The boot.php had been cleared of most functions

src/Core/Lock/Type/SemaphoreLock.php

@@ -24,7 +24,7 @@ namespace Friendica\Core\Lock\Type;
 use Friendica\Core\Cache\Enum\Duration;
 use Friendica\Core\Lock\Enum\Type;
 use Friendica\Core\Lock\Exception\InvalidLockDriverException;
-use function get_temppath;
+use Friendica\Core\System;
 
 class SemaphoreLock extends AbstractLock
 {
@@ -44,7 +44,7 @@ class SemaphoreLock extends AbstractLock
 	{
 		$success = true;
 
-		$temp = get_temppath();
+		$temp = System::getTempPath();
 
 		$file = $temp . '/' . $key . '.sem';
 

src/Core/Renderer.php

@@ -84,7 +84,7 @@ class Renderer
 			$output = $t->replaceMacros($template, $vars);
 		} catch (Exception $e) {
 			DI::logger()->critical($e->getMessage(), ['template' => $template, 'vars' => $vars]);
-			$message = is_site_admin() ?
+			$message = DI::app()->isSiteAdmin() ?
 				$e->getMessage() :
 				DI::l10n()->t('Friendica can\'t display this page at the moment, please contact the administrator.');
 			throw new ServiceUnavailableException($message);
@@ -113,7 +113,7 @@ class Renderer
 			$template = $t->getTemplateFile($file, $subDir);
 		} catch (Exception $e) {
 			DI::logger()->critical($e->getMessage(), ['file' => $file, 'subDir' => $subDir]);
-			$message = is_site_admin() ?
+			$message = DI::app()->isSiteAdmin() ?
 				$e->getMessage() :
 				DI::l10n()->t('Friendica can\'t display this page at the moment, please contact the administrator.');
 			throw new ServiceUnavailableException($message);
@@ -140,7 +140,7 @@ class Renderer
 		} else {
 			$admin_message = DI::l10n()->t('template engine cannot be registered without a name.');
 			DI::logger()->critical($admin_message, ['class' => $class]);
-			$message = is_site_admin() ?
+			$message = DI::app()->isSiteAdmin() ?
 				$admin_message :
 				DI::l10n()->t('Friendica can\'t display this page at the moment, please contact the administrator.');
 			throw new ServiceUnavailableException($message);
@@ -174,7 +174,7 @@ class Renderer
 
 		$admin_message = DI::l10n()->t('template engine is not registered!');
 		DI::logger()->critical($admin_message, ['template_engine' => $template_engine]);
-		$message = is_site_admin() ?
+		$message = DI::app()->isSiteAdmin() ?
 			$admin_message :
 			DI::l10n()->t('Friendica can\'t display this page at the moment, please contact the administrator.');
 		throw new ServiceUnavailableException($message);

src/Core/System.php

@@ -21,10 +21,12 @@
 
 namespace Friendica\Core;
 
+use Exception;
 use Friendica\DI;
 use Friendica\Network\HTTPException\FoundException;
 use Friendica\Network\HTTPException\MovedPermanentlyException;
 use Friendica\Network\HTTPException\TemporaryRedirectException;
+use Friendica\Util\BasePath;
 use Friendica\Util\XML;
 
 /**
@@ -323,6 +325,88 @@ class System
 		exit();
 	}
 
+	/**
+	 * Fetch the temp path of the system
+	 *
+	 * @return string Path for temp files
+	 */
+	public static function getTempPath()
+	{
+		$temppath = DI::config()->get("system", "temppath");
+
+		if (($temppath != "") && System::isDirectoryUsable($temppath)) {
+			// We have a temp path and it is usable
+			return BasePath::getRealPath($temppath);
+		}
+
+		// We don't have a working preconfigured temp path, so we take the system path.
+		$temppath = sys_get_temp_dir();
+
+		// Check if it is usable
+		if (($temppath != "") && System::isDirectoryUsable($temppath)) {
+			// Always store the real path, not the path through symlinks
+			$temppath = BasePath::getRealPath($temppath);
+
+			// To avoid any interferences with other systems we create our own directory
+			$new_temppath = $temppath . "/" . DI::baseUrl()->getHostname();
+			if (!is_dir($new_temppath)) {
+				/// @TODO There is a mkdir()+chmod() upwards, maybe generalize this (+ configurable) into a function/method?
+				mkdir($new_temppath);
+			}
+
+			if (System::isDirectoryUsable($new_temppath)) {
+				// The new path is usable, we are happy
+				DI::config()->set("system", "temppath", $new_temppath);
+				return $new_temppath;
+			} else {
+				// We can't create a subdirectory, strange.
+				// But the directory seems to work, so we use it but don't store it.
+				return $temppath;
+			}
+		}
+
+		// Reaching this point means that the operating system is configured badly.
+		return '';
+	}
+
+	/**
+	 * Returns the path where spool files are stored
+	 *
+	 * @return string Spool path
+	 */
+	public static function getSpoolPath()
+	{
+		$spoolpath = DI::config()->get('system', 'spoolpath');
+		if (($spoolpath != "") && System::isDirectoryUsable($spoolpath)) {
+			// We have a spool path and it is usable
+			return $spoolpath;
+		}
+
+		// We don't have a working preconfigured spool path, so we take the temp path.
+		$temppath = self::getTempPath();
+
+		if ($temppath != "") {
+			// To avoid any interferences with other systems we create our own directory
+			$spoolpath = $temppath . "/spool";
+			if (!is_dir($spoolpath)) {
+				mkdir($spoolpath);
+			}
+
+			if (System::isDirectoryUsable($spoolpath)) {
+				// The new path is usable, we are happy
+				DI::config()->set("system", "spoolpath", $spoolpath);
+				return $spoolpath;
+			} else {
+				// We can't create a subdirectory, strange.
+				// But the directory seems to work, so we use it but don't store it.
+				return $temppath;
+			}
+		}
+
+		// Reaching this point means that the operating system is configured badly.
+		return "";
+	}
+
 	/// @todo Move the following functions from boot.php
 	/*
 	function local_user()
@@ -331,7 +415,5 @@ class System
 	function notice($s)
 	function info($s)
 	function is_site_admin()
-	function get_temppath()
-	function get_spoolpath()
 	*/
 }

src/Core/Worker.php

@@ -277,6 +277,44 @@ class Worker
 		return DBA::exists('workerqueue', $condition);
 	}
 
+	/**
+	 * Checks if the given file is valid to be included
+	 *
+	 * @param mixed $file 
+	 * @return bool 
+	 */
+	private static function validateInclude(&$file)
+	{
+		$orig_file = $file;
+	
+		$file = realpath($file);
+	
+		if (strpos($file, getcwd()) !== 0) {
+			return false;
+		}
+	
+		$file = str_replace(getcwd() . "/", "", $file, $count);
+		if ($count != 1) {
+			return false;
+		}
+	
+		if ($orig_file !== $file) {
+			return false;
+		}
+	
+		$valid = false;
+		if (strpos($file, "include/") === 0) {
+			$valid = true;
+		}
+	
+		if (strpos($file, "addon/") === 0) {
+			$valid = true;
+		}
+	
+		// Simply return flag
+		return $valid;
+	}
+	
 	/**
 	 * Execute a worker entry
 	 *
@@ -360,7 +398,7 @@ class Worker
 			$include = "include/".$include.".php";
 		}
 
-		if (!validate_include($include)) {
+		if (!self::validateInclude($include)) {
 			Logger::warning("Include file is not valid", ['file' => $argv[0]]);
 			$stamp = (float)microtime(true);
 			DBA::delete('workerqueue', ['id' => $queue["id"]]);