PHP safeHeader函数代码示例

/**
 * Write the jsConnect string for single sign on.
 *
 * @param array $User An array containing information about the currently signed on user. If no user is signed in then this should be an empty array.
 * @param array $Request An array of the $_GET request.
 * @param string $ClientID The string client ID that you set up in the jsConnect settings page.
 * @param string $Secret The string secred that you set up in the jsConnect settings page.
 * @param string|bool $Secure Whether or not to check for security. This is one of these values.
 *  - true: Check for security and sign the response with an md5 hash.
 *  - false: Don't check for security, but sign the response with an md5 hash.
 *  - string: Check for security and sign the response with the given hash algorithm. See hash_algos() for what your server can support.
 *  - null: Don't check for security and don't sign the response.
 * @since 1.1b Added the ability to provide a hash algorithm to $Secure.
 */
function writeJsConnect($User, $Request, $ClientID, $Secret, $Secure = true)
{
    $User = array_change_key_case($User);
    // Error checking.
    if ($Secure) {
        // Check the client.
        if (!isset($Request['client_id'])) {
            $Error = ['error' => 'invalid_request', 'message' => 'The client_id parameter is missing.'];
        } elseif ($Request['client_id'] != $ClientID) {
            $Error = ['error' => 'invalid_client', 'message' => "Unknown client {$Request['client_id']}."];
        } elseif (!isset($Request['timestamp']) && !isset($Request['signature'])) {
            if (is_array($User) && count($User) > 0) {
                // This isn't really an error, but we are just going to return public information when no signature is sent.
                $Error = ['name' => $User['name'], 'photourl' => @$User['photourl']];
            } else {
                $Error = ['name' => '', 'photourl' => ''];
            }
        } elseif (!isset($Request['timestamp']) || !is_numeric($Request['timestamp'])) {
            $Error = ['error' => 'invalid_request', 'message' => 'The timestamp parameter is missing or invalid.'];
        } elseif (!isset($Request['signature'])) {
            $Error = ['error' => 'invalid_request', 'message' => 'Missing  signature parameter.'];
        } elseif (($Diff = abs($Request['timestamp'] - jsTimestamp())) > JS_TIMEOUT) {
            $Error = ['error' => 'invalid_request', 'message' => 'The timestamp is invalid.'];
        } else {
            // Make sure the timestamp hasn't timed out.
            $Signature = jsHash($Request['timestamp'] . $Secret, $Secure);
            if ($Signature != $Request['signature']) {
                $Error = ['error' => 'access_denied', 'message' => 'Signature invalid.'];
            }
        }
    }
    if (isset($Error)) {
        $Result = $Error;
    } elseif (is_array($User) && count($User) > 0) {
        if ($Secure === null) {
            $Result = $User;
        } else {
            $Result = signJsConnect($User, $ClientID, $Secret, $Secure, true);
        }
    } else {
        $Result = ['name' => '', 'photourl' => ''];
    }
    $Json = json_encode($Result);
    if (isset($Request['callback'])) {
        safeHeader('Content-Type: application/javascript');
        echo "{$Request['callback']}({$Json})";
    } else {
        safeHeader('Content-Type: application/json');
        echo $Json;
    }
}

//.........这里部分代码省略.........
             $Reaction = $Authenticator->repeatResponse();
             break;
             // Not enough information to perform authentication, render input form
         // Not enough information to perform authentication, render input form
         case Gdn_Authenticator::MODE_GATHER:
             $this->addJsFile('entry.js');
             $Reaction = $Authenticator->loginResponse();
             if ($this->Form->isPostBack()) {
                 $this->Form->addError('ErrorCredentials');
                 Logger::event('signin_failure', Logger::WARNING, '{username} failed to sign in. Some or all credentials were missing.');
             }
             break;
             // All information is present, authenticate
         // All information is present, authenticate
         case Gdn_Authenticator::MODE_VALIDATE:
             // Attempt to authenticate.
             try {
                 if (!$this->Request->isAuthenticatedPostBack() && !c('Garden.Embed.Allow')) {
                     $this->Form->addError('Please try again.');
                     $Reaction = $Authenticator->failedResponse();
                 } else {
                     $AuthenticationResponse = $Authenticator->authenticate();
                     $UserInfo = array();
                     $UserEventData = array_merge(array('UserID' => Gdn::session()->UserID, 'Payload' => val('HandshakeResponse', $Authenticator, false)), $UserInfo);
                     Gdn::authenticator()->trigger($AuthenticationResponse, $UserEventData);
                     switch ($AuthenticationResponse) {
                         case Gdn_Authenticator::AUTH_PERMISSION:
                             $this->Form->addError('ErrorPermission');
                             Logger::event('signin_failure', Logger::WARNING, '{username} failed to sign in. Permission denied.');
                             $Reaction = $Authenticator->failedResponse();
                             break;
                         case Gdn_Authenticator::AUTH_DENIED:
                             $this->Form->addError('ErrorCredentials');
                             Logger::event('signin_failure', Logger::WARNING, '{username} failed to sign in. Authentication denied.');
                             $Reaction = $Authenticator->failedResponse();
                             break;
                         case Gdn_Authenticator::AUTH_INSUFFICIENT:
                             // Unable to comply with auth request, more information is needed from user.
                             Logger::event('signin_failure', Logger::WARNING, '{username} failed to sign in. More information needed from user.');
                             $this->Form->addError('ErrorInsufficient');
                             $Reaction = $Authenticator->failedResponse();
                             break;
                         case Gdn_Authenticator::AUTH_PARTIAL:
                             // Partial auth completed.
                             $Reaction = $Authenticator->partialResponse();
                             break;
                         case Gdn_Authenticator::AUTH_SUCCESS:
                         default:
                             // Full auth completed.
                             if ($AuthenticationResponse == Gdn_Authenticator::AUTH_SUCCESS) {
                                 $UserID = Gdn::session()->UserID;
                             } else {
                                 $UserID = $AuthenticationResponse;
                             }
                             safeHeader("X-Vanilla-Authenticated: yes");
                             safeHeader("X-Vanilla-TransientKey: " . Gdn::session()->transientKey());
                             $Reaction = $Authenticator->successResponse();
                     }
                 }
             } catch (Exception $Ex) {
                 $this->Form->addError($Ex);
             }
             break;
         case Gdn_Authenticator::MODE_NOAUTH:
             $Reaction = Gdn_Authenticator::REACT_REDIRECT;
             break;
     }
     switch ($Reaction) {
         case Gdn_Authenticator::REACT_RENDER:
             // Do nothing (render the view)
             break;
         case Gdn_Authenticator::REACT_EXIT:
             exit;
             break;
         case Gdn_Authenticator::REACT_REMOTE:
             // Let the authenticator handle generating output, using a blank slate
             $this->_DeliveryType = DELIVERY_TYPE_VIEW;
             exit;
             break;
         case Gdn_Authenticator::REACT_REDIRECT:
         default:
             if (is_string($Reaction)) {
                 $Route = $Reaction;
             } else {
                 $Route = $this->redirectTo();
             }
             if ($this->_RealDeliveryType != DELIVERY_TYPE_ALL && $this->_DeliveryType != DELIVERY_TYPE_ALL) {
                 $this->RedirectUrl = url($Route);
             } else {
                 if ($Route !== false) {
                     redirect($Route);
                 } else {
                     redirect(Gdn::router()->getDestination('DefaultController'));
                 }
             }
             break;
     }
     $this->setData('SendWhere', "/entry/auth/{$AuthenticationSchemeAlias}");
     $this->render();
 }

 /**
  * Display 'no permission' page.
  *
  * @since 2.0.0
  * @access public
  */
 public function unauthorized()
 {
     Gdn_Theme::section('Error');
     if ($this->deliveryMethod() == DELIVERY_METHOD_XHTML) {
         safeHeader("HTTP/1.0 401", true, 401);
         $this->render();
     } else {
         $this->RenderException(permissionException());
     }
 }

 * here, but some things have already been loaded and are immutable.
 */
if (file_exists(PATH_CONF . '/bootstrap.early.php')) {
    require_once PATH_CONF . '/bootstrap.early.php';
}
Gdn::config()->caching(true);
debug(c('Debug', false));
setHandlers();
/**
 * Installer Redirect
 *
 * If Garden is not yet installed, force the request to /dashboard/setup and
 * begin installation.
 */
if (Gdn::config('Garden.Installed', false) === false && strpos(Gdn_Url::request(), 'setup') === false) {
    safeHeader('Location: ' . Gdn::request()->url('dashboard/setup', true));
    exit;
}
/**
 * Extension Managers
 *
 * Now load the Addon, Application, Theme and Plugin managers into the Factory, and
 * process the application-specific configuration defaults.
 */
// ApplicationManager
Gdn::factoryInstall(Gdn::AliasApplicationManager, 'Gdn_ApplicationManager', '', Gdn::FactorySingleton, [Gdn::addonManager()]);
// ThemeManager
Gdn::factoryInstall(Gdn::AliasThemeManager, 'Gdn_ThemeManager', '', Gdn::FactorySingleton, [Gdn::addonManager()]);
// PluginManager
Gdn::factoryInstall(Gdn::AliasPluginManager, 'Gdn_PluginManager', '', Gdn::FactorySingleton, [Gdn::addonManager()]);
// Start the addons, plugins, and applications.

 public function ServeCss($ThemeType, $Filename)
 {
     // Split the filename into filename and etag.
     if (preg_match('`([\\w_-]+?)-(\\w+).css$`', $Filename, $Matches)) {
         $Basename = $Matches[1];
         $ETag = $Matches[2];
     } else {
         throw NotFoundException();
     }
     $Basename = ucfirst($Basename);
     $this->EventArguments['Basename'] = $Basename;
     $this->EventArguments['ETag'] = $ETag;
     $this->FireEvent('BeforeServeCss');
     if (function_exists('header_remove')) {
         header_remove('Set-Cookie');
     }
     safeHeader("Content-Type: text/css");
     if (!in_array($Basename, array('Style', 'Admin'))) {
         safeHeader("HTTP/1.0 404", TRUE, 404);
         echo "/* Could not find {$Basename}/{$ETag} */";
         die;
     }
     $RequestETags = GetValue('HTTP_IF_NONE_MATCH', $_SERVER);
     if (get_magic_quotes_gpc()) {
         $RequestETags = stripslashes($RequestETags);
     }
     $RequestETags = explode(',', $RequestETags);
     foreach ($RequestETags as $RequestETag) {
         if ($RequestETag == $ETag) {
             safeHeader("HTTP/1.0 304", TRUE, 304);
             die;
         }
     }
     safeHeader("Cache-Control:public, max-age=14400");
     $CurrentETag = self::ETag();
     safeHeader("ETag: {$CurrentETag}");
     $CachePath = PATH_CACHE . '/css/' . CLIENT_NAME . '-' . $ThemeType . '-' . strtolower($Basename) . "-{$CurrentETag}.css";
     if (!Debug() && file_exists($CachePath)) {
         readfile($CachePath);
         die;
     }
     // Include minify...
     set_include_path(PATH_LIBRARY . "/vendors/Minify/lib" . PATH_SEPARATOR . get_include_path());
     require_once PATH_LIBRARY . "/vendors/Minify/lib/Minify/CSS.php";
     ob_start();
     echo "/* CSS generated for etag: {$CurrentETag}.\n *\n";
     $Paths = $this->GetCssFiles($ThemeType, $Basename, $ETag, $NotFound);
     // First, do a pass through the files to generate some information.
     foreach ($Paths as $Info) {
         list($Path, $UrlPath) = $Info;
         echo " * {$UrlPath}\n";
     }
     // Echo the paths that weren't found to help debugging.
     foreach ($NotFound as $Info) {
         list($Filename, $Folder) = $Info;
         echo " * {$Folder}/{$Filename} NOT FOUND.\n";
     }
     echo " */\n\n";
     // Now that we have all of the paths we want to serve them.
     foreach ($Paths as $Info) {
         list($Path, $UrlPath, $Options) = $Info;
         echo "/* File: {$UrlPath} */\n";
         $Css = GetValue('Css', $Options);
         if (!$Css) {
             $Css = file_get_contents($Path);
         }
         $Css = Minify_CSS::minify($Css, array('preserveComments' => TRUE, 'prependRelativePath' => $this->UrlPrefix . Asset(dirname($UrlPath) . '/'), 'currentDir' => dirname($Path), 'minify' => TRUE));
         echo $Css;
         echo "\n\n";
     }
     // Create a cached copy of the file.
     $Css = ob_get_flush();
     if (!file_exists(dirname($CachePath))) {
         mkdir(dirname($CachePath), 0775, TRUE);
     }
     file_put_contents($CachePath, $Css);
 }

 /**
  * Serve all CSS files.
  *
  * @param $themeType
  * @param $filename
  * @throws Exception
  */
 public function serveCss($themeType, $filename)
 {
     // Split the filename into filename and etag.
     if (preg_match('`([\\w-]+?)-(\\w+).css$`', $filename, $matches)) {
         $basename = $matches[1];
         $eTag = $matches[2];
     } else {
         throw notFoundException();
     }
     $basename = strtolower($basename);
     $this->EventArguments['Basename'] = $basename;
     $this->EventArguments['ETag'] = $eTag;
     $this->fireEvent('BeforeServeCss');
     if (function_exists('header_remove')) {
         header_remove('Set-Cookie');
     }
     // Get list of anchor files
     $anchors = $this->getAnchors();
     safeHeader("Content-Type: text/css");
     $anchorFileName = "{$basename}.css";
     if (!in_array($anchorFileName, $anchors)) {
         safeHeader("HTTP/1.0 404", true, 404);
         echo "/* Could not find {$basename}/{$eTag} */";
         die;
     }
     $requestETags = val('HTTP_IF_NONE_MATCH', $_SERVER);
     $requestETags = explode(',', $requestETags);
     foreach ($requestETags as $requestETag) {
         if ($requestETag == $eTag) {
             safeHeader("HTTP/1.0 304", true, 304);
             die;
         }
     }
     safeHeader("Cache-Control:public, max-age=14400");
     $currentETag = self::eTag();
     safeHeader("ETag: {$currentETag}");
     $cachePath = PATH_CACHE . '/css/' . CLIENT_NAME . '-' . $themeType . '-' . "{$basename}-{$currentETag}.css";
     if (!Debug() && file_exists($cachePath)) {
         readfile($cachePath);
         die;
     }
     // Include minify...
     set_include_path(PATH_LIBRARY . "/vendors/Minify/lib" . PATH_SEPARATOR . get_include_path());
     require_once PATH_LIBRARY . "/vendors/Minify/lib/Minify/CSS.php";
     ob_start();
     echo "/* CSS generated for etag: {$currentETag}.\n *\n";
     $notFound = [];
     $paths = $this->getCssFiles($themeType, $basename, $eTag, $notFound);
     // First, do a pass through the files to generate some information.
     foreach ($paths as $info) {
         list($path, $urlPath) = $info;
         echo " * {$urlPath}\n";
     }
     // Echo the paths that weren't found to help debugging.
     foreach ($notFound as $info) {
         list($filename, $folder) = $info;
         echo " * {$folder}/{$filename} NOT FOUND.\n";
     }
     echo " */\n\n";
     // Now that we have all of the paths we want to serve them.
     foreach ($paths as $info) {
         list($path, $urlPath, $options) = $info;
         echo "/* File: {$urlPath} */\n";
         $css = val('Css', $options);
         if (!$css) {
             $css = file_get_contents($path);
         }
         $css = Minify_CSS::minify($css, ['preserveComments' => true, 'prependRelativePath' => $this->UrlPrefix . asset(dirname($urlPath) . '/'), 'currentDir' => dirname($path), 'minify' => true]);
         echo $css;
         echo "\n\n";
     }
     // Create a cached copy of the file.
     $css = ob_get_flush();
     if (!file_exists(dirname($cachePath))) {
         mkdir(dirname($cachePath), 0775, true);
     }
     file_put_contents($cachePath, $css);
 }

 /**
  * Serves a file to the browser.
  *
  * @param string $File Full path to the file being served.
  * @param string $Name Name to give the file being served. Including extension overrides $File extension. Uses $File filename if empty.
  * @param string $MimeType The mime type of the file.
  * @param string $ServeMode Whether to download the file as an attachment, or inline
  */
 public static function serveFile($File, $Name = '', $MimeType = '', $ServeMode = 'attachment')
 {
     $FileIsLocal = substr($File, 0, 4) == 'http' ? false : true;
     $FileAvailable = $FileIsLocal ? is_readable($File) : true;
     if ($FileAvailable) {
         // Close the database connection
         Gdn::database()->closeConnection();
         // Determine if Path extension should be appended to Name
         $NameExtension = strtolower(pathinfo($Name, PATHINFO_EXTENSION));
         $FileExtension = strtolower(pathinfo($File, PATHINFO_EXTENSION));
         if ($NameExtension == '') {
             if ($Name == '') {
                 $Name = pathinfo($File, PATHINFO_FILENAME) . '.' . $FileExtension;
             } elseif (!stringEndsWith($Name, '.' . $FileExtension)) {
                 $Name .= '.' . $FileExtension;
             }
         } else {
             $Extension = $NameExtension;
         }
         $Name = rawurldecode($Name);
         // Figure out the MIME type
         $MimeTypes = array("pdf" => "application/pdf", "txt" => "text/plain", "html" => "text/html", "htm" => "text/html", "exe" => "application/octet-stream", "zip" => "application/zip", "doc" => "application/msword", "xls" => "application/vnd.ms-excel", "ppt" => "application/vnd.ms-powerpoint", "gif" => "image/gif", "png" => "image/png", "jpeg" => "image/jpg", "jpg" => "image/jpg", "php" => "text/plain", "ico" => "image/vnd.microsoft.icon");
         if ($MimeType == '') {
             if (array_key_exists($FileExtension, $MimeTypes)) {
                 $MimeType = $MimeTypes[$FileExtension];
             } else {
                 $MimeType = 'application/force-download';
             }
         }
         @ob_end_clean();
         // required for IE, otherwise Content-Disposition may be ignored
         if (ini_get('zlib.output_compression')) {
             ini_set('zlib.output_compression', 'Off');
         }
         if ($ServeMode == 'inline') {
             safeHeader('Content-Disposition: inline; filename="' . $Name . '"');
         } else {
             safeHeader('Content-Disposition: attachment; filename="' . $Name . '"');
         }
         safeHeader('Content-Type: ' . $MimeType);
         safeHeader("Content-Transfer-Encoding: binary");
         safeHeader('Accept-Ranges: bytes');
         safeHeader("Cache-control: private");
         safeHeader('Pragma: private');
         safeHeader("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
         readfile($File);
         exit;
     } else {
         die('not readable');
     }
 }

 /**
  * Set P3P header because IE won't allow cookies thru the iFrame without it.
  *
  * This must be done in the Dispatcher because of PrivateCommunity.
  * That precludes using Controller->SetHeader.
  * This is done so comment & forum embedding can work in old IE.
  */
 public function Gdn_Dispatcher_AppStartup_Handler($Sender)
 {
     safeHeader('P3P: CP="CAO PSA OUR"', TRUE);
     if ($SSO = Gdn::Request()->Get('sso')) {
         SaveToConfig('Garden.Registration.SendConnectEmail', FALSE, FALSE);
         $IsApi = preg_match('`\\.json$`i', Gdn::Request()->Path());
         $UserID = FALSE;
         try {
             $CurrentUserID = Gdn::Session()->UserID;
             $UserID = Gdn::UserModel()->SSO($SSO);
         } catch (Exception $Ex) {
             Trace($Ex, TRACE_ERROR);
         }
         if ($UserID) {
             Gdn::Session()->Start($UserID, !$IsApi, !$IsApi);
             if ($UserID != $CurrentUserID) {
                 Gdn::UserModel()->FireEvent('AfterSignIn');
             }
         } else {
             // There was some sort of error. Let's print that out.
             Trace(Gdn::UserModel()->Validation->ResultsText(), TRACE_WARNING);
         }
     }
 }

// ThemeManager
Gdn::FactoryInstall(Gdn::AliasThemeManager, 'Gdn_ThemeManager');
// PluginManager
Gdn::FactoryInstall(Gdn::AliasPluginManager, 'Gdn_PluginManager');
// Load the configurations for enabled Applications
foreach (Gdn::ApplicationManager()->EnabledApplicationFolders() as $ApplicationName => $ApplicationFolder) {
    Gdn::Config()->Load(PATH_APPLICATIONS . "/{$ApplicationFolder}/settings/configuration.php");
}
/**
 * Installer Redirect
 *
 * If Garden is not yet installed, force the request to /dashboard/setup and
 * begin installation.
 */
if (Gdn::Config('Garden.Installed', FALSE) === FALSE && strpos(Gdn_Url::Request(), 'setup') === FALSE) {
    safeHeader('Location: ' . Gdn::Request()->Url('dashboard/setup', TRUE));
    exit;
}
// Re-apply loaded user settings
Gdn::Config()->OverlayDynamic();
/**
 * Bootstrap Late
 *
 * All configurations are loaded, as well as the Application, Plugin and Theme
 * managers.
 */
if (file_exists(PATH_CONF . '/bootstrap.late.php')) {
    require_once PATH_CONF . '/bootstrap.late.php';
}
if (C('Debug')) {
    Debug(TRUE);

 function Redirect($Destination = FALSE, $StatusCode = NULL)
 {
     if (!$Destination) {
         $Destination = Url('');
     }
     //      if (Debug() && $Trace = Trace()) {
     //         Trace("Redirecting to $Destination");
     //         return;
     //      }
     // Close any db connections before exit
     $Database = Gdn::Database();
     $Database->CloseConnection();
     // Clear out any previously sent content
     @ob_end_clean();
     // assign status code
     $SendCode = is_null($StatusCode) ? 302 : $StatusCode;
     // re-assign the location header
     safeHeader("Location: " . Url($Destination), TRUE, $SendCode);
     // Exit
     exit;
 }

 /**
  * Display 'no permission' page.
  *
  * @since 2.0.0
  * @access public
  */
 public function Permission()
 {
     Gdn_Theme::Section('Error');
     if ($this->DeliveryMethod() == DELIVERY_METHOD_XHTML) {
         safeHeader("HTTP/1.0 401", TRUE, 401);
         $this->Render();
     } else {
         $this->RenderException(PermissionException());
     }
 }

 /**
  * Parses the query string looking for supplied request parameters. Places
  * anything useful into this object's Controller properties.
  *
  * @param int $FolderDepth
  */
 protected function analyzeRequest(&$Request)
 {
     // Here is the basic format of a request:
     // [/application]/controller[/method[.json|.xml]]/argn|argn=valn
     // Here are some examples of what this method could/would receive:
     // /application/controller/method/argn
     // /controller/method/argn
     // /application/controller/argn
     // /controller/argn
     // /controller
     // Clear the slate
     $this->_ApplicationFolder = '';
     $this->ControllerName = '';
     $this->ControllerMethod = 'index';
     $this->_ControllerMethodArgs = array();
     $this->Request = $Request->path(false);
     $PathAndQuery = $Request->PathAndQuery();
     $MatchRoute = Gdn::router()->matchRoute($PathAndQuery);
     // We have a route. Take action.
     if ($MatchRoute !== false) {
         switch ($MatchRoute['Type']) {
             case 'Internal':
                 $Request->pathAndQuery($MatchRoute['FinalDestination']);
                 $this->Request = $Request->path(false);
                 break;
             case 'Temporary':
                 safeHeader("HTTP/1.1 302 Moved Temporarily");
                 safeHeader("Location: " . Url($MatchRoute['FinalDestination']));
                 exit;
                 break;
             case 'Permanent':
                 safeHeader("HTTP/1.1 301 Moved Permanently");
                 safeHeader("Location: " . Url($MatchRoute['FinalDestination']));
                 exit;
                 break;
             case 'NotAuthorized':
                 safeHeader("HTTP/1.1 401 Not Authorized");
                 $this->Request = $MatchRoute['FinalDestination'];
                 break;
             case 'NotFound':
                 safeHeader("HTTP/1.1 404 Not Found");
                 $this->Request = $MatchRoute['FinalDestination'];
                 break;
             case 'Test':
                 $Request->pathAndQuery($MatchRoute['FinalDestination']);
                 $this->Request = $Request->path(false);
                 decho($MatchRoute, 'Route');
                 decho(array('Path' => $Request->path(), 'Get' => $Request->get()), 'Request');
                 die;
         }
     }
     switch ($Request->outputFormat()) {
         case 'rss':
             $this->_SyndicationMethod = SYNDICATION_RSS;
             $this->_DeliveryMethod = DELIVERY_METHOD_RSS;
             break;
         case 'atom':
             $this->_SyndicationMethod = SYNDICATION_ATOM;
             $this->_DeliveryMethod = DELIVERY_METHOD_RSS;
             break;
         case 'default':
         default:
             $this->_SyndicationMethod = SYNDICATION_NONE;
             break;
     }
     if ($this->Request == '') {
         $DefaultController = Gdn::router()->getRoute('DefaultController');
         $this->Request = $DefaultController['Destination'];
     }
     $Parts = explode('/', str_replace('\\', '/', $this->Request));
     /**
      * The application folder is either the first argument or is not provided. The controller is therefore
      * either the second argument or the first, depending on the result of the previous statement. Check that.
      */
     try {
         // if the 1st argument is a valid application, check if it has a controller matching the 2nd argument
         if (in_array($Parts[0], $this->enabledApplicationFolders())) {
             $this->findController(1, $Parts);
         }
         // if no match, see if the first argument is a controller
         $this->findController(0, $Parts);
         // 3] See if there is a plugin trying to create a root method.
         list($MethodName, $DeliveryMethod) = $this->_splitDeliveryMethod(GetValue(0, $Parts), true);
         if ($MethodName && Gdn::pluginManager()->hasNewMethod('RootController', $MethodName, true)) {
             $this->_DeliveryMethod = $DeliveryMethod;
             $Parts[0] = $MethodName;
             $Parts = array_merge(array('root'), $Parts);
             $this->findController(0, $Parts);
         }
         throw new GdnDispatcherControllerNotFoundException();
     } catch (GdnDispatcherControllerFoundException $e) {
         switch ($this->_DeliveryMethod) {
             case DELIVERY_METHOD_JSON:
             case DELIVERY_METHOD_XML:
//.........这里部分代码省略.........

 /**
  * @param Gdn_Dispatcher $sender
  */
 public function gdn_dispatcher_sendHeaders_handler($sender)
 {
     $csrfToken = Gdn::request()->post(Gdn_Session::CSRF_NAME, Gdn::request()->get(Gdn_Session::CSRF_NAME, Gdn::request()->getValueFrom(Gdn_Request::INPUT_SERVER, 'HTTP_X_CSRF_TOKEN')));
     if ($csrfToken && Gdn::session()->isValid() && !Gdn::session()->validateTransientKey($csrfToken)) {
         safeHeader('X-CSRF-Token: ' . Gdn::session()->transientKey());
     }
 }

 /**
  * Rewrite the request based on rewrite rules (currently called routes in Vanilla).
  *
  * This method modifies the passed {@link $request} object. It can also cause a redirect if a rule matches that
  * specifies a redirect.
  *
  * @param Gdn_Request $request The request to rewrite.
  */
 private function rewriteRequest($request)
 {
     $pathAndQuery = $request->PathAndQuery();
     $matchRoute = Gdn::router()->matchRoute($pathAndQuery);
     // We have a route. Take action.
     if (!empty($matchRoute)) {
         $dest = $matchRoute['FinalDestination'];
         if (strpos($dest, '?') === false) {
             // The rewrite rule doesn't include a query string so keep the current one intact.
             $request->path($dest);
         } else {
             // The rewrite rule has a query string so rewrite that too.
             $request->pathAndQuery($dest);
         }
         switch ($matchRoute['Type']) {
             case 'Internal':
                 // Do nothing. The request has been rewritten.
                 break;
             case 'Temporary':
                 safeHeader("HTTP/1.1 302 Moved Temporarily");
                 safeHeader("Location: " . url($matchRoute['FinalDestination']));
                 exit;
                 break;
             case 'Permanent':
                 safeHeader("HTTP/1.1 301 Moved Permanently");
                 safeHeader("Location: " . url($matchRoute['FinalDestination']));
                 exit;
                 break;
             case 'NotAuthorized':
                 safeHeader("HTTP/1.1 401 Not Authorized");
                 break;
             case 'NotFound':
                 safeHeader("HTTP/1.1 404 Not Found");
                 break;
             case 'Drop':
                 die;
             case 'Test':
                 decho($matchRoute, 'Route');
                 decho(array('Path' => $request->path(), 'Get' => $request->get()), 'Request');
                 die;
         }
     } elseif (in_array($request->path(), ['', '/'])) {
         $this->isHomepage = true;
         $defaultController = Gdn::router()->getRoute('DefaultController');
         $request->pathAndQuery($defaultController['Destination']);
     }
     return $request;
 }

 /**
  * Set P3P header because IE won't allow cookies thru the iFrame without it.
  *
  * This must be done in the Dispatcher because of PrivateCommunity.
  * That precludes using Controller->SetHeader.
  * This is done so comment & forum embedding can work in old IE.
  *
  * @param Gdn_Dispatcher $Sender
  */
 public function gdn_dispatcher_appStartup_handler($Sender)
 {
     safeHeader('P3P: CP="CAO PSA OUR"', true);
     if ($SSO = Gdn::request()->get('sso')) {
         saveToConfig('Garden.Registration.SendConnectEmail', false, false);
         $IsApi = preg_match('`\\.json$`i', Gdn::request()->path());
         $UserID = false;
         try {
             $CurrentUserID = Gdn::session()->UserID;
             $UserID = Gdn::userModel()->sso($SSO);
         } catch (Exception $Ex) {
             trace($Ex, TRACE_ERROR);
         }
         if ($UserID) {
             Gdn::session()->start($UserID, !$IsApi, !$IsApi);
             if ($IsApi) {
                 Gdn::session()->validateTransientKey(true);
             }
             if ($UserID != $CurrentUserID) {
                 Gdn::userModel()->fireEvent('AfterSignIn');
             }
         } else {
             // There was some sort of error. Let's print that out.
             foreach (Gdn::userModel()->Validation->resultsArray() as $msg) {
                 trace($msg, TRACE_ERROR);
             }
             Gdn::userModel()->Validation->reset();
         }
     }
 }