[Helpmeict-cvs] Helpdesk domains.php,1.7,1.8

[Scott P. <wht...@us...>]

Update of /cvsroot/helpmeict/Helpdesk
In directory sc8-pr-cvs17:/tmp/cvs-serv6666

Modified Files:
	domains.php 
Log Message:
More elegant way of sanitizing inputs and assinging GET/POST/REQUEST variables.


Index: domains.php
===================================================================
RCS file: /cvsroot/helpmeict/Helpdesk/domains.php,v
retrieving revision 1.7
retrieving revision 1.8
diff -C2 -d -r1.7 -r1.8
*** domains.php	7 Sep 2007 22:04:21 -0000	1.7
--- domains.php	11 Sep 2007 16:17:32 -0000	1.8
***************
*** 48,52 ****
    require_once 'system/message.php';
  
!   global $act, $domain, $message;
    // Set Language
    set_text_domain("domains");
--- 48,52 ----
    require_once 'system/message.php';
  
!   global $act, $domain, $message, $domains;
    // Set Language
    set_text_domain("domains");
***************
*** 55,79 ****
      // scrubbing the field NAME...
      if (preg_match('/%/', urlencode($key))) die('FATAL::XSS hack attempt detected. Your IP has been logged.');
!     $_POST[$key] = htmlentities(strip_tags($val), ENT_QUOTES);
    }
    foreach($_REQUEST as $key => $val) {
      if (preg_match('/%/', urlencode($key))) die('FATAL::XSS hack attempt detected. Your IP has been logged.');
!     $_REQUEST[$key] = htmlentities(strip_tags($val), ENT_QUOTES); 
    }
  
    // Retrieve Get/Post variables
  
!   if (!get_magic_quotes_gpc()) {
!     $act = addslashes($_REQUEST['act']);
!     $domain = addslashes($_POST['domain']);
!     $domains = addslashes($_REQUEST['domains']);
!     $defaultpriority = addslashes($_POST['defaultpriority']);
    }
!   else {
!     $act = $_REQUEST['act'];
!     $domain = $_POST['domain'];
!     $domains = $_REQUEST['domains'];
!     $defaultpriority = $_POST['defaultpriority'];
    }
    // Action: Add a domain to the system
    if ($act == 'adddomainaction') {
--- 55,148 ----
      // scrubbing the field NAME...
      if (preg_match('/%/', urlencode($key))) die('FATAL::XSS hack attempt detected. Your IP has been logged.');
!     if(is_array($_POST[$key])) {
!       foreach ($_POST[$key] as $key2 => $val2) {
!         if (get_magic_quotes_gpc()) {
!           $_POST[$key2][$val2] = addslashes(htmlentities(strip_tags($val2), ENT_QUOTES));
!         }
!         else {
!           $_POST[$key2][$val2] = htmlentities(strip_tags($val2), ENT_QUOTES);
!         }
!       }
!     }
!     else {
!       if (get_magic_quotes_gpc()) {
!         $_POST[$key] = addslashes(htmlentities(strip_tags($val), ENT_QUOTES));
!       }
!       else {
!         $_POST[$key] = htmlentities(strip_tags($val), ENT_QUOTES);
!       }
!     }
    }
+ 
+   foreach($_GET as $key => $val) {
+     // scrubbing the field NAME...
+     if (preg_match('/%/', urlencode($key))) die('FATAL::XSS hack attempt detected. Your IP has been logged.');
+     if(is_array($_GET[$key])) {
+       foreach ($_GET[$key] as $key2 => $val2) {
+         if (get_magic_quotes_gpc()) {
+           $_GET[$key2][$val2] = addslashes(htmlentities(strip_tags($val2), ENT_QUOTES));
+         }
+         else {
+           $_GET[$key2][$val2] = htmlentities(strip_tags($val2), ENT_QUOTES);
+         }
+       }
+     }
+     else {
+       if (get_magic_quotes_gpc()) {
+         $_GET[$key] = addslashes(htmlentities(strip_tags($val), ENT_QUOTES));
+       }
+       else {
+         $_GET[$key] = htmlentities(strip_tags($val), ENT_QUOTES);
+       }
+     }
+   }
+ 
    foreach($_REQUEST as $key => $val) {
+     // scrubbing the field NAME...
      if (preg_match('/%/', urlencode($key))) die('FATAL::XSS hack attempt detected. Your IP has been logged.');
!     if(is_array($_REQUEST[$key])) {
!       foreach ($_REQUEST[$key] as $key2 => $val2) {
!         if (get_magic_quotes_gpc()) {
!           $_REQUEST[$key2][$val2] = addslashes(htmlentities(strip_tags($val2), ENT_QUOTES));
!         }
!         else {
!           $_REQUEST[$key2][$val2] = htmlentities(strip_tags($val2), ENT_QUOTES);
!         }
!       }
!     }
!     else {
!       if (get_magic_quotes_gpc()) {
!         $_REQUEST[$key] = addslashes(htmlentities(strip_tags($val), ENT_QUOTES));
!       }
!       else {
!         $_REQUEST[$key] = htmlentities(strip_tags($val), ENT_QUOTES);
!       }
!     }
    }
  
    // Retrieve Get/Post variables
  
!   $requestarg = Array(
!                   'act',
!                   'domains'
!                   );
! 
!   $postarg = Array(
!                'domain',
!                'defaultpriority'
!                );
! 
!   foreach ($requestarg as $request) {
!     if (isset($_REQUEST[$request])) {
!       $$request = $_REQUEST[$request];
!     }
    }
! 
!   foreach ($postarg as $post) {
!     if (isset($_POST[$post])) {
!       $$post = $_POST[$post];
!     }
    }
+ 
    // Action: Add a domain to the system
    if ($act == 'adddomainaction') {
***************
*** 95,99 ****
  
        $dirname = dirname($_SERVER['PHP_SELF']);
!       $https = 'http'.($_SERVER['HTTPS'] ? 's' : '');
        $headertext = "Location: $https://".$_SERVER['HTTP_HOST'].$dirname.(strrpos($dirname,'/') == (strlen($dirname)-1)?'':'/').'domains.php?domains='.$_SESSION['_domain'];
  
--- 164,168 ----
  
        $dirname = dirname($_SERVER['PHP_SELF']);
!       $https = 'http'.(isset($_SERVER['HTTPS']) ? 's' : '');
        $headertext = "Location: $https://".$_SERVER['HTTP_HOST'].$dirname.(strrpos($dirname,'/') == (strlen($dirname)-1)?'':'/').'domains.php?domains='.$_SESSION['_domain'];
  
***************
*** 114,118 ****
  
        $dirname = dirname($_SERVER['PHP_SELF']);
!       $https = 'http'.($_SERVER['HTTPS'] ? 's' : '');
        $headertext = "Location: $https://".$_SERVER['HTTP_HOST'].$dirname.(strrpos($dirname,'/') == (strlen($dirname)-1)?'':'/').'domains.php?domains='.$domains;
  
--- 183,187 ----
  
        $dirname = dirname($_SERVER['PHP_SELF']);
!       $https = 'http'.(isset($_SERVER['HTTPS']) ? 's' : '');
        $headertext = "Location: $https://".$_SERVER['HTTP_HOST'].$dirname.(strrpos($dirname,'/') == (strlen($dirname)-1)?'':'/').'domains.php?domains='.$domains;
  
***************
*** 139,143 ****
  
      $dirname = dirname($_SERVER['PHP_SELF']);
!     $https = 'http'.($_SERVER['HTTPS'] ? 's' : '');
      $headertext = "Location: $https://".$_SERVER['HTTP_HOST'].$dirname.(strrpos($dirname,'/') == (strlen($dirname)-1)?'':'/').'domains.php?domains='.$domains;
  
--- 208,212 ----
  
      $dirname = dirname($_SERVER['PHP_SELF']);
!     $https = 'http'.(isset($_SERVER['HTTPS']) ? 's' : '');
      $headertext = "Location: $https://".$_SERVER['HTTP_HOST'].$dirname.(strrpos($dirname,'/') == (strlen($dirname)-1)?'':'/').'domains.php?domains='.$domains;