WooYun.org

quotesGPC(); // 效果：addslashes


if($config['sy_istemplate']!='1' || md5(md5($config['sy_safekey']).$_GET['m'])!=$_POST['safekey'])


{


	foreach($_POST  as $id=>$v){


		safesql($id,$v,"POST",$config);


		$id = sfkeyword($id,$config);


		$v = sfkeyword($v,$config);


		$_POST[$id]=common_htmlspecialchars($v);


	}


}


foreach($_GET  as $id=>$v){


	


	safesql($id,$v,"GET",$config);


	$id = sfkeyword($id,$config);


	$v = sfkeyword($v,$config);


	if(!is_array($v))


	$v=substr(strip_tags($v),0,80);





	$_GET[$id]=common_htmlspecialchars($v);


}





foreach($_COOKIE  as $id=>$v){


	


	safesql($id,$v,"COOKIE",$config);


	$id = sfkeyword($id,$config);


	$v = sfkeyword($v,$config);


	$v=substr(strip_tags($v),0,52);


	$_COOKIE[$id]=common_htmlspecialchars($v);


}

safesql($id,$v,"POST",$config);


$id = sfkeyword($id,$config);


$v = sfkeyword($v,$config);


$_POST[$id]=common_htmlspecialchars($v);

if($config['sy_istemplate']!='1' || md5(md5($config['sy_safekey']).$_GET['m'])!=$_POST['safekey'])


{


	foreach($_POST  as $id=>$v){


		safesql($id,$v,"POST",$config);


		$id = sfkeyword($id,$config);


		$v = sfkeyword($v,$config);


		$_POST[$id]=common_htmlspecialchars($v);


	}


}

$config['sy_istemplate']!='1' || md5(md5($config['sy_safekey']).$_GET['m'])!=$_POST['safekey']

$r=rand(10000000,99999999);


mysql_query("update $table_config set `config`='$r' where `name`='sy_safekey'");

<tr>


        <th width="160">系统安全码：</th>


        <td><input class="input-text tips_class" type="text" name="sy_safekey" id="sy_safekey" value="<?php echo $this->_tpl_vars['config']['sy_safekey']; ?>


" size="40" maxlength="255"/><font color="gray" style="display:none">系统部分功能使用的加密串，请自定义修改，如：986jhgyutw.*x</font></td>


        <td width="160">sy_safekey</td>


    </tr>

<tr>


        <th width="160">系统安全码：</th>


        <td><input class="input-text tips_class" type="text" name="sy_safekey" id="sy_safekey" value="{yun:}$config.sy_safekey{/yun}" size="40" maxlength="255"/><font color="gray" style="display:none">系统部分功能使用的加密串，请自定义修改，如：986jhgyutw.*x</font></td>


        <td width="160">sy_safekey</td>


    </tr>

function index_action(){


    if($this->uid!=$_GET['id']&&$_COOKIE['usertype']=='1'){


       ... ... ...


    }


    if($_POST['submit'])


    {


        ... ... ...


    }


    if($_POST['submit2'])


    {


       ... ... ...


    }


    ... ... ...


    $tp=$_GET['tp']?$_GET['tp']:"index";


    $this->seo("company_".$tp);


    $this->yunset("com_style",$this->config['sy_weburl']."/template/company/".$tplurl."/");


    $this->yunset("comstyle","../template/company/".$tplurl."/");


    $this->yunset("defaultstyle","../template/default/");


    $this->yuntpl(array('company/'.$tplurl."/".$tp));





}

if(is_file(LIB_PATH.'webscan360/360safe/360webscan.php')){


    require_once(LIB_PATH.'webscan360/360safe/360webscan.php');


}

//get拦截规则


$getfilter = "<[^>]*?=[^>]*?&#[^>]*?>|\\b(alert\\(|confirm\\(|expression\\(|prompt\\()|<[^>]*?\\b(onerror|onmousemove|onload|onclick|onmouseover)\\b[^>]*?>|^\\+\\/v(8|9)|\\b(and|or)\\b\\s*?([\\(\\)'\"\\d]+?=[\\(\\)'\"\\d]+?|[\\(\\)'\"a-zA-Z]+?=[\\(\\)'\"a-zA-Z]+?|>|<|\s+?[\\w]+?\\s+?\\bin\\b\\s*?\(|\\blike\\b\\s+?[\"'])|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";


//post拦截规则


$postfilter = "<[^>]*?=[^>]*?&#[^>]*?>|\\b(alert\\(|confirm\\(|expression\\(|prompt\\()|<[^>]*?\\b(onerror|onmousemove|onload|onclick|onmouseover)\\b[^>]*?>|\\b(and|or)\\b\\s*?([\\(\\)'\"\\d]+?=[\\(\\)'\"\\d]+?|[\\(\\)'\"a-zA-Z]+?=[\\(\\)'\"a-zA-Z]+?|>|<|\s+?[\\w]+?\\s+?\\bin\\b\\s*?\(|\\blike\\b\\s+?[\"'])|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";


//cookie拦截规则


$cookiefilter = "\\b(and|or)\\b\\s*?([\\(\\)'\"\\d]+?=[\\(\\)'\"\\d]+?|[\\(\\)'\"a-zA-Z]+?=[\\(\\)'\"a-zA-Z]+?|>|<|\s+?[\\w]+?\\s+?\\bin\\b\\s*?\(|\\blike\\b\\s+?[\"'])|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";

if ($webscan_switch&&webscan_white($webscan_white_directory,$webscan_white_url)) {





  if ($webscan_get) {





    foreach($_GET as $key=>$value) {


      webscan_StopAttack($key,$value,$getfilter,"GET"); // 对GET进行过滤


    }


  }


  if ($webscan_post) {


    foreach($_POST as $key=>$value) {


      webscan_StopAttack($key,$value,$postfilter,"POST"); // 对POST进行过滤


    }


  }


  if ($webscan_cookie) {


    foreach($_COOKIE as $key=>$value) {


      webscan_StopAttack($key,$value,$cookiefilter,"COOKIE"); // 对COOKIE进行过滤


    }


  }


  if ($webscan_referre) {


    foreach($webscan_referer as $key=>$value) {


      webscan_StopAttack($key,$value,$postfilter,"REFERRER"); // 对REFERER头进行过滤


    }


  }


}

if ($webscan_switch&&webscan_white($webscan_white_directory,$webscan_white_url)) {

/**


 *  拦截目录白名单


 */


function webscan_white($webscan_white_name,$webscan_white_url=array()) {


  $url_path=$_SERVER['PHP_SELF'];


  $url_var=$_SERVER['QUERY_STRING'];


  if (preg_match("/".$webscan_white_name."/is",$url_path)==1) {


    return false;


  }


  foreach ($webscan_white_url as $key => $value) {


    if(!empty($url_var)&&!empty($value)){


      if (stristr($url_path,$key)&&stristr($url_var,$value)) {


        return false;


      }


    }


    elseif (empty($url_var)&&empty($value)) {


      if (stristr($url_path,$key)) {


        return false;


      }


    }


  }





  return true;


}

//后台白名单,后台操作将不会拦截,添加"|"隔开白名单目录下面默认是网址带 admin  /dede/ 放行


$webscan_white_directory='admin|\/dede\/|\/install\/';


//url白名单,可以自定义添加url白名单,默认是对phpcms的后台url放行


//写法：比如phpcms 后台操作url index.php?m=admin php168的文章提交链接post.php?job=postnew&step=post ,dedecms 空间设置edit_space_info.php


$webscan_white_url = array('index.php' => 'admin_dir=admin','post.php' => 'job=postnew&step=post','edit_space_info.php'=>'');

function quotesGPC() {





	if(!get_magic_quotes_gpc()){


	 	$_POST = array_map("addSlash", $_POST);


		$_GET = array_map("addSlash", $_GET);


		$_COOKIE = array_map("addSlash", $_COOKIE);


	}





}


function addSlash($el) {


	if (is_array($el))


		return array_map("addSlash", $el);


	else


		return addslashes($el);


}

function index_action()


{


    $this->get_moblie(); // 通过UA判断是否是手机端


    if($this->uid || $this->username)


    {


        $this->wapheader('member/index.php'); //登陆用户跳转


    }


    if($_POST['submit'])


    {


        if($_POST['wxid'])


        {


            $wxparse = '&wxid='.$_POST['wxid'];


        }


        $usertype=$_POST['usertype']?intval($_POST['usertype']):1;


        $username = str_replace('\\','',$_POST['username']); // 漏洞点：过滤\


        if($usertype>0 && $username!='')


        {


            $userinfo = $this->obj->DB_select_once("member","`username`='".str_replace('\\','',$_POST['username'])."' and usertype='".$usertype."'","username,usertype,password,uid,salt");





    ... ... ...