Skip to content

Commit d35091a

Browse files
kalcaddlekalcaddle
committed
4.46 release
1 parent 6d25211 commit d35091a

File tree

47 files changed

+163
-87
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+163
-87
lines changed

‎ChangeLog.md

Lines changed: 2 additions & 2 deletions

‎app/controller/pluginApp.class.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ function __construct() {
1919
public function to() {
2020
$route = $this->in['URLremote'];
2121
if(count($route) >= 3){
22-
$app = $route[2];
22+
$app = clear_html($route[2]);
2323
$action = $route[3];
2424

2525
if(count($route) == 3){
@@ -136,6 +136,7 @@ public function setConfig(){
136136

137137
// download=>fileSize=>unzip=>remove
138138
public function install(){
139+
if(!preg_match("/^[0-9a-zA-Z_]*$/",$this->in['app'])) show_json("error!",false);
139140
$app = _DIR_CLEAR($this->in['app']);
140141
$appPath = PLUGIN_DIR.$app.'.zip';
141142
$appPathTemp = $appPath.'.downloading';
@@ -212,6 +213,7 @@ public function unInstall(){
212213
if( !$this->in['app']){
213214
show_json(LNG('data_not_full'),false);
214215
}
216+
if(!preg_match("/^[0-9a-zA-Z_]*$/",$this->in['app'])) show_json("error!",false);
215217
$model = $this->loadModel('Plugin');
216218
$model->remove($this->in['app']);
217219
del_dir(PLUGIN_DIR.$this->in['app']);

‎app/controller/user.class.php

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,8 @@ public function sso(){
239239
){
240240
$result = true;
241241
}else{
242-
$error = $this->in['check'].' 没有权限, 配置权限需要为: "'.$this->in['value'].'"';
242+
$error = clear_html($this->in['check']).' 没有权限, 配置权限需要为: "'
243+
.clear_html($this->in['value']).'"';
243244
}
244245
}
245246
if($result){

‎app/controller/utils.php

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎app/function/common.function.php

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -119,14 +119,11 @@ function mtime(){
119119
/**
120120
* 过滤HTML
121121
*/
122-
function clear_html($HTML, $br = true){
123-
$HTML = htmlspecialchars(trim($HTML));
124-
$HTML = str_replace("\t", ' ', $HTML);
125-
if ($br) {
126-
return nl2br($HTML);
127-
} else {
128-
return str_replace("\n", '', $HTML);
129-
}
122+
function clear_html($html, $br = true){
123+
$html = $html === null ? "" : $html;
124+
$replace = array('<','>','"',"'");
125+
$replaceTo = array('&lt;','&gt;','&quot;','&#39;');
126+
return str_replace($replace,$replaceTo,$html);
130127
}
131128

132129
/**

‎app/function/file.function.php

Lines changed: 57 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1035,10 +1035,18 @@ function file_put_out($file,$download=-1,$downFilename=false){
10351035
}
10361036
header('Etag: '.$etag);
10371037
header('Last-Modified: '.$time.' GMT');
1038-
header("X-OutFileName: ".$filenameOutput);
1038+
header("X-OutFileName: ".$filename);
10391039
header("X-Powered-By: kodExplorer.");
10401040
header("X-FileSize: ".$file_size);
10411041

1042+
// 过滤svg中非法script内容; 避免xxs;
1043+
if(!$download && get_path_ext($filename) == 'svg'){
1044+
if($file_size > 1024*1024*5) {exit;}
1045+
$content = file_get_contents($file);
1046+
$content = removeXXS($content);
1047+
echo $content;exit;
1048+
}
1049+
10421050
//远程路径不支持断点续传；打开zip内部文件
10431051
if(!file_exists($file)){
10441052
header('HTTP/1.1 200 OK');
@@ -1089,6 +1097,54 @@ function file_put_out($file,$download=-1,$downFilename=false){
10891097
}
10901098
fclose($fp);
10911099
}
1100+
function removeXXS($val){
1101+
$val = preg_replace('/([\x00-\x08\x0b-\x0c\x0e-\x19])/', '', $val);
1102+
$search = 'abcdefghijklmnopqrstuvwxyz';
1103+
$search .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
1104+
$search .= '1234567890!@#$%^&*()';
1105+
$search .= '~`";:?+/={}[]-_|\'\\';
1106+
for ($i = 0; $i < strlen($search); $i++) {
1107+
// ;? matches the ;, which is optional
1108+
// 0{0,7} matches any padded zeros, which are optional and go up to 8 chars
1109+
// @ @ search for the hex values
1110+
$val = preg_replace('/(&#[xX]0{0,8}' . dechex(ord($search[$i])) . ';?)/i', $search[$i], $val); // with a ;
1111+
// @ @ 0{0,7} matches '0' zero to seven times
1112+
$val = preg_replace('/(&#0{0,8}' . ord($search[$i]) . ';?)/', $search[$i], $val); // with a ;
1113+
}
1114+
1115+
// now the only remaining whitespace attacks are \t, \n, and \r
1116+
$ra1 = array('javascript', 'vbscript', 'expression', 'applet', 'meta', 'xml', 'blink', 'link', 'style', 'script', 'embed', 'object', 'iframe', 'frame', 'frameset', 'ilayer', 'layer', 'bgsound', 'title', 'base');
1117+
1118+
$ra1 = array('javascript', 'vbscript', 'expression','script');// 过多,误判
1119+
$ra2 = array('onabort', 'onactivate', 'onafterprint', 'onafterupdate', 'onbeforeactivate', 'onbeforecopy', 'onbeforecut', 'onbeforedeactivate', 'onbeforeeditfocus', 'onbeforepaste', 'onbeforeprint', 'onbeforeunload', 'onbeforeupdate', 'onblur', 'onbounce', 'oncellchange', 'onchange', 'onclick', 'oncontextmenu', 'oncontrolselect', 'oncopy', 'oncut', 'ondataavailable', 'ondatasetchanged', 'ondatasetcomplete', 'ondblclick', 'ondeactivate', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onerrorupdate', 'onfilterchange', 'onfinish', 'onfocus', 'onfocusin', 'onfocusout', 'onhelp', 'onkeydown', 'onkeypress', 'onkeyup', 'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown', 'onmouseenter', 'onmouseleave', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange', 'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart', 'onrowenter', 'onrowexit', 'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect', 'onselectionchange', 'onselectstart', 'onstart', 'onstop', 'onsubmit', 'onunload');
1120+
$ra = array_merge($ra1, $ra2);
1121+
1122+
$found = true; // keep replacing as long as the previous round replaced something
1123+
while ($found == true) {
1124+
$val_before = $val;
1125+
for ($i = 0; $i < sizeof($ra); $i++) {
1126+
$pattern = '/';
1127+
for ($j = 0; $j < strlen($ra[$i]); $j++) {
1128+
if ($j > 0) {
1129+
$pattern .= '(';
1130+
$pattern .= '(&#[xX]0{0,8}([9ab]);)';
1131+
$pattern .= '|';
1132+
$pattern .= '|(&#0{0,8}([9|10|13]);)';
1133+
$pattern .= ')*';
1134+
}
1135+
$pattern .= $ra[$i][$j];
1136+
}
1137+
$pattern .= '/i';
1138+
$replacement = substr($ra[$i], 0, 2) . '_' . substr($ra[$i], 2); // add in <> to nerf the tag
1139+
$val = preg_replace($pattern, $replacement, $val); // filter out the hex tags
1140+
if ($val_before == $val) {
1141+
// no replacements were made, so exit the loop
1142+
$found = false;
1143+
}
1144+
}
1145+
}
1146+
return $val;
1147+
}
10921148

10931149
/**
10941150
* 远程文件下载到服务器

‎app/function/helper.function.php

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
//扩展名权限判断 有权限则返回1 不是true
44
function checkExt($file){
55
if($GLOBALS['isRoot']) return 1;
6+
if($file == '.htaccess' || $file == '.user.ini') return false;
67
if (strstr($file,'<') || strstr($file,'>') || $file=='') {
78
return 0;
89
}
@@ -17,7 +18,7 @@ function checkExt($file){
1718
$extArr = array_merge($extArr,array('phtml','phtm','htaccess','pwml'));
1819
}
1920
if(in_array('htm',$extArr) || in_array('html',$extArr)){
20-
$extArr = array_merge($extArr,array('html','shtml','shtm','html'));
21+
$extArr = array_merge($extArr,array('html','shtml','shtm','html','svg'));
2122
}
2223
foreach ($extArr as $current) {
2324
if ($current !== '' && stristr($file,'.'.$current)){//含有扩展名

‎app/kod/Mcrypt.class.php

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,8 @@ public static function decode($string,$key = '')
110110
$box[$j] = $tmp;
111111
$result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));
112112
}
113-
if ((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0)
113+
$theTime = intval(substr($result, 0, 10));
114+
if (($theTime == 0 || $theTime - time() > 0)
114115
&& substr($result, 10, 16) == substr(md5(substr($result, 26) . $keyb), 0, 16)
115116
) {
116117
return substr($result, 26);

‎app/template/api/view.html

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -68,17 +68,15 @@
6868
<script type="text/javascript" src="./index.php?share/commonJs&st=api&act=view#id=<?php echo rand_string(4);?>"></script>
6969

7070
<?php
71-
$name = rawurldecode(get_path_this($_GET['path']));
72-
if(isset($_GET['name'])){
73-
$name = rawurldecode($_GET['name']);
74-
}
71+
$path = rawurldecode($_GET['path']);
72+
$name = get_path_this($path);
73+
if(isset($_GET['name'])){$name = rawurldecode($_GET['name']);}
7574
?>
7675
<script type="text/javascript">
7776
G.shareInfo = {
78-
path:"<?php echo $_GET['path'];?>",
79-
name:"<?php echo get_path_this($_GET['path']);?>",
80-
mtime:0,
81-
size:0
77+
path:"<?php echo clear_html($path);?>",
78+
name:"<?php echo clear_html($name);?>",
79+
mtime:0,size:0
8280
}
8381
<?php if(ST.'.'.ACT == 'explorer.fileView'){echo "G.shareInfo.view = true;G.sharePage=undefined;";}?>
8482
G['accessToken'] = "<?php echo access_token_get();?>";

‎app/template/common/navbar.html

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,8 @@
8383
<i class="font-icon icon-user"></i>
8484
<?php
8585
$user = $_SESSION['kodUser'];
86-
echo $user['nickName']?$user['nickName']:$user['name'];
86+
$name = $user['nickName']?$user['nickName']:$user['name'];
87+
echo clear_html($name);
8788
?>&nbsp;
8889
<b class="caret"></b>
8990
</a>

0 commit comments

Comments
 (0)