[Phpfreechat-svn] SF.net SVN: phpfreechat: [521] trunk/src

[<ke...@us...>]

Revision: 521
Author:   kerphi
Date:     2006-05-28 07:59:14 -0700 (Sun, 28 May 2006)
ViewCVS:  http://svn.sourceforge.net/phpfreechat/?rev=521&view=rev

Log Message:
-----------
Refactoring on the 'cmdtoplay' code : remove the command call from the client side (security issue)

Modified Paths:
--------------
    trunk/src/commands/update.class.php
    trunk/src/phpfreechat.class.php
Modified: trunk/src/commands/update.class.php
===================================================================
--- trunk/src/commands/update.class.php	2006-05-28 12:23:40 UTC (rev 520)
+++ trunk/src/commands/update.class.php	2006-05-28 14:59:14 UTC (rev 521)
@@ -25,6 +25,7 @@
       //       }
 
 
+      /*
       // ---
       // play the other commands
       $nickid = $container->getNickId($u->nick);
@@ -34,7 +35,7 @@
         $xml_reponse->addScript("pfc.handleResponse('update', 'cmdtoplay', Array('".$cmdtmp[0]."','".addslashes($cmdtmp[1])."'));");
       $container->rmMeta("cmdtoplay", "nickname", $nickid);
       // ---
-
+      */
       
       // update the user nickname timestamp
       $cmd =& pfcCommand::Factory("updatemynick");

Modified: trunk/src/phpfreechat.class.php
===================================================================
--- trunk/src/phpfreechat.class.php	2006-05-28 12:23:40 UTC (rev 520)
+++ trunk/src/phpfreechat.class.php	2006-05-28 14:59:14 UTC (rev 521)
@@ -365,7 +365,6 @@
 
     }
 
-    /*
     
     // before playing the wanted command
     // play the found commands into the meta 'cmdtoplay'
@@ -381,20 +380,27 @@
       if ($cmdtmp != NULL)
       {
         // store the new cmdtoplay list (-1 item)
-        $cmdtoplay = $container->setMeta("cmdtoplay", "nickname", $nickid);
+        $cmdtoplay = $container->setMeta(serialize($cmdtoplay), "cmdtoplay", "nickname", $nickid);
 
         // play the command
+        $cmd =& pfcCommand::Factory($cmdtmp[0]);
+        if ($c->debug)
+          $cmd->run($xml_reponse, $clientid, $cmdtmp[1], $sender, $recipient, $recipientid);
+        else
+          @$cmd->run($xml_reponse, $clientid, $cmdtmp[1], $sender, $recipient, $recipientid);
+
+        if ($cmdtmp[0] == "leave")
+          $xml_reponse->addScript("alert('KICK');");
         
         // check if there is other command to play
         $cmdtoplay = $container->getMeta("cmdtoplay", "nickname", $nickid);
-        $cmdtoplay = ($cmdtoplay == NULL) ? array() : unserialize($cmdtoplay);
+        $cmdtoplay = ($cmdtoplay == NULL) ? array() : unserialize($cmdtoplay);        
       }
 
       $morecmd = (count($cmdtoplay) > 0);
     }
 
 
-    */
 
 
 


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.