<?php

if (!is_array($conf))
  $conf = array();
// This allows us to test whether this file has been included
$conf['fb_settings_check'] = TRUE;

if (isset($_REQUEST['fb_sig'])) {
  // It's a facebook callback!

  // Can't rely on cookies for session data, use what fb passes in.
  // The following settings make drupal's session.inc work for us.
  // Would be cleaner, perhaps, to use our own session.inc, but we're lazy. ;)

  // The cookie domain and session name get munged by bootstrap.inc
  // AFTER we get called here.  So we have to be extra careful to use
  // the same values they end up with.  In other words, the slightest change
  // to bootstrap.inc could break this (as it did from drupal 5.1 to
  // drupal 5.2) and its a real pain to track down.
  global $cookie_domain;
  if (!$cookie_domain) {
    // If the $cookie_domain is empty, try to use the session.cookie_domain.
    $cookie_domain = ini_get('session.cookie_domain');
  }
  if ($cookie_domain) {
    // If the user specifies the cookie domain, also use it for session name.
    $session_name = $cookie_domain;
  }
  else {
    // Otherwise use $base_url as session name, without the protocol
    // to use the same session identifiers across http and https.
    list( , $session_name) = explode('://', $base_url, 2);
    // We try to set the cookie domain to the hostname.
    // We escape the hostname because it can be modified by a visitor.
    if (!empty($_SERVER['HTTP_HOST'])) {
      $cookie_domain = check_plain($_SERVER['HTTP_HOST']);
    }
  }
  // Strip leading periods, www., and port numbers from cookie domain.
  $cookie_domain = ltrim($cookie_domain, '.');
  if (strpos($cookie_domain, 'www.') === 0) {
    $cookie_domain = substr($cookie_domain, 4);
  }
  $cookie_domain = explode(':', $cookie_domain);
  $cookie_domain = '.'. $cookie_domain[0];
  
  // Now that we have the proper name of the cookie domain, we have to
  // recognize that facebook is not sending cookies.  So we use the fb
  // session key instead.

  if (isset($_REQUEST['fb_sig_session_key']))
    $sk = 'fb_' . $_REQUEST['fb_sig_session_key'];
  else
    $sk = 'fb_not_logged_in';

  //$cookie_domain = '.'.$sk.'.'.$cookie_domain; // ensure it's unique
  $session_name = $cookie_domain;
  $session_name_after_bootstrap = 'SESS'. md5($session_name); // This has to be exactly the same as bootstrap.inc!

  // Now finally, the line that will trick session.inc into working for us:
  $_COOKIE[$session_name_after_bootstrap] = $sk;

  //print("set cookie[" . $session_name_after_bootstrap . "] to $sk.");  // debug
  // We also need the session_id set to something, so that form token validation can work.
  session_id($sk);


  // Force clean URLs.  Looks better on facebook, and helps us know
  // what to expect Note that we set our facebook callback to end in
  // "?q=" so clean URLs will work in a facebook app whether or not
  // they work locally
  $conf['clean_url'] = 1;

  // Force the admin theme to be our facebook theme.
  // TODO: find a way to make this configurable.  I.e. to support iframe apps.
  $conf['admin_theme'] = 'fb_fbml';

  // Filters will behave differently on facebook, so we cannot share the cache_filter table.
  if (!is_array($db_prefix))
	if (isset($db_prefix)) 
	  $db_prefix = array('default' => $db_prefix);
	else
	  $db_prefix = array();
  if (!isset($db_prefix['cache_filter']))
	$db_prefix['cache_filter'] = 'fb_';
  
  // Worth considering: use db_prefix to give facebook, or each app,
  // it's own set of users.

 }

// Perhaps change other ini session settings here???

?>