Design/EasySoft-ZenTaoPMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 30 Wiki Activity

* adjust for filter super var.

Browse Source
This commit is contained in:
wangyidong
2015-11-13 10:02:28 +08:00
parent 603f64a618
commit 1af9dbe0c5
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
framework/router.class.php
+10 -4
View File
@@ -480,7 +480,8 @@ class router
{
foreach($_COOKIE as $cookieKey => $cookieValue)
{
if(preg_match('/[^a-zA-Z0-9=_\- ,`+\/\.]/', $cookieValue)) unset($_COOKIE[$cookieKey]);
if(preg_match('/[^a-zA-Z0-9_\.]/', $cookieKey)) unset($_COOKIE[$cookieKey]);
if(preg_match('/[^a-zA-Z0-9=_\- ,`+\/\.%\x7f-\xff]/', $cookieValue)) unset($_COOKIE[$cookieKey]);
}
}
@@ -495,14 +496,18 @@ class router
$extension = ltrim(strrchr($fileName, '.'), '.');
if(strrpos($this->config->file->dangers, $extension) !== false)
{
foreach($files as $fileKey => $value) unset($_FILES[$varName][$fileKey][$i]);
foreach($files as $fileKey => $value)
{
unset($_FILES);
break 2;
}
}
}
}
else
{
$extension = ltrim(strrchr($files['name'], '.'), '.');
if(strrpos($this->config->file->dangers, $extension) !== false) $_FILES[$varName] = array();
if(strrpos($this->config->file->dangers, $extension) !== false) unset($_FILES);
}
}
}
@@ -1234,7 +1239,8 @@ class router
/* Check params from URL. */
foreach($passedParams as $param => $value)
{
if(preg_match('/[^a-zA-Z0-9=_,`+\/\.]/', $value)) die('Error params!');
if(preg_match('/[^a-zA-Z0-9_\.]/', $param)) die('Bad Request!');
if(preg_match('/[^a-zA-Z0-9=_,`+\/\.%]/', $value)) die('Bad Request!');
}
/* If not strict mode, the keys of passed params and default params must be the same order. */