fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Some changes in InputFilter class and check genericAjax

Browse Source
This commit is contained in:
Paula V. Quispe
2015-03-10 17:06:49 -04:00
parent 2615af7403
commit 3440e95d3f
2 changed files with 79 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
gulliver/methods/genericAjax.php
View File

@@ -1,4 +1,10 @@
<?php <?php
G::LoadSystem('inputfilter');
$filter = new InputFilter();
$_GET = $filter->xssFilterHard($_GET);
$_POST = $filter->xssFilterHard($_POST);
$_REQUEST = $filter->xssFilterHard($_REQUEST);
$_SESSION = $filter->xssFilterHard($_SESSION);
$request = isset($_POST['request'])? $_POST['request']: null; $request = isset($_POST['request'])? $_POST['request']: null;
if( !isset($request) ){ if( !isset($request) ){

88
gulliver/system/class.inputfilter.php
View File

@@ -366,7 +366,7 @@ class InputFilter
} }
/** /**
* Internal method removes tags/special characters from a string * Internal method removes tags/special characters
* @author Marcelo Cuiza * @author Marcelo Cuiza
* @access protected * @access protected
* @param Array or String $input * @param Array or String $input
@@ -413,8 +413,13 @@ class InputFilter
if(is_array($val) && sizeof($val)) { if(is_array($val) && sizeof($val)) {
$input[$i] = $this->xssFilterHard($val); $input[$i] = $this->xssFilterHard($val);
} else { } else {
$inputFiltered = $purifier->purify($val); if(!empty($val)) {
$input[$i] = addslashes(htmlspecialchars($inputFiltered, ENT_COMPAT, 'UTF-8')); $inputFiltered = $purifier->purify($val);
$inputFiltered = addslashes(htmlspecialchars($inputFiltered, ENT_COMPAT, 'UTF-8'));
} else {
$inputFiltered = "";
}
$input[$i] = $inputFiltered;
} }
} }
} }
@@ -429,25 +434,78 @@ class InputFilter
} }
} }
/**
* Internal method: protect against SQL injection
* @author Marcelo Cuiza
* @access protected
* @param String $con
* @param String $query
* @param Array $values
* @return String $query
*/
function preventSqlInjection($query, $values = Array(), &$con = NULL)
{
if(is_array($values) && sizeof($values)) {
foreach($values as $k1 => $val1) {
$values[$k1] = mysql_real_escape_string($val1);
}
if ( get_magic_quotes_gpc() ) {
foreach($values as $k => $val) {
$values[$k] = stripslashes($val);
}
}
$newquery = vsprintf($query,$values);
} else {
//$newquery = mysql_real_escape_string($query);
$newquery = $this->quoteSmart($this->decode($query), $con);
}
return $newquery;
}
/** /**
* Internal method: protect against SQL injenction * Internal method: protect against SQL injenction
* @author Marcelo Cuiza * @author Marcelo Cuiza
* @access protected * @access protected
* @param Array or String $value * @param String $value
* @return Array or String $value * @param String $type
* @return String $value
*/ */
function protectSql($value) function validateInput($value, $type = "string")
{ {
// Stripslashes if(!isset($value) || trim($value) === '' || $value === NULL ) {
if ( get_magic_quotes_gpc() ) { return '';
$value = stripslashes( $value ); }
if($pos = strpos($value,";")) {
$value = substr($value,0,$pos);
} }
// Quote if not a number or a numeric string
if ( !is_numeric( $value ) ) switch($type) {
{ case 'float':
$value = "'" . mysql_real_escape_string($value) . "'"; $value = (float)filter_var($value, FILTER_SANITIZE_NUMBER_FLOAT);
break;
case 'int':
$value = (int)filter_var($value, FILTER_SANITIZE_NUMBER_INT);
break;
case 'boolean':
$value = (boolean)filter_var($value, FILTER_VALIDATE_BOOLEAN,FILTER_NULL_ON_FAILURE);
break;
case 'path':
if(!file_exists($value)) {
$value = '';
}
break;
case 'noSql':
$value = (string)filter_var($value, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH);
if(preg_match('/\b(or|and|xor|drop|insert|update|delete|select)\b/i' , $value)) {
$value = '';
}
break;
default:
$value = (string)filter_var($value, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH);
} }
return $value; return $value;
} }
} }