iarv/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-03-28 17:42:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

bug 1329 fixed: add a check_input_parameter function to prevent hacking

Browse Source 
attempts.

git-svn-id: http://piwigo.org/svn/branches/2.0@4495 68402e56-0260-453c-a942-63ccdbb3a9ee
This commit is contained in:
plegall
2009-12-15 00:33:57 +00:00
parent 8bbbe6c794
commit 742e2a7c0a
6 changed files with 59 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
admin/cat_list.php
View File

@@ -64,6 +64,8 @@ function save_categories_order($categories)
// | initialization |
// +-----------------------------------------------------------------------+
check_input_parameter('parent_id', @$_GET['parent_id'], false, PATTERN_ID);
$categories = array();
$base_url = get_root_url().'admin.php?page=cat_list';

2
admin/element_set.php
View File

@@ -39,6 +39,8 @@ include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
// +-----------------------------------------------------------------------+
check_status(ACCESS_ADMINISTRATOR);
check_input_parameter('selection', @$_POST['selection'], true, PATTERN_ID);
// +-----------------------------------------------------------------------+
// | caddie management |
// +-----------------------------------------------------------------------+

6
admin/element_set_global.php
View File

@@ -43,6 +43,12 @@ check_status(ACCESS_ADMINISTRATOR);
// | deletion form submission |
// +-----------------------------------------------------------------------+
// the $_POST['selection'] was already checked in element_set.php
check_input_parameter('add_tags', @$_POST['add_tags'], true, PATTERN_ID);
check_input_parameter('del_tags', @$_POST['del_tags'], true, PATTERN_ID);
check_input_parameter('associate', @$_POST['associate'], false, PATTERN_ID);
check_input_parameter('dissociate', @$_POST['dissociate'], false, PATTERN_ID);
if (isset($_POST['delete']))
{
if (isset($_POST['confirm_deletion']) and 1 == $_POST['confirm_deletion'])

3
admin/picture_modify.php
View File

@@ -33,6 +33,9 @@ include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
// +-----------------------------------------------------------------------+
check_status(ACCESS_ADMINISTRATOR);
check_input_parameter('image_id', $_GET['image_id'], false, PATTERN_ID);
check_input_parameter('cat_id', @$_GET['cat_id'], false, PATTERN_ID);
// +-----------------------------------------------------------------------+
// | synchronize metadata |
// +-----------------------------------------------------------------------+

3
include/constants.php
View File

@@ -38,6 +38,9 @@ define('ACCESS_ADMINISTRATOR', 3);
define('ACCESS_WEBMASTER', 4);
define('ACCESS_CLOSED', 5);
// Sanity checks
define('PATTERN_ID', '/^\d+$/');
// Table names
if (!defined('CATEGORIES_TABLE'))
define('CATEGORIES_TABLE', $prefixeTable.'categories');

43
include/functions.inc.php
View File

@@ -1492,4 +1492,47 @@ function get_comment_post_key($image_id)
)
);
}
/*
* breaks the script execution if the given value doesn't match the given
* pattern. This should happen only during hacking attempts.
*
* @param string param_name
* @param mixed param_value
* @param boolean is_array
* @param string pattern
*
* @return void
*/
function check_input_parameter($param_name, $param_value, $is_array, $pattern)
{
// it's ok if the input parameter is null
if (empty($param_value))
{
return true;
}
if ($is_array)
{
if (!is_array($param_value))
{
die('[Hacking attempt] the input parameter "'.$param_name.'" should be an array');
}
foreach ($param_value as $item_to_check)
{
if (!preg_match($pattern, $item_to_check))
{
die('[Hacking attempt] an item is not valid in input parameter "'.$param_name.'"');
}
}
}
else
{
if (!preg_match($pattern, $param_value))
{
die('[Hacking attempt] the input parameter "'.$param_name.'" is not valid');
}
}
}
?>