Changeset 115 for trunk/admin

Timestamp:

04/10/06 22:17:16 (3 years ago)

Author:

michiel

Message:

Fix a lot of possible sql-injections.

Re #54

Files:

• trunk/admin/index.php (modified) (21 diffs)

trunk/admin/index.php

@@ -114 +114 @@
                         <div class="log_head">
                                 <span class="log_subject">
-                                        &nbsp;&nbsp;<a href="?action=edit_post&amp;id=<?=$row["id"]?>"><?=$row["title"]?></a>&nbsp;&nbsp;
+                                        &nbsp;&nbsp;<a href="?action=edit_post&amp;id=<?=$row["id"]?>"><?=stripslashes($row["title"])?></a>&nbsp;&nbsp;
                                         <?
-                                                $r =& $db->query("SELECT COUNT(*) FROM articles WHERE categories_id=".$row["id"]);
+                                                $r =& $db->query(sprintf("SELECT COUNT(*) FROM articles WHERE categories_id = %d", $row["id"]));
                                                 if (PEAR::isError($r)) {
                                                         die($r->getMessage());
@@ -127 +127 @@
                         <div class="log_body">
                                 <span class="log_contents">
-                                        <?=$row["body"]?>
+                                        <?=stripslashes($row["body"])?>
                                 </span>
                         </div>
@@ -168 +168 @@
                 $post["date"]          = mktime();
                 $post["categories_id"] = 0;
-                $post["active"]        = "on";
-                $post["public"]        = "on";
-                $post["mail_comments"] = "on";
-        } else {
-                $res =& $db->query("SELECT * FROM articles WHERE id=$id");
+                $post["active"]        = 1;
+                $post["public"]        = 1;
+                $post["mail_comments"] = 1;
+        } else {
+                $res =& $db->query(sprintf("SELECT * FROM articles WHERE id = %d", $id));
                 if (PEAR::isError($res)) {
                         die($res->getMessage());
@@ -202 +202 @@
                 <div class="log_head">
                         <span class="log_subject">
-                                &nbsp;&nbsp;<input type="text" id="title" name="post[title]" value="<?=$post["title"]?>" />&nbsp;&nbsp;
+                                &nbsp;&nbsp;<input type="text" id="title" name="post[title]" value="<?=stripslashes($post["title"])?>" />&nbsp;&nbsp;
                                 category:
                                 <select name="post[categories_id]">
@@ -223 +223 @@
                                 /* xinha stuff */
                                 ?>
-                                <textarea id="editor_area" name="post[body]" rows="10" cols="50" style="width: 100%"><?=$post["body"]?></textarea>
+                                <textarea id="editor_area" name="post[body]" rows="10" cols="50" style="width: 100%"><?=stripslashes($post["body"])?></textarea>
                                 <?
 
@@ -253 +253 @@
                                 </select>
                                 <br />
-      send trackback info to: 
-      <input type="text" name="post[tb_uri]" value="<?=$post["tb_uri"]?>" size="50" /><br />
-                                <input type="checkbox" name="post[mail_comments]"<? if ($post["mail_comments"]) { echo " CHECKED"; } ?> />&nbsp;send comments as email to me.</span>
+                                send trackback info to: 
+                                <input type="text" name="post[tb_uri]" value="<?=$post["tb_uri"]?>" size="50" /><br />
+                                <input type="checkbox" value="1" name="post[mail_comments]"<? if ($post["mail_comments"]) { echo " checked=\"checked\""; } ?> />&nbsp;send comments as email to me.
+                        </span>
                         <input type="submit" value="save" />
                         <? if ($post["id"]) { ?>
@@ -264 +265 @@
                 </div>
                 <div class="log_foot">
-                        <span class="log_date">active: <input type="checkbox" name="post[active]" <? if ($post["active"]) { echo "checked=\"checked\""; } ?> /></span>
-                        <span class="log_author">public: <input type="checkbox" name="post[public]" <? if ($post["public"]) { echo "checked=\"checked\""; } ?> /></span>
-                        <span class="log_author">aside: <input type="checkbox" name="post[aside]" <? if ($post["aside"]) { echo "checked=\"checked\""; } ?> /></span>
+                        <span class="log_date">active: <input type="checkbox" value="1" name="post[active]" <? if ($post["active"]) { echo "checked=\"checked\""; } ?> /></span>
+                        <span class="log_author">public: <input type="checkbox" value="1" name="post[public]" <? if ($post["public"]) { echo "checked=\"checked\""; } ?> /></span>
+                        <span class="log_author">aside: <input type="checkbox" value="1" name="post[aside]" <? if ($post["aside"]) { echo "checked=\"checked\""; } ?> /></span>
                 </div>
         </div>
@@ -280 +281 @@
 //---------------------------------------
 function save_post($post) {
-        global $db;
+        $db = $GLOBALS["db"];
         if ($post["id"]) {
-                $sql = "SELECT date,active FROM articles WHERE id=".(int)$post["id"];
+                $sql = sprintf("SELECT date,active FROM articles WHERE id = %d", $post["id"]);
                 $r =& $db->query($sql);
                 $r->fetchInto($orig_post, DB_FETCHMODE_ASSOC);
-                $query  = "UPDATE articles SET ";
-                $query .= "\"title\"='".$post["title"]."'";
-                $query .= ", \"body\"='".$post["body"]."'";
-                $query .= ", categories_id=".$post["categories_id"];
-                $query .= ($post["active"]=="on")?", active=1":", active=0";
-                $query .= ($post["public"]=="on")?", public=1":", public=0";
-                $query .= ($post["aside"]=="on")?", aside=1":", aside=0";
-                $query .= ($post["mail_comments"]=="on")?", mail_comments=1":", mail_comments=0";
+                $query  = sprintf("UPDATE articles SET title = '%s', body = '%s', categories_id = %d, active = %d, public = %d, aside = %d, mail_comments = %d",
+                        preg_quote(strip_tags($post["title"]), "'"),
+                        preg_quote(_strip_tags($post["body"]), "'"),
+                        $post["categories_id"],
+                        $post["active"],
+                        $post["public"],
+                        $post["aside"],
+                        $post["mail_comments"]
+                );
                 //if post was inactive, and now it's active, we don't update the "modified" fields in the database.
-                if ($post["active"] == "on") {
-                        if ($orig_post["active"]!=0) {
-                                $query .= ", last_modified=".mktime();
-                                $query .= ", modified_by=".$_SESSION["author_id"];              
+                if ($post["active"]) {
+                        if ($orig_post["active"]) {
+                                $query .= sprintf(", last_modified = %d", mktime());
+                                $query .= sprintf(", modified_by = %d", $_SESSION["author_id"]);                
                         }
                 }
                 //only update the date if it is not the same day as the posts original date
                 if (date("d", $orig_post["date"]) != $post["day"] || date("m", $orig_post["date"]) != $post["month"] || date("Y", $orig_post["date"]) != $post["year"]) {
-                        $query .= ", date=".mktime(date("H"), date("i"), date("s"), $post["month"], $post["day"], $post["year"]);
-                }
-                $query .= ", ping_sent=1, tb_uri='".$tb_uri."'";
-                $query .= " WHERE id=".$post["id"];
-        } else {
-                $query  = "INSERT INTO articles (title, body, authors_id, categories_id, date, active, public, aside, mail_comments, ping_sent, tb_uri) VALUES (";
-                $query .= "'".$post["title"]."'";
-                $query .= ", '".$post["body"]."'";
-                $query .= ", ".$_SESSION["author_id"];
-                $query .= ", ".$post["categories_id"];
-                $query .= ", ".mktime(date("H"), date("i"), date("s"), $post["month"], $post["day"], $post["year"]);
-                $query .= ($post["active"]=="on")?", 1":", 0";
-                $query .= ($post["public"]=="on")?", 1":", 0";
-                $query .= ($post["aside"]=="on")?", 1":", 0";
-                $query .= ($post["mail_comments"]=="on")?", 1":", 0";
-                $query .= ", 0";
-                $query .= ", '".$post["tb_uri"]."'";
-                $query .= ")";
+                        $query .= sprintf(", date = %d", mktime(date("H"), date("i"), date("s"), $post["month"], $post["day"], $post["year"]));
+                }
+                $query .= sprintf(", ping_sent = 1, tb_uri = '%s'", preg_quote($tb_uri, "'"));
+                $query .= sprintf(" WHERE id = %d", $post["id"]);
+        } else {
+                $query  = "INSERT INTO articles (title, body, authors_id, categories_id, date, active, public, aside, mail_comments, ping_sent, tb_uri)";
+                $query .= sprintf("VALUES ('%s', '%s', %d, %d, %d, %d, %d, %d, %d, %d, '%s')",
+                        preg_quote(strip_tags($post["title"]), "'"),
+                        preg_quote(_strip_tags($post["body"]), "'"),
+                        $_SESSION["author_id"],
+                        $post["categories_id"],
+                        mktime(date("H"), date("i"), date("s"), $post["month"], $post["day"], $post["year"]),
+                        $post["active"], $post["public"], $post["aside"], $post["mail_comments"], 0,
+                        preg_quote($post["tb_uri"], "'")
+                );
         }
         $res =& $db->query($query);
@@ -326 +325 @@
         }
         if (!$post["id"]) {
-                $sql = "SELECT id FROM articles WHERE title='".$post["title"]."' AND body='".$post["body"]."' AND authors_id=".$_SESSION["author_id"]." AND categories_id=".$post["categories_id"];
+                /* this is a new post. fetch old data */
+                $sql = sprintf("SELECT id FROM articles WHERE title = '%s' AND body = '%s' AND authors_id = %d AND categories_id = %d",
+                        preg_quote(strip_tags($post["title"]), "'"),
+                        preg_quote(_strip_tags($post["body"]), "'"),
+                        $_SESSION["author_id"], $post["categories_id"]
+                );
                 $res =& $db->query($sql);
                 $res->fetchInto($temp, DB_FETCHMODE_ASSOC);
@@ -340 +344 @@
                 $http->addPostData("url", $post_uri);
                 $http->addPostData("blog_name", "http://".$_SERVER["SERVER_NAME"].substr($_SERVER["REQUEST_URI"],0,strpos($_SERVER["REQUEST_URI"], "/admin/index.php"))."/");
-                $http->AddPostData("excerpt", substr(strip_tags($post["body"]), 100));
+                $http->AddPostData("excerpt", substr(_strip_tags($post["body"]), 100));
                 $http->addPostData("charset", "UTF-8");
                 if (!PEAR::isError($http->sendRequest())) {
@@ -347 +351 @@
                         die("error");
                 }
-                $sql = "UPDATE articles SET ping_sent=1 WHERE id=".$post["id"];
+                $sql = sprintf("UPDATE articles SET ping_sent = 1 WHERE id = %d", $post["id"]);
                 $res =& $db->query($sql);
         }
@@ -358 +362 @@
 function delete_post($id) {
         global $db;
-        $query = "DELETE FROM articles WHERE id=$id";
+        $query = sprintf("DELETE FROM articles WHERE id = %d", $id);
         $res =& $db->query($query);
         if (PEAR::isError($res)) {
@@ -364 +368 @@
         }
         //delete comments for this post
-        $query = "DELETE FROM comments WHERE articles_id=$id";
+        $query = sprintf("DELETE FROM comments WHERE articles_id = %d", $id);
         $res =& $db->query($query);
         if (PEAR::isError($res)) {
@@ -388 +392 @@
                         <div class="log_head">
                                 <span class="log_subject">
-                                        &nbsp;&nbsp;<a href="?action=edit_cat&amp;id=<?=$row["id"]?>"><?=$row["name"]?></a>&nbsp;&nbsp;
+                                        &nbsp;&nbsp;<a href="?action=edit_cat&amp;id=<?=$row["id"]?>"><?=stripslashes($row["name"])?></a>&nbsp;&nbsp;
                                         <?
-                                                $r =& $db->query("SELECT COUNT(*) FROM articles WHERE categories_id=".$row["id"]);
+                                                $r =& $db->query(sprintf("SELECT COUNT(*) FROM articles WHERE categories_id = %d", $row["id"]));
                                                 if (PEAR::isError($r)) {
                                                         die($r->getMessage());
@@ -401 +405 @@
                         <div class="log_body">
                                 <span class="log_contents">
-                                        <?=nl2br($row["desc"])?>
+                                        <?=nl2br(stripslashes($row["desc"]))?>
                                 </span>
                         </div>
@@ -422 +426 @@
                 $cat["name"]   = "category name";
                 $cat["desc"]   = "Category description";
-                $cat["active"] = "on";
-                $cat["public"] = "on";
-        } else {
-                $res =& $db->query("SELECT * FROM categories WHERE id=$id");
+                $cat["active"] = "1";
+                $cat["public"] = "1";
+        } else {
+                $res =& $db->query(sprintf("SELECT * FROM categories WHERE id = %d", $id));
                 if (PEAR::isError($res)) {
                         die($res->getMessage());
@@ -438 +442 @@
                 <div class="log_head">
                         <span class="log_subject">
-                                &nbsp;&nbsp;<input type="text" name="cat[name]" value="<?=$cat["name"]?>" />&nbsp;&nbsp;
+                                &nbsp;&nbsp;<input type="text" name="cat[name]" value="<?=stripslashes($cat["name"])?>" />&nbsp;&nbsp;
                                 <?
-                                        $r =& $db->query("SELECT COUNT(*) FROM articles WHERE categories_id=".$cat["id"]);
+                                        $r =& $db->query(sprintf("SELECT COUNT(*) FROM articles WHERE categories_id = %d", $cat["id"]));
                                         if (PEAR::isError($r)) {
                                                 die($r->getMessage());
@@ -451 +455 @@
                 <div class="log_body">
                         <span class="log_contents">
-                                <textarea name="cat[description]" style="width: 200px; height: 100px;"><?=$cat["desc"]?></textarea>
+                                <textarea name="cat[description]" style="width: 200px; height: 100px;"><?=stripslashes($cat["desc"])?></textarea>
                         </span>
                         <input type="submit" value="save" />
@@ -460 +464 @@
                 </div>
                 <div class="log_foot">
-                        <span class="log_date">active: <input type="checkbox" name="cat[active]" <? if ($cat["active"]) { echo "checked=\"checked\""; } ?> /></span>
-                        <span class="log_author">public: <input type="checkbox" name="cat[public]" <? if ($cat["public"]) { echo "checked=\"checked\""; } ?> /></span>
+                        <span class="log_date">active: <input type="checkbox" value="1" name="cat[active]" <? if ($cat["active"]) { echo "checked=\"checked\""; } ?> /></span>
+                        <span class="log_author">public: <input type="checkbox" value="1" name="cat[public]" <? if ($cat["public"]) { echo "checked=\"checked\""; } ?> /></span>
                 </div>
         </div>
@@ -474 +478 @@
         global $db;
         if ($cat["id"]) {
-                $query  = "UPDATE categories SET ";
-                $query .= "\"name\"='".$cat["name"]."'";
-                $query .= ", \"desc\"='".$cat["description"]."'";
-                $query .= ($cat["active"]=="on")?", active=1":", active=0";
-                $query .= ($cat["public"]=="on")?", public=1":", public=0";
-                $query .= " WHERE id=".$cat["id"];
-        } else {
-                $query  = "INSERT INTO categories (\"name\", \"desc\", active, public) VALUES (";
-                $query .= "'".$cat["name"]."'";
-                $query .= ", '".$cat["description"]."'";
-                $query .= ($cat["active"]=="on")?", 1":", 0";
-                $query .= ($cat["public"]=="on")?", 1":", 0";
-                $query .= ")";
+                $query  = sprintf("UPDATE categories SET \"name\" = '%s', \"desc\" = '%s', active = %d, public = %d WHERE id = %d",
+                        preg_quote(strip_tags($cat["name"]), "'"),
+                        preg_quote(strip_tags($cat["description"]), "'"),
+                        $cat["active"],
+                        $cat["public"],
+                        $cat["id"]
+                );
+        } else {
+                $query  = sprintf("INSERT INTO categories (\"name\", \"desc\", active, public) VALUES ('%s', '%s', %d, %d)",
+                        preg_quote(strip_tags($cat["name"]), "'"),
+                        preg_quote(strip_tags($cat["description"]), "'"),
+                        $cat["active"],
+                        $cat["public"]
+                );
         }
         $res =& $db->query($query);
@@ -1093 +1098 @@
 }
 
+//}}}--------------------------------------
+//{{{ _strip_tags: strip tags we don't like
+//-----------------------------------------
+function _strip_tags($text) {
+        $allowed_tags  = "<h1><h2><p><font><ul><li><ol><blockquote><u><strike><sub><br>";
+        $allowed_tags .= "<sup><img><a><table><tbody><tr><td><tt><pre><div><span>";
+        $text = strip_tags($text, $allowed_tags);
+        return preg_replace('/<(.*?)>/ie', "'<'._strip_attributes('\\1').'>'", $text);
+}
+
+//}}}---------------------------------------------------
+//{{{ _strip_attributes: strip evil attributes from tags
+//------------------------------------------------------
+function _strip_attributes($text) {
+        $attr_to_strip = array(
+                "javascript:",
+                "onclick",
+                "ondblclick",
+                "onmousedown",
+                "onmouseup",
+                "onmouseover"
+        );
+        foreach ($attr_to_strip as $attribute) {
+                $text = stripslashes(preg_replace("/$attribute/i", "forbidden", $text));
+        }
+        return $text;
+}
+
 //}}}-------------
 //{{{ plugin stuff