fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-01-08 19:21:40 +09:00
Code Issues Projects Releases Packages Wiki Activity

When webshell defence, array var check

Browse source 
git-svn-id: http://xe-core.googlecode.com/svn/branches/1.5.3.2@12316 201d5d3c-b55e-5fd7-737f-ddc643e51545
This commit is contained in:
ovclas 2012-11-27 11:06:34 +00:00
parent d870abfc10
commit f167d85c7b
1 changed files with 33 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

48
classes/context/Context.class.php
View file

@ -113,6 +113,15 @@ class Context {
* @var bool true if attached file exists
*/
var $is_uploaded = false;
/**
* Pattern for request vars check
* @var array
*/
var $pattern = array(
'/<\?/iUsm',
'/<\%/iUsm',
'/<script(\s|\S)*language[\s]*=("|\')php("|\')(\s|\S)*/iUsm'
);
/**
* Check init
* @var bool false if init fail
@ -807,12 +816,6 @@ class Context {
function _setRequestArgument() {
if(!count($_REQUEST)) return;
$pattern = array(
'/<\?/iUsm',
'/<\%/iUsm',
'/<script(\s|\S)*language[\s]*=("|\')php("|\')(\s|\S)*/iUsm'
);
foreach($_REQUEST as $key => $val) {
if($val === '' || Context::get($key)) continue;
$val = $this->_filterRequestVar($key, $val);
@ -823,21 +826,36 @@ class Context {
if($set_to_vars)
{
foreach($pattern AS $key2=>$value2)
{
$result = preg_match($value2, $val);
if($result)
{
$this->isSuccessInit = false;
break;
}
}
$this->_recursiveCheckVar($val);
}
$this->set($key, $val, $set_to_vars);
}
}
function _recursiveCheckVar($val)
{
if(is_string($val))
{
foreach($this->pattern as $pattern)
{
$result = preg_match($pattern, $val);
if($result)
{
$this->isSuccessInit = FALSE;
return;
}
}
}
else if(is_array($val))
{
foreach($val as $val2)
{
$this->_recursiveCheckVar($val2);
}
}
}
/**
* Handle request arguments for JSON
*