Changeset 30864

Timestamp:

Jan 8, 2015, 2:06:27 PM (9 years ago)

Author:

plg

Message:

bug 3186: improved security on search.php

Location:

trunk

Files:

• include/functions.inc.php (modified) (1 diff)
• search.php (modified) (4 diffs)

trunk/include/functions.inc.php

@@ -1878 +1878 @@
     }
 
-    foreach ($param_value as $item_to_check)
-    {
-      if (!preg_match($pattern, $item_to_check))
+    foreach ($param_value as $key => $item_to_check)
+    {
+      if (!preg_match(PATTERN_ID, $key) or !preg_match($pattern, $item_to_check))
       {
         fatal_error('[Hacking attempt] an item is not valid in input parameter "'.$param_name.'"');

trunk/search.php

@@ -49 +49 @@
   {
     check_input_parameter('mode', $_POST, false, '/^(OR|AND)$/');
-
-    $fields = array_intersect($_POST['fields'], array('name', 'comment', 'file'));
-    
+    check_input_parameter('fields', $_POST, true, '/^(name|comment|file)$/');
+
     $drop_char_match = array(
       '-','^','$',';','#','&','(',')','<','>','`','\'','"','|',',','@','_',
@@ -72 +71 @@
         ),
       'mode' => $_POST['mode'],
-      'fields' => $fields,
+      'fields' => $_POST['fields'],
       );
   }
@@ -113 +112 @@
 
   // dates
+  check_input_parameter('date_type', $_POST, false, '/^date_(creation|available)$/');
+  
   $type_date = $_POST['date_type'];
 
@@ -152 +153 @@
   (rules, last_seen)
   VALUES
-  (\''.serialize($search).'\', NOW())
+  (\''.pwg_db_real_escape_string(serialize($search)).'\', NOW())
 ;';
     pwg_query($query);