| 91 |
|
### Caching System
|
| 92 |
|
|
| 93 |
|
#### `check_cache($page, $method): void`
|
| 94 |
|
Determines if a page can be cached and prepares the cache check.
|
| 95 |
|
|
| 96 |
|
**Parameters:**
|
| 97 |
|
- `$page` (string) - Page name to cache
|
| 98 |
|
- `$method` (string) - Request method/action (e.g., 'show', 'edit')
|
| 99 |
|
|
| 100 |
|
**Caching Rules:**
|
| 101 |
|
- ✅ Enabled for GET requests only
|
| 102 |
|
- ✅ Disabled for POST requests
|
| 103 |
|
- ❌ Never cached for 'edit' or 'watch' methods
|
| 104 |
|
- ✅ Only cached for anonymous users (no logged-in users)
|
| 105 |
|
|
| 106 |
|
**Example:**
|
| 107 |
|
```php
|
| 108 |
|
$http->check_cache('HomePage', 'show');
|
| 109 |
|
```
|
| 110 |
|
|
| 111 |
|
---
|
| 112 |
|
|
| 113 |
|
#### `store_cache(): void`
|
| 114 |
|
Saves the generated page content to cache file.
|
| 115 |
|
|
| 116 |
|
**Features:**
|
| 117 |
|
- Retrieves output buffer content
|
| 118 |
|
- Saves to cache file with proper permissions
|
| 119 |
|
- Records cache metadata in database
|
| 120 |
|
- Only executes if caching flag is set and user is anonymous
|
| 121 |
|
|
| 122 |
|
**Example:**
|
| 123 |
|
```php
|
| 124 |
|
// Called at end of page rendering
|
| 125 |
|
$http->store_cache();
|
| 126 |
|
```
|
| 127 |
|
|
| 128 |
|
---
|
| 129 |
|
|
| 130 |
|
#### `invalidate_page($page): int`
|
| 131 |
|
Invalidates all cached versions of a page.
|
| 132 |
|
|
| 133 |
|
**Parameters:**
|
| 134 |
|
- `$page` (string) - Page name to invalidate
|
| 135 |
|
|
| 136 |
|
**Returns:**
|
| 137 |
|
- Number of cache entries invalidated
|
| 138 |
|
|
| 139 |
|
**Process:**
|
| 140 |
|
1. Finds all cached versions (different methods/languages)
|
| 141 |
|
2. Touches files to past timestamp (faster than deletion)
|
| 142 |
|
3. Removes entries from cache metadata table
|
| 143 |
|
4. Returns count of invalidated caches
|
| 144 |
|
|
| 145 |
|
**Example:**
|
| 146 |
|
```php
|
| 147 |
|
$count = $http->invalidate_page('HomePage');
|
| 148 |
|
echo "Invalidated $count cache entries";
|
| 149 |
|
```
|
| 150 |
|
|
| 151 |
|
---
|
| 152 |
|
|
| 153 |
|
### TLS/HTTPS Security
|
| 154 |
|
|
| 155 |
|
#### `secure_base_url(): void`
|
| 156 |
|
Switches base URL from HTTP to HTTPS.
|
| 157 |
|
|
| 158 |
|
**Purpose:**
|
| 159 |
|
- Ensures all subsequent URLs use HTTPS
|
| 160 |
|
- Stores original HTTP URL for fallback
|
| 161 |
|
- Called when TLS session is detected
|
| 162 |
|
|
| 163 |
|
**Example:**
|
| 164 |
|
```php
|
| 165 |
|
$http->secure_base_url();
|
| 166 |
|
// $db->base_url now uses https://
|
| 167 |
|
```
|
| 168 |
|
|
| 169 |
|
---
|
| 170 |
|
|
| 171 |
|
#### `ensure_tls($url): void`
|
| 172 |
|
Enforces HTTPS for a specific URL and redirects if necessary.
|
| 173 |
|
|
| 174 |
|
**Parameters:**
|
| 175 |
|
- `$url` (string) - URL to secure
|
| 176 |
|
|
| 177 |
|
**Behavior:**
|
| 178 |
|
- If not already HTTPS and TLS is enabled, forces HTTPS redirect
|
| 179 |
|
- Handles both relative and absolute URLs
|
| 180 |
|
- Converts relative URLs using current server name
|
| 181 |
|
|
| 182 |
|
**Example:**
|
| 183 |
|
```php
|
| 184 |
|
$http->ensure_tls('/secure/payment');
|
| 185 |
|
```
|
| 186 |
|
|
| 187 |
|
---
|
| 188 |
|
|
| 189 |
|
### IP Address Detection
|
| 190 |
|
|
| 191 |
|
#### `real_ip(): string` (Private)
|
| 192 |
|
Detects client's real IP address accounting for proxies.
|
| 193 |
|
|
| 194 |
|
**Proxy Headers Checked (in order):**
|
| 195 |
|
1. `HTTP_X_CLUSTER_CLIENT_IP`
|
| 196 |
|
2. `HTTP_X_FORWARDED_FOR` (or custom header)
|
| 197 |
|
3. `HTTP_CLIENT_IP`
|
| 198 |
|
4. `HTTP_X_REMOTE_ADDR`
|
| 199 |
|
5. `REMOTE_ADDR` (fallback)
|
| 200 |
|
|
| 201 |
|
**Features:**
|
| 202 |
|
- Filters out private/reserved IP ranges
|
| 203 |
|
- Respects configured reverse proxy addresses
|
| 204 |
|
- Returns `'0.0.0.0'` as fallback
|
| 205 |
|
|
| 206 |
|
**Configuration in Database:**
|
| 207 |
|
- `reverse_proxy_addresses` - Comma/space-separated proxy IPs
|
| 208 |
|
- `reverse_proxy_header` - Custom header name (default: `X-Forwarded-For`)
|
| 209 |
|
|
| 210 |
|
**Example:**
|
| 211 |
|
```php
|
| 212 |
|
$client_ip = $http->ip; // e.g., "203.0.113.42"
|
| 213 |
|
```
|
| 214 |
|
|
| 215 |
|
---
|
| 216 |
|
|
| 217 |
|
### HTTPS Detection
|
| 218 |
|
|
| 219 |
|
#### `tls_session(): bool` (Private)
|
| 220 |
|
Detects if current connection uses HTTPS/TLS.
|
| 221 |
|
|
| 222 |
|
**Checks (any being true = HTTPS):**
|
| 223 |
|
- `$_SERVER['HTTPS']` is 'on'
|
| 224 |
|
- `$_SERVER['SERVER_PORT']` is 443
|
| 225 |
|
- `$_SERVER['HTTP_X_FORWARDED_PROTO']` is 'https'
|
| 226 |
|
- `$_SERVER['HTTP_X_FORWARDED_SSL']` is 'on'
|
| 227 |
|
- `$_SERVER['HTTP_X_FORWARDED_PORT']` is 443
|
| 228 |
|
|
| 229 |
|
---
|
| 230 |
|
|
| 231 |
|
### Security Headers
|
| 232 |
|
|
| 233 |
|
#### `http_security_headers(): void`
|
| 234 |
|
Sets security-related HTTP headers.
|
| 235 |
|
|
| 236 |
|
**Headers Set:**
|
| 237 |
|
|
| 238 |
|
| Header | Purpose | Config Key |
|
| 239 |
|
|--------|---------|------------|
|
| 240 |
|
| Content-Security-Policy | XSS/injection protection | `csp` |
|
| 241 |
|
| Permissions-Policy | Control browser features | `permissions_policy` |
|
| 242 |
|
| Referrer-Policy | Control referrer information | `referrer_policy` |
|
| 243 |
|
| Strict-Transport-Security | Force HTTPS | Auto (TLS only) |
|
| 244 |
|
| X-Frame-Options | Clickjacking protection | Hardcoded: `SAMEORIGIN` |
|
| 245 |
|
| X-Content-Type-Options | MIME sniffing prevention | Hardcoded: `nosniff` |
|
| 246 |
|
|
| 247 |
|
**CSP Configuration Options:**
|
| 248 |
|
- `0` - Disabled
|
| 249 |
|
- `1` - Default policy (from `csp.conf`)
|
| 250 |
|
- `2` - Custom policy (from `csp_custom.conf`)
|
| 251 |
|
|
| 252 |
|
**Example:**
|
| 253 |
|
```php
|
| 254 |
|
$http->http_security_headers();
|
| 255 |
|
```
|
| 256 |
|
|
| 257 |
|
---
|
| 258 |
|
|
| 259 |
|
### HTTP Methods
|
| 260 |
|
|
| 261 |
|
#### `redirect($url, $permanent = false): void`
|
| 262 |
|
Performs an HTTP redirect.
|
| 263 |
|
|
| 264 |
|
**Parameters:**
|
| 265 |
|
- `$url` (string) - Target URL
|
| 266 |
|
- `$permanent` (bool) - Use 301 (permanent) vs 302 (temporary)
|
| 267 |
|
|
| 268 |
|
**Features:**
|
| 269 |
|
- Decodes `&` entities to prevent broken redirects
|
| 270 |
|
- Only works if headers not yet sent
|
| 271 |
|
- Uses output buffering to work anywhere in page processing
|
| 272 |
|
|
| 273 |
|
**Example:**
|
| 274 |
|
```php
|
| 275 |
|
$http->redirect('http://example.com/new-page', true); // 301
|
| 276 |
|
$http->redirect('/wiki/HomePage'); // 302
|
| 277 |
|
```
|
| 278 |
|
|
| 279 |
|
---
|
| 280 |
|
|
| 281 |
|
#### `terminate(): void`
|
| 282 |
|
Safe exit/die with cleanup.
|
| 283 |
|
|
| 284 |
|
**Cleanup Operations:**
|
| 285 |
|
- Saves diagnostic logs to session flash data
|
| 286 |
|
- Ends script execution
|
| 287 |
|
|
| 288 |
|
**Example:**
|
| 289 |
|
```php
|
| 290 |
|
$http->terminate();
|
| 291 |
|
```
|
| 292 |
|
|
| 293 |
|
---
|
| 294 |
|
|
| 295 |
|
#### `status($code): void`
|
| 296 |
|
Sets HTTP response status code.
|
| 297 |
|
|
| 298 |
|
**Supported Status Codes:**
|
| 299 |
|
```php
|
| 300 |
|
200 => 'OK'
|
| 301 |
|
206 => 'Partial Content'
|
| 302 |
|
301 => 'Moved Permanently'
|
| 303 |
|
302 => 'Moved Temporarily'
|
| 304 |
|
304 => 'Not Modified'
|
| 305 |
|
400 => 'Bad Request'
|
| 306 |
|
401 => 'Unauthorized'
|
| 307 |
|
403 => 'Forbidden'
|
| 308 |
|
404 => 'Not Found'
|
| 309 |
|
405 => 'Method Not Allowed'
|
| 310 |
|
409 => 'Conflict'
|
| 311 |
|
410 => 'Gone'
|
| 312 |
|
416 => 'Requested Range Not Satisfiable'
|
| 313 |
|
500 => 'Internal Server Error'
|
| 314 |
|
501 => 'Not Implemented'
|
| 315 |
|
503 => 'Service Unavailable'
|
| 316 |
|
```
|
| 317 |
|
|
| 318 |
|
**Example:**
|
| 319 |
|
```php
|
| 320 |
|
$http->status(404); // Send 404 Not Found
|
| 321 |
|
```
|
| 322 |
|
|
| 323 |
|
---
|
| 324 |
|
|
| 325 |
|
### Caching Control
|
| 326 |
|
|
| 327 |
|
#### `no_cache($client_only = true): void`
|
| 328 |
|
Disables caching of the current page.
|
| 329 |
|
|
| 330 |
|
**Parameters:**
|
| 331 |
|
- `$client_only` (bool, default: TRUE)
|
| 332 |
|
- `TRUE`: Disable browser cache only
|
| 333 |
|
- `FALSE`: Disable both browser and server cache
|
| 334 |
|
|
| 335 |
|
**Headers Set:**
|
| 336 |
|
- `Last-Modified: <current-time>` (always fresh)
|
| 337 |
|
- `Cache-Control: no-store`
|
| 338 |
|
|
| 339 |
|
**Example:**
|
| 340 |
|
```php
|
| 341 |
|
$http->no_cache(); // Client-side only
|
| 342 |
|
$http->no_cache(false); // Both client & server
|
| 343 |
|
```
|
| 344 |
|
|
| 345 |
|
---
|
| 346 |
|
|
| 347 |
|
#### `cache_promisc(): void`
|
| 348 |
|
Marks page as publicly cacheable.
|
| 349 |
|
|
| 350 |
|
**Headers Set:**
|
| 351 |
|
- `Cache-Control: public`
|
| 352 |
|
|
| 353 |
|
**Example:**
|
| 354 |
|
```php
|
| 355 |
|
$http->cache_promisc();
|
| 356 |
|
```
|
| 357 |
|
|
| 358 |
|
---
|
| 359 |
|
|
| 360 |
|
### Language Negotiation
|
| 361 |
|
|
| 362 |
|
#### `user_agent_language(): string`
|
| 363 |
|
Determines best language based on browser preferences.
|
| 364 |
|
|
| 365 |
|
**Features:**
|
| 366 |
|
- Follows RFC 9110 section 12.5.4 (HTTP Accept-Language)
|
| 367 |
|
- Parses `Accept-Language` header with quality factors
|
| 368 |
|
- Attempts exact match first, then language fallback
|
| 369 |
|
- Falls back to default system language
|
| 370 |
|
|
| 371 |
|
**Example Header:**
|
| 372 |
|
```
|
| 373 |
|
Accept-Language: en-US,en;q=0.9,de;q=0.8
|
| 374 |
|
```
|
| 375 |
|
|
| 376 |
|
**Returns:**
|
| 377 |
|
- Language code (e.g., 'en', 'en-US', 'de')
|
| 378 |
|
|
| 379 |
|
---
|
| 380 |
|
|
| 381 |
|
#### `available_languages($subset = true): array`
|
| 382 |
|
Returns list of available language translations.
|
| 383 |
|
|
| 384 |
|
**Parameters:**
|
| 385 |
|
- `$subset` (bool, default: TRUE)
|
| 386 |
|
- `TRUE`: Only allowed languages
|
| 387 |
|
- `FALSE`: All available languages
|
| 388 |
|
|
| 389 |
|
**Features:**
|
| 390 |
|
- Scans `LANG_DIR` for language files
|
| 391 |
|
- Filters by `allowed_languages` config if set
|
| 392 |
|
- Caches result in session
|
| 393 |
|
- System language always included
|
| 394 |
|
|
| 395 |
|
**Returns:**
|
| 396 |
|
- Associative array: `['en' => 'en', 'de' => 'de', ...]`
|
| 397 |
|
|
| 398 |
|
**Example:**
|
| 399 |
|
```php
|
| 400 |
|
$all_langs = $http->available_languages(false);
|
| 401 |
|
$allowed = $http->available_languages(true);
|
| 402 |
|
```
|
| 403 |
|
|
| 404 |
|
---
|
| 405 |
|
|
| 406 |
|
### File Serving
|
| 407 |
|
|
| 408 |
|
#### `sendfile($path, $filename = null, $age = null): void`
|
| 409 |
|
Serves files with proper HTTP headers and caching.
|
| 410 |
|
|
| 411 |
|
**Parameters:**
|
| 412 |
|
- `$path` (string) - File path (or HTTP_XXX constant for error pages)
|
| 413 |
|
- `$filename` (string, optional) - Custom download filename
|
| 414 |
|
- `$age` (int, optional) - Cache age in days
|
| 415 |
|
|
| 416 |
|
**Features:**
|
| 417 |
|
- HTTP range request support (partial file downloads)
|
| 418 |
|
- ETag and Last-Modified conditional requests
|
| 419 |
|
- Proper MIME type detection
|
| 420 |
|
- Content-Security-Policy for special file types
|
| 421 |
|
- Streaming for large files
|
| 422 |
|
- GZip compression for text files
|
| 423 |
|
|
| 424 |
|
**Special Paths:**
|
| 425 |
|
```php
|
| 426 |
|
$http->sendfile(404); // Serves file defined by HTTP_404 constant
|
| 427 |
|
$http->sendfile(403); // Serves file defined by HTTP_403 constant
|
| 428 |
|
```
|
| 429 |
|
|
| 430 |
|
**Example:**
|
| 431 |
|
```php
|
| 432 |
|
$http->sendfile('uploads/document.pdf', 'my-document.pdf', 30);
|
| 433 |
|
```
|
| 434 |
|
|
| 435 |
|
---
|
| 436 |
|
|
| 437 |
|
#### `mime_type($path): string`
|
| 438 |
|
Returns MIME type for a file.
|
| 439 |
|
|
| 440 |
|
**Returns:**
|
| 441 |
|
- MIME type string (e.g., 'application/pdf')
|
| 442 |
|
- Default: `'application/octet-stream'`
|
| 443 |
|
|
| 444 |
|
**Example:**
|
| 445 |
|
```php
|
| 446 |
|
$mime = $http->mime_type('file.pdf'); // 'application/pdf'
|
| 447 |
|
```
|
| 448 |
|
|
| 449 |
|
---
|
| 450 |
|
|
| 451 |
|
#### `mime_types(): array` (Private)
|
| 452 |
|
Loads and caches MIME types from configuration.
|
| 453 |
|
|
| 454 |
|
**Features:**
|
| 455 |
|
- Reads from `config/mime.types`
|
| 456 |
|
- Caches to `cache/config/mime.types`
|
| 457 |
|
- Reloads if config is updated
|
| 458 |
|
|
| 459 |
|
---
|
| 460 |
|
|
| 461 |
|
### Compression
|
| 462 |
|
|
| 463 |
|
#### `gzip(): void`
|
| 464 |
|
Compresses HTTP response with gzip/x-gzip.
|
| 465 |
|
|
| 466 |
|
**Features:**
|
| 467 |
|
- Manually implements gzip (not relying on zlib.output_compression)
|
| 468 |
|
- Produces correct `Content-Length` header
|
| 469 |
|
- Only compresses if:
|
| 470 |
|
- 860 bytes < content < 1 MB
|
| 471 |
|
- Client accepts compression
|
| 472 |
|
- Headers not already sent
|
| 473 |
|
|
| 474 |
|
**Example:**
|
| 475 |
|
```php
|
| 476 |
|
$http->gzip();
|
| 477 |
|
```
|
| 478 |
|
|
| 479 |
|
---
|
| 480 |
|
|
| 481 |
|
### Utility Methods
|
| 482 |
|
|
| 483 |
|
#### `parse_str($str): array` (Private)
|
| 484 |
|
Parses URL-encoded strings with special character handling.
|
| 485 |
|
|
| 486 |
|
**Purpose:**
|
| 487 |
|
- Safely handles special characters in query/form data
|
| 488 |
|
- Converts encoding properly
|
| 489 |
|
|
| 490 |
|
**Example:**
|
| 491 |
|
```php
|
| 492 |
|
$data = $http->parse_str('name=John&age=30');
|
| 493 |
|
```
|
| 494 |
|
|
| 495 |
|
---
|
| 496 |
|
|
| 497 |
|
#### `request_uri(): string` (Private)
|
| 498 |
|
Extracts and normalizes REQUEST_URI from server.
|
| 499 |
|
|
| 500 |
|
**Normalization:**
|
| 501 |
|
- Removes base URL prefix
|
| 502 |
|
- Removes spaces
|
| 503 |
|
- Collapses multiple slashes
|
| 504 |
|
- Removes `..` path traversal attempts
|
| 505 |
|
- Removes leading/trailing slashes
|
| 506 |
|
|
| 507 |
|
---
|
| 508 |
|
|
| 509 |
|
#### `cut_prefix($prefix, $path): string` (Private)
|
| 510 |
|
Removes prefix from path (case-insensitive).
|
| 511 |
|
|
| 512 |
|
---
|
| 513 |
|
|
| 514 |
|
#### `get_header_conf($file_name): string` (Private)
|
| 515 |
|
Loads security header configuration from files.
|
| 516 |
|
|
| 517 |
|
**Files Supported:**
|
| 518 |
|
- `csp.conf` / `csp_custom.conf`
|
| 519 |
|
- `permissions_policy.conf` / `permissions_policy_custom.conf`
|
| 520 |
|
|
| 521 |
|
---
|
| 522 |
|
|
| 523 |
|
## Configuration Dependencies
|
| 524 |
|
|
| 525 |
|
The class relies on these database configuration settings:
|
| 526 |
|
|
| 527 |
|
| Setting | Type | Purpose |
|
| 528 |
|
|---------|------|---------|
|
| 529 |
|
| `base_url` | string | Wiki's base URL |
|
| 530 |
|
| `tls` | bool | Enable HTTPS enforcement |
|
| 531 |
|
| `cache` | bool | Enable page caching |
|
| 532 |
|
| `cache_ttl` | int | Cache lifetime in seconds |
|
| 533 |
|
| `session_store` | int | 1=File, 0=Database |
|
| 534 |
|
| `system_seed_hash` | string | Session encryption seed |
|
| 535 |
|
| `cookie_prefix` | string | Session cookie prefix |
|
| 536 |
|
| `cookie_path` | string | Cookie path |
|
| 537 |
|
| `allow_persistent_cookie` | bool | Allow persistent login |
|
| 538 |
|
| `session_length` | int | Session lifetime in seconds |
|
| 539 |
|
| `reverse_proxy_addresses` | string | Comma/space-separated proxy IPs |
|
| 540 |
|
| `reverse_proxy_header` | string | Custom X-Forwarded header |
|
| 541 |
|
| `language` | string | Default language code |
|
| 542 |
|
| `multilanguage` | bool | Enable language negotiation |
|
| 543 |
|
| `allowed_languages` | string | Comma/space-separated allowed langs |
|
| 544 |
|
| `enable_security_headers` | bool | Send security headers |
|
| 545 |
|
| `csp` | int | CSP setting (0/1/2) |
|
| 546 |
|
| `permissions_policy` | int | Permissions-Policy setting (0/1/2) |
|
| 547 |
|
| `referrer_policy` | int | Referrer-Policy setting (0-8) |
|
| 548 |
|
|
| 549 |
|
---
|
| 550 |
|
|
| 551 |
|
## Constants Used
|
| 552 |
|
|
| 553 |
|
| Constant | Type | Purpose |
|
| 554 |
|
|----------|------|---------|
|
| 555 |
|
| `IN_WACKO` | bool | Security check (exit if not defined) |
|
| 556 |
|
| `CHMOD_SAFE` | int | File permissions for cache files |
|
| 557 |
|
| `CHMOD_FILE` | int | File permissions for config cache |
|
| 558 |
|
| `CACHE_PAGE_DIR` | string | Page cache directory |
|
| 559 |
|
| `CACHE_SESSION_DIR` | string | Session cache directory |
|
| 560 |
|
| `CACHE_CONFIG_DIR` | string | Config cache directory |
|
| 561 |
|
| `CONFIG_DIR` | string | Configuration directory |
|
| 562 |
|
| `LANG_DIR` | string | Language files directory |
|
| 563 |
|
| `DAYSECS` | int | Seconds in a day (86400) |
|
| 564 |
|
| `HTTP_404` | string | Path to 404 error page |
|
| 565 |
|
| `HTTP_403` | string | Path to 403 error page |
|
| 566 |
|
|
| 567 |
|
---
|
| 568 |
|
|
| 569 |
|
## Workflow Examples
|
| 570 |
|
|
| 571 |
|
### Example 1: Handling a GET Request
|
| 572 |
|
|
| 573 |
|
```php
|
| 574 |
|
// In main wiki entry point
|
| 575 |
|
$http = new Http($db);
|
| 576 |
|
$http->session(0); // Start session
|
| 577 |
|
|
| 578 |
|
// Check if page can be served from cache
|
| 579 |
|
$http->check_cache('HomePage', 'show');
|
| 580 |
|
|
| 581 |
|
// ... render page content ...
|
| 582 |
|
|
| 583 |
|
// Store rendered page in cache if applicable
|
| 584 |
|
$http->store_cache();
|
| 585 |
|
|
| 586 |
|
// Send security headers
|
| 587 |
|
$http->http_security_headers();
|
| 588 |
|
|
| 589 |
|
// Possibly compress output
|
| 590 |
|
$http->gzip();
|
| 591 |
|
```
|
| 592 |
|
|
| 593 |
|
### Example 2: Handling TLS/HTTPS Upgrade
|
| 594 |
|
|
| 595 |
|
```php
|
| 596 |
|
$http = new Http($db); // Constructor detects TLS requirement
|
| 597 |
|
// If TLS is enabled and user wasn't in TLS before:
|
| 598 |
|
// - Sets TLS session flag
|
| 599 |
|
// - Marks session with TLS cookie
|
| 600 |
|
// - Redirects to HTTPS version
|
| 601 |
|
```
|
| 602 |
|
|
| 603 |
|
### Example 3: Invalidating Cache After Page Edit
|
| 604 |
|
|
| 605 |
|
```php
|
| 606 |
|
// User edits a page
|
| 607 |
|
$http = new Http($db);
|
| 608 |
|
$count = $http->invalidate_page('HomePage');
|
| 609 |
|
// All cached versions (different languages, methods) are invalidated
|
| 610 |
|
```
|
| 611 |
|
|
| 612 |
|
### Example 4: Serving a File
|
| 613 |
|
|
| 614 |
|
```php
|
| 615 |
|
$http = new Http($db);
|
| 616 |
|
$http->session(2); // Static file mode - no session replay prevention
|
| 617 |
|
|
| 618 |
|
// Serve with 30-day cache
|
| 619 |
|
$http->sendfile('uploads/manual.pdf', 'user-manual.pdf', 30);
|
| 620 |
|
```
|
| 621 |
|
|
| 622 |
|
---
|
| 623 |
|
|
| 624 |
|
## Security Considerations
|
| 625 |
|
|
| 626 |
|
### 1. **IP Address Spoofing**
|
| 627 |
|
- Validates IPs against private ranges
|
| 628 |
|
- Filters proxy-provided IPs appropriately
|
| 629 |
|
- Configurable reverse proxy trust
|
| 630 |
|
|
| 631 |
|
### 2. **Session Security**
|
| 632 |
|
- Binds sessions to IP address
|
| 633 |
|
- Binds sessions to TLS status
|
| 634 |
|
- Supports both file and database storage
|
| 635 |
|
- HttpOnly cookies by default
|
| 636 |
|
|
| 637 |
|
### 3. **TLS Enforcement**
|
| 638 |
|
- Automatic HTTPS upgrade when configured
|
| 639 |
|
- Marks TLS sessions to prevent downgrade attacks
|
| 640 |
|
- HSTS header support
|
| 641 |
|
|
| 642 |
|
### 4. **Content Security**
|
| 643 |
|
- CSP headers to prevent XSS
|
| 644 |
|
- X-Frame-Options to prevent clickjacking
|
| 645 |
|
- X-Content-Type-Options to prevent MIME sniffing
|
| 646 |
|
- Referrer-Policy control
|
| 647 |
|
- Permissions-Policy for browser features
|
| 648 |
|
|
| 649 |
|
### 5. **File Serving**
|
| 650 |
|
- Validates file existence and readability
|
| 651 |
|
- Prevents directory traversal via `realpath()`
|
| 652 |
|
- Rejects symbolic links
|
| 653 |
|
- Special CSP for SVG and PDF files
|
| 654 |
|
|
| 655 |
|
### 6. **Cache Security**
|
| 656 |
|
- Cached only for anonymous users
|
| 657 |
|
- Disabled for sensitive operations (edit, watch)
|
| 658 |
|
- Only GET requests cached
|
| 659 |
|
|
| 660 |
|
---
|
| 661 |
|
|
| 662 |
|
## Performance Optimization
|
| 663 |
|
|
| 664 |
|
### 1. **Page Caching**
|
| 665 |
|
- Stores full HTML output
|
| 666 |
|
- TTL-based expiration
|
| 667 |
|
- Language and method-aware caching
|
| 668 |
|
- Conditional request support (304 Not Modified)
|
| 669 |
|
|
| 670 |
|
### 2. **MIME Type Caching**
|
| 671 |
|
- Loads MIME types once and caches
|
| 672 |
|
- Regenerates only when config changes
|
| 673 |
|
|
| 674 |
|
### 3. **Session Options**
|
| 675 |
|
- File-based sessions for simple deployments
|
| 676 |
|
- Database sessions for distributed systems
|
| 677 |
|
|
| 678 |
|
### 4. **Compression**
|
| 679 |
|
- Manual gzip implementation
|
| 680 |
|
- Proper Content-Length generation
|
| 681 |
|
- Only compresses appropriate sizes
|
| 682 |
|
|
| 683 |
|
---
|
| 684 |
|
|
| 685 |
|
## Debugging
|
| |
80 |
=== Debugging ===
|