OSDN Git Service

XML-RPC for PHP Unspecified PHP Code Execution Vulnerability
[nucleus-jp/nucleus-jp-ancient.git] / utf8 / nucleus / libs / xmlrpcs.inc.php
index 92e3250..ae4986a 100755 (executable)
@@ -1,10 +1,10 @@
 <?php\r
-// by Edd Dumbill (C) 1999-2001\r
+// by Edd Dumbill (C) 1999-2002\r
 // <edd@usefulinc.com>\r
-// $Id: xmlrpcs.inc.php,v 1.5 2005-03-12 06:19:05 kimitake Exp $\r
+// $Id: xmlrpcs.inc.php,v 1.6 2005-08-13 07:24:44 kimitake Exp $\r
 // $NucleusJP$\r
 \r
-// Copyright (c) 1999,2000,2001 Edd Dumbill.\r
+// Copyright (c) 1999,2000,2002 Edd Dumbill.\r
 // All rights reserved.\r
 //\r
 // Redistribution and use in source and binary forms, with or without\r
 // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED\r
 // OF THE POSSIBILITY OF SUCH DAMAGE.\r
 \r
-// XML RPC Server class\r
-// requires: xmlrpc.inc\r
-\r
-// listMethods: either a string, or nothing\r
-$_xmlrpcs_listMethods_sig=array(array($xmlrpcArray, $xmlrpcString), \r
-                                                                                                                               array($xmlrpcArray));\r
-$_xmlrpcs_listMethods_doc='This method lists all the methods that the XML-RPC server knows how to dispatch';\r
-function _xmlrpcs_listMethods($server, $m) {\r
-       global $xmlrpcerr, $xmlrpcstr, $_xmlrpcs_dmap;\r
-       $v=new xmlrpcval();\r
-       $dmap=$server->dmap;\r
-       $outAr=array();\r
-       for(reset($dmap); list($key, $val)=each($dmap); ) {\r
-               $outAr[]=new xmlrpcval($key, "string");\r
-       }\r
-       $dmap=$_xmlrpcs_dmap;\r
-       for(reset($dmap); list($key, $val)=each($dmap); ) {\r
-               $outAr[]=new xmlrpcval($key, "string");\r
-       }\r
-       $v->addArray($outAr);\r
-       return new xmlrpcresp($v);\r
-}\r
-\r
-$_xmlrpcs_methodSignature_sig=array(array($xmlrpcArray, $xmlrpcString));\r
-$_xmlrpcs_methodSignature_doc='Returns an array of known signatures (an array of arrays) for the method name passed. If no signatures are known, returns a none-array (test for type != array to detect missing signature)';\r
-function _xmlrpcs_methodSignature($server, $m) {\r
-       global $xmlrpcerr, $xmlrpcstr, $_xmlrpcs_dmap;\r
-\r
-       $methName=$m->getParam(0);\r
-       $methName=$methName->scalarval();\r
-       if (ereg("^system\.", $methName)) {\r
-               $dmap=$_xmlrpcs_dmap; $sysCall=1;\r
-       } else {\r
-               $dmap=$server->dmap; $sysCall=0;\r
+       // XML RPC Server class\r
+       // requires: xmlrpc.inc\r
+\r
+       // listMethods: either a string, or nothing\r
+       $_xmlrpcs_listMethods_sig=array(array($xmlrpcArray, $xmlrpcString), array($xmlrpcArray));\r
+       $_xmlrpcs_listMethods_doc='This method lists all the methods that the XML-RPC server knows how to dispatch';\r
+       function _xmlrpcs_listMethods($server, $m)\r
+       {\r
+               global $xmlrpcerr, $xmlrpcstr, $_xmlrpcs_dmap;\r
+               $v=new xmlrpcval();\r
+               $dmap=$server->dmap;\r
+               $outAr=array();\r
+               for(reset($dmap); list($key, $val)=each($dmap); )\r
+               {\r
+                       $outAr[]=new xmlrpcval($key, 'string');\r
+               }\r
+               $dmap=$_xmlrpcs_dmap;\r
+               for(reset($dmap); list($key, $val)=each($dmap); )\r
+               {\r
+                       $outAr[]=new xmlrpcval($key, 'string');\r
+               }\r
+               $v->addArray($outAr);\r
+               return new xmlrpcresp($v);\r
        }\r
-       //      print "<!-- ${methName} -->\n";\r
-       if (isset($dmap[$methName])) {\r
-               if ($dmap[$methName]["signature"]) {\r
-                       $sigs=array();\r
-                       $thesigs=$dmap[$methName]["signature"];\r
-                       for($i=0; $i<sizeof($thesigs); $i++) {\r
-                               $cursig=array();\r
-                               $inSig=$thesigs[$i];\r
-                               for($j=0; $j<sizeof($inSig); $j++) {\r
-                                       $cursig[]=new xmlrpcval($inSig[$j], "string");\r
+\r
+       $_xmlrpcs_methodSignature_sig=array(array($xmlrpcArray, $xmlrpcString));\r
+       $_xmlrpcs_methodSignature_doc='Returns an array of known signatures (an array of arrays) for the method name passed. If no signatures are known, returns a none-array (test for type != array to detect missing signature)';\r
+       function _xmlrpcs_methodSignature($server, $m)\r
+       {\r
+               global $xmlrpcerr, $xmlrpcstr, $_xmlrpcs_dmap;\r
+\r
+               $methName=$m->getParam(0);\r
+               $methName=$methName->scalarval();\r
+               if (ereg("^system\.", $methName))\r
+               {\r
+                       $dmap=$_xmlrpcs_dmap; $sysCall=1;\r
+               }\r
+               else\r
+               {\r
+                       $dmap=$server->dmap; $sysCall=0;\r
+               }\r
+               //      print "<!-- ${methName} -->\n";\r
+               if (isset($dmap[$methName]))\r
+               {\r
+                       if ($dmap[$methName]['signature'])\r
+                       {\r
+                               $sigs=array();\r
+                               $thesigs=$dmap[$methName]['signature'];\r
+                               for($i=0; $i<sizeof($thesigs); $i++)\r
+                               {\r
+                                       $cursig=array();\r
+                                       $inSig=$thesigs[$i];\r
+                                       for($j=0; $j<sizeof($inSig); $j++)\r
+                                       {\r
+                                               $cursig[]=new xmlrpcval($inSig[$j], 'string');\r
+                                       }\r
+                                       $sigs[]=new xmlrpcval($cursig, 'array');\r
                                }\r
-                               $sigs[]=new xmlrpcval($cursig, "array");\r
+                               $r=new xmlrpcresp(new xmlrpcval($sigs, 'array'));\r
                        }\r
-                       $r=new xmlrpcresp(new xmlrpcval($sigs, "array"));\r
-               } else {\r
-                       $r=new xmlrpcresp(new xmlrpcval("undef", "string"));\r
+                       else\r
+                       {\r
+                               $r=new xmlrpcresp(new xmlrpcval('undef', 'string'));\r
+                       }\r
+               }\r
+               else\r
+               {\r
+                       $r=new xmlrpcresp(0,$xmlrpcerr['introspect_unknown'], $xmlrpcstr['introspect_unknown']);\r
                }\r
-       } else {\r
-                       $r=new xmlrpcresp(0,\r
-                                                 $xmlrpcerr["introspect_unknown"],\r
-                                                 $xmlrpcstr["introspect_unknown"]);\r
+               return $r;\r
        }\r
-       return $r;\r
-}\r
-\r
-$_xmlrpcs_methodHelp_sig=array(array($xmlrpcString, $xmlrpcString));\r
-$_xmlrpcs_methodHelp_doc='Returns help text if defined for the method passed, otherwise returns an empty string';\r
-function _xmlrpcs_methodHelp($server, $m) {\r
-       global $xmlrpcerr, $xmlrpcstr, $_xmlrpcs_dmap;\r
-\r
-       $methName=$m->getParam(0);\r
-       $methName=$methName->scalarval();\r
-       if (ereg("^system\.", $methName)) {\r
-               $dmap=$_xmlrpcs_dmap; $sysCall=1;\r
-       } else {\r
-               $dmap=$server->dmap; $sysCall=0;\r
+\r
+       $_xmlrpcs_methodHelp_sig=array(array($xmlrpcString, $xmlrpcString));\r
+       $_xmlrpcs_methodHelp_doc='Returns help text if defined for the method passed, otherwise returns an empty string';\r
+       function _xmlrpcs_methodHelp($server, $m)\r
+       {\r
+               global $xmlrpcerr, $xmlrpcstr, $_xmlrpcs_dmap;\r
+\r
+               $methName=$m->getParam(0);\r
+               $methName=$methName->scalarval();\r
+               if (ereg("^system\.", $methName))\r
+               {\r
+                       $dmap=$_xmlrpcs_dmap; $sysCall=1;\r
+               }\r
+               else\r
+               {\r
+                       $dmap=$server->dmap; $sysCall=0;\r
+               }\r
+               // print "<!-- ${methName} -->\n";\r
+               if (isset($dmap[$methName]))\r
+               {\r
+                       if ($dmap[$methName]['docstring'])\r
+                       {\r
+                               $r=new xmlrpcresp(new xmlrpcval($dmap[$methName]['docstring']), 'string');\r
+                       }\r
+                       else\r
+                       {\r
+                               $r=new xmlrpcresp(new xmlrpcval('', 'string'));\r
+                       }\r
+               }\r
+               else\r
+               {\r
+                       $r=new xmlrpcresp(0, $xmlrpcerr['introspect_unknown'], $xmlrpcstr['introspect_unknown']);\r
+               }\r
+               return $r;\r
        }\r
-       //      print "<!-- ${methName} -->\n";\r
-       if (isset($dmap[$methName])) {\r
-               if ($dmap[$methName]["docstring"]) {\r
-                       $r=new xmlrpcresp(new xmlrpcval($dmap[$methName]["docstring"]),\r
-                                                                                               "string");\r
-               } else {\r
-                       $r=new xmlrpcresp(new xmlrpcval("", "string"));\r
+\r
+       $_xmlrpcs_multicall_sig = array(array($xmlrpcArray, $xmlrpcArray));\r
+       $_xmlrpcs_multicall_doc = 'Boxcar multiple RPC calls in one request. See http://www.xmlrpc.com/discuss/msgReader$1208 for details';\r
+\r
+       function _xmlrpcs_multicall_error($err)\r
+       {\r
+               if (is_string($err))\r
+               {\r
+                       global $xmlrpcerr, $xmlrpcstr;\r
+                       $str  = $xmlrpcstr["multicall_${err}"];\r
+                       $code = $xmlrpcerr["multicall_${err}"];\r
+               }\r
+               else\r
+               {\r
+                       $code = $err->faultCode();\r
+                       $str = $err->faultString();\r
                }\r
-       } else {\r
-                       $r=new xmlrpcresp(0,\r
-                                                 $xmlrpcerr["introspect_unknown"],\r
-                                                 $xmlrpcstr["introspect_unknown"]);\r
+               $struct['faultCode'] = new xmlrpcval($code, 'int');\r
+               $struct['faultString'] = new xmlrpcval($str, 'string');\r
+               return new xmlrpcval($struct, 'struct');\r
        }\r
-       return $r;\r
-}\r
-\r
-$_xmlrpcs_dmap=array(\r
-                                                                                "system.listMethods" =>\r
-                                                                                array("function" => "_xmlrpcs_listMethods",\r
-                                                                                                        "signature" => $_xmlrpcs_listMethods_sig,\r
-                                                                                                        "docstring" => $_xmlrpcs_listMethods_doc),\r
-                                                                                "system.methodHelp" =>\r
-                                                                                array("function" => "_xmlrpcs_methodHelp",\r
-                                                                                                        "signature" => $_xmlrpcs_methodHelp_sig,\r
-                                                                                                        "docstring" => $_xmlrpcs_methodHelp_doc),\r
-                                                                                "system.methodSignature" =>\r
-                                                                                array("function" => "_xmlrpcs_methodSignature",\r
-                                                                                                        "signature" => $_xmlrpcs_methodSignature_sig,\r
-                                                                                                        "docstring" => $_xmlrpcs_methodSignature_doc)\r
-                                                                                );\r
-\r
-$_xmlrpc_debuginfo="";\r
-function xmlrpc_debugmsg($m) {\r
-       global $_xmlrpc_debuginfo;\r
-       $_xmlrpc_debuginfo=$_xmlrpc_debuginfo . $m . "\n";\r
-}\r
-\r
-class xmlrpc_server {\r
-  var $dmap=array();\r
-\r
-  function xmlrpc_server($dispMap, $serviceNow=1) {\r
-               global $HTTP_RAW_POST_DATA;\r
-               // dispMap is a despatch array of methods\r
-               // mapped to function names and signatures\r
-               // if a method\r
-               // doesn't appear in the map then an unknown\r
-               // method error is generated\r
-               $this->dmap=$dispMap;\r
-               if ($serviceNow) {\r
-                       $this->service();\r
+\r
+       function _xmlrpcs_multicall_do_call($server, $call)\r
+       {\r
+               if ($call->kindOf() != 'struct')\r
+               {\r
+                       return _xmlrpcs_multicall_error('notstruct');\r
+               }\r
+               $methName = $call->structmem('methodName');\r
+               if (!$methName)\r
+               {\r
+                       return _xmlrpcs_multicall_error('nomethod');\r
+               }\r
+               if ($methName->kindOf() != 'scalar' || $methName->scalartyp() != 'string')\r
+               {\r
+                       return _xmlrpcs_multicall_error('notstring');\r
+               }\r
+               if ($methName->scalarval() == 'system.multicall')\r
+               {\r
+                       return _xmlrpcs_multicall_error('recursion');\r
                }\r
-  }\r
 \r
-       function serializeDebug() {\r
-               global $_xmlrpc_debuginfo;\r
-               if ($_xmlrpc_debuginfo!="") \r
-                       return "<!-- DEBUG INFO:\n\n" .\r
-                               $_xmlrpc_debuginfo . "\n-->\n";\r
-               else\r
-                       return "";\r
+               $params = $call->structmem('params');\r
+               if (!$params)\r
+               {\r
+                       return _xmlrpcs_multicall_error('noparams');\r
+               }\r
+               if ($params->kindOf() != 'array')\r
+               {\r
+                       return _xmlrpcs_multicall_error('notarray');\r
+               }\r
+               $numParams = $params->arraysize();\r
+\r
+               $msg = new xmlrpcmsg($methName->scalarval());\r
+               for ($i = 0; $i < $numParams; $i++)\r
+               {\r
+                       $msg->addParam($params->arraymem($i));\r
+               }\r
+\r
+               $result = $server->execute($msg);\r
+\r
+               if ($result->faultCode() != 0)\r
+               {\r
+                       return _xmlrpcs_multicall_error($result);    // Method returned fault.\r
+               }\r
+\r
+               return new xmlrpcval(array($result->value()), 'array');\r
+       }\r
+\r
+       function _xmlrpcs_multicall($server, $m)\r
+       {\r
+               $calls = $m->getParam(0);\r
+               $numCalls = $calls->arraysize();\r
+               $result = array();\r
+\r
+               for ($i = 0; $i < $numCalls; $i++)\r
+               {\r
+                       $call = $calls->arraymem($i);\r
+                       $result[$i] = _xmlrpcs_multicall_do_call($server, $call);\r
+               }\r
+\r
+               return new xmlrpcresp(new xmlrpcval($result, 'array'));\r
        }\r
 \r
-       function service() {\r
-               $r=$this->parseRequest();\r
-               $payload="<" . "?xml version=\"1.0\"?" . ">\n" . \r
-                       $this->serializeDebug() .\r
-                       $r->serialize();\r
-               header("Content-type: text/xml\r\nContent-length: " . \r
-                                        strlen($payload));\r
-               print $payload;\r
+       $_xmlrpcs_dmap=array(\r
+               'system.listMethods' => array(\r
+                       'function' => '_xmlrpcs_listMethods',\r
+                       'signature' => $_xmlrpcs_listMethods_sig,\r
+                       'docstring' => $_xmlrpcs_listMethods_doc),\r
+               'system.methodHelp' => array(\r
+                       'function' => '_xmlrpcs_methodHelp',\r
+                       'signature' => $_xmlrpcs_methodHelp_sig,\r
+                       'docstring' => $_xmlrpcs_methodHelp_doc),\r
+               'system.methodSignature' => array(\r
+                       'function' => '_xmlrpcs_methodSignature',\r
+                       'signature' => $_xmlrpcs_methodSignature_sig,\r
+                       'docstring' => $_xmlrpcs_methodSignature_doc),\r
+               'system.multicall' => array(\r
+                       'function' => '_xmlrpcs_multicall',\r
+                       'signature' => $_xmlrpcs_multicall_sig,\r
+                       'docstring' => $_xmlrpcs_multicall_doc\r
+               )\r
+       );\r
+\r
+       $_xmlrpc_debuginfo='';\r
+       function xmlrpc_debugmsg($m)\r
+       {\r
+               global $_xmlrpc_debuginfo;\r
+               $_xmlrpc_debuginfo=$_xmlrpc_debuginfo . $m . "\n";\r
        }\r
 \r
-       function verifySignature($in, $sig) {\r
-               for($i=0; $i<sizeof($sig); $i++) {\r
-                       // check each possible signature in turn\r
-                       $cursig=$sig[$i];\r
-                       if (sizeof($cursig)==$in->getNumParams()+1) {\r
-                               $itsOK=1;\r
-                               for($n=0; $n<$in->getNumParams(); $n++) {\r
-                                       $p=$in->getParam($n);\r
-                                       // print "<!-- $p -->\n";\r
-                                       if ($p->kindOf() == "scalar") {\r
-                                               $pt=$p->scalartyp();\r
-                                       } else {\r
-                                               $pt=$p->kindOf();\r
+       class xmlrpc_server\r
+       {\r
+               var $dmap=array();\r
+\r
+               function xmlrpc_server($dispMap='', $serviceNow=1)\r
+               {\r
+                       global $HTTP_RAW_POST_DATA;\r
+                       // dispMap is a dispatch array of methods\r
+                       // mapped to function names and signatures\r
+                       // if a method\r
+                       // doesn't appear in the map then an unknown\r
+                       // method error is generated\r
+                       /* milosch - changed to make passing dispMap optional.\r
+                        * instead, you can use the class add_to_map() function\r
+                        * to add functions manually (borrowed from SOAPX4)\r
+                        */\r
+                       if($dispMap)\r
+                       {\r
+                               $this->dmap = $dispMap;\r
+                               if($serviceNow)\r
+                               {\r
+                                       $this->service();\r
+                               }\r
+                       }\r
+               }\r
+\r
+               function serializeDebug()\r
+               {\r
+                       global $_xmlrpc_debuginfo;\r
+                       if ($_xmlrpc_debuginfo!='')\r
+                       {\r
+                               return "<!-- DEBUG INFO:\n\n" . xmlrpc_encode_entitites($_xmlrpc_debuginfo) . "\n-->\n";\r
+                       }\r
+                       else\r
+                       {\r
+                               return '';\r
+                       }\r
+               }\r
+\r
+               function service()\r
+               {\r
+                       //global $xmlrpc_defencoding;\r
+\r
+                       $r=$this->parseRequest();\r
+                       //$payload='<?xml version="1.0" encoding="' . $xmlrpc_defencoding . '"?' . '>' . "\n"\r
+                       $payload='<?xml version="1.0" ?' . '>' . "\n"\r
+                               . $this->serializeDebug()\r
+                               . $r->serialize();\r
+                       header('Content-Type: text/xml');\r
+                       header('Content-Length: ' . (int)strlen($payload));\r
+                       print $payload;\r
+               }\r
+\r
+               /*\r
+               add a method to the dispatch map\r
+               */\r
+               function add_to_map($methodname,$function,$sig,$doc)\r
+               {\r
+                       $this->dmap[$methodname] = array(\r
+                               'function'  => $function,\r
+                               'signature' => $sig,\r
+                               'docstring' => $doc\r
+                       );\r
+               }\r
+\r
+               function verifySignature($in, $sig)\r
+               {\r
+                       for($i=0; $i<sizeof($sig); $i++)\r
+                       {\r
+                               // check each possible signature in turn\r
+                               $cursig=$sig[$i];\r
+                               if (sizeof($cursig)==$in->getNumParams()+1)\r
+                               {\r
+                                       $itsOK=1;\r
+                                       for($n=0; $n<$in->getNumParams(); $n++)\r
+                                       {\r
+                                               $p=$in->getParam($n);\r
+                                               // print "<!-- $p -->\n";\r
+                                               if ($p->kindOf() == 'scalar')\r
+                                               {\r
+                                                       $pt=$p->scalartyp();\r
+                                               }\r
+                                               else\r
+                                               {\r
+                                                       $pt=$p->kindOf();\r
+                                               }\r
+                                               // $n+1 as first type of sig is return type\r
+                                               if ($pt != $cursig[$n+1])\r
+                                               {\r
+                                                       $itsOK=0;\r
+                                                       $pno=$n+1; $wanted=$cursig[$n+1]; $got=$pt;\r
+                                                       break;\r
+                                               }\r
                                        }\r
-                                       // $n+1 as first type of sig is return type\r
-                                       if ($pt != $cursig[$n+1]) {\r
-                                               $itsOK=0;\r
-                                               $pno=$n+1; $wanted=$cursig[$n+1]; $got=$pt;\r
-                                               break;\r
+                                       if ($itsOK)\r
+                                       {\r
+                                               return array(1,'');\r
                                        }\r
                                }\r
-                       if ($itsOK) \r
-                               return array(1);\r
                        }\r
+                       if (isset($wanted))\r
+                               return array(0, "Wanted ${wanted}, got ${got} at param ${pno})");\r
+                       else\r
+                               return array(0, "No method signature matches number of parameters");\r
                }\r
-               return array(0, "Wanted ${wanted}, got ${got} at param ${pno})");\r
-       }\r
 \r
-  function parseRequest($data="") {\r
-       global $_xh,$HTTP_RAW_POST_DATA;\r
-       global $xmlrpcerr, $xmlrpcstr, $xmlrpcerrxml, $xmlrpc_defencoding,\r
-               $_xmlrpcs_dmap;\r
+               function parseRequest($data='')\r
+               {\r
+                       global $_xh,$HTTP_RAW_POST_DATA;\r
+                       global $xmlrpcerr, $xmlrpcstr, $xmlrpcerrxml, $xmlrpc_defencoding,\r
+                       $_xmlrpcs_dmap, $xmlrpc_internalencoding;\r
 \r
-       \r
+                       if ($data=='')\r
+                       {\r
+                               $data=$HTTP_RAW_POST_DATA;\r
+                       }\r
+            // G. Giunta 2005/02/13: we do NOT expect to receive html entities\r
+            // so we do not try to convert them into xml character entities\r
+                       //$data = xmlrpc_html_entity_xlate($data);\r
+                       $parser = xml_parser_create($xmlrpc_defencoding);\r
 \r
-       if ($data=="") {\r
-         $data=$HTTP_RAW_POST_DATA;\r
-       }\r
-       $parser = xml_parser_create($xmlrpc_defencoding);\r
-\r
-       $_xh[$parser]=array();\r
-       $_xh[$parser]['st']="";\r
-       $_xh[$parser]['cm']=0; \r
-       $_xh[$parser]['isf']=0; \r
-       $_xh[$parser]['params']=array();\r
-       $_xh[$parser]['method']="";\r
-\r
-       // decompose incoming XML into request structure\r
-\r
-       xml_parser_set_option($parser, XML_OPTION_CASE_FOLDING, true);\r
-       xml_set_element_handler($parser, "xmlrpc_se", "xmlrpc_ee");\r
-       xml_set_character_data_handler($parser, "xmlrpc_cd");\r
-       xml_set_default_handler($parser, "xmlrpc_dh");\r
-       if (!xml_parse($parser, $data, 1)) {\r
-         // return XML error as a faultCode\r
-         $r=new xmlrpcresp(0,\r
-                                               $xmlrpcerrxml+xml_get_error_code($parser),\r
-                                               sprintf("XML error: %s at line %d",\r
+                       $_xh[$parser]=array();\r
+                       $_xh[$parser]['st']='';\r
+                       $_xh[$parser]['cm']=0;\r
+                       $_xh[$parser]['isf']=0;\r
+                       $_xh[$parser]['params']=array();\r
+                       $_xh[$parser]['method']='';\r
+\r
+                       // decompose incoming XML into request structure\r
+\r
+                       xml_parser_set_option($parser, XML_OPTION_CASE_FOLDING, true);\r
+            // G. Giunta 2005/02/13: PHP internally uses ISO-8859-1, so we have to tell\r
+            // the xml parser to give us back data in the expected charset\r
+            xml_parser_set_option($parser, XML_OPTION_TARGET_ENCODING, $xmlrpc_internalencoding);\r
+\r
+                       xml_set_element_handler($parser, 'xmlrpc_se', 'xmlrpc_ee');\r
+                       xml_set_character_data_handler($parser, 'xmlrpc_cd');\r
+                       xml_set_default_handler($parser, 'xmlrpc_dh');\r
+                       if (!xml_parse($parser, $data, 1))\r
+                       {\r
+                               // return XML error as a faultCode\r
+                               $r=new xmlrpcresp(0,\r
+                               $xmlrpcerrxml+xml_get_error_code($parser),\r
+                               sprintf('XML error: %s at line %d',\r
                                        xml_error_string(xml_get_error_code($parser)),\r
-                                 xml_get_current_line_number($parser)));\r
-         xml_parser_free($parser);\r
-       } else {\r
-         xml_parser_free($parser);\r
-         $m=new xmlrpcmsg($_xh[$parser]['method']);\r
-         // now add parameters in\r
-         $plist="";\r
-         for($i=0; $i<sizeof($_xh[$parser]['params']); $i++) {\r
-                       //print "<!-- " . $_xh[$parser]['params'][$i]. "-->\n";\r
-                       $plist.="$i - " .  $_xh[$parser]['params'][$i]. " \n";\r
-                       eval('$m->addParam(' . $_xh[$parser]['params'][$i]. ");");\r
-         }\r
-               // uncomment this to really see what the server's getting!\r
-               // xmlrpc_debugmsg($plist);\r
-         // now to deal with the method\r
-               $methName=$_xh[$parser]['method'];\r
-               if (ereg("^system\.", $methName)) {\r
-                       $dmap=$_xmlrpcs_dmap; $sysCall=1;\r
-               } else {\r
-                       $dmap=$this->dmap; $sysCall=0;\r
+                                       xml_get_current_line_number($parser)));\r
+                               xml_parser_free($parser);\r
+                       }\r
+                       else\r
+                       {\r
+                               xml_parser_free($parser);\r
+                               $m=new xmlrpcmsg($_xh[$parser]['method']);\r
+                               // now add parameters in\r
+                               $plist='';\r
+                               $allOK = 1;\r
+                               for($i=0; $i<sizeof($_xh[$parser]['params']); $i++)\r
+                               {\r
+                                       //print "<!-- " . $_xh[$parser]['params'][$i]. "-->\n";\r
+                                       $plist.="$i - " .  $_xh[$parser]['params'][$i]. ";\n";\r
+                                       $allOK = 0;\r
+                                       @eval('$m->addParam(' . $_xh[$parser]['params'][$i]. '); $allOK=1;');\r
+                                       if (!$allOK)\r
+                                       {\r
+                                               break;\r
+                                       }\r
+                               }\r
+                               // uncomment this to really see what the server's getting!\r
+                               // xmlrpc_debugmsg($plist);\r
+                               if (!$allOK)\r
+                               {\r
+                                       $r = new xmlrpcresp(0,\r
+                                               $xmlrpcerr['incorrect_params'],\r
+                                               $xmlrpcstr['incorrect_params'] . ": xml error in param " . $i);\r
+                               }\r
+                               else\r
+                               {\r
+                                       $r = $this->execute($m);\r
+                               }\r
+                       }\r
+                       return $r;\r
                }\r
-         if (isset($dmap[$methName]['function'])) {\r
-                       // dispatch if exists\r
-                       if (isset($dmap[$methName]['signature'])) {\r
-                               $sr=$this->verifySignature($m, \r
-                                                                                                                                       $dmap[$methName]['signature'] );\r
+\r
+               function execute ($m)\r
+               {\r
+                       global $xmlrpcerr, $xmlrpcstr, $_xmlrpcs_dmap;\r
+                       // now to deal with the method\r
+                       $methName = $m->method();\r
+                       $sysCall = ereg("^system\.", $methName);\r
+                       $dmap = $sysCall ? $_xmlrpcs_dmap : $this->dmap;\r
+\r
+                       if (!isset($dmap[$methName]['function']))\r
+                       {\r
+                               // No such method\r
+                               return new xmlrpcresp(0,\r
+                                       $xmlrpcerr['unknown_method'],\r
+                                       $xmlrpcstr['unknown_method']);\r
                        }\r
-                       if ( (!isset($dmap[$methName]['signature']))\r
-                                        || $sr[0]) {\r
-                               // if no signature or correct signature\r
-                               if ($sysCall) { \r
-                                       eval('$r=' . $dmap[$methName]['function'] . \r
-                                                        '($this, $m);');\r
-                               } else {\r
-                                       eval('$r=' . $dmap[$methName]['function'] . \r
-                                                        '($m);');\r
+\r
+                       // Check signature.\r
+                       if (isset($dmap[$methName]['signature']))\r
+                       {\r
+                               $sig = $dmap[$methName]['signature'];\r
+                               list($ok, $errstr) = $this->verifySignature($m, $sig);\r
+                               if(!$ok)\r
+                               {\r
+                                       // Didn't match.\r
+                                       return new xmlrpcresp(\r
+                                               0,\r
+                                               $xmlrpcerr['incorrect_params'],\r
+                                               $xmlrpcstr['incorrect_params'] . ": ${errstr}"\r
+                                       );\r
                                }\r
-                       } else {\r
-                               $r=new xmlrpcresp(0,\r
-                                                 $xmlrpcerr["incorrect_params"],\r
-                                                 $xmlrpcstr["incorrect_params"].": ". $sr[1]);\r
                        }\r
-         } else {\r
-               // else prepare error response\r
-               $r=new xmlrpcresp(0,\r
-                                                 $xmlrpcerr["unknown_method"],\r
-                                                 $xmlrpcstr["unknown_method"]);\r
-         }\r
-       }\r
-       return $r;\r
-  }\r
 \r
-  function echoInput() {\r
-       global $HTTP_RAW_POST_DATA;\r
+                       $func = $dmap[$methName]['function'];\r
 \r
-       // a debugging routine: just echos back the input\r
-       // packet as a string value\r
+                       if ($sysCall)\r
+                       {\r
+                               return call_user_func($func, $this, $m);\r
+                       }\r
+                       else\r
+                       {\r
+                               return call_user_func($func, $m);\r
+                       }\r
+               }\r
+\r
+               function echoInput()\r
+               {\r
+                       global $HTTP_RAW_POST_DATA;\r
 \r
-       $r=new xmlrpcresp;\r
-       $r->xv=new xmlrpcval( "'Aha said I: '" . $HTTP_RAW_POST_DATA, "string");\r
-       print $r->serialize();\r
-  }\r
-}\r
+                       // a debugging routine: just echos back the input\r
+                       // packet as a string value\r
 \r
+                       $r=new xmlrpcresp;\r
+                       $r->xv=new xmlrpcval( "'Aha said I: '" . $HTTP_RAW_POST_DATA, 'string');\r
+                       print $r->serialize();\r
+               }\r
+       }\r
 ?>\r