fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-04-02 01:52:10 +09:00
Code Issues Projects Releases Packages Wiki Activity

#18986199 : fixed security vulnerability

Browse source 
git-svn-id: http://xe-core.googlecode.com/svn/sandbox@7579 201d5d3c-b55e-5fd7-737f-ddc643e51545
This commit is contained in:
haneul 2010-07-05 02:52:44 +00:00
parent 54ccb240f2
commit d02c0ec987
1 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
config/func.inc.php
View file

@ -677,8 +677,13 @@
function _isHackedSrc($src) {
if(!$src) return false;
if($src) {
$target = trim($src);
if(preg_match('/(\s|(\&\#)|(script:))/i', $target)) return true;
if(preg_match('/data:/i', $target)) return true;
$url_info = parse_url($src);
$query = $url_info['query'];
if(!trim($query)) return false;
$query = str_replace("&","&",$query);
$queries = explode('&', $query);
$cnt = count($queries);
@ -690,9 +695,6 @@
$val = strtolower(trim(substr($tmp_str,$pos+1)));
if( ($key=='module'&&$val=='admin') || ($key=='act'&&preg_match('/admin/i',$val)) ) return true;
}
$target = trim($src);
if(preg_match('/(\s|(\&\#)|(script:))/i', $target)) return true;
}
return false;
}