Changeset 1408 in ExiteCMS for branches/PLi-Fusion/includes/core_functions.php

Timestamp:

05/15/08 22:25:54 (4 years ago)

Author:

hverton

Message:

Merged trunk revisions 1342:1407 into the PLi-Fusion branch

File:

• branches/PLi-Fusion/includes/core_functions.php (modified) (3 diffs)

branches/PLi-Fusion/includes/core_functions.php

@@ -49 +49 @@
 // prevent any possible XSS attacks via $_GET.
 foreach ($_GET as $check_url) {
-    if ((eregi("<[^>]*script*\"?[^>]*>", $check_url)) || (eregi("<[^>]*object*\"?[^>]*>", $check_url)) ||
-        (eregi("<[^>]*iframe*\"?[^>]*>", $check_url)) || (eregi("<[^>]*applet*\"?[^>]*>", $check_url)) ||
-        (eregi("<[^>]*meta*\"?[^>]*>", $check_url)) || (eregi("<[^>]*style*\"?[^>]*>", $check_url)) ||
-        (eregi("<[^>]*form*\"?[^>]*>", $check_url)) || (eregi("\([^>]*\"?[^)]*\)", $check_url))) {
-    die ();
+    // deal with array's in GET parameters
+    if (is_array($check_url)) {
+        foreach ($check_url as $url_parts) {
+            if ((eregi("<[^>]*script*\"?[^>]*>", $url_parts)) || (eregi("<[^>]*object*\"?[^>]*>", $url_parts)) ||
+                    (eregi("<[^>]*iframe*\"?[^>]*>", $url_parts)) || (eregi("<[^>]*applet*\"?[^>]*>", $url_parts)) ||
+                    (eregi("<[^>]*meta*\"?[^>]*>", $url_parts)) || (eregi("<[^>]*style*\"?[^>]*>", $url_parts)) ||
+                    (eregi("<[^>]*form*\"?[^>]*>", $url_parts)) || (eregi("\([^>]*\"?[^)]*\)", $url_parts))) {
+                die ();
+            }
+        }
+    } else {
+        if ((eregi("<[^>]*script*\"?[^>]*>", $check_url)) || (eregi("<[^>]*object*\"?[^>]*>", $check_url)) ||
+                (eregi("<[^>]*iframe*\"?[^>]*>", $check_url)) || (eregi("<[^>]*applet*\"?[^>]*>", $check_url)) ||
+                (eregi("<[^>]*meta*\"?[^>]*>", $check_url)) || (eregi("<[^>]*style*\"?[^>]*>", $check_url)) ||
+                (eregi("<[^>]*form*\"?[^>]*>", $check_url)) || (eregi("\([^>]*\"?[^)]*\)", $check_url))) {
+            die ();
+        }
     }
 }
@@ -524 +536 @@
 }
 
+// internal function: preg_replace_callback for parseubb, to validate the URL found in [url]
+function _parseubb_checkurl($matches) {
+
+    // if it's a old-style bbcode (not [url=][/url] but [url][/url]), convert it before checking
+    if (empty($matches[2])) {
+        $matches[2] = $matches[3];
+    }
+
+    // Build the regex to check the URL
+    $scheme = "(https?|s?ftp|mailto|svn|cvs|callto|mms|skype)\:\/\/";           // SCHEMES supported
+    $urlregex = "^(".$scheme.")?";                                              // make the scheme optional
+    $urlregex .= "([a-z0-9+!*(),;?&=\$_.-]+(\:[a-z0-9+!*(),;?&=\$_.-]+)?@)?";   // USERID + PASSWORD (optional)
+    $urlregex .= "[a-z0-9+\$_-]+(\.[a-z0-9+\$_-]+)*";                           // HOSTNAME or IP
+    $urlregex .= "(\:[0-9]{2,5})?";                                             // PORT (optional)
+    $urlregex .= "(\/([a-z0-9+\$_-]\.?)+)*\/?";                                 // PATH (optional)
+    $urlregex .= "(\?[a-z+&\$_.-][a-z0-9;:@/&%=+\$_.-]*)?";                     // GET querystring (optional)
+    $urlregex .= "(#[a-z_.-][a-z0-9+\$_.-]*)?\$";                               // ANCHOR (optional)
+
+    // validate the URL (in $matches[1])
+    if (eregi($urlregex, $matches[2])) {
+        // check if the URL is prefixed. If not, assume http://
+        if (!eregi("^(".$scheme."){1}", $matches[2])) {
+            $matches[2] = "http://".$matches[2];
+        }
+        // return the html for the URL bbcode
+        return "<a href='".$matches[2]."' alt='' target='_blank'>".$matches[3]."</a>";
+    } else {
+        // make the bbcode passed harmless
+        return stripinput($matches[0]);
+    }
+}
+
 // Parse bbcode into HTML code
 function parseubb($text) {
@@ -550 +594 @@
     // correct illegal [url=] BBcode
     $text = str_replace("[url=]", "[url]", $text);
-        
-    $text = preg_replace('#\[url\]([\r\n]*)(http://|ftp://|https://|ftps://)([^\s\'\";\+]*?)([\r\n]*)\[/url\]#si', '<a href=\'\2\3\' target=\'_blank\'>\2\3</a>', $text);
-    $text = preg_replace('#\[url\]([\r\n]*)([^\s\'\";\+]*?)([\r\n]*)\[/url\]#si', '<a href=\'http://\2\' target=\'_blank\'>\2</a>', $text);
-    $text = preg_replace('#\[url=([\r\n]*)(http://|ftp://|https://|ftps://)([^\'\";]*?)\](.*?)([\r\n]*)\[/url\]#si', '<a href=\'\2\3\' target=\'_blank\'>\4</a>', $text);
-    $text = preg_replace('#\[url=([\r\n]*)([^\s\'\";\+]*?)\](.*?)([\r\n]*)\[/url\]#si', '<a href=\'http://\2\' target=\'_blank\'>\3</a>', $text);
-
+
+    // convert URL bbcode, strip non-valid URL's
+    $text = preg_replace_callback('#\[url(=)?(.*?)\](.*?)([\r\n]*)\[/url\]#si', '_parseubb_checkurl', $text);
+
+    // convert mail bbcode
     $text = preg_replace('#\[mail\]([\r\n]*)([^\s\'\";:\+]*?)([\r\n]*)\[/mail\]#si', '<a href=\'mailto:\2\'>\2</a>', $text);
     $text = preg_replace('#\[mail=([\r\n]*)([^\s\'\";:\+]*?)\](.*?)([\r\n]*)\[/mail\]#si', '<a href=\'mailto:\2\'>\3</a>', $text);
     
     $text = preg_replace('#\[small\](.*?)\[/small\]#si', '<span class=\'small\'>\1</span>', $text);
-    $text = preg_replace('#\[color=(\#[0-9a-fA-F]{6}|black|blue|brown|cyan|gray|green|lime|maroon|navy|olive|orange|purple|red|silver|violet|white|yellow)\](.*?)\[/color\]#si', '<span style=\'color:\1\'>\2</span>', $text);
+    $text = preg_replace('#\[color=(\#[0-9a-fA-F]{6}|black|blue|brown|cyan|grey|green|lime|maroon|navy|olive|orange|purple|red|silver|violet|white|yellow)\](.*?)\[/color\]#si', '<span style=\'color:\1\'>\2</span>', $text);
     
     $text = preg_replace('#\[flash width=([0-9]*?) height=([0-9]*?)\]([^\s\'\";:\+]*?)(\.swf)\[/flash\]#si', '<object classid=\'clsid:D27CDB6E-AE6D-11cf-96B8-444553540000\' codebase=\'http://active.macromedia.com/flash6/cabs/swflash.cab#version=6,0,0,0\' id=\'\3\4\' width=\'\1\' height=\'\2\'><param name=movie value=\'\3\4\'><param name=\'quality\' value=\'high\'><param name=\'bgcolor\' value=\'#ffffff\'><embed src=\'\3\4\' quality=\'high\' bgcolor=\'#ffffff\' width=\'\1\' height=\'\2\' type=\'application/x-shockwave-flash\' pluginspage=\'http://www.macromedia.com/go/getflashplayer\'></embed></object>', $text);