Port the code to PHP 8.5.

Replace the short open tags and the removed functions (mcrypt, mysql_error,
salt-less crypt). Decode the reCAPTCHA reply as JSON, turn off mysqli
exceptions, drop stripslashes(), and default missing input values.
Fix the misplaced continue in prune_images().

publish/addeditor.php

@@ -1,4 +1,4 @@
-<? 
+<?php 
 if ( ! isset($_SERVER['HTTPS'])) {
    header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
 }
@@ -12,9 +12,9 @@ if (!isset($_SESSION['editor'])) {
   open_db('open');
   $table = "editors";
 
-  $username = $db->real_escape_string($_POST['username']);
-  $password = crypt($_POST['password']);
-  $email    = $db->real_escape_string($_POST['email']);
+  $username = $db->real_escape_string($_POST['username'] ?? '');
+  $password = $db->real_escape_string(password_hash($_POST['password'] ?? '', PASSWORD_DEFAULT));
+  $email    = $db->real_escape_string($_POST['email'] ?? '');
   $query = "INSERT INTO $table SET".
             "`username` = '".$username."', ".
             "`password` = '".$password."', ".
@@ -39,18 +39,18 @@ if (!isset($_SESSION['editor'])) {
     <script type="text/javascript" src="../utilities.js"></script>
     <link rel="alternate" type="application/rss+xml" title="xxx.org.za RSS feed" href="/feed" />
   </head>
-<? flush(); ?>
+<?php flush(); ?>
 <body>
 <div id="container">
-<? include_once("../sidebar.inc.php"); ?>
+<?php include_once("../sidebar.inc.php"); ?>
 <main id="main">
 <div id="maintext">
 
 <H1>add editor</H1>
 
-<? if ($added) { ?>
+<?php if ($added) { ?>
   <p>Added editor <?= $username ?></p>
-<? } else { ?>
+<?php } else { ?>
 
 <form action="https://xxx.org.za<?= $_SERVER['REQUEST_URI'] ?>" method="post">
   <div class="grid">
@@ -77,12 +77,12 @@ if (!isset($_SESSION['editor'])) {
 
   </div><!-- .grid -->
 </form>
-<? } ?>
+<?php } ?>
 
 </div> <!-- .maintext  -->
 </main> <!-- .main      -->
 </div> <!-- .container -->
-<? include_once("../bottombar.inc.php"); ?>
+<?php include_once("../bottombar.inc.php"); ?>
 
 </body>
 </html>

publish/choose.inc.php

@@ -1,4 +1,4 @@
-<?
+<?php
 // Default to the queue.
 if (!isset($_REQUEST['queue']))
   $queue = TRUE;
@@ -12,15 +12,15 @@ if (!get_id() && (get_count() > 1))
 if ($queue) { ?>
 
 <p>To view already-posted articles, <a href="edit?queue=0">click here</a>.</p>
-<?  } else { ?>
+<?php  } else { ?>
 <p>To view articles in the queue, <a href="edit?queue=1">click here</a>.</p>
 <div class="input" style="text-align: justify">
         <form action="" method="get">
-  <input name="search" type="text" class="input" id="search" maxlength="40" value="<?= $_GET['search'] ?>" />
+  <input name="search" type="text" class="input" id="search" maxlength="40" value="<?= $_GET['search'] ?? '' ?>" />
   <input name="queue" type="hidden" value="0" />
   <button type="submit" id="choose" name="action" value="choose" class="inputbutton">Search</button>
 </form>
 </div>
-<?  }
+<?php  }
 echo display_stories();
 ?>

publish/edit.php

@@ -1,4 +1,4 @@
-<?
+<?php
 if ( ! isset($_SERVER['HTTPS'])) {
    header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
 }
@@ -22,9 +22,9 @@ if (!isset($_SESSION['editor'])) {
     <link rel='stylesheet' type='text/css' href='../publish/style.css' />
     <script type="text/javascript" src="../utilities.js"></script>
     <link rel="alternate" type="application/rss+xml" title="xxx.org.za RSS feed" href="/feed" />
-<? include_once('./tinymce_init.inc.php'); ?>
+<?php include_once('./tinymce_init.inc.php'); ?>
   </head>
-<?
+<?php
   flush();
   require_once("../get_data.lib.php");
   open_db('open');
@@ -35,13 +35,13 @@ if (!isset($_SESSION['editor'])) {
 ?>
 <body>
 <div id='container'>
-<? include_once("../sidebar.inc.php"); ?>
+<?php include_once("../sidebar.inc.php"); ?>
 <div id='main'>
 <div id='maintext'>
 
 <H1>edit</H1>
 
-<? 
+<?php 
 
 /* Authenticated admin user allowed to: check the queue
           edit article on the queue
@@ -116,9 +116,9 @@ switch ($action) {
 </div> <!-- maintext  -->
 </div> <!-- main      -->
 </div> <!-- container -->
-<? include_once("../bottombar.inc.php"); ?>
+<?php include_once("../bottombar.inc.php"); ?>
 
-<? open_db('close'); ?>
+<?php open_db('close'); ?>
 <!-- Finis -->
 
 </body>

publish/index.php

@@ -1,4 +1,4 @@
-<? require_once("../session.lib.php"); ?>
+<?php require_once("../session.lib.php"); ?>
 <!DOCTYPE html>
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
@@ -11,12 +11,12 @@
     <link rel='stylesheet' type='text/css' href='../publish/style.css' />
     <script type="text/javascript" src="../utilities.js"></script>
     <link rel="alternate" type="application/rss+xml" title="xxx.org.za RSS feed" href="/feed" />
-<? include_once('tinymce_init.inc.php'); ?>
-<? if (!$is_admin ) { ?>
+<?php include_once('tinymce_init.inc.php'); ?>
+<?php if (!$is_admin ) { ?>
     <script src="https://www.google.com/recaptcha/api.js"></script>
-<? } ?>
+<?php } ?>
   </head>
-<? 
+<?php 
   flush(); 
   require_once("../get_data.lib.php");
   open_db('open');
@@ -26,13 +26,13 @@
 ?>
 <body>
 <div id='container'>
-<? include_once("../sidebar.inc.php"); ?>
+<?php include_once("../sidebar.inc.php"); ?>
 <div id='main'>
 <div id='maintext'>
 
 <h1>submit</h1>
 
-<? 
+<?php 
 /* Authenticated admin user allowed to: check the queue
 					edit article on the queue
 					optionally preview
@@ -84,9 +84,9 @@ switch ($action) {
 </div> <!-- maintext  -->
 </div> <!-- main      -->
 </div> <!-- container -->
-<? include_once("../bottombar.inc.php"); ?>
+<?php include_once("../bottombar.inc.php"); ?>
 
-<?  open_db('close'); ?>
+<?php  open_db('close'); ?>
 
 </body>
 </html>

publish/login.php

@@ -1,4 +1,4 @@
-<?
+<?php
 if ( ! isset($_SERVER['HTTPS'])) {
    header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
 }
@@ -14,20 +14,22 @@ if (isset($_SESSION['editor'])) {
   $table = "editors";
   open_db('open');
 
-  $username = $db->real_escape_string($_POST['username']);
+  $username = $db->real_escape_string($_POST['username'] ?? '');
   $query = "SELECT * FROM $table WHERE ".
            "username LIKE '".$username."' ".
            "LIMIT 1;";
-  $getid = $db->query($query) or die("Query failed: ".$db->error());
+  $getid = $db->query($query) or die("Query failed: ".$db->error);
   $row = $getid->fetch_assoc();
 
-  if (isset($row)) 
+  $stored_password = '';
+  if (isset($row))
     $stored_password = $row['password'];
   else  $denied = TRUE;
   $getid->close();
   open_db('close');
-  $compare_password = $_POST['password'];
-  if (crypt($compare_password, $stored_password) != $stored_password) {
+  $compare_password = $_POST['password'] ?? '';
+  // password_verify() also accepts hashes made by the old crypt() call
+  if (!password_verify($compare_password, $stored_password)) {
     $denied = TRUE;
   } else {
     $_SESSION['editor'] = $username; 
@@ -65,21 +67,21 @@ if (isset($_SESSION['editor'])) {
     <script type="text/javascript" src="../utilities.js"></script>
     <link rel="alternate" type="application/rss+xml" title="xxx.org.za RSS feed" href="/feed" />
   </head>
-<? flush(); ?>
+<?php flush(); ?>
 <body>
 <div id="container">
-<? include_once("../sidebar.inc.php"); ?>
+<?php include_once("../sidebar.inc.php"); ?>
 <main id="main">
 <div id="maintext">
 
 <H1>editor login</H1>
 
-<? 
+<?php 
 if ($denied) 
   echo "<p><strong>Access denied. Please try again.</strong></p>\n";
 ?>
 
-<form action="<? echo "https://xxx.org.za".$_SERVER['REQUEST_URI']; ?>" method="post">
+<form action="<?php echo "https://xxx.org.za".$_SERVER['REQUEST_URI']; ?>" method="post">
   <div class="grid">
 
     <label for="username">Username: </label>
@@ -108,7 +110,7 @@ if ($denied)
 </div> <!-- .maintext  -->
 </main> <!-- .main      -->
 </div> <!-- .container -->
-<? include_once("../bottombar.inc.php"); ?>
+<?php include_once("../bottombar.inc.php"); ?>
 
 </body>
 </html>

publish/logout.php

@@ -1,4 +1,4 @@
-<?
+<?php
 //include_once('../session.lib.php');
 header( 'Cache-Control: no-store, no-cache, must-revalidate' );
 header( 'Cache-Control: post-check=0, pre-check=0', false );

publish/modify.inc.php

@@ -1,4 +1,4 @@
-<?
+<?php
 echo display_stories();
  
 echo "<br /><br />\n";

publish/post.lib.php

@@ -1,4 +1,4 @@
-<? 
+<?php 
 require_once('../open_db.lib.php');
 require_once('../get_data.lib.php');
 
@@ -11,12 +11,14 @@ function save_data($id = NULL) {
   else
     $move = FALSE;
   $table = which_table($move, $action);
+  $image_file = FALSE;
+  $queue_id   = NULL;
 
-  // extract POST variables (running through stripslashes)
+  // extract POST variables
   $result = get_post_data(TRUE);
   // assign their keys and values to the symbol table
   extract($result[0], EXTR_OVERWRITE);
- 
+
   // Process data...
   $story = sanitise($story);
   // Add the date if it's not got one
@@ -86,7 +88,7 @@ function save_data($id = NULL) {
   // Get the (new) ID if we don't already have it.
   if (!is_numeric($id) || $move) {
     $query = "SELECT LAST_INSERT_ID();";
-    $getid = $db->query($query) or die("Query failed: ".$db->error());
+    $getid = $db->query($query) or die("Query failed: ".$db->error);
     $row = $getid->fetch_row();
     $id = $row[0];
   }
@@ -119,8 +121,9 @@ function delete_story($id, $move = FALSE) {
 
   $query = "DELETE FROM $table WHERE `id` = '".$id."' LIMIT 1;";
   //echo $query;
-  $result = $db->query($query)or die("Query failed : ".$db->error());
+  $result = $db->query($query)or die("Query failed : ".$db->error);
 
+  $message = '';
   if (!$move)
     $message = 'Article has been deleted.';
 
@@ -129,13 +132,13 @@ function delete_story($id, $move = FALSE) {
 
 function get_mimetype($image_file) {
   $upload = getimagesize($image_file);
-  $mimetype = $upload['mime'];
+  $mimetype = $upload ? $upload['mime'] : NULL;
   return $mimetype;
 }
 
 function save_uploaded_file() {
   // Save uploaded file to new, temporary location
-  if (is_uploaded_file($_FILES['upload']['tmp_name'])) {
+  if (is_uploaded_file($_FILES['upload']['tmp_name'] ?? '')) {
     $tmp_file = $_FILES['upload']['tmp_name'];
     $new_file = $_SERVER['DOCUMENT_ROOT'] . "/graphics" . $tmp_file;
     $end_dir  = dirname($new_file);
@@ -164,8 +167,8 @@ function prune_images($image_file) {
   unlink($image_file);
 
   if ( $dir_handle = @opendir($cleanup_dir) ) {
-    if($dir_handle=='.' || $dir_handle=='..') continue;
-    while ($cleanup_file = readdir ($dir_handle)) {
+    while (($cleanup_file = readdir ($dir_handle)) !== FALSE) {
+      if ($cleanup_file == '.' || $cleanup_file == '..') continue;
       $cleanup_file = $cleanup_dir . "/". $cleanup_file;
       if (@filemtime($cleanup_file) < (time() - $age)) {
         @unlink($cleanup_file);
@@ -184,10 +187,12 @@ function prune_images($image_file) {
 $validate = array();
 function validate_data() {
   global $validate;
-  // extract POST variables (running through stripslashes)
+  // extract POST variables
   $result = get_post_data(TRUE);
   // assign their keys and values to the symbol table
   extract($result[0], EXTR_OVERWRITE);
+  $upload_error = $_FILES['upload']['error']    ?? UPLOAD_ERR_NO_FILE;
+  $upload_tmp   = $_FILES['upload']['tmp_name'] ?? '';
 
 
   if (!$author) {
@@ -203,11 +208,11 @@ function validate_data() {
   }
 
   // 0 == no error; 4 == no file; all others are errors.
-  if ($_FILES['upload']['error'] > 0 &&
-      $_FILES['upload']['error'] !== 4) {
-    $validate['upload'] = 'There was an error uploading the file ('.$_FILES['upload']['error'].')';
-  } else if ($_FILES['upload']['tmp_name']) {
-    $upload = getimagesize($_FILES['upload']['tmp_name']);
+  if ($upload_error > 0 &&
+      $upload_error !== 4) {
+    $validate['upload'] = 'There was an error uploading the file ('.$upload_error.')';
+  } else if ($upload_tmp) {
+    $upload = getimagesize($upload_tmp);
     if (!$upload)
       $validate['upload'] = htmlspecialchars($_FILES['upload']['name']) . 
                             " wasn't an image file. Please go back.";
@@ -245,7 +250,7 @@ function send_email($title, $author, $story) {
   $headers = 'From: x.x.x Queue <editor@xxx.org.za>'."\r\n";
   $message = "Please review the queue. $author has sent the following new submission:\n\n";
   if ($story)
-    $message .= wordwrap(preg_replace("#(<br.?/?>|</p>)#", "\n", strip_tags(stripslashes(html_entity_decode_full($story)))));
+    $message .= wordwrap(preg_replace("#(<br.?/?>|</p>)#", "\n", strip_tags(html_entity_decode_full($story))));
   else
     $message .= "<Submission is an image. Review on the site.>";
   $message .= "\n\nhttp://xxx.org.za/publish/edit";

publish/preview.inc.php

@@ -1,4 +1,4 @@
-<?
+<?php
 $result = get_post_data(TRUE, TRUE);
 extract($result[0], EXTR_OVERWRITE);
 
@@ -12,7 +12,9 @@ if (isset($_POST['g-recaptcha-response'])) {
   $captcha_resp = file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret=".urlencode(config('RECAPTCHA_SECRET'))."&response=".
       $captcha."&remoteip=".$_SERVER['REMOTE_ADDR']);
   var_dump($captcha_resp);
-  if ($captcha_resp.success==false) {
+  // PHP 8 treats the bare word "success" as an undefined constant, so decode the JSON reply
+  $captcha_json = json_decode((string)$captcha_resp);
+  if (empty($captcha_json->success)) {
     $validate['captcha'] = 'The words you typed in the captcha were not correct. Please try again.';
     include('./write.inc.php');
     return;
@@ -21,7 +23,7 @@ if (isset($_POST['g-recaptcha-response'])) {
 
 echo '<p>Please review your submission. Once you\'ve finished, please click "Submit" at the bottom of the page, or click "Preview" to check it again.</p>';
 
-if (is_uploaded_file($_FILES['upload']['tmp_name']) && !isset($validate['upload'])) {
+if (is_uploaded_file($_FILES['upload']['tmp_name'] ?? '') &&!isset($validate['upload'])) {
   $tmp_file   = $_FILES['upload']['tmp_name'];
   $upload     = getimagesize($tmp_file);
   $new_file   = $_SERVER['DOCUMENT_ROOT'] . "/graphics" . $tmp_file;

publish/write.inc.php

@@ -1,4 +1,4 @@
-<?
+<?php
 $id     = get_id();
 $search = get_search_args();
 
@@ -51,13 +51,13 @@ if (count($validate) !== 0) {
 </div>
 <div class="textarea rightcolumn">
   <div id="textparent">
-    <textarea name="story" id="story" rows="20" cols="50"><? 
+    <textarea name="story" id="story" rows="20" cols="50"><?php 
 echo (isset($story) ? $story : '')
   ?></textarea>
     <div class="note">(To get line-breaks&mdash;as in poetry&mdash;instead of paragraph breaks, hit shift-enter instead of enter.)</div>
   </div>
   <div class="upload" id="uploadparent" style="display: none;"><div>
-<? 
+<?php 
 if (isset($file_src) || isset($img)) {
   if (isset($file_src)) {
     echo '  <input type="hidden" id="uploaded" name="uploaded" value="'.$file_src.'" />';
@@ -70,7 +70,7 @@ if (isset($file_src) || isset($img)) {
 }
 ?>
     <input type="file" name="upload" id="upload" />
-<? 
+<?php 
 if (isset($file_src) || isset($img)) {
   echo '  <div>';
   echo '  <div class="remove">';
@@ -86,22 +86,22 @@ if (isset($file_src) || isset($img)) {
   </div></div>
 </div>
 
-<?  if ($is_admin) { ?>
-  <label<? isset($validate['comments']) ? ' class="red"' : '' ?> for="comments">Comments:</label>
+<?php  if ($is_admin) { ?>
+  <label<?php isset($validate['comments']) ? ' class="red"' : '' ?> for="comments">Comments:</label>
   <div class="rightcolumn">
     <input type="text" name="comments" id="comments" maxlength="150" value="<?= isset($comments) ? $comments : '' ?>" />
   </div>
   <input type="hidden" id="editor" name="editor" value="<?= $username ?>" />
-<? } else { ?>
+<?php } else { ?>
   <input type="hidden" id="editor" name="editor" value="original author" />
-<? } ?>
+<?php } ?>
 
 <div style="display: none;">
 <input type="hidden" id="date" name="date" value="<?= isset($date) ? $date : '' ?>" />
 <input type="hidden" id="id" name="id" value="<?= isset($id) ? $id : '' ?>" />
 </div>
 
-<?
+<?php
   if (!$is_admin && (($action == "") || isset($validate['captcha']))) {
     echo '<div class="g-recaptcha" data-sitekey="'.htmlspecialchars(config('RECAPTCHA_SITE_KEY')).'"></div>';
   }
@@ -116,7 +116,7 @@ if (isset($file_src) || isset($img)) {
 ?>
 <div class="leftcolumn"></div>
 <div class="submission rightcolumn">
-<?
+<?php
   if (isset($queue) && $is_admin) {
     echo '<button type="submit" id="preview" name="action" value="save">Save in queue</button>';
   } else {
@@ -138,7 +138,7 @@ if (isset($file_src) || isset($img)) {
 
 </form>
 
-<?
+<?php
   echo '<script type="text/javascript">'."\n";
 if (isset($file_src) || isset($img) || isset($validate['upload'])) {
   echo "  showHide('upload')\n";