Merge pull request #42 in ZP/z-push from...

Merge pull request #42 in ZP/z-push from feature/ZP-686-use-php_sapi_name-to-detect-console to develop

* commit 'e5f75f64':
  ZP-686 Do not expose information in state migrate script. Released under the Affero GNU General Public License (AGPL) version 3.
  ZP-686 Add check also to z-push-top. Don't expose additional information about the system configuration to a potential attacker. Released under the Affero GNU General Public License (AGPL) version 3.
  ZP-686 Replace $_SERVER["TERM"] with php_sapi_name(). Released under the Affero GNU General Public License (AGPL) version 3.

src/backend/zarafa/listfolders.php

@@ -10,7 +10,7 @@
 *
 * Created   :   06.05.2011
 *
-* Copyright 2007 - 2013 Zarafa Deutschland GmbH
+* Copyright 2007 - 2013, 2015 Zarafa Deutschland GmbH
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License, version 3,
@@ -67,8 +67,8 @@ function main() {
 
 function listfolders_configure() {
 
-    if (!isset($_SERVER["TERM"]) || !isset($_SERVER["LOGNAME"])) {
-        echo "This script should not be called in a browser.\n";
+    if (php_sapi_name() != "cli") {
+        fwrite(STDERR, "This script can only be called from the CLI.\n");
         exit(1);
     }
 

src/z-push-admin.php

@@ -9,7 +9,7 @@
 *
 * Created   :   14.05.2010
 *
-* Copyright 2007 - 2013 Zarafa Deutschland GmbH
+* Copyright 2007 - 2015 Zarafa Deutschland GmbH
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License, version 3,
@@ -112,7 +112,7 @@ include('version.php');
         if (! ZPushAdminCLI::SureWhatToDo()) {
             // show error message if available
             if (ZPushAdminCLI::GetErrorMessage())
-                echo "ERROR: ". ZPushAdminCLI::GetErrorMessage() . "\n";
+                fwrite(STDERR, ZPushAdminCLI::GetErrorMessage() . "\n");
 
             echo ZPushAdminCLI::UsageInstructions();
             exit(1);
@@ -191,8 +191,8 @@ class ZPushAdminCLI {
      * @access public
      */
     static public function CheckEnv() {
-        if (!isset($_SERVER["TERM"]) || !isset($_SERVER["LOGNAME"]))
-            self::$errormessage = "This script should not be called in a browser.";
+        if (php_sapi_name() != "cli")
+            self::$errormessage = "This script can only be called from the CLI.";
 
         if (!function_exists("getopt"))
             self::$errormessage = "PHP Function getopt not found. Please check your PHP version and settings.";

src/z-push-top.php

@@ -67,6 +67,9 @@ include('version.php');
         if (!function_exists("pcntl_signal"))
             throw new FatalException("Function pcntl_signal() is not available. Please install package 'php5-pcntl' (or similar) on your system.");
 
+        if (php_sapi_name() != "cli")
+            throw new FatalException("This script can only be called from the CLI.");
+
         $zpt = new ZPushTop();
 
         // check if help was requested from CLI
@@ -85,7 +88,8 @@ include('version.php');
             echo "Z-Push shared memory interprocess communication is not available.\n";
     }
     catch (ZPushException $zpe) {
-        die(get_class($zpe) . ": ". $zpe->getMessage() . "\n");
+        fwrite(STDERR, get_class($zpe) . ": ". $zpe->getMessage() . "\n");
+        exit(1);
     }
 
     echo "terminated\n";

tools/migrate-2.0.x-2.1.0.php

@@ -52,8 +52,8 @@ define('ZPUSH_BASE_PATH', "../src");
  * MAIN
 */
 try {
-    if (!isset($_SERVER["TERM"]) || !isset($_SERVER["LOGNAME"]))
-        die("This script should not be called in a browser.");
+    if (php_sapi_name() != "cli")
+        die("This script can only be called from the CLI.");
 
     if (!defined('ZPUSH_BASE_PATH') || !file_exists(ZPUSH_BASE_PATH . "/config.php"))
         die("ZPUSH_BASE_PATH not set correctly or no config.php file found\n");