Skip to content
This repository has been archived by the owner on May 18, 2021. It is now read-only.

Commit

Permalink
修复一些SQL注入漏洞
Browse files Browse the repository at this point in the history
  • Loading branch information
@burpheart
burpheart committed Aug 12, 2020
1 parent f781c10 commit 1639dab
Show file tree
Hide file tree
Showing 5 changed files with 9 additions and 8 deletions.
4 changes: 2 additions & 2 deletions forummanage.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@
else{
sql_query("DELETE FROM forummods WHERE forumid=".sqlesc($id)) or sqlerr(__FILE__, __LINE__);
}
sql_query("UPDATE forums SET sort = '" . $_POST['sort'] . "', name = " . sqlesc($_POST['name']). ", description = " . sqlesc($_POST['desc']). ", forid = ".sqlesc(($_POST['overforums'])).", minclassread = '" . $_POST['readclass'] . "', minclasswrite = '" . $_POST['writeclass'] . "', minclasscreate = '" . $_POST['createclass'] . "' where id = ".sqlesc($id)) or sqlerr(__FILE__, __LINE__);
sql_query("UPDATE forums SET sort = '" . sqlesc($_POST['sort']) . "', name = " . sqlesc($_POST['name']). ", description = " . sqlesc($_POST['desc']). ", forid = ".sqlesc(($_POST['overforums'])).", minclassread = '" . sqlesc($_POST['readclass']) . "', minclasswrite = '" . sqlesc($_POST['writeclass']) . "', minclasscreate = '" . sqlesc($_POST['createclass']) . "' where id = ".sqlesc($id)) or sqlerr(__FILE__, __LINE__);
$Cache->delete_value('forums_list');
$Cache->delete_value('forum_moderator_array');
header("Location: forummanage.php");
Expand All @@ -60,7 +60,7 @@
header("Location: " . get_protocol_prefix() . "$BASEURL/forummanage.php");
die();
}
sql_query("INSERT INTO forums (sort, name, description, minclassread, minclasswrite, minclasscreate, forid) VALUES(" . $_POST['sort'] . ", " . sqlesc($_POST['name']). ", " . sqlesc($_POST['desc']). ", " . $_POST['readclass'] . ", " . $_POST['writeclass'] . ", " . $_POST['createclass'] . ", ".sqlesc(($_POST['overforums'])).")") or sqlerr(__FILE__, __LINE__);
sql_query("INSERT INTO forums (sort, name, description, minclassread, minclasswrite, minclasscreate, forid) VALUES(" . sqlesc($_POST['sort']) . ", " . sqlesc($_POST['name']). ", " . sqlesc($_POST['desc']). ", " . sqlesc($_POST['readclass']) . ", " . sqlesc($_POST['writeclass']) . ", " . sqlesc($_POST['createclass']) . ", ".sqlesc(($_POST['overforums'])).")") or sqlerr(__FILE__, __LINE__);
$Cache->delete_value('forums_list');
if ($_POST["moderator"]){
$id = mysql_insert_id();
Expand Down
4 changes: 2 additions & 2 deletions include/functions.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -448,7 +448,7 @@ function int_check($value,$stdhead = false, $stdfood = true, $die = true, $log =
else
{
if (!is_valid_id($value)) {
$msg = "Invalid ID Attempt: Username: ".$CURUSER["username"]." - UserID: ".$CURUSER["id"]." - UserIP : ".getip();
$msg = "Invalid ID Attempt: Username: ".$CURUSER["username"]." - UserID: ".$CURUSER["id"]." - UserIP : ".getip()." - IDValue : ".htmlspecialchars($value);//记录详细操作 便于判断用户是否真的违规操作 给予封禁
if ($log)
write_log($msg,'mod');

Expand All @@ -471,7 +471,7 @@ function int_check($value,$stdhead = false, $stdfood = true, $die = true, $log =

function is_valid_id($id)
{
return is_numeric($id) && ($id > 0) && (floor($id) == $id);
return is_numeric($id) && ($id >= 0) && (floor($id) == $id);

This comment has been minimized.

Sign in to view

Copy link
@Rhilip

Rhilip Oct 20, 2020

此处修复方式也过于粗暴，NPHP在某些场合使用 is_valid_id(0) 作为输出判定。这么改会导致部分地方出现不该有的输出。

This comment has been minimized.

Sign in to view

Copy link
@gudumibug

gudumibug Dec 26, 2020

dalao 这项不改也可以把

This comment has been minimized.

Sign in to view

Copy link
@Rhilip

Rhilip Dec 27, 2020

dalao 这项不改也可以把

不用改，改了反而出问题。这个repo主修复漏洞就没测试过。有些部分的修复就是有问题的。
}


Expand Down
1 change: 1 addition & 0 deletions modrules.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@
}
elseif ($_GET["act"] == "edit"){
$id = $_GET["id"];
int_check($id);
$res = @mysql_fetch_array(@sql_query("select * from rules where id='$id'"));
stdhead("Edit rules");
//print("<td valign=top style=\"padding: 10px;\" colspan=2 align=center>");
Expand Down
6 changes: 3 additions & 3 deletions staffbox.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -129,7 +129,7 @@
$receiver = 0 + $_GET["receiver"];

int_check($receiver,true);

int_check($answeringto,true); //防止sql注入
$res = sql_query("SELECT * FROM users WHERE id=$receiver") or die(mysql_error());
$user = mysql_fetch_assoc($res);

Expand Down Expand Up @@ -219,7 +219,7 @@
permissiondenied();

$id = 0 + $_GET["id"];

int_check($id,true);
sql_query ("UPDATE staffmessages SET answered=1, answeredby = $CURUSER[id] WHERE id = $id") or sqlerr();
$Cache->delete_value('staff_new_message_count');
header("Refresh: 0; url=staffbox.php?action=viewpm&pmid=$id");
Expand All @@ -232,7 +232,7 @@
if ($action == "takecontactanswered") {
if (get_user_class() < $staffmem_class)
permissiondenied();

int_check($_POST[setanswered],true);
if ($_POST['setdealt']){
$res = sql_query ("SELECT id FROM staffmessages WHERE answered=0 AND id IN (" . implode(", ", $_POST[setanswered]) . ")");
while ($arr = mysql_fetch_assoc($res))
Expand Down
2 changes: 1 addition & 1 deletion takestaffmess.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
$updateset = $_POST['clases'];
if (is_array($updateset)) {
foreach ($updateset as $class) {
if (!is_valid_id($class) && $class != 0)
if (!is_valid_id($class)) //这种判断可以被直接绕过 当有一个对比参数是整数的时候，会把另外一个参数强制转换为整数。 如果参数开头不是整数就会返回0 把是否等于零放入is_valid_id函数内判断
stderr("Error","Invalid Class");
}
}else{
Expand Down

0 comments on commit 1639dab

Please sign in to comment.