Changeset 192

Timestamp:

03/21/07 20:41:09 (14 years ago)

Author:

exi

Message:

Fixed several potential security issues with unchecked variables.
Added .htaccess files to common/ and mods/.
Modified the sync module to not send item data anymore.

Location:

dev

Files:

• common/.htaccess (added)
• common/admin/admin_sync.php (modified) (5 diffs)
• common/feed.php (modified) (5 diffs)
• common/includes/class.alliance.php (modified) (1 diff)
• common/includes/class.pilot.php (modified) (2 diffs)
• common/index.php (modified) (5 diffs)
• common/portrait_grab.php (modified) (3 diffs)
• mods/.htaccess (added)
• mods/signature_generator/sig.php (modified) (1 diff)
• templates/admin_roles_assign.tpl (added)

dev/common/admin/admin_sync.php

@@ -31 +31 @@
     }
 
-    $content_file .= 'ITEMS_START';
+    if (isset($_REQUEST['itm_update']))
+    {
+        $content_file .= 'ITEMS_START';
+    }
+    /*
     $qry->execute("select itm_name, itm_externalid, itm_value from kb3_items where itm_value != 0");
     while ($data = $qry->getRow())
@@ -37 +41 @@
         $content_file .= '§'.$data['itm_name'].'|'.$data['itm_externalid'].'|'.$data['itm_value'].'-';
     }
+    */
 
     $content_file = gzdeflate($content_file);
 
     $http->set_postdata('data', $content_file);
-    $http->set_useragent("EVE-KB SYNC (VER ".KB_VERSION.")");
+    $http->set_useragent('EVE-KB SYNC (VER '.KB_VERSION.')');
     $http->set_header('X-KBHost: '.base64_encode(KB_HOST));
 
-    // wait 90s for processed answer
-    $http->setSockettimeout(90);
+    // wait 30s for processed answer
+    $http->setSockettimeout(30);
     $file = $http->get_content();
     $header = $http->get_header();
 
-    preg_match("/X-KBVersion: (.*)/", $header, $match);
+    preg_match('/X-KBVersion: (.*)/', $header, $match);
     $version = explode('.', trim($match[1]));
     $recv = $http->get_recv();
@@ -67 +72 @@
             $html .= "getting compressed data failed, server response was:<br><pre>\n";
             $html .= $file."</pre>\n";
-            $html .= "Sent ".round($sended/1024, 2)." kB and received ".round($recv/1024, 2)." kB of data.<br>\n";
+            $html .= 'Sent '.round($sended/1024, 2)." kB and received ".round($recv/1024, 2)." kB of data.<br>\n";
         }
     }
@@ -75 +80 @@
 
         // get all names we'll find
-        preg_match_all("^!(.*?)\|(.*?)-^", $data, $matches);
+        preg_match_all('^!(.*?)\|(.*?)-^', $data, $matches);
         $results = count($matches[1]);
         $update = new DBQuery();
+        $new = 0;
         for ($i = 0; $i<$results; $i++)
         {
             $update->execute("update kb3_pilots set plt_externalid='".addslashes($matches[2][$i])."' where plt_name='".addslashes($matches[1][$i])."' limit 1");
+            if (mysql_affected_rows() == 1)
+            {
+                $new++;
+            }
         }
-        $html .= "Synchronization complete, got $results new ids from server running version ".$version[0].'.'.$version[1].'.'.$version[2].'.<br/>';
+        $html .= "Synchronization complete, got $new new ids and ".($results - $new)." unknown pilots from server running version ".$version[0].'.'.$version[1].'.'.$version[2].'.<br/>';
 
         if (isset($_REQUEST['itm_update']))
@@ -147 +157 @@
     $html .= "<table class=kb-subtable>";
     $html .= "<tr><td width=120><b>Update item values</b></td><td><input type=checkbox name=itm_update id=itm_update";
-    $html .= " checked=\"checked\"></td></tr>";
+    $html .= " ></td></tr>";
     $html .= "<tr><td width=120><b>Overwrite local values</b></td><td><input type=checkbox name=itm_overwrite id=itm_overwrite";
-    $html .= " checked=\"checked\">(If disabled only values with 0 will be overwritten)</td></tr>";
+    $html .= " >(If disabled only values with 0 will be overwritten)</td></tr>";
     $html .= '<input type="hidden" name="do" value="sync">';
     $html .= '<tr><td width=120></td><td><input type=submit name=submit value="Synchronize now"></td></tr></table></form>';

dev/common/feed.php

@@ -1 +1 @@
 <?php
-////////////
-//////
-//////  feed writer after
-//////  liq's feed syndication mod v1.5
-//////
-////////////
 
 @set_time_limit(120);
-require_once('common/includes/db.php');
 require_once('common/includes/class.corp.php');
 require_once('common/includes/class.alliance.php');
@@ -24 +17 @@
 $klist->setPodsNoobShips(true);
 
-if ($_GET['week'])
+$w = intval($_GET['week']);
+if ($w)
 {
-    $klist->setWeek($_GET['week']);
+    $klist->setWeek($w);
 }
 elseif (!$_GET['lastkllid'])
@@ -33 +27 @@
 }
 
-if ($_GET['year'])
+$y = intval($_GET['year']);
+if ($y)
 {
-    $klist->setYear($_GET['year']);
+    $klist->setYear($y);
 }
 elseif (!$_GET['lastkllid'])
@@ -42 +37 @@
 }
 
-if ($_GET['lastkllid'] && method_exists($klist, 'setMinKllID'))
+$kid = intval($_GET['lastkllid']);
+if ( && method_exists($klist, 'setMinKllID'))
 {
-    $klist->setMinKllID($_GET['lastkllid']);
+    $klist->setMinKllID($kid);
 }
 
@@ -129 +125 @@
 {
     $kill = new Kill($id);
-    $html .= "<item>
-                                <title>" . $id . "</title>
-                                <description><![CDATA[ ".$kill->getRawMail()." ]]></description>
-                                <guid>?a=kill_detail&amp;kll_id=".$id."</guid>
-                                <pubDate>" . strftime("%a, %d %b %Y %T %Z", strtotime($timestamp)) . "</pubDate>
+    $html .= '<item>
+                                <title>'.$id.'</title>
+                                <description><![CDATA[ '.$kill->getRawMail().' ]]></description>
+                                <guid>?a=kill_detail&amp;kll_id='.$id.'</guid>
+                                <pubDate>'.strftime("%a, %d %b %Y %T %Z", strtotime($timestamp))."</pubDate>
                                 </item>\n";
 }
-$html .= "</channel></rss>";
+$html .= '</channel></rss>';
 
 if ($_GET['gz'])

dev/common/includes/class.alliance.php

@@ -1 +1 @@
 <?php
-require_once("db.php");
 
 class Alliance

dev/common/includes/class.pilot.php

@@ -8 +8 @@
     function Pilot($id = 0)
     {
-        $this->id_ = $id;
+        $this->id_ = intval($id);
         $this->qry_ = new DBQuery();
     }
@@ -113 +113 @@
     function setCharacterID($id)
     {
+        $id = intval($id);
+        if (!$id)
+        {
+            return false;
+        }
         $qry = new DBQuery();
         $qry->execute("update kb3_pilots set plt_externalid = ".$id."
-                       where plt_id = ".$this->id_) or die($qry->getErrorMsg());
+                       where plt_id = ".$this->id_);
     }
 }

dev/common/index.php

@@ -30 +30 @@
 require_once('common/includes/class.user.php');
 require_once('common/includes/class.session.php');
-require_once('smarty/Smarty.class.php');
+require_once('common/smarty/Smarty.class.php');
 
 // smarty doesnt like it
@@ -38 +38 @@
 $page = str_replace('.', '', $_GET['a']);
 $page = str_replace('/', '', $page);
-if ($page == '')
+if ($page == '' || $page == 'index')
 {
     $page = 'home';
@@ -143 +143 @@
 if ($docache)
 {
-    if (!file_exists(KB_CACHEDIR . '/' . KB_SITE))
-    {
-        @mkdir(KB_CACHEDIR . '/' . KB_SITE);
+    if (!file_exists(KB_CACHEDIR.'/'.KB_SITE))
+    {
+        @mkdir(KB_CACHEDIR.'/'.KB_SITE);
     }
 
@@ -159 +159 @@
     $cachetime = $cachetime * 60;
 
-    $cachefile = KB_CACHEDIR . '/' . KB_SITE . '/' . md5($_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']) . '.cache';
+    $cachefile = KB_CACHEDIR.'/'.KB_SITE.'/'.md5($_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']).'.cache';
     $timestamp = ((@file_exists($cachefile))) ? @filemtime($cachefile) : 0;
 
@@ -175 +175 @@
 if ($settingsPage)
 {
-    include ('mods/'.substr($page, 9, strlen($page)-9).'/settings.php');
+    if (!Session::isAdmin())
+    {
+        header('Location: ?a=login');
+        echo '<a href="?a=login">Login</a>';
+        exit;
+    }
+
+    include('mods/'.substr($page, 9, strlen($page)-9).'/settings.php');
 }
 elseif ($modOverrides)

dev/common/portrait_grab.php

@@ -23 +23 @@
     else
     {
-        $now = date("Y-m-d H:m:s");
+        $now = date('Y-m-d H:m:s');
 
         $alliance = new Alliance();
@@ -31 +31 @@
         $pilot = new Pilot();
         $plt_id = $pilot->add($_SERVER['HTTP_EVE_CHARNAME'], $corp, $now);
-        $pilot->setCharacterID($_SERVER['HTTP_EVE_CHARID']);
-        @unlink("cache/portraits/".$_SERVER['HTTP_EVE_CHARID']."_32.jpg");
-        @unlink("cache/portraits/".$_SERVER['HTTP_EVE_CHARID']."_64.jpg");
-        @unlink("cache/portraits/".$_SERVER['HTTP_EVE_CHARID']."_128.jpg");
-        @unlink("cache/portraits/".$_SERVER['HTTP_EVE_CHARID']."_256.jpg");
-        @unlink("cache/portraits/".$_SERVER['HTTP_EVE_CHARID']."_512.jpg");
+        $id = intval($_SERVER['HTTP_EVE_CHARID']);
+        $pilot->setCharacterID($id);
+        @unlink("cache/portraits/".$id."_32.jpg");
+        @unlink("cache/portraits/".$id."_64.jpg");
+        @unlink("cache/portraits/".$id."_128.jpg");
+        @unlink("cache/portraits/".$id."_256.jpg");
+        @unlink("cache/portraits/".$id."_512.jpg");
         $html .= "<img src=\"".$pilot->getPortraitURL(64).".jpg\" border=\"0\">";
         $html .= "Character portrait updated !<br>";
         $html .= "<a href=\"?a=igb\">Return</a><br>";
-
-        //$updated = true;
     }
 }
@@ -49 +48 @@
 $page->setContent($html);
 $page->generate();
-
-/*
-if ($updated)
-{
-    flush();
-    ignore_user_abort(1);
-    $id = $_SERVER['HTTP_EVE_CHARID'];
-
-    $img = imagecreatefromjpeg("http://img.eve.is/serv.asp?s=512&c=".$id);
-    if ($img)
-    {
-        $newimg = imagecreatetruecolor(32, 32);
-        imagecopyresampled($newimg, $img, 0, 0, 0, 0, 32, 32, 512, 512);
-        imagejpeg($newimg, "cache/portraits/" . $id . "_32.jpg");
-        $newimg = imagecreatetruecolor(64, 64);
-        imagecopyresampled($newimg, $img, 0, 0, 0, 0, 64, 64, 512, 512);
-        imagejpeg($newimg, "cache/portraits/" . $id . "_64.jpg");
-        $newimg = imagecreatetruecolor(128, 128);
-        imagecopyresampled($newimg, $img, 0, 0, 0, 0, 128, 128, 512, 512);
-        imagejpeg($newimg, "cache/portraits/" . $id . "_128.jpg");
-    }
-}
-*/
 ?>

dev/mods/signature_generator/sig.php

@@ -19 +19 @@
 }
 
-if (!$plt_id = $_GET['i'])
+if (!$plt_id = intval($_GET['i']))
 {
     errorPic('No pilot id specified.');