - Retrieves output buffer content <!--markup:2:begin-->||
||<!--markup:2:end--> - Saves to cache file with proper permissions <!--markup:2:begin-->||
||<!--markup:2:end--> - Records cache metadata in database <!--markup:2:begin-->||
||<!--markup:2:end--> - Only executes if caching flag is set and user is anonymous <!--markup:2:begin-->||
||<!--markup:2:end--> **Example:**
<!--markup:1:begin-->```php<!--markup:1:end-->** <!--markup:2:begin-->||
||
php // Called at end of page rendering $http->store_cache(); 
`

---

#### `invalidate_page($page): int`<!--markup:1:end-->
<!--markup:2:begin-->%% ||
|| ---- ||
|| ===== ##invalidate_page($page): int## ===== ||
||<!--markup:2:end--> Invalidates all cached versions of a page. <!--markup:2:begin-->||
||<!--markup:2:end--> **Parameters:** <!--markup:2:begin-->||
||<!--markup:2:end--> - <!--markup:1:begin-->`$page`<!--markup:1:end--> <!--markup:2:begin-->##$page##<!--markup:2:end--> (string) - Page name to invalidate <!--markup:2:begin-->||
||<!--markup:2:end--> **Returns:** <!--markup:2:begin-->||
||<!--markup:2:end--> - Number of cache entries invalidated <!--markup:2:begin-->||
||<!--markup:2:end--> **Process:** <!--markup:2:begin-->||
||<!--markup:2:end--> 1. Finds all cached versions (different methods/languages) <!--markup:2:begin-->||
||<!--markup:2:end--> 2. Touches files to past timestamp (faster than deletion) <!--markup:2:begin-->||
||<!--markup:2:end--> 3. Removes entries from cache metadata table <!--markup:2:begin-->||
||<!--markup:2:end--> 4. Returns count of invalidated caches <!--markup:2:begin-->||
||<!--markup:2:end--> **Example:**
<!--markup:1:begin-->
`php** 
php<!--markup:2:end-->
$count = $http->invalidate_page('HomePage');
echo "Invalidated $count cache entries";
<!--markup:1:begin-->```

---

###<!--markup:1:end-->
<!--markup:2:begin-->
==== TLS/HTTPS Security `secure_base_url(): void`==== ===== secure_base_url(): void ===== Switches base URL from HTTP to HTTPS. Purpose: - Ensures all subsequent URLs use HTTPS - Stores original HTTP URL for fallback - Called when TLS session is detected Example: 
`php<!--markup:1:end-->** <!--markup:2:begin-->||
|| %%php<!--markup:2:end-->
$http->secure_base_url();
// $db->base_url now uses https://
<!--markup:1:begin-->
`
`ensure_tls($url): void` 
 ||
|| ---- ||
|| ===== ##ensure_tls($url): void## ===== ||
||<!--markup:2:end--> Enforces HTTPS for a specific URL and redirects if necessary. <!--markup:2:begin-->||
||<!--markup:2:end--> **Parameters:** <!--markup:2:begin-->||
||<!--markup:2:end--> - <!--markup:1:begin-->`$url`<!--markup:1:end--> <!--markup:2:begin-->##$url##<!--markup:2:end--> (string) - URL to secure <!--markup:2:begin-->||
||<!--markup:2:end--> **Behavior:** <!--markup:2:begin-->||
||<!--markup:2:end--> - If not already HTTPS and TLS is enabled, forces HTTPS redirect <!--markup:2:begin-->||
||<!--markup:2:end--> - Handles both relative and absolute URLs <!--markup:2:begin-->||
||<!--markup:2:end--> - Converts relative URLs using current server name <!--markup:2:begin-->||
||<!--markup:2:end--> **Example:**
<!--markup:1:begin-->```php<!--markup:1:end-->** <!--markup:2:begin-->||
||
php $http->ensure_tls('/secure/payment'); 
`

---

###<!--markup:1:end-->
<!--markup:2:begin-->%% ||
|| ---- ||
|| ====<!--markup:2:end--> IP Address Detection

<!--markup:1:begin-->#### `real_ip(): string`<!--markup:1:end--> <!--markup:2:begin-->==== ||
|| ===== ##real_ip(): string##<!--markup:2:end--> (Private) <!--markup:2:begin-->===== ||
||<!--markup:2:end--> Detects client's real IP address accounting for proxies. <!--markup:2:begin-->||
||<!--markup:2:end--> **Proxy Headers Checked (in order):** <!--markup:2:begin-->||
||<!--markup:2:end--> 1. <!--markup:1:begin-->`HTTP_X_CLUSTER_CLIENT_IP`<!--markup:1:end--> <!--markup:2:begin-->##HTTP_X_CLUSTER_CLIENT_IP## ||
||<!--markup:2:end--> 2. <!--markup:1:begin-->`HTTP_X_FORWARDED_FOR`<!--markup:1:end--> <!--markup:2:begin-->##HTTP_X_FORWARDED_FOR##<!--markup:2:end--> (or custom header) <!--markup:2:begin-->||
||<!--markup:2:end--> 3. <!--markup:1:begin-->`HTTP_CLIENT_IP`<!--markup:1:end--> <!--markup:2:begin-->##HTTP_CLIENT_IP## ||
||<!--markup:2:end--> 4. <!--markup:1:begin-->`HTTP_X_REMOTE_ADDR`<!--markup:1:end--> <!--markup:2:begin-->##HTTP_X_REMOTE_ADDR## ||
||<!--markup:2:end--> 5. <!--markup:1:begin-->`REMOTE_ADDR`<!--markup:1:end--> <!--markup:2:begin-->##REMOTE_ADDR##<!--markup:2:end--> (fallback) <!--markup:2:begin-->||
||<!--markup:2:end--> **Features:** <!--markup:2:begin-->||
||<!--markup:2:end--> - Filters out private/reserved IP ranges <!--markup:2:begin-->||
||<!--markup:2:end--> - Respects configured reverse proxy addresses <!--markup:2:begin-->||
||<!--markup:2:end--> - Returns <!--markup:1:begin-->`'0.0.0.0'`<!--markup:1:end--> <!--markup:2:begin-->##'0.0.0.0'##<!--markup:2:end--> as fallback <!--markup:2:begin-->||
||<!--markup:2:end--> **Configuration in Database:** <!--markup:2:begin-->||
||<!--markup:2:end--> - <!--markup:1:begin-->`reverse_proxy_addresses`<!--markup:1:end--> <!--markup:2:begin-->##reverse_proxy_addresses##<!--markup:2:end--> - Comma/space-separated proxy IPs <!--markup:2:begin-->||
||<!--markup:2:end--> - <!--markup:1:begin-->`reverse_proxy_header`<!--markup:1:end--> <!--markup:2:begin-->##reverse_proxy_header##<!--markup:2:end--> - Custom header name (default: <!--markup:1:begin-->`X-Forwarded-For`)<!--markup:1:end--> <!--markup:2:begin-->##X-Forwarded-For##) ||
||<!--markup:2:end--> **Example:**
<!--markup:1:begin-->
`php** 
php<!--markup:2:end-->
$client_ip = $http->ip;  // e.g., "203.0.113.42"
<!--markup:1:begin-->```

---

###<!--markup:1:end-->
<!--markup:2:begin-->
==== HTTPS Detection `tls_session(): bool`==== ===== tls_session(): bool (Private) ===== Detects if current connection uses HTTPS/TLS. Checks (any being true = HTTPS): - `$_SERVER['HTTPS']`$_SERVER['HTTPS'] is 'on' - `$_SERVER['SERVER_PORT']`$_SERVER['SERVER_PORT'] is 443 - `$_SERVER['HTTP_X_FORWARDED_PROTO']`$_SERVER['HTTP_X_FORWARDED_PROTO'] is 'https' - `$_SERVER['HTTP_X_FORWARDED_SSL']`$_SERVER['HTTP_X_FORWARDED_SSL'] is 'on' - `$_SERVER['HTTP_X_FORWARDED_PORT']`$_SERVER['HTTP_X_FORWARDED_PORT'] is 443
###
==== Security Headers `http_security_headers(): void`==== ===== http_security_headers(): void ===== Sets security-related HTTP headers. Headers Set:|** Header | Purpose | Config Key
| |
|
|
|
 |
Content-Security-Policy | XSS/injection protection | `csp` | |csp Permissions-Policy | Control browser features | `permissions_policy` | |permissions_policy Referrer-Policy | Control referrer information | `referrer_policy` | |referrer_policy Strict-Transport-Security | Force HTTPS | Auto (TLS only) | | X-Frame-Options | Clickjacking protection | Hardcoded: `SAMEORIGIN` | |SAMEORIGIN X-Content-Type-Options | MIME sniffing prevention | Hardcoded: `nosniff` |nosniff CSP Configuration Options: - `0`0 - Disabled - `1`1 - Default policy (from `csp.conf`)csp.conf) - `2`2 - Custom policy (from `csp_custom.conf`)csp_custom.conf) Example: 
`php<!--markup:1:end-->** <!--markup:2:begin-->||
|| %%php<!--markup:2:end-->
$http->http_security_headers();
<!--markup:1:begin-->
`
### 
 ||
|| ---- ||
|| ====<!--markup:2:end--> HTTP Methods

<!--markup:1:begin-->#### `redirect($url,<!--markup:1:end--> <!--markup:2:begin-->==== ||
|| ===== ##redirect($url,<!--markup:2:end--> $permanent = false): <!--markup:1:begin-->void`<!--markup:1:end--> <!--markup:2:begin-->void## ===== ||
||<!--markup:2:end--> Performs an HTTP redirect. <!--markup:2:begin-->||
||<!--markup:2:end--> **Parameters:** <!--markup:2:begin-->||
||<!--markup:2:end--> - <!--markup:1:begin-->`$url`<!--markup:1:end--> <!--markup:2:begin-->##$url##<!--markup:2:end--> (string) - Target URL <!--markup:2:begin-->||
||<!--markup:2:end--> - <!--markup:1:begin-->`$permanent`<!--markup:1:end--> <!--markup:2:begin-->##$permanent##<!--markup:2:end--> (bool) - Use 301 (permanent) vs 302 (temporary) <!--markup:2:begin-->||
||<!--markup:2:end--> **Features:** <!--markup:2:begin-->||
||<!--markup:2:end--> - Decodes <!--markup:1:begin-->`&amp;`<!--markup:1:end--> <!--markup:2:begin-->##&amp;##<!--markup:2:end--> entities to prevent broken redirects <!--markup:2:begin-->||
||<!--markup:2:end--> - Only works if headers not yet sent <!--markup:2:begin-->||
||<!--markup:2:end--> - Uses output buffering to work anywhere in page processing <!--markup:2:begin-->||
||<!--markup:2:end--> **Example:**
<!--markup:1:begin-->```php<!--markup:1:end-->** <!--markup:2:begin-->||
||
php $http->redirect('http://example.com/new-page', true); // 301 $http->redirect('/wiki/HomePage'); // 302 
`

---

#### `terminate(): void`<!--markup:1:end-->
<!--markup:2:begin-->%% ||
|| ---- ||
|| ===== ##terminate(): void## ===== ||
||<!--markup:2:end--> Safe exit/die with cleanup. <!--markup:2:begin-->||
||<!--markup:2:end--> **Cleanup Operations:** <!--markup:2:begin-->||
||<!--markup:2:end--> - Saves diagnostic logs to session flash data <!--markup:2:begin-->||
||<!--markup:2:end--> - Ends script execution <!--markup:2:begin-->||
||<!--markup:2:end--> **Example:**
<!--markup:1:begin-->
`php** 
php<!--markup:2:end-->
$http->terminate();
<!--markup:1:begin-->```

---

#### `status($code): void`<!--markup:1:end-->
<!--markup:2:begin-->
===== status($code): void ===== Sets HTTP response status code. Supported Status Codes: 
`php<!--markup:1:end-->** <!--markup:2:begin-->||
|| %%php<!--markup:2:end-->
200 => 'OK'
206 => 'Partial Content'
301 => 'Moved Permanently'
302 => 'Moved Temporarily'
304 => 'Not Modified'
400 => 'Bad Request'
401 => 'Unauthorized'
403 => 'Forbidden'
404 => 'Not Found'
405 => 'Method Not Allowed'
409 => 'Conflict'
410 => 'Gone'
416 => 'Requested Range Not Satisfiable'
500 => 'Internal Server Error'
501 => 'Not Implemented'
503 => 'Service Unavailable'
<!--markup:1:begin-->
` 
 ||
||<!--markup:2:end--> **Example:**
<!--markup:1:begin-->```php<!--markup:1:end-->** <!--markup:2:begin-->||
||
php $http->status(404); // Send 404 Not Found 
`

---

###<!--markup:1:end-->
<!--markup:2:begin-->%% ||
|| ---- ||
|| ====<!--markup:2:end--> Caching Control

<!--markup:1:begin-->#### `no_cache($client_only<!--markup:1:end--> <!--markup:2:begin-->==== ||
|| ===== ##no_cache($client_only<!--markup:2:end--> = true): <!--markup:1:begin-->void`<!--markup:1:end--> <!--markup:2:begin-->void## ===== ||
||<!--markup:2:end--> Disables caching of the current page. <!--markup:2:begin-->||
||<!--markup:2:end--> **Parameters:** <!--markup:2:begin-->||
||<!--markup:2:end--> - <!--markup:1:begin-->`$client_only`<!--markup:1:end--> <!--markup:2:begin-->##$client_only##<!--markup:2:end--> (bool, default: TRUE) <!--markup:2:begin-->||
||<!--markup:2:end--> - <!--markup:1:begin-->`TRUE`:<!--markup:1:end--> <!--markup:2:begin-->##TRUE##:<!--markup:2:end--> Disable browser cache only <!--markup:2:begin-->||
||<!--markup:2:end--> - <!--markup:1:begin-->`FALSE`:<!--markup:1:end--> <!--markup:2:begin-->##FALSE##:<!--markup:2:end--> Disable both browser and server cache <!--markup:2:begin-->||
||<!--markup:2:end--> **Headers Set:** <!--markup:2:begin-->||
||<!--markup:2:end--> - <!--markup:1:begin-->`Last-Modified: <current-time>`<!--markup:1:end--> <!--markup:2:begin-->##Last-Modified: <current-time>##<!--markup:2:end--> (always fresh) <!--markup:2:begin-->||
||<!--markup:2:end--> - <!--markup:1:begin-->`Cache-Control: no-store`<!--markup:1:end--> <!--markup:2:begin-->##Cache-Control: no-store## ||
||<!--markup:2:end--> **Example:**
<!--markup:1:begin-->
`php** 
php<!--markup:2:end-->
$http->no_cache();        // Client-side only
$http->no_cache(false);   // Both client & server
<!--markup:1:begin-->```

---

#### `cache_promisc(): void`<!--markup:1:end-->
<!--markup:2:begin-->
===== cache_promisc(): void ===== Marks page as publicly cacheable. Headers Set: - `Cache-Control: public`Cache-Control: public Example: 
`php<!--markup:1:end-->** <!--markup:2:begin-->||
|| %%php<!--markup:2:end-->
$http->cache_promisc();
<!--markup:1:begin-->
`
### 
 ||
|| ---- ||
|| ====<!--markup:2:end--> Language Negotiation

<!--markup:1:begin-->#### `user_agent_language(): string`<!--markup:1:end--> <!--markup:2:begin-->==== ||
|| ===== ##user_agent_language(): string## ===== ||
||<!--markup:2:end--> Determines best language based on browser preferences. <!--markup:2:begin-->||
||<!--markup:2:end--> **Features:** <!--markup:2:begin-->||
||<!--markup:2:end--> - Follows RFC 9110 section 12.5.4 (HTTP Accept-Language) <!--markup:2:begin-->||
||<!--markup:2:end--> - Parses <!--markup:1:begin-->`Accept-Language`<!--markup:1:end--> <!--markup:2:begin-->##Accept-Language##<!--markup:2:end--> header with quality factors <!--markup:2:begin-->||
||<!--markup:2:end--> - Attempts exact match first, then language fallback <!--markup:2:begin-->||
||<!--markup:2:end--> - Falls back to default system language <!--markup:2:begin-->||
||<!--markup:2:end--> **Example Header:**
<!--markup:1:begin-->```<!--markup:1:end-->** <!--markup:2:begin-->||
||
Accept-Language: en-US,en;q=0.9,de;q=0.8 
`<!--markup:1:end-->
<!--markup:2:begin-->%% ||
||<!--markup:2:end--> **Returns:** <!--markup:2:begin-->||
||<!--markup:2:end--> - Language code (e.g., 'en', 'en-US', 'de')

<!--markup:1:begin-->---

#### `available_languages($subset<!--markup:1:end--> <!--markup:2:begin-->||
|| ---- ||
|| ===== ##available_languages($subset<!--markup:2:end--> = true): <!--markup:1:begin-->array`<!--markup:1:end--> <!--markup:2:begin-->array## ===== ||
||<!--markup:2:end--> Returns list of available language translations. <!--markup:2:begin-->||
||<!--markup:2:end--> **Parameters:** <!--markup:2:begin-->||
||<!--markup:2:end--> - <!--markup:1:begin-->`$subset`<!--markup:1:end--> <!--markup:2:begin-->##$subset##<!--markup:2:end--> (bool, default: TRUE) <!--markup:2:begin-->||
||<!--markup:2:end--> - <!--markup:1:begin-->`TRUE`:<!--markup:1:end--> <!--markup:2:begin-->##TRUE##:<!--markup:2:end--> Only allowed languages <!--markup:2:begin-->||
||<!--markup:2:end--> - <!--markup:1:begin-->`FALSE`:<!--markup:1:end--> <!--markup:2:begin-->##FALSE##:<!--markup:2:end--> All available languages <!--markup:2:begin-->||
||<!--markup:2:end--> **Features:** <!--markup:2:begin-->||
||<!--markup:2:end--> - Scans <!--markup:1:begin-->`LANG_DIR`<!--markup:1:end--> <!--markup:2:begin-->##LANG_DIR##<!--markup:2:end--> for language files <!--markup:2:begin-->||
||<!--markup:2:end--> - Filters by <!--markup:1:begin-->`allowed_languages`<!--markup:1:end--> <!--markup:2:begin-->##allowed_languages##<!--markup:2:end--> config if set <!--markup:2:begin-->||
||<!--markup:2:end--> - Caches result in session <!--markup:2:begin-->||
||<!--markup:2:end--> - System language always included <!--markup:2:begin-->||
||<!--markup:2:end--> **Returns:** <!--markup:2:begin-->||
||<!--markup:2:end--> - Associative array: <!--markup:1:begin-->`['en'<!--markup:1:end--> <!--markup:2:begin-->##['en'<!--markup:2:end--> => 'en', 'de' => 'de', <!--markup:1:begin-->...]`<!--markup:1:end--> <!--markup:2:begin-->...]## ||
||<!--markup:2:end--> **Example:**
<!--markup:1:begin-->
`php** 
php<!--markup:2:end-->
$all_langs = $http->available_languages(false);
$allowed = $http->available_languages(true);
<!--markup:1:begin-->```

---

###<!--markup:1:end-->
<!--markup:2:begin-->
==== File Serving `sendfile($path,==== ===== ##sendfile($path, $filename = null, $age = null): void`void## ===== Serves files with proper HTTP headers and caching. Parameters: - `$path`$path (string) - File path (or HTTP_XXX constant for error pages) - `$filename`$filename (string, optional) - Custom download filename - `$age`$age (int, optional) - Cache age in days Features: - HTTP range request support (partial file downloads) - ETag and Last-Modified conditional requests - Proper MIME type detection - Content-Security-Policy for special file types - Streaming for large files - GZip compression for text files Special Paths: 
`php<!--markup:1:end-->** <!--markup:2:begin-->||
|| %%php<!--markup:2:end-->
$http->sendfile(404);  // Serves file defined by HTTP_404 constant
$http->sendfile(403);  // Serves file defined by HTTP_403 constant
<!--markup:1:begin-->
` 
 ||
||<!--markup:2:end--> **Example:**
<!--markup:1:begin-->```php<!--markup:1:end-->** <!--markup:2:begin-->||
||
php $http->sendfile('uploads/document.pdf', 'my-document.pdf', 30); 
`

---

#### `mime_type($path): string`<!--markup:1:end-->
<!--markup:2:begin-->%% ||
|| ---- ||
|| ===== ##mime_type($path): string## ===== ||
||<!--markup:2:end--> Returns MIME type for a file. <!--markup:2:begin-->||
||<!--markup:2:end--> **Returns:** <!--markup:2:begin-->||
||<!--markup:2:end--> - MIME type string (e.g., 'application/pdf') <!--markup:2:begin-->||
||<!--markup:2:end--> - Default: <!--markup:1:begin-->`'application/octet-stream'`<!--markup:1:end--> <!--markup:2:begin-->##'application/octet-stream'## ||
||<!--markup:2:end--> **Example:**
<!--markup:1:begin-->
`php** 
php<!--markup:2:end-->
$mime = $http->mime_type('file.pdf');  // 'application/pdf'
<!--markup:1:begin-->```

---

#### `mime_types(): array`<!--markup:1:end-->
<!--markup:2:begin-->
===== mime_types(): array (Private) ===== Loads and caches MIME types from configuration. Features: - Reads from `config/mime.types`config/mime.types - Caches to `cache/config/mime.types`cache/config/mime.types - Reloads if config is updated
###
==== Compression `gzip(): void`==== ===== gzip(): void ===== Compresses HTTP response with gzip/x-gzip. Features: - Manually implements gzip (not relying on zlib.output_compression) - Produces correct `Content-Length`Content-Length header - Only compresses if: - 860 bytes < content < 1 MB - Client accepts compression - Headers not already sent Example: 
`php<!--markup:1:end-->** <!--markup:2:begin-->||
|| %%php<!--markup:2:end-->
$http->gzip();
<!--markup:1:begin-->
`
### 
 ||
|| ---- ||
|| ====<!--markup:2:end--> Utility Methods

<!--markup:1:begin-->#### `parse_str($str): array`<!--markup:1:end--> <!--markup:2:begin-->==== ||
|| ===== ##parse_str($str): array##<!--markup:2:end--> (Private) <!--markup:2:begin-->===== ||
||<!--markup:2:end--> Parses URL-encoded strings with special character handling. <!--markup:2:begin-->||
||<!--markup:2:end--> **Purpose:** <!--markup:2:begin-->||
||<!--markup:2:end--> - Safely handles special characters in query/form data <!--markup:2:begin-->||
||<!--markup:2:end--> - Converts encoding properly <!--markup:2:begin-->||
||<!--markup:2:end--> **Example:**
<!--markup:1:begin-->```php<!--markup:1:end-->** <!--markup:2:begin-->||
||
php $data = $http->parse_str('name=John&age=30'); 
`

---

#### `request_uri(): string`<!--markup:1:end-->
<!--markup:2:begin-->%% ||
|| ---- ||
|| ===== ##request_uri(): string##<!--markup:2:end--> (Private) <!--markup:2:begin-->===== ||
||<!--markup:2:end--> Extracts and normalizes REQUEST_URI from server. <!--markup:2:begin-->||
||<!--markup:2:end--> **Normalization:** <!--markup:2:begin-->||
||<!--markup:2:end--> - Removes base URL prefix <!--markup:2:begin-->||
||<!--markup:2:end--> - Removes spaces <!--markup:2:begin-->||
||<!--markup:2:end--> - Collapses multiple slashes <!--markup:2:begin-->||
||<!--markup:2:end--> - Removes <!--markup:1:begin-->`..`<!--markup:1:end--> <!--markup:2:begin-->##..##<!--markup:2:end--> path traversal attempts <!--markup:2:begin-->||
||<!--markup:2:end--> - Removes leading/trailing slashes

<!--markup:1:begin-->---

#### `cut_prefix($prefix,<!--markup:1:end--> <!--markup:2:begin-->||
|| ---- ||
|| ===== ##cut_prefix($prefix,<!--markup:2:end--> $path): <!--markup:1:begin-->string`<!--markup:1:end--> <!--markup:2:begin-->string##<!--markup:2:end--> (Private) <!--markup:2:begin-->===== ||
||<!--markup:2:end--> Removes prefix from path (case-insensitive).

<!--markup:1:begin-->---

#### `get_header_conf($file_name): string`<!--markup:1:end--> <!--markup:2:begin-->||
|| ---- ||
|| ===== ##get_header_conf($file_name): string##<!--markup:2:end--> (Private) <!--markup:2:begin-->===== ||
||<!--markup:2:end--> Loads security header configuration from files. <!--markup:2:begin-->||
||<!--markup:2:end--> **Files Supported:** <!--markup:2:begin-->||
||<!--markup:2:end--> - <!--markup:1:begin-->`csp.conf`<!--markup:1:end--> <!--markup:2:begin-->##csp.conf##<!--markup:2:end--> / <!--markup:1:begin-->`csp_custom.conf`<!--markup:1:end--> <!--markup:2:begin-->##csp_custom.conf## ||
||<!--markup:2:end--> - <!--markup:1:begin-->`permissions_policy.conf`<!--markup:1:end--> <!--markup:2:begin-->##permissions_policy.conf##<!--markup:2:end--> / <!--markup:1:begin-->`permissions_policy_custom.conf`

---

##<!--markup:1:end--> <!--markup:2:begin-->##permissions_policy_custom.conf## ||
|| ---- ||
|| ===<!--markup:2:end--> Configuration Dependencies <!--markup:2:begin-->=== ||
||<!--markup:2:end--> The class relies on these database configuration settings:

<!--markup:1:begin-->|<!--markup:1:end--> <!--markup:2:begin-->||
||<!--markup:2:end--> Setting | Type | Purpose <!--markup:2:begin-->||
|| ---------<!--markup:2:end--> |
<!--markup:1:begin-->|---------|------|---------|<!--markup:1:end--> <!--markup:2:begin-->------<!--markup:2:end--> | <!--markup:1:begin-->`base_url`<!--markup:1:end--> <!--markup:2:begin-->--------- ||
|| ##base_url##<!--markup:2:end--> | string | Wiki's base URL <!--markup:1:begin-->|
| `tls`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##tls##<!--markup:2:end--> | bool | Enable HTTPS enforcement <!--markup:1:begin-->|
| `cache`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##cache##<!--markup:2:end--> | bool | Enable page caching <!--markup:1:begin-->|
| `cache_ttl`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##cache_ttl##<!--markup:2:end--> | int | Cache lifetime in seconds <!--markup:1:begin-->|
| `session_store`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##session_store##<!--markup:2:end--> | int | 1=File, 0=Database <!--markup:1:begin-->|
| `system_seed_hash`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##system_seed_hash##<!--markup:2:end--> | string | Session encryption seed <!--markup:1:begin-->|
| `cookie_prefix`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##cookie_prefix##<!--markup:2:end--> | string | Session cookie prefix <!--markup:1:begin-->|
| `cookie_path`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##cookie_path##<!--markup:2:end--> | string | Cookie path <!--markup:1:begin-->|
| `allow_persistent_cookie`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##allow_persistent_cookie##<!--markup:2:end--> | bool | Allow persistent login <!--markup:1:begin-->|
| `session_length`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##session_length##<!--markup:2:end--> | int | Session lifetime in seconds <!--markup:1:begin-->|
| `reverse_proxy_addresses`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##reverse_proxy_addresses##<!--markup:2:end--> | string | Comma/space-separated proxy IPs <!--markup:1:begin-->|
| `reverse_proxy_header`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##reverse_proxy_header##<!--markup:2:end--> | string | Custom X-Forwarded header <!--markup:1:begin-->|
| `language`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##language##<!--markup:2:end--> | string | Default language code <!--markup:1:begin-->|
| `multilanguage`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##multilanguage##<!--markup:2:end--> | bool | Enable language negotiation <!--markup:1:begin-->|
| `allowed_languages`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##allowed_languages##<!--markup:2:end--> | string | Comma/space-separated allowed langs <!--markup:1:begin-->|
| `enable_security_headers`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##enable_security_headers##<!--markup:2:end--> | bool | Send security headers <!--markup:1:begin-->|
| `csp`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##csp##<!--markup:2:end--> | int | CSP setting (0/1/2) <!--markup:1:begin-->|
| `permissions_policy`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##permissions_policy##<!--markup:2:end--> | int | Permissions-Policy setting (0/1/2) <!--markup:1:begin-->|
| `referrer_policy`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##referrer_policy##<!--markup:2:end--> | int | Referrer-Policy setting (0-8) <!--markup:1:begin-->|

---

##<!--markup:1:end--> <!--markup:2:begin-->||
|| ---- ||
|| ===<!--markup:2:end--> Constants Used

<!--markup:1:begin-->|<!--markup:1:end--> <!--markup:2:begin-->=== ||
||<!--markup:2:end--> Constant | Type | Purpose <!--markup:2:begin-->||
|| ----------<!--markup:2:end--> |
<!--markup:1:begin-->|----------|------|---------|<!--markup:1:end--> <!--markup:2:begin-->------<!--markup:2:end--> | <!--markup:1:begin-->`IN_WACKO`<!--markup:1:end--> <!--markup:2:begin-->--------- ||
|| ##IN_WACKO##<!--markup:2:end--> | bool | Security check (exit if not defined) <!--markup:1:begin-->|
| `CHMOD_SAFE`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##CHMOD_SAFE##<!--markup:2:end--> | int | File permissions for cache files <!--markup:1:begin-->|
| `CHMOD_FILE`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##CHMOD_FILE##<!--markup:2:end--> | int | File permissions for config cache <!--markup:1:begin-->|
| `CACHE_PAGE_DIR`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##CACHE_PAGE_DIR##<!--markup:2:end--> | string | Page cache directory <!--markup:1:begin-->|
| `CACHE_SESSION_DIR`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##CACHE_SESSION_DIR##<!--markup:2:end--> | string | Session cache directory <!--markup:1:begin-->|
| `CACHE_CONFIG_DIR`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##CACHE_CONFIG_DIR##<!--markup:2:end--> | string | Config cache directory <!--markup:1:begin-->|
| `CONFIG_DIR`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##CONFIG_DIR##<!--markup:2:end--> | string | Configuration directory <!--markup:1:begin-->|
| `LANG_DIR`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##LANG_DIR##<!--markup:2:end--> | string | Language files directory <!--markup:1:begin-->|
| `DAYSECS`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##DAYSECS##<!--markup:2:end--> | int | Seconds in a day (86400) <!--markup:1:begin-->|
| `HTTP_404`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##HTTP_404##<!--markup:2:end--> | string | Path to 404 error page <!--markup:1:begin-->|
| `HTTP_403`<!--markup:1:end--> <!--markup:2:begin-->||
|| ##HTTP_403##<!--markup:2:end--> | string | Path to 403 error page <!--markup:1:begin-->|

---

##<!--markup:1:end--> <!--markup:2:begin-->||
|#

----

===<!--markup:2:end--> Workflow Examples

<!--markup:1:begin-->###<!--markup:1:end--> <!--markup:2:begin-->===

====<!--markup:2:end--> Example 1: Handling a GET Request

<!--markup:1:begin-->
`php==== 
php<!--markup:2:end-->
// In main wiki entry point
$http = new Http($db);
$http->session(0);  // Start session

// Check if page can be served from cache
$http->check_cache('HomePage', 'show');

// ... render page content ...

// Store rendered page in cache if applicable
$http->store_cache();

// Send security headers
$http->http_security_headers();

// Possibly compress output
$http->gzip();
<!--markup:1:begin-->```

###<!--markup:1:end-->
<!--markup:2:begin-->

Example 2: Handling TLS/HTTPS Upgrade 
`php<!--markup:1:end--> <!--markup:2:begin-->====

%%php<!--markup:2:end-->
$http = new Http($db);  // Constructor detects TLS requirement
// If TLS is enabled and user wasn't in TLS before:
// - Sets TLS session flag
// - Marks session with TLS cookie
// - Redirects to HTTPS version
<!--markup:1:begin-->
` ### 
====<!--markup:2:end--> Example 3: Invalidating Cache After Page Edit

<!--markup:1:begin-->```php<!--markup:1:end--> <!--markup:2:begin-->====
php // User edits a page $http = new Http($db); $count = $http->invalidate_page('HomePage'); // All cached versions (different languages, methods) are invalidated 
`

###<!--markup:1:end-->
<!--markup:2:begin-->%%

====<!--markup:2:end--> Example 4: Serving a File

<!--markup:1:begin-->
`php==== 
php<!--markup:2:end-->
$http = new Http($db);
$http->session(2);  // Static file mode - no session replay prevention

// Serve with 30-day cache
$http->sendfile('uploads/manual.pdf', 'user-manual.pdf', 30);
<!--markup:1:begin-->```

---

##<!--markup:1:end-->
<!--markup:2:begin-->
=== Security Considerations ###===

1. IP Address Spoofing====
  • Validates IPs against private ranges
  • Filters proxy-provided IPs appropriately
  • Configurable reverse proxy trust ### ==== 2. Session Security ====
  • Binds sessions to IP address
  • Binds sessions to TLS status
  • Supports both file and database storage
  • HttpOnly cookies by default ### ==== 3. TLS Enforcement ====
  • Automatic HTTPS upgrade when configured
  • Marks TLS sessions to prevent downgrade attacks
  • HSTS header support ### ==== 4. Content Security ====
  • CSP headers to prevent XSS
  • X-Frame-Options to prevent clickjacking
  • X-Content-Type-Options to prevent MIME sniffing
  • Referrer-Policy control
  • Permissions-Policy for browser features ### ==== 5. File Serving ====
  • Validates file existence and readability
  • Prevents directory traversal via `realpath()` realpath()
  • Rejects symbolic links
  • Special CSP for SVG and PDF files ### ==== 6. Cache Security ====
  • Cached only for anonymous users
  • Disabled for sensitive operations (edit, watch)
  • Only GET requests cached
    ##
    ===     Performance Optimization ### ===

1. Page Caching====
  • Stores full HTML output
  • TTL-based expiration
  • Language and method-aware caching
  • Conditional request support (304 Not Modified) ### ==== 2. MIME Type Caching ====
  • Loads MIME types once and caches
  • Regenerates only when config changes ### ==== 3. Session Options ====
  • File-based sessions for simple deployments
  • Database sessions for distributed systems ### ==== 4. Compression ====
  • Manual gzip implementation
  • Proper Content-Length generation
  • Only compresses appropriate sizes
    ##
    ===     Debugging === The class integrates with WackoWiki's diagnostic system: 
    `php<!--markup:1:end-->

<!--markup:2:begin-->%%php<!--markup:2:end-->
// Diagnostic messages are preserved across redirects
// via session flash data

// Check cached pages (debug comments in output):
// <!-- WackoWiki Caching Engine: page cached at 2024-01-15 12:30:45 GMT -->
<!--markup:1:begin-->
    `
    ##     %%
    ===     Related Classes ===
  • Session Classes (`SessionFileStore`, `SessionDbalStore`)** (SessionFileStore, SessionDbalStore) - Session management backends
  • Database Class - Configuration and cache metadata storage
  • Ut Utility Class - String/path utilities
  • Diag Class - Diagnostic logging
    ##
    ===     Version History ===
  • Supports PHP 8.0+ (uses match expressions, union types)
  • Follows RFC 9110 for HTTP header handling
  • Modern cookie security practices
    ##
    ===     Conclusion === The `Http` Http class is the central request/response handler in WackoWiki, managing everything from session initialization to security headers to file serving. Understanding this class is essential for:
  • Extending WackoWiki with custom request handlers
  • Implementing custom session logic
  • Adding new security policies
  • Optimizing cache strategies
  • Debugging HTTP-related issues