Changeset 300

Timestamp:

09/06/06 20:42:31 (2 years ago)

Author:

michiel

Message:

-fixed more of the same typo (dont you just love copy/paste)
-updated old copyleft holders

-Added _handle_php_bugs function.

This function is written after I read what happened to aloith.debian.org today.
Some weird bugs in php were used to deface some sites on aloith and they also managed
to get an IRC proxy installed. Reading the POC of some of the bugs made me come up with
the new function. Part of the code was taken from resources on the web (php.net comments and advisory)
Users without register_globals=On in their php.ini wont have to worry :)

Location:

trunk

Files:

• admin/login.php (modified) (1 diff)
• common/hosts.php.sample (modified) (1 diff)
• common/mvblog_common.php (modified) (2 diffs)
• common/rdf.php (modified) (1 diff)
• common/rss.php (modified) (1 diff)
• common/tb.php (modified) (1 diff)
• index.php (modified) (1 diff)

trunk/admin/login.php

@@ -1 +1 @@
 <?
 /*
- * MvBlog -- An open source no-noncence blogtool
+ * MvBlog -- An open source no-nonsense blogtool
  *
  * Copyright (C) 2005-2006, Michiel van Baak
- * Logo design (C) 2005, Sofie van Tendeloo
+ * Logo design (C) 2005-2006, Sofie van Tendeloo
  *
  * Michiel van Baak <mvanbaak@users.sourceforge.net>

trunk/common/hosts.php.sample

@@ -1 +1 @@
 <?php
 /*
- * MvBlog -- An open source no-noncence blogtool
+ * MvBlog -- An open source no-nonsense blogtool
  *
- * Copyright (C) 2005, Michiel van Baak
- * Logo design (C) 2005, Sofie van Tendeloo
+ * Copyright (C) 2005-2006, Michiel van Baak
+ * Logo design (C) 2005-2006, Sofie van Tendeloo
  *
  * Michiel van Baak <mvanbaak@users.sourceforge.net>

trunk/common/mvblog_common.php

@@ -122 +122 @@
                 textdomain($domain);
 
+                /* handle php bugs with globals overwrite */
+                $this->_handle_php_bugs();
+
                 /* handle magic quotes */
                 $this->_handle_magic_quotes();
@@ -154 +157 @@
         /* }}} */
         /* data manipulation methods */
+        /* _handle_php_bugs {{{ */
+        /**
+         * Handle some php bugs.
+         *
+         * There's some weird bugs when register_globals is on.
+         * You can clear them with stuff like this: ?GLOBALS&GLOBALS[bla]=test
+         * So what we do is detect this and bail out.
+         * We also make sure that if register_globals is on the gpc stuff will be removed from the globals stuff
+         */
+        protected function _handle_php_bugs() {
+                /**
+                 * catch "PHP5 Globals Vulnerability".
+                 * code taken from Advisory ttp://www.ush.it/2006/01/25/php5-globals-vulnerability/ 
+                 */
+                if (isset($HTTP_POST_VARS['GLOBALS']) || isset($_POST['GLOBALS']) || isset($HTTP_POST_FILES['GLOBALS']) || isset($_FILES['GLOBALS']) ||
+                        isset($HTTP_GET_VARS['GLOBALS']) || isset($_GET['GLOBALS']) || isset($HTTP_COOKIE_VARS['GLOBALS']) || isset($_COOKIE['GLOBALS']))
+                        die("GLOBAL GPC hacking attemt!");
+                /**
+                 *      if register_globals is on, you cannot turn it off with ini_set.
+                 *      The vars will be registered before the ini_set is executed.
+                 *      We can fake register_globals is off by removing the GPCFR keys from
+                 *      the global var space :) I got the idea from Alan Hogan with his comment on php.net ini_set function docs.
+                 *      I rewrote it to match mvblog codestyle
+                 */
+                if (ini_get("register_globals")) {
+                        foreach ($_GET as $key => $value)
+                                if (preg_match("/^([a-z]|_){1}([a-z0-9]|_)*$/si", $key))
+                                        unset($GLOBALS[$key]);
+
+                        foreach ($_POST as $key => $value)
+                                if (preg_match('/^([a-zA-Z]|_){1}([a-zA-Z0-9]|_)*$/', $key))
+                                        unset($GLOBALS[$key]);
+
+                        foreach ($_COOKIE as $key => $value)
+                                if (preg_match('/^([a-zA-Z]|_){1}([a-zA-Z0-9]|_)*$/', $key))
+                                        unset($GLOBALS[$key]);
+
+                        foreach ($_FILES as $key => $value)
+                                if (preg_match('/^([a-zA-Z]|_){1}([a-zA-Z0-9]|_)*$/', $key))
+                                        unset($GLOBALS[$key]);
+
+                        foreach ($_REQUEST as $key => $value)
+                                if (preg_match('/^([a-zA-Z]|_){1}([a-zA-Z0-9]|_)*$/', $key))
+                                        unset($GLOBALS[$key]);
+                }
+        }
+        /* }}} */
         /* _handle_magic_quotes {{{ */
         /**

trunk/common/rdf.php

@@ -1 +1 @@
 <?php
 /*
- * MvBlog -- An open source no-noncence blogtool
+ * MvBlog -- An open source no-nonsense blogtool
  *
- * Copyright (C) 2005, Michiel van Baak
- * Logo design (C) 2005, Sofie van Tendeloo
+ * Copyright (C) 2005-2006, Michiel van Baak
+ * Logo design (C) 2005-2006, Sofie van Tendeloo
  *
  * Michiel van Baak <mvanbaak@users.sourceforge.net>

trunk/common/rss.php

@@ -1 +1 @@
 <?php
 /*
- * MvBlog -- An open source no-noncence blogtool
+ * MvBlog -- An open source no-nonsense blogtool
  *
- * Copyright (C) 2005, Michiel van Baak
- * Logo design (C) 2005, Sofie van Tendeloo
+ * Copyright (C) 2005-2006, Michiel van Baak
+ * Logo design (C) 2005-2006, Sofie van Tendeloo
  *
  * Michiel van Baak <mvanbaak@users.sourceforge.net>

trunk/common/tb.php

@@ -1 +1 @@
 <?php
 /*
- * MvBlog -- An open source no-noncence blogtool
+ * MvBlog -- An open source no-nonsense blogtool
  *
  * Copyright (C) 2005-2006, Michiel van Baak
- * Logo design (C) 2005, Sofie van Tendeloo
+ * Logo design (C) 2005-2006, Sofie van Tendeloo
  *
  * Michiel van Baak <mvanbaak@users.sourceforge.net>

trunk/index.php

@@ -3 +3 @@
  * MvBlog -- An open source no-nonsense blogtool
  *
- * Copyright (C) 2005, Michiel van Baak
- * Logo design (C) 2005, Sofie van Tendeloo
+ * Copyright (C) 2005-2006, Michiel van Baak
+ * Logo design (C) 2005-2006, Sofie van Tendeloo
  *
  * Michiel van Baak <mvanbaak@users.sourceforge.net>