OSDN -- Desenvolver e Download de Software Open Source
Estado tradução de Português translation status for pt
  • R/O
  • HTTP
  • SSH
  • HTTPS
Fork

nucleus-jp-ancient: Commit

Nucleus CMS日本語版SVNをgit-svnしたもの。リポジトリの変換作業用


Commit MetaInfo

Revisão5858b291735300650ae88fe06805bd8a717e117f (tree)
Hora2008-09-26 13:32:31
Autorkimitake <kimitake@1ca2...>
Commiterkimitake

Mensagem de Log

fixed XSS issue

git-svn-id: https://svn.sourceforge.jp/svnroot/nucleus-jp/nucleus-jp/branches/branch-3-3@709 1ca29b6e-896d-4ea0-84a5-967f57386b96

Mudança Sumário

Diff

--- a/euc/nucleus/libs/globalfunctions.php
+++ b/euc/nucleus/libs/globalfunctions.php
@@ -307,6 +307,13 @@ if (!headers_sent() ) {
307307 $language = getLanguageName();
308308 include($DIR_LANG . ereg_replace( '[\\|/]', '', $language) . '.php');
309309
310+// check if valid charset
311+if (!encoding_check(false,false,_CHARSET)) {
312+ foreach(array($_REQUEST, $_SERVER) as $input) {
313+ array_walk($input, 'encoding_check');
314+ }
315+}
316+
310317 /*
311318 Backed out for now: See http://forum.nucleuscms.org/viewtopic.php?t=3684 for details
312319
@@ -551,6 +558,13 @@ function sendContentType($contenttype, $pagetype = '', $charset = _CHARSET) {
551558 } else {
552559 header('Content-Type: ' . $contenttype);
553560 }
561+
562+ // check if valid charset
563+ if (!encoding_check(false,false,$charset)) {
564+ foreach(array($_REQUEST, $_SERVER) as $input) {
565+ array_walk($input, 'encoding_check');
566+ }
567+ }
554568 }
555569 }
556570
@@ -558,9 +572,11 @@ function sendContentType($contenttype, $pagetype = '', $charset = _CHARSET) {
558572 * Errors before the database connection has been made
559573 */
560574 function startUpError($msg, $title) {
575+ if (!defined('_CHARSET')) define('_CHARSET','iso-8859-1');
576+ header('Content-Type: text/html; charset=' . _CHARSET);
561577 ?>
562578 <html xmlns="http://www.w3.org/1999/xhtml">
563- <head><meta http-equiv="Content-Type" content="text/html; charset=EUC-JP" />
579+ <head><meta http-equiv="Content-Type" content="text/html; charset=<?php echo _CHARSET?>" />
564580 <title><?php echo htmlspecialchars($title)?></title></head>
565581 <body>
566582 <h1><?php echo htmlspecialchars($title)?></h1>
@@ -1495,6 +1511,69 @@ function formatDate($format, $timestamp, $defaultFormat, &$blog) {
14951511 }
14961512 }
14971513
1514+function encoding_check($val, $key, $encoding=false, $exclude=false) {
1515+ /*
1516+ When 3rd argument is set, return if checked already.
1517+ When 4th argument is set, set the excluded key(s).
1518+ */
1519+ static $search=false, $checked=array(), $excludes=array();
1520+ if ($exclude!==false) {
1521+ if (is_array($exclude)) {
1522+ foreach($exclude as $v) $excludes[$v]=true;
1523+ } else $excludes[$excludes]=true;
1524+ return;
1525+ }
1526+ if ($encoding!==false) {
1527+ switch($encoding=strtolower($encoding)){
1528+ case 'utf-8':
1529+ $search='/^([\x00-\x7F]+'.
1530+ '|[\xC2-\xDF][\x80-\xBF]'.
1531+ '|[\xE0-\xEF][\x80-\xBF][\x80-\xBF]'.
1532+ '|[\xF0-\xF7][\x80-\xBF][\x80-\xBF][\x80-\xBF]'.
1533+ '|[\xF8-\xFB][\x80-\xBF][\x80-\xBF][\x80-\xBF][\x80-\xBF]'.
1534+ '|[\xFC-\xFD][\x80-\xBF][\x80-\xBF][\x80-\xBF][\x80-\xBF][\x80-\xBF])*/';
1535+ break;
1536+ case 'euc-jp':
1537+ $search='/^([\x00-\x7F]+'.
1538+ '|[\x8E][\xA0-\xDF]'.
1539+ '|[\x8F]?[\xA1-\xFE][\xA1-\xFE])*/';
1540+ break;
1541+ case 'gb2312':
1542+ $search='/^([\x00-\x7F]+'.
1543+ '|[\xA1-\xF7][\xA1-\xFE])*/';
1544+ break;
1545+ default:
1546+ $search=false;
1547+ if (preg_match('/^iso\-8859\-[0-9]{1,2}$/',$encoding)) break;
1548+ if (preg_match('/^windows\-125[0-8]$/',$encoding)) break;
1549+ startUpError('<p>Unknown or non-supported encoding.</p>', 'Encoding Error');
1550+ exit;
1551+ }
1552+ if (isset($checked[$encoding])) return true; // Already checked.
1553+ $checked[$encoding]=true;
1554+ }
1555+ if ($key===false) return false; // Not yet checked.
1556+ if ($search===false) return true; // non-multibyte encoding
1557+ if (isset($excludes[$key])) return true; // This key isn't checked.
1558+ if (is_array($val)) {
1559+ array_walk($val, 'encoding_check');
1560+ } else {
1561+ preg_match($search,$val,$m);
1562+ $val2 = (string)$m[0];
1563+ if (!($val2 === (string)$val)) {
1564+ startUpError('<p>Invalid input.</p>', 'Input Error');
1565+ exit;
1566+ }
1567+ }
1568+ preg_match($search,$key,$m);
1569+ $key2 = (string)$m[0];
1570+ if (!($key2 === (string)$key)) {
1571+ startUpError('<p>Invalid input.</p>', 'Input Error');
1572+ exit;
1573+ }
1574+ return true;
1575+}
1576+
14981577 function checkVars($aVars) {
14991578 global $HTTP_GET_VARS, $HTTP_POST_VARS, $HTTP_COOKIE_VARS, $HTTP_ENV_VARS, $HTTP_POST_FILES, $HTTP_SESSION_VARS;
15001579
--- a/utf8/nucleus/documentation/history.html
+++ b/utf8/nucleus/documentation/history.html
@@ -65,7 +65,13 @@
6565 </ul>
6666 </li>
6767 <li>
68- <strong>Nucleus v3.31SP1 (February 5, 2008)</strong>
68+ <strong>Nucleus v3.31 SP2 (EUC-JP only) (September 26, 2008)</strong>
69+ <ul>
70+ <li>FIXED: An XSS issue</li>
71+ </ul>
72+ </li>
73+ <li>
74+ <strong>Nucleus v3.31 SP1 (February 5, 2008)</strong>
6975 <ul>
7076 <li>FIXED: An XSS issue</li>
7177 <li>CHANGED(JP): (<a href="http://nucleus-jp.sourceforge.jp/tracker/?do=details&amp;id=83">#83(JP)</a>): ブックマークレットの高さを50ピクセル追加. (kmorimatsu)</li>
@@ -83,7 +89,7 @@
8389 </ul>
8490 </li>
8591 <li>
86- <strong>Nucleus v3.3 &quot;Lithium&quot; (Beta - March 11, 2007)</strong>
92+ <strong>Nucleus v3.3 (May 1, 2007)</strong>
8793 <ul>
8894 <li>ADDED: add description of charset skin variable to documentation.(JP) (shizuki)</li>
8995 <li>FIXED: fix description of if/else/endif skin variables to documentation, inlcuding ifnot, elseif, and elseifnot (JP) (shizuki)</li>
--- a/utf8/nucleus/libs/globalfunctions.php
+++ b/utf8/nucleus/libs/globalfunctions.php
@@ -307,6 +307,13 @@ if (!headers_sent() ) {
307307 $language = getLanguageName();
308308 include($DIR_LANG . ereg_replace( '[\\|/]', '', $language) . '.php');
309309
310+// check if valid charset
311+if (!encoding_check(false,false,_CHARSET)) {
312+ foreach(array($_REQUEST, $_SERVER) as $input) {
313+ array_walk($input, 'encoding_check');
314+ }
315+}
316+
310317 /*
311318 Backed out for now: See http://forum.nucleuscms.org/viewtopic.php?t=3684 for details
312319
@@ -551,6 +558,13 @@ function sendContentType($contenttype, $pagetype = '', $charset = _CHARSET) {
551558 } else {
552559 header('Content-Type: ' . $contenttype);
553560 }
561+
562+ // check if valid charset
563+ if (!encoding_check(false,false,$charset)) {
564+ foreach(array($_REQUEST, $_SERVER) as $input) {
565+ array_walk($input, 'encoding_check');
566+ }
567+ }
554568 }
555569 }
556570
@@ -558,9 +572,11 @@ function sendContentType($contenttype, $pagetype = '', $charset = _CHARSET) {
558572 * Errors before the database connection has been made
559573 */
560574 function startUpError($msg, $title) {
575+ if (!defined('_CHARSET')) define('_CHARSET','iso-8859-1');
576+ header('Content-Type: text/html; charset=' . _CHARSET);
561577 ?>
562578 <html xmlns="http://www.w3.org/1999/xhtml">
563- <head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
579+ <head><meta http-equiv="Content-Type" content="text/html; charset=<?php echo _CHARSET?>" />
564580 <title><?php echo htmlspecialchars($title)?></title></head>
565581 <body>
566582 <h1><?php echo htmlspecialchars($title)?></h1>
@@ -1495,6 +1511,69 @@ function formatDate($format, $timestamp, $defaultFormat, &$blog) {
14951511 }
14961512 }
14971513
1514+function encoding_check($val, $key, $encoding=false, $exclude=false) {
1515+ /*
1516+ When 3rd argument is set, return if checked already.
1517+ When 4th argument is set, set the excluded key(s).
1518+ */
1519+ static $search=false, $checked=array(), $excludes=array();
1520+ if ($exclude!==false) {
1521+ if (is_array($exclude)) {
1522+ foreach($exclude as $v) $excludes[$v]=true;
1523+ } else $excludes[$excludes]=true;
1524+ return;
1525+ }
1526+ if ($encoding!==false) {
1527+ switch($encoding=strtolower($encoding)){
1528+ case 'utf-8':
1529+ $search='/^([\x00-\x7F]+'.
1530+ '|[\xC2-\xDF][\x80-\xBF]'.
1531+ '|[\xE0-\xEF][\x80-\xBF][\x80-\xBF]'.
1532+ '|[\xF0-\xF7][\x80-\xBF][\x80-\xBF][\x80-\xBF]'.
1533+ '|[\xF8-\xFB][\x80-\xBF][\x80-\xBF][\x80-\xBF][\x80-\xBF]'.
1534+ '|[\xFC-\xFD][\x80-\xBF][\x80-\xBF][\x80-\xBF][\x80-\xBF][\x80-\xBF])*/';
1535+ break;
1536+ case 'euc-jp':
1537+ $search='/^([\x00-\x7F]+'.
1538+ '|[\x8E][\xA0-\xDF]'.
1539+ '|[\x8F]?[\xA1-\xFE][\xA1-\xFE])*/';
1540+ break;
1541+ case 'gb2312':
1542+ $search='/^([\x00-\x7F]+'.
1543+ '|[\xA1-\xF7][\xA1-\xFE])*/';
1544+ break;
1545+ default:
1546+ $search=false;
1547+ if (preg_match('/^iso\-8859\-[0-9]{1,2}$/',$encoding)) break;
1548+ if (preg_match('/^windows\-125[0-8]$/',$encoding)) break;
1549+ startUpError('<p>Unknown or non-supported encoding.</p>', 'Encoding Error');
1550+ exit;
1551+ }
1552+ if (isset($checked[$encoding])) return true; // Already checked.
1553+ $checked[$encoding]=true;
1554+ }
1555+ if ($key===false) return false; // Not yet checked.
1556+ if ($search===false) return true; // non-multibyte encoding
1557+ if (isset($excludes[$key])) return true; // This key isn't checked.
1558+ if (is_array($val)) {
1559+ array_walk($val, 'encoding_check');
1560+ } else {
1561+ preg_match($search,$val,$m);
1562+ $val2 = (string)$m[0];
1563+ if (!($val2 === (string)$val)) {
1564+ startUpError('<p>Invalid input.</p>', 'Input Error');
1565+ exit;
1566+ }
1567+ }
1568+ preg_match($search,$key,$m);
1569+ $key2 = (string)$m[0];
1570+ if (!($key2 === (string)$key)) {
1571+ startUpError('<p>Invalid input.</p>', 'Input Error');
1572+ exit;
1573+ }
1574+ return true;
1575+}
1576+
14981577 function checkVars($aVars) {
14991578 global $HTTP_GET_VARS, $HTTP_POST_VARS, $HTTP_COOKIE_VARS, $HTTP_ENV_VARS, $HTTP_POST_FILES, $HTTP_SESSION_VARS;
15001579
Show on old repository browser