Design/EasySoft-ZenTaoPMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 30 Wiki Activity

- Reset commit.

Browse Source
This commit is contained in:
zhujinyong
2023-09-11 14:10:27 +08:00
parent 21993fbd14
commit 1376e7667c
2 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
framework/base/router.class.php
-1
View File
@@ -691,7 +691,6 @@ class baseRouter
$_POST = validater::filterSuper($_POST);
$_GET = validater::filterSuper($_GET);
$_COOKIE = validater::filterSuper($_COOKIE);
$_SERVER = validater::filterSuper($_SERVER);
/* Filter common get and cookie vars. */
if($this->config->framework->filterParam == 2)
lib/base/filter/filter.class.php
+3 -3
View File
@@ -661,11 +661,11 @@ class baseValidater
global $config;
if(empty($config->framework->filterXSS)) return $var;
if(stripos($var, '&lt;script') !== false || stripos($var, '<script') !== false || stripos($var, '&lt;iframe') !== false || stripos($var, '<iframe') !== false)
if(stripos($var, '&lt;script') !== false || stripos($var, '<script') !== false)
{
$var = (string)$var;
$evils = array('iframe', 'script', 'appendchild(', 'createElement(', 'xss.re', 'onfocus', 'onclick', 'innerHTML', 'replaceChild(', 'html(', 'append(', 'appendTo(', 'prepend(', 'prependTo(', 'after(', 'insertBefore', 'before(', 'replaceWith(', 'alert(', 'confirm(');
$replaces = array('ｉｆｒａｍｅ', 'ｓｃｒｉｐｔ', 'a p p e n d c h i l d (', 'c r e a t e E l e m e n t (', 'x s s . r e', 'o n f o c u s', 'o n c l i c k', 'i n n e r H T M L', 'r e p l a c e C h i l d (', 'h t m l (', 'a p p e n d (', 'a p p e n d T o (', 'p r e p e n d (', 'p r e p e n d T o (', 'a f t e r (', 'i n s e r t B e f o r e (', 'b e f o r e (', 'r e p l a c e W i t h (', 'a l e r t (', 'c o n f i r m (');
$evils = array('appendchild(', 'createElement(', 'xss.re', 'onfocus', 'onclick', 'innerHTML', 'replaceChild(', 'html(', 'append(', 'appendTo(', 'prepend(', 'prependTo(', 'after(', 'insertBefore', 'before(', 'replaceWith(', 'alert(', 'confirm(');
$replaces = array('a p p e n d c h i l d (', 'c r e a t e E l e m e n t (', 'x s s . r e', 'o n f o c u s', 'o n c l i c k', 'i n n e r H T M L', 'r e p l a c e C h i l d (', 'h t m l (', 'a p p e n d (', 'a p p e n d T o (', 'p r e p e n d (', 'p r e p e n d T o (', 'a f t e r (', 'i n s e r t B e f o r e (', 'b e f o r e (', 'r e p l a c e W i t h (', 'a l e r t (', 'c o n f i r m (');
$var = str_ireplace($evils, $replaces, $var);
}