HOR-1363 "CLONE - Penetration test >> Internal paths exposed in cases" SOLVED
Issue:
CLONE - Penetration test >> Internal paths exposed in cases
Cause:
No se filtran las variables
Solution:
- Se filtran las variables enviadas
- Para evitar mostrar los paths de los files que son mostrados cuando se genera un notice PHP, se debe configurar
el php.ini, se sugiere revisar las siguientes URL: http://www.zootemplate.com/news-updates/how-to-disable-notice-and-warning-in-phpini-file
This commit is contained in:
@@ -661,4 +661,35 @@ class InputFilter
|
||||
$sanitizefilteredPath = mb_ereg_replace("(^~)", '', $sanitizefilteredPath);
|
||||
return $sanitizefilteredPath;
|
||||
}
|
||||
|
||||
/**
|
||||
* Filter only characters valids by regular expression
|
||||
*
|
||||
* @param mixed $data Data
|
||||
* @param mixed $regex Regular expression
|
||||
*
|
||||
* @return mixed Returns data with the characters valids by regular expression
|
||||
*/
|
||||
function xssRegexFilter($data, $regex)
|
||||
{
|
||||
try {
|
||||
switch (gettype($data)) {
|
||||
case 'array':
|
||||
foreach ($data as $key => $value) {
|
||||
$data[$key] = $this->xssRegexFilter($value, (is_array($regex))? ((isset($regex[$key]))? $regex[$key] : '') : $regex);
|
||||
}
|
||||
break;
|
||||
default:
|
||||
if ($regex != '') {
|
||||
$data = (preg_match_all($regex, $data, $arrayMatch))? implode('', $arrayMatch[0]) : '';
|
||||
}
|
||||
break;
|
||||
}
|
||||
|
||||
//Return
|
||||
return $data;
|
||||
} catch (Exception $e) {
|
||||
throw $e;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user