fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-01-09 03:32:00 +09:00
Code Issues Projects Releases Packages Wiki Activity

Ensure more consistent operation of security checks

Browse source 
- 수상한 파일이 업로드되었을 때 isSuccessInit = false로 지정
- isSuccessInit = false인 경우 무조건 에러메시지 출력 (xpressengine/xe-core#2304)
- 보안정책 관련 에러메시지는 msg_security_violation으로 통일
This commit is contained in:
Kijin Sung 2018-10-10 16:27:23 +09:00
parent 4dca555392
commit c3f1e24b02
2 changed files with 13 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

31
classes/module/ModuleHandler.class.php
View file

@ -43,14 +43,10 @@ class ModuleHandler extends Handler
}
$oContext = Context::getInstance();
if($oContext->isSuccessInit == FALSE)
if($oContext->isSuccessInit === false)
{
$logged_info = Context::get('logged_info');
if($logged_info->is_admin != "Y")
{
$this->error = 'msg_invalid_request';
return;
}
$this->error = 'msg_security_violation';
return;
}
// Set variables from request arguments
@ -70,26 +66,23 @@ class ModuleHandler extends Handler
}
// Validate variables to prevent XSS
$isInvalid = NULL;
if($this->module && !preg_match("/^([a-z0-9\_\-]+)$/i", $this->module))
$isInvalid = false;
if($this->module && !preg_match('/^[a-zA-Z0-9_-]+$/', $this->module))
{
$isInvalid = TRUE;
$isInvalid = true;
}
if($this->mid && !preg_match("/^([a-z0-9\_\-]+)$/i", $this->mid))
if($this->mid && !preg_match('/^[a-zA-Z0-9_-]+$/', $this->mid))
{
$isInvalid = TRUE;
$isInvalid = true;
}
if($this->act && !preg_match("/^([a-z0-9\_\-]+)$/i", $this->act))
if($this->act && !preg_match('/^[a-zA-Z0-9_-]+$/', $this->act))
{
$isInvalid = TRUE;
$isInvalid = true;
}
if($isInvalid)
{
htmlHeader();
echo lang('msg_security_violation');
htmlFooter();
Context::close();
exit;
$this->error = 'msg_security_violation';
return;
}
if(isset($this->act) && (strlen($this->act) >= 4 && substr_compare($this->act, 'disp', 0, 4) === 0))