fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-05-01 00:02:21 +09:00
Code Issues Projects Releases Packages Wiki Activity

관리자 세션을 악용할 수 있는 img, embed, input등의 src 값 변조 시도를 사전 제거하는 코드 추가

Browse source 
git-svn-id: http://xe-core.googlecode.com/svn/sandbox@4354 201d5d3c-b55e-5fd7-737f-ddc643e51545
This commit is contained in:
zero 2008-07-14 08:15:57 +00:00
parent de22070cee
commit a557a12e42
3 changed files with 44 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

13
modules/opage/opage.controller.php
View file

@ -72,7 +72,7 @@
$this->target_path = $path;
// element의 속성중 value에 " 로 안 묶여 있는 것을 검사하여 묶어줌
$content = preg_replace_callback('/([^=^"^ ]*)=([^ ^>]*)/i', array($this, '_fixQuotation'), $content);
$content = preg_replace_callback('/([^=^"^ ]*)=([^ ^>]*)/i', fixQuotation, $content);
// img, input, a, link등의 href, src값 변경
$content = preg_replace_callback('!(script|link|a|img|input)([^>]*)(href|src)=[\'"](.*?)[\'"]!is', array($this, '_replaceSrc'), $content);
@ -104,16 +104,5 @@
$buff = sprintf('url(%s)', $href);
return $buff;
}
/**
* @brief 태그의 속성에 " 를 추가
**/
function _fixQuotation($matches) {
$key = $matches[1];
$val = $matches[2];
if(substr($val,0,1)!='"') $val = '"'.$val.'"';
return sprintf('%s=%s', $key, $val);
}
}
?>