SMF in WordPress

For some reason, while using WordPress and including SMF’s SSI.php, it would not detect my logged in SMF session. Baffled and almost thinking this was a SMF bug of some sorts, I began to debug this process.

Well it turns out it is sorta a SMF old PHP support issue, but the problem lies in WordPress. This is the function in WordPress wp-includes/load.php

/**
 * Add magic quotes to $_GET, $_POST, $_COOKIE, and $_SERVER.
 *
 * Also forces $_REQUEST to be $_GET + $_POST. If $_SERVER, $_COOKIE,
 * or $_ENV are needed, use those superglobals directly.
 *
 * @access private
 * @since 3.0.0
 */
function wp_magic_quotes() {
        // If already slashed, strip.
        if ( get_magic_quotes_gpc() ) {
                $_GET    = stripslashes_deep( $_GET    );
                $_POST   = stripslashes_deep( $_POST   );
                $_COOKIE = stripslashes_deep( $_COOKIE );
        }
  
        // Escape with wpdb.
        $_GET    = add_magic_quotes( $_GET    );
        $_POST   = add_magic_quotes( $_POST   );
        $_COOKIE = add_magic_quotes( $_COOKIE );
        $_SERVER = add_magic_quotes( $_SERVER );

        // Force REQUEST to be GET + POST.
        $_REQUEST = array_merge( $_GET, $_POST );
}

The problem here, is that they add magic quotes to the cookie. Not quite sure why they are even doing this. But it broke adding SMF. The part in SMF which failed because of this is in SMFs Sources/Load.php in the loadUserSettings function

		// Fix a security hole in PHP 4.3.9 and below...
		if (preg_match('~^a:[34]:\{i:0;(i:\d{1,6}|s:[1-8]:"\d{1,8}");i:1;s:(0|40):"([a-fA-F0-9]{40})?";i:2;[id]:\d{1,14};(i:3;i:\d;)?\}$~i', $_COOKIE[$cookiename]) == 1)
		{
			list ($id_member, $password) = @unserialize($_COOKIE[$cookiename]);
			$id_member = !empty($id_member) && strlen($password) > 0 ? (int) $id_member : 0;
		}
		else
			$id_member = 0;

Because of old PHP support in SMF, its trying to combat a cookie security issue that existed below PHP 4.3.9. Now I don’t use that version, but I rather not strip out the code. The preg match was failing because it was not finding that valid string in the cookie. Since all the double quotes where escaped with a slash \.

For my code, I called in Settings.php from SMF and then did a stripslashes on the cookie. Then I included SSI.php, with the results I expected of it finding my active SMF session.

		require_once(pBS::get('smf_dir') . '/Settings.php');
		if (isset($_COOKIE[$cookiename]))
			$_COOKIE[$cookiename] = stripslashes($_COOKIE[$cookiename]);

		require_once(pBS::get('smf_dir') . '/SSI.php');

I should note because SMF uses a lot of global variables, that I had to globalize all of those before hand. I just borrowed the globals from SSI.php and put them into that scripts function.