mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-08-13 04:04:12 +02:00
Code Issues Releases Wiki Activity

several security fixes in admin pages

Browse Source 
changed bbcode to only allow jpg, jpeg, gif and png


git-svn-id: file:///svn/phpbb/branches/phpBB-2_0_0@4876 89ea8834-ac86-4346-8a33-228a782c2dd0
This commit is contained in:
Meik Sievertsen
2004-03-25 15:57:20 +00:00
parent 79c15bd7c1
commit 234b1f13de
21 changed files with 1038 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
phpBB/admin/admin_forumauth.php
View File

@@ -102,20 +102,23 @@ if( isset($HTTP_POST_VARS['submit']) )
{
if(isset($HTTP_POST_VARS['simpleauth']))
{
$simple_ary = $simple_auth_ary[$HTTP_POST_VARS['simpleauth']];
$simple_ary = $simple_auth_ary[intval($HTTP_POST_VARS['simpleauth'])];
for($i = 0; $i < count($simple_ary); $i++)
{
$sql .= ( ( $sql != '' ) ? ', ' : '' ) . $forum_auth_fields[$i] . ' = ' . $simple_ary[$i];
}
$sql = "UPDATE " . FORUMS_TABLE . " SET $sql WHERE forum_id = $forum_id";
if (is_array($simple_ary))
{
$sql = "UPDATE " . FORUMS_TABLE . " SET $sql WHERE forum_id = $forum_id";
}
}
else
{
for($i = 0; $i < count($forum_auth_fields); $i++)
{
$value = $HTTP_POST_VARS[$forum_auth_fields[$i]];
$value = intval($HTTP_POST_VARS[$forum_auth_fields[$i]]);
if ( $forum_auth_fields[$i] == 'auth_vote' )
{

1
phpBB/admin/admin_forums.php
View File

@@ -55,6 +55,7 @@ $forum_auth_ary = array(
if( isset($HTTP_POST_VARS['mode']) || isset($HTTP_GET_VARS['mode']) )
{
$mode = ( isset($HTTP_POST_VARS['mode']) ) ? $HTTP_POST_VARS['mode'] : $HTTP_GET_VARS['mode'];
$mode = htmlspecialchars($mode);
}
else
{

1
phpBB/admin/admin_groups.php
View File

@@ -49,6 +49,7 @@ else
if ( isset($HTTP_POST_VARS['mode']) || isset($HTTP_GET_VARS['mode']) )
{
$mode = ( isset($HTTP_POST_VARS['mode']) ) ? $HTTP_POST_VARS['mode'] : $HTTP_GET_VARS['mode'];
$mode = htmlspecialchars($mode);
}
else
{

1
phpBB/admin/admin_ranks.php
View File

@@ -38,6 +38,7 @@ require('./pagestart.' . $phpEx);
if( isset($HTTP_GET_VARS['mode']) || isset($HTTP_POST_VARS['mode']) )
{
$mode = ($HTTP_GET_VARS['mode']) ? $HTTP_GET_VARS['mode'] : $HTTP_POST_VARS['mode'];
$mode = htmlspecialchars($mode);
}
else
{

3
phpBB/admin/admin_smilies.php
View File

@@ -57,6 +57,7 @@ require('./pagestart.' . $phpEx);
if( isset($HTTP_POST_VARS['mode']) || isset($HTTP_GET_VARS['mode']) )
{
$mode = ( isset($HTTP_POST_VARS['mode']) ) ? $HTTP_POST_VARS['mode'] : $HTTP_GET_VARS['mode'];
$mode = htmlspecialchars($mode);
}
else
{
@@ -313,6 +314,7 @@ else if ( $mode != "" )
//
$smiley_id = ( !empty($HTTP_POST_VARS['id']) ) ? $HTTP_POST_VARS['id'] : $HTTP_GET_VARS['id'];
$smiley_id = intval($smiley_id);
$sql = "DELETE FROM " . SMILIES_TABLE . "
WHERE smilies_id = " . $smiley_id;
@@ -333,6 +335,7 @@ else if ( $mode != "" )
//
$smiley_id = ( !empty($HTTP_POST_VARS['id']) ) ? $HTTP_POST_VARS['id'] : $HTTP_GET_VARS['id'];
$smiley_id = intval($smiley_id);
$sql = "SELECT *
FROM " . SMILIES_TABLE . "

5
phpBB/admin/admin_styles.php
View File

@@ -56,6 +56,7 @@ if ($cancel)
if( isset($HTTP_GET_VARS['mode']) || isset($HTTP_POST_VARS['mode']) )
{
$mode = ( isset($HTTP_GET_VARS['mode']) ) ? $HTTP_GET_VARS['mode'] : $HTTP_POST_VARS['mode'];
$mode = htmlspecialchars($mode);
}
else
{
@@ -488,7 +489,7 @@ switch( $mode )
$themes_title = $lang['Edit_theme'];
$themes_explain = $lang['Edit_theme_explain'];
$style_id = $HTTP_GET_VARS['style_id'];
$style_id = intval($HTTP_GET_VARS['style_id']);
$selected_names = array();
$selected_values = array();
@@ -703,7 +704,7 @@ switch( $mode )
$sql = "SELECT *
FROM " . THEMES_TABLE . "
WHERE template_name = '$template_name'";
WHERE template_name = '" . str_replace("\'", "''", $template_name) . "'";
if(!$result = $db->sql_query($sql))
{
message_die(GENERAL_ERROR, "Could not get theme data for selected template", "", __LINE__, __FILE__, $sql);

2
phpBB/admin/admin_ug_auth.php
View File

@@ -56,6 +56,8 @@ while( list($var, $param) = @each($params) )
$user_id = intval($user_id);
$group_id = intval($group_id);
$adv = intval($adv);
$mode = htmlspecialchars($mode);
//
// Start program - define vars

6
phpBB/admin/admin_user_ban.php
View File

@@ -277,7 +277,7 @@ if ( isset($HTTP_POST_VARS['submit']) )
{
if ( $user_list[$i] != -1 )
{
$where_sql .= ( ( $where_sql != '' ) ? ', ' : '' ) . $user_list[$i];
$where_sql .= ( ( $where_sql != '' ) ? ', ' : '' ) . intval($user_list[$i]);
}
}
}
@@ -290,7 +290,7 @@ if ( isset($HTTP_POST_VARS['submit']) )
{
if ( $ip_list[$i] != -1 )
{
$where_sql .= ( ( $where_sql != '' ) ? ', ' : '' ) . $ip_list[$i];
$where_sql .= ( ( $where_sql != '' ) ? ', ' : '' ) . str_replace("\'", "''", $ip_list[$i]);
}
}
}
@@ -303,7 +303,7 @@ if ( isset($HTTP_POST_VARS['submit']) )
{
if ( $email_list[$i] != -1 )
{
$where_sql .= ( ( $where_sql != '' ) ? ', ' : '' ) . $email_list[$i];
$where_sql .= ( ( $where_sql != '' ) ? ', ' : '' ) . str_replace("\'", "''", $email_list[$i]);
}
}
}

3
phpBB/admin/admin_users.php
View File

@@ -47,6 +47,7 @@ $html_entities_replace = array('&lt;', '&gt;');
if( isset( $HTTP_POST_VARS['mode'] ) || isset( $HTTP_GET_VARS['mode'] ) )
{
$mode = ( isset( $HTTP_POST_VARS['mode']) ) ? $HTTP_POST_VARS['mode'] : $HTTP_GET_VARS['mode'];
$mode = htmlspecialchars($mode);
}
else
{
@@ -838,7 +839,7 @@ if ( $mode == 'edit' || $mode == 'save' && ( isset($HTTP_POST_VARS['username'])
if( isset($HTTP_POST_VARS['avatarcategory']) )
{
$category = $HTTP_POST_VARS['avatarcategory'];
$category = htmlspecialchars($HTTP_POST_VARS['avatarcategory']);
}
else
{

6
phpBB/admin/admin_words.php
View File

@@ -39,6 +39,7 @@ require('./pagestart.' . $phpEx);
if( isset($HTTP_GET_VARS['mode']) || isset($HTTP_POST_VARS['mode']) )
{
$mode = ($HTTP_GET_VARS['mode']) ? $HTTP_GET_VARS['mode'] : $HTTP_POST_VARS['mode'];
$mode = htmlspecialchars($mode);
}
else
{
@@ -63,7 +64,7 @@ if( $mode != "" )
{
if( $mode == "edit" || $mode == "add" )
{
$word_id = ( isset($HTTP_GET_VARS['id']) ) ? $HTTP_GET_VARS['id'] : 0;
$word_id = ( isset($HTTP_GET_VARS['id']) ) ? intval($HTTP_GET_VARS['id']) : 0;
$template->set_filenames(array(
"body" => "admin/words_edit_body.tpl")
@@ -113,7 +114,7 @@ if( $mode != "" )
}
else if( $mode == "save" )
{
$word_id = ( isset($HTTP_POST_VARS['id']) ) ? $HTTP_POST_VARS['id'] : 0;
$word_id = ( isset($HTTP_POST_VARS['id']) ) ? intval($HTTP_POST_VARS['id']) : 0;
$word = ( isset($HTTP_POST_VARS['word']) ) ? trim($HTTP_POST_VARS['word']) : "";
$replacement = ( isset($HTTP_POST_VARS['replacement']) ) ? trim($HTTP_POST_VARS['replacement']) : "";
@@ -150,6 +151,7 @@ if( $mode != "" )
if( isset($HTTP_POST_VARS['id']) || isset($HTTP_GET_VARS['id']) )
{
$word_id = ( isset($HTTP_POST_VARS['id']) ) ? $HTTP_POST_VARS['id'] : $HTTP_GET_VARS['id'];
$word_id = intval($word_id);
}
else
{