archive/piwigo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

merge r30864 from trunk to branch 2.7

Browse source 
bug 3186: improved security on search.php


git-svn-id: http://piwigo.org/svn/branches/2.7@30867 68402e56-0260-453c-a942-63ccdbb3a9ee
This commit is contained in:
plegall 2015-01-08 13:11:46 +00:00
parent bd4ff9fe71
commit 6d04381f9d
2 changed files with 7 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
include/functions.inc.php
View file

@ -1877,9 +1877,9 @@ function check_input_parameter($param_name, $param_array, $is_array, $pattern, $
fatal_error('[Hacking attempt] the input parameter "'.$param_name.'" should be an array'); fatal_error('[Hacking attempt] the input parameter "'.$param_name.'" should be an array');
} }
foreach ($param_value as $item_to_check) foreach ($param_value as $key => $item_to_check)
{ {
if (!preg_match($pattern, $item_to_check)) if (!preg_match(PATTERN_ID, $key) or !preg_match($pattern, $item_to_check))
{ {
fatal_error('[Hacking attempt] an item is not valid in input parameter "'.$param_name.'"'); fatal_error('[Hacking attempt] an item is not valid in input parameter "'.$param_name.'"');
} }

9
search.php
View file

@ -48,8 +48,7 @@ if (isset($_POST['submit']))
and !preg_match('/^\s*$/', $_POST['search_allwords'])) and !preg_match('/^\s*$/', $_POST['search_allwords']))
{ {
check_input_parameter('mode', $_POST, false, '/^(OR|AND)$/'); check_input_parameter('mode', $_POST, false, '/^(OR|AND)$/');
check_input_parameter('fields', $_POST, true, '/^(name|comment|file)$/');
$fields = array_intersect($_POST['fields'], array('name', 'comment', 'file'));
$drop_char_match = array( $drop_char_match = array(
'-','^','$',';','#','&','(',')','<','>','`','\'','"','|',',','@','_', '-','^','$',';','#','&','(',')','<','>','`','\'','"','|',',','@','_',
@ -71,7 +70,7 @@ if (isset($_POST['submit']))
) )
), ),
'mode' => $_POST['mode'], 'mode' => $_POST['mode'],
'fields' => $fields, 'fields' => $_POST['fields'],
); );
} }
@ -112,6 +111,8 @@ if (isset($_POST['submit']))
} }
// dates // dates
check_input_parameter('date_type', $_POST, false, '/^date_(creation|available)$/');
$type_date = $_POST['date_type']; $type_date = $_POST['date_type'];
if (!empty($_POST['start_year'])) if (!empty($_POST['start_year']))
@ -151,7 +152,7 @@ if (isset($_POST['submit']))
INSERT INTO '.SEARCH_TABLE.' INSERT INTO '.SEARCH_TABLE.'
(rules, last_seen) (rules, last_seen)
VALUES VALUES
(\''.serialize($search).'\', NOW()) (\''.pwg_db_real_escape_string(serialize($search)).'\', NOW())
;'; ;';
pwg_query($query); pwg_query($query);