fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-05-10 20:44:28 +09:00
Code Issues Projects Releases Packages Wiki Activity

When webshell defence, array var check

Browse source 
git-svn-id: http://xe-core.googlecode.com/svn/branches/1.5.3.2@12316 201d5d3c-b55e-5fd7-737f-ddc643e51545
This commit is contained in:
ovclas 2012-11-27 11:06:34 +00:00
parent d870abfc10
commit f167d85c7b
1 changed files with 33 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

48
classes/context/Context.class.php
View file

@ -113,6 +113,15 @@ class Context {
* @var bool true if attached file exists * @var bool true if attached file exists
*/ */
var $is_uploaded = false; var $is_uploaded = false;
/**
* Pattern for request vars check
* @var array
*/
var $pattern = array(
'/<\?/iUsm',
'/<\%/iUsm',
'/<script(\s|\S)*language[\s]*=("|\')php("|\')(\s|\S)*/iUsm'
);
/** /**
* Check init * Check init
* @var bool false if init fail * @var bool false if init fail
@ -807,12 +816,6 @@ class Context {
function _setRequestArgument() { function _setRequestArgument() {
if(!count($_REQUEST)) return; if(!count($_REQUEST)) return;
$pattern = array(
'/<\?/iUsm',
'/<\%/iUsm',
'/<script(\s|\S)*language[\s]*=("|\')php("|\')(\s|\S)*/iUsm'
);
foreach($_REQUEST as $key => $val) { foreach($_REQUEST as $key => $val) {
if($val === '' || Context::get($key)) continue; if($val === '' || Context::get($key)) continue;
$val = $this->_filterRequestVar($key, $val); $val = $this->_filterRequestVar($key, $val);
@ -823,21 +826,36 @@ class Context {
if($set_to_vars) if($set_to_vars)
{ {
foreach($pattern AS $key2=>$value2) $this->_recursiveCheckVar($val);
{
$result = preg_match($value2, $val);
if($result)
{
$this->isSuccessInit = false;
break;
}
}
} }
$this->set($key, $val, $set_to_vars); $this->set($key, $val, $set_to_vars);
} }
} }
function _recursiveCheckVar($val)
{
if(is_string($val))
{
foreach($this->pattern as $pattern)
{
$result = preg_match($pattern, $val);
if($result)
{
$this->isSuccessInit = FALSE;
return;
}
}
}
else if(is_array($val))
{
foreach($val as $val2)
{
$this->_recursiveCheckVar($val2);
}
}
}
/** /**
* Handle request arguments for JSON * Handle request arguments for JSON
* *