diff --git a/gulliver/methods/genericAjax.php b/gulliver/methods/genericAjax.php index 712797f5f..f0f53b9f1 100755 --- a/gulliver/methods/genericAjax.php +++ b/gulliver/methods/genericAjax.php @@ -1,4 +1,10 @@ xssFilterHard($_GET,"url"); +$_POST = $filter->xssFilterHard($_POST,"url"); +$_REQUEST = $filter->xssFilterHard($_REQUEST,"url"); +$_SESSION = $filter->xssFilterHard($_SESSION,"url"); $request = isset($_POST['request'])? $_POST['request']: null; if( !isset($request) ){ diff --git a/gulliver/system/class.inputfilter.php b/gulliver/system/class.inputfilter.php index e512d97f0..30f5d0de1 100644 --- a/gulliver/system/class.inputfilter.php +++ b/gulliver/system/class.inputfilter.php @@ -366,13 +366,13 @@ class InputFilter } /** - * Internal method removes tags/special characters from a string + * Internal method removes tags/special characters * @author Marcelo Cuiza * @access protected * @param Array or String $input * @return Array or String $input */ - public function xssFilter($input) + public function xssFilter($input, $type = "") { if(is_array($input)) { if(sizeof($input)) { @@ -380,7 +380,16 @@ class InputFilter if(is_array($val) && sizeof($val)) { $input[$i] = $this->xssFilter($val); } else { - $input[$i] = addslashes(htmlspecialchars(filter_var($val, FILTER_SANITIZE_STRING), ENT_COMPAT, 'UTF-8')); + if(!empty($val)) { + if($type != "url" && !strpos(basename($val), "=")) { + $inputFiltered = addslashes(htmlspecialchars(filter_var($val, FILTER_SANITIZE_STRING), ENT_COMPAT, 'UTF-8')); + } else { + $inputFiltered = filter_var($val, FILTER_SANITIZE_STRING); + } + } else { + $inputFiltered = ""; + } + $input[$i] = $inputFiltered; } } } @@ -389,7 +398,11 @@ class InputFilter if(!isset($input) || trim($input) === '' || $input === NULL ) { return ''; } else { - return addslashes(htmlspecialchars(filter_var($input, FILTER_SANITIZE_STRING), ENT_COMPAT, 'UTF-8')); + if($type != "url") { + return addslashes(htmlspecialchars(filter_var($input, FILTER_SANITIZE_STRING), ENT_COMPAT, 'UTF-8')); + } else { + return filter_var($input, FILTER_SANITIZE_STRING); + } } } } @@ -401,53 +414,120 @@ class InputFilter * @param Array or String $input * @return Array or String $input */ - function xssFilterHard($input) + function xssFilterHard($input, $type = "") { require_once (PATH_THIRDPARTY . 'HTMLPurifier/HTMLPurifier.auto.php'); - //G::LoadThirdParty ('HTMLPurifier', 'HTMLPurifier.auto.php'); $config = HTMLPurifier_Config::createDefault(); $purifier = new HTMLPurifier($config); if(is_array($input)) { if(sizeof($input)) { foreach($input as $i => $val) { if(is_array($val) && sizeof($val)) { - $input[$i] = $this->xssFilterHard($val); + $input[$i] = $this->xssFilterHard($val,$type); } else { - $inputFiltered = $purifier->purify($val); - $input[$i] = addslashes(htmlspecialchars($inputFiltered, ENT_COMPAT, 'UTF-8')); + if(!empty($val)) { + $inputFiltered = $purifier->purify($val); + $pos = strpos($inputFiltered, "="); + if($type != "url" && $pos === false) { + $inputFiltered = addslashes(htmlspecialchars($inputFiltered, ENT_COMPAT, 'UTF-8')); + } else { + $inputFiltered = str_replace('&','&',$inputFiltered); + } + } else { + $inputFiltered = ""; + } + $input[$i] = $inputFiltered; } } } return $input; - } else { + } else { if(!isset($input) || trim($input) === '' || $input === NULL ) { return ''; } else { $input = $purifier->purify($input); - return addslashes(htmlspecialchars($input, ENT_COMPAT, 'UTF-8')); + $pos = strpos(basename($input), "="); + if($type != "url" && $pos === false) { + $input = addslashes(htmlspecialchars($input, ENT_COMPAT, 'UTF-8')); + } else { + $input = str_replace('&','&',$input); + } + return $input; } } } + /** + * Internal method: protect against SQL injection + * @author Marcelo Cuiza + * @access protected + * @param String $con + * @param String $query + * @param Array $values + * @return String $query + */ + function preventSqlInjection($query, $values = Array(), &$con = NULL) + { + if(is_array($values) && sizeof($values)) { + foreach($values as $k1 => $val1) { + $values[$k1] = mysql_real_escape_string($val1); + } + + if ( get_magic_quotes_gpc() ) { + foreach($values as $k => $val) { + $values[$k] = stripslashes($val); + } + } + $newquery = vsprintf($query,$values); + } else { + //$newquery = mysql_real_escape_string($query); + $newquery = $this->quoteSmart($this->decode($query), $con); + } + return $newquery; + } + /** * Internal method: protect against SQL injenction * @author Marcelo Cuiza * @access protected - * @param Array or String $value - * @return Array or String $value + * @param String $value + * @param String $type + * @return String $value */ - function protectSql($value) + function validateInput($value, $type = "string") { - // Stripslashes - if ( get_magic_quotes_gpc() ) { - $value = stripslashes( $value ); - } - // Quote if not a number or a numeric string - if ( !is_numeric( $value ) ) - { - $value = "'" . mysql_real_escape_string($value) . "'"; + if(!isset($value) || trim($value) === '' || $value === NULL ) { + return ''; + } + + if($pos = strpos($value,";")) { + $value = substr($value,0,$pos); } + + switch($type) { + case 'float': + $value = (float)filter_var($value, FILTER_SANITIZE_NUMBER_FLOAT); + break; + case 'int': + $value = (int)filter_var($value, FILTER_SANITIZE_NUMBER_INT); + break; + case 'boolean': + $value = (boolean)filter_var($value, FILTER_VALIDATE_BOOLEAN,FILTER_NULL_ON_FAILURE); + break; + case 'path': + if(!file_exists($value)) { + $value = ''; + } + break; + case 'noSql': + $value = (string)filter_var($value, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH); + if(preg_match('/\b(or|and|xor|drop|insert|update|delete|select)\b/i' , $value)) { + $value = ''; + } + break; + default: + $value = (string)filter_var($value, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH); + } return $value; } -} - +} \ No newline at end of file diff --git a/gulliver/system/class.webResource.php b/gulliver/system/class.webResource.php index 021d00ba9..973fc4afb 100755 --- a/gulliver/system/class.webResource.php +++ b/gulliver/system/class.webResource.php @@ -66,7 +66,14 @@ class WebResource $paramsRef[] = '$parameters[' . $key . ']'; } } - $res = eval( 'return ($this->' . $post['function'] . '(' . implode( ',', $paramsRef ) . '));' ); + + $paramsRef = implode( ',', $paramsRef ); + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); + $post['function'] = $filter->validateInput($post['function']); + $paramsRef = $filter->validateInput($paramsRef); + + $res = eval( 'return ($this->' . $post['function'] . '(' . $paramsRef . '));' ); $res = G::json_encode( $res ); print ($res) ; } else { @@ -82,13 +89,18 @@ class WebResource */ function _encode () { + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); header( 'Content-Type: text/json' ); $methods = get_class_methods( get_class( $this ) ); + $methods = $filter->xssFilterHard($methods); + $this->_uri = $filter->xssFilterHard($this->_uri); print ('{') ; $first = true; foreach ($methods as $method) { //To avoid PHP version incompatibilities, put the $method name in lowercase $method = strtolower( $method ); + $method = $filter->xssFilterHard($method); if ((substr( $method, 0, 1 ) === '_') || (strcasecmp( $method, 'WebResource' ) == 0) || (strcasecmp( $method, get_class( $this ) ) == 0)) { } elseif (strcasecmp( substr( $method, 0, 3 ), 'js_' ) == 0) { if (! $first) { diff --git a/rbac/engine/templates/login/showDBFiles.php b/rbac/engine/templates/login/showDBFiles.php index 31682bdd9..89cab1860 100755 --- a/rbac/engine/templates/login/showDBFiles.php +++ b/rbac/engine/templates/login/showDBFiles.php @@ -30,11 +30,14 @@ die; } - + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); + echo ""; echo ""; echo ""; $curPage = getenv( "REQUEST_URI" ); + $curPage = $filter->xssFilterHard($curPage,"url"); //running the while loop $first = 0; while ($file = readdir($dir_handle)) diff --git a/workflow/engine/classes/class.pmTable.php b/workflow/engine/classes/class.pmTable.php index 005a7a3ac..01ffda4c3 100755 --- a/workflow/engine/classes/class.pmTable.php +++ b/workflow/engine/classes/class.pmTable.php @@ -135,7 +135,7 @@ class PmTable * @param string $dbsUid corresponding to DBS_UID key * @return string contains resolved DBS_UID */ - public function resolveDbSource ($dbsUid) + public static function resolveDbSource($dbsUid) { switch ($dbsUid) { case 'workflow': diff --git a/workflow/engine/classes/model/AdditionalTables.php b/workflow/engine/classes/model/AdditionalTables.php index f443d72e5..9c52cc061 100755 --- a/workflow/engine/classes/model/AdditionalTables.php +++ b/workflow/engine/classes/model/AdditionalTables.php @@ -1,4 +1,4 @@ -validateInput($_POST['sort']); + $sClassPeerName = $filter->validateInput($sClassPeerName); if (isset($_POST['sort'])) { if ($_POST['dir'] == 'ASC') { if ($keyOrderUppercase) { - eval('$oCriteria->addAscendingOrderByColumn("' . $_POST['sort'] . '");'); + eval('$oCriteria->addAscendingOrderByColumn("' . $sort . '");'); } else { - eval('$oCriteria->addAscendingOrderByColumn(' . $sClassPeerName . '::' . $_POST['sort'] . ');'); + eval('$oCriteria->addAscendingOrderByColumn(' . $sClassPeerName . '::' . $sort . ');'); } } else { if ($keyOrderUppercase) { - eval('$oCriteria->addDescendingOrderByColumn("' . $_POST['sort'] . '");'); + eval('$oCriteria->addDescendingOrderByColumn("' . $sort . '");'); } else { - eval('$oCriteria->addDescendingOrderByColumn(' . $sClassPeerName . '::' . $_POST['sort'] . ');'); + eval('$oCriteria->addDescendingOrderByColumn(' . $sClassPeerName . '::' . $sort . ');'); } } } diff --git a/workflow/engine/methods/services/soap.php b/workflow/engine/methods/services/soap.php index c0e0f4ec4..d96866ed2 100755 --- a/workflow/engine/methods/services/soap.php +++ b/workflow/engine/methods/services/soap.php @@ -154,6 +154,8 @@ function getCaseInfo ($params) function SendVariables ($params) { + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); ifSessionExpiredBreakThis( $params->sessionId ); $x = ifPermission( $params->sessionId, 'PM_CASES' ); if ($x == 0) { @@ -172,6 +174,8 @@ function SendVariables ($params) foreach ($variables as $key => $val) { $name = $val->name; $value = $val->value; + $val->name = $filter->validateInput($val->name); + $val->value = $filter->validateInput($val->value); eval( '$Fields[ ' . $val->name . ' ]= $val->value ;' ); } } @@ -241,6 +245,8 @@ function executeTrigger ($params) function NewCaseImpersonate ($params) { + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); ifSessionExpiredBreakThis( $params->sessionId ); $x = ifPermission( $params->sessionId, 'PM_CASES' ); if ($x == 0) { @@ -254,6 +260,8 @@ function NewCaseImpersonate ($params) foreach ($variables as $key => $val) { $name = $val->name; $value = $val->value; + $val->name = $filter->validateInput($val->name); + $val->value = $filter->validateInput($val->value); eval( '$Fields[ ' . $val->name . ' ]= $val->value ;' ); } $params->variables = $Fields; @@ -265,6 +273,8 @@ function NewCase ($params) { G::LoadClass( 'wsBase' ); G::LoadClass( 'sessions' ); + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); ifSessionExpiredBreakThis( $params->sessionId ); $x = ifPermission( $params->sessionId, 'PM_CASES' ); if ($x == 0) { @@ -296,6 +306,8 @@ function NewCase ($params) $name = $val->name; $value = $val->value; if (! is_object( $val->value )) { + $val->name = $filter->validateInput($val->name); + $val->value = $filter->validateInput($val->value); eval( '$Fields[ ' . $val->name . ' ]= $val->value ;' ); } else { if (is_array( $val->value->item )) { diff --git a/workflow/engine/methods/services/soap2.php b/workflow/engine/methods/services/soap2.php index aa5d8cda4..982f97f5f 100755 --- a/workflow/engine/methods/services/soap2.php +++ b/workflow/engine/methods/services/soap2.php @@ -689,6 +689,8 @@ function NewCaseImpersonate ($params) function NewCase ($params) { G::LoadClass( "sessions" ); + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); $vsResult = isValidSession( $params->sessionId ); @@ -757,6 +759,8 @@ function NewCase ($params) if (is_array( $variables )) { foreach ($variables as $key => $val) { if (! is_object( $val->value )) { + $val->name = $filter->validateInput($val->name); + $val->value = $filter->validateInput($val->value); eval( "\$field[" . $val->name . "]= \$val->value;" ); } } diff --git a/workflow/engine/templates/login/showDBFiles.php b/workflow/engine/templates/login/showDBFiles.php index 31682bdd9..89cab1860 100755 --- a/workflow/engine/templates/login/showDBFiles.php +++ b/workflow/engine/templates/login/showDBFiles.php @@ -30,11 +30,14 @@ die; } - + G::LoadSystem('inputfilter'); + $filter = new InputFilter(); + echo "
Please select a valid workspace to continue
"; echo ""; echo ""; $curPage = getenv( "REQUEST_URI" ); + $curPage = $filter->xssFilterHard($curPage,"url"); //running the while loop $first = 0; while ($file = readdir($dir_handle))
Please select a valid workspace to continue