This file is indexed.

/usr/share/php/Horde/Rpc/Phpgw.php is in php-horde-rpc 2.1.7-2.

This file is owned by root:root, with mode 0o644.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
<?php
/**
 * The Horde_Rpc_Phpgw class provides an XMLRPC implementation of the
 * Horde RPC system compatible with phpgw. It is based on the
 * xmlrpc.php implementation by Jan Schneider.
 *
 * See the enclosed file COPYING for license information (LGPL). If you
 * did not receive this file, see http://www.horde.org/licenses/lgpl21.
 *
 * @author   Michael Braun <mi.braun@onlinehome.de>
 * @category Horde
 * @package  Rpc
 */
class Horde_Rpc_Phpgw extends Horde_Rpc
{
    /**
     * Resource handler for the XML-RPC server.
     *
     * @var resource
     */
    var $_server;

    /**
     * XMLRPC server constructor.
     */
    function __construct($request, $params = array())
    {
        parent::__construct($request, $params);

        $this->_server = xmlrpc_server_create();

        // Register only phpgw services.
        foreach ($GLOBALS['registry']->listMethods('phpgw') as $method) {
            $methods = explode('/', $method);
            array_shift($methods);
            $method = implode('.', $methods);
            xmlrpc_server_register_method($this->_server, $method, array('Horde_Rpc_Phpgw', '_dispatcher'));
        }
    }

    /**
     * Authorization is done by xmlrpc method system.login.
     */
    function authorize()
    {
        return true;
    }

    /**
     * Sends an RPC request to the server and returns the result.
     *
     * @param string  The raw request string.
     *
     * @return string  The XML encoded response from the server.
     */
    function getResponse($request)
    {
        $response = null;
        return xmlrpc_server_call_method($this->_server, $request, $response);
    }

    /**
     * Will be registered as the handler for all available methods
     * and will call the appropriate function through the registry.
     *
     * @access private
     *
     * @param string $method  The name of the method called by the RPC request.
     * @param array $params   The passed parameters.
     * @param mixed $data     Unknown.
     *
     * @return mixed  The result of the called registry method.
     */
    function _dispatcher($method, $params, $data)
    {
        global $registry;
        $method = str_replace('.', '/', 'phpgw.' . $method);

        if (!$registry->hasMethod($method)) {
            Horde::log(sprintf(Horde_Rpc_Translation::t("Method \"%s\" is not defined"), $method), 'NOTICE');
            return sprintf(Horde_Rpc_Translation::t("Method \"%s\" is not defined"), $method);
        }

        // Try to resume a session
        if (isset($params[0]['kp3']) && $params[0]["kp3"] == session_name() && session_id() != $params[0]["sessionid"]) {
            Horde::log("manually reload session ".$params[0]["sessionid"], 'NOTICE');
            session_regenerate_id();
            session_unset();
            session_id($params[0]["sessionid"]);
        }

        // Be authenticated or call system.login.
        $authenticated = $registry->isAuthenticated() || $method== "phpgw/system/login";

        if ($authenticated) {
            Horde::log("rpc call $method allowed", 'NOTICE');
            return $registry->call($method, $params);
        } else {
            return PEAR::raiseError(Horde_Rpc_Translation::t("You did not authenticate."), 'horde.error');
            // return parent::authorize();
            // error 9 "access denied"
        }
    }

    /**
     * Builds an XMLRPC request and sends it to the XMLRPC server.
     *
     * This statically called method is actually the XMLRPC client.
     *
     * @param string|Horde_Url $url     The path to the XMLRPC server on the
     *                                  called host.
     * @param string $method             The method to call.
     * @param Horde_Http_Client $client  The transport client
     * @param array $params              A hash containing any necessary
     *                                   parameters for the method call.
     *
     * @return mixed  The returned result from the method.
     * @throws Horde_Rpc_Exception
     */
    public static function request($url, $method, $client, $params = null)
    {
        $options['method'] = 'POST';
        $headers = array(
            'User-Agent' => 'Horde RPC client',
            'Content-Type', 'text/xml');
        try {
            $result = $client->post((string)$url, xmlrpc_encode_request($method, $params), $headers);
        } catch (Horde_Http_Exception $e) {
            throw new Horde_Rpc_Exception($result);
        }
        if ($result->code != 200) {
            throw new Horde_Rpc_Exception(Horde_Rpc_Translation::t("Request couldn't be answered. Returned errorcode: ") . $result->code);
        } elseif (strpos($result->getBody(), '<?xml') === false) {
            throw new Horde_Rpc_Exception(Horde_Rpc_Translation::t("No valid XML data returned:") . "\n" . $result->getBody());
        } else {
            $response = @xmlrpc_decode(substr($result->getBody(), strpos($result->getBody(), '<?xml')));
            if (is_array($response) && isset($response['faultString'])) {
                throw new Horde_Rpc_Exception($response['faultString']);
            } elseif (is_array($response) && isset($response[0]) &&
                      is_array($response[0]) && isset($response[0]['faultString'])) {
                throw new Horde_Rpc_Exception($response[0]['faultString']);
            }
            return $response;
        }
    }

}