Changeset 13117

Timestamp:

10/29/09 23:28:44 (3 years ago)

Author:

Alexander Trofimov

Message:

Ticket #1384

Location:

trunk

Files:

• administration/banners.php (modified) (1 diff)
• administration/basic_settings.php (modified) (1 diff)
• administration/css_file.php (modified) (1 diff)
• administration/lang_file.php (modified) (1 diff)
• administration/notifies.php (modified) (1 diff)
• administration/pageBuilder.php (modified) (1 diff)
• inc/classes/BxDolInstaller.php (modified) (2 diffs)
• inc/security.inc.php (modified) (2 diffs)
• install/sql/v70.sql (modified) (1 diff)
• join.php (modified) (1 diff)
• modules/boonex/map_profiles/install/installer.php (modified) (1 diff)
• modules/boonex/open_social/os.php (modified) (1 diff)
• pedit.php (modified) (1 diff)
• plugins/phpids/IDS/Config/Config.ini (modified) (1 diff)
• plugins/phpids/IDS/default_filter.xml (modified) (5 diffs)

trunk/administration/banners.php

@@ -18 +18 @@
 * see license.txt file; if not, write to marketing@boonex.com
 ***************************************************************************/
+
+define('BX_SECURITY_EXCEPTIONS', true);
+$aBxSecurityExceptions = array(
+    'POST.Text',
+    'REQUEST.Text',
+);
 
 require_once( '../inc/header.inc.php' );

trunk/administration/basic_settings.php

@@ -18 +18 @@
 * see license.txt file; if not, write to marketing@boonex.com
 ***************************************************************************/
+
+define('BX_SECURITY_EXCEPTIONS', true);
+$aBxSecurityExceptions = array(
+    'POST.content_text',
+    'REQUEST.content_text',
+);
 
 require_once( '../inc/header.inc.php' );

trunk/administration/css_file.php

@@ -18 +18 @@
 * see license.txt file; if not, write to marketing@boonex.com
 ***************************************************************************/
+
+define('BX_SECURITY_EXCEPTIONS', true);
+$aBxSecurityExceptions = array(
+    'POST.content',
+    'REQUEST.content',
+);
 
 require_once( '../inc/header.inc.php' );

trunk/administration/lang_file.php

@@ -19 +19 @@
 ***************************************************************************/
 
+define ('BX_SECURITY_EXCEPTIONS', true);
+$aBxSecurityExceptions = array ();
+for ($i=1; $i<255 ; ++$i) {
+    $aBxSecurityExceptions[] = 'POST.string_for_'.$i;
+    $aBxSecurityExceptions[] = 'REQUEST.string_for_'.$i;
+}
+
 require_once( '../inc/header.inc.php' );
 require_once( BX_DIRECTORY_PATH_INC . 'profiles.inc.php' );

trunk/administration/notifies.php

@@ -18 +18 @@
 * see license.txt file; if not, write to marketing@boonex.com
 ***************************************************************************/
+
+define('BX_SECURITY_EXCEPTIONS', true);
+$aBxSecurityExceptions = array(
+    'POST.body',
+    'REQUEST.body',
+);
 
 require_once( '../inc/header.inc.php' );

trunk/administration/pageBuilder.php

@@ -20 +20 @@
 ***************************************************************************/
 
+define('BX_SECURITY_EXCEPTIONS', true);
+$aBxSecurityExceptions = array(
+    'POST.Content',
+    'REQUEST.Content',
+);
+
 require_once( '../inc/header.inc.php' );
 require_once( BX_DIRECTORY_PATH_INC . 'db.inc.php' );

trunk/inc/classes/BxDolInstaller.php

@@ -634 +634 @@
     }
 
-    function _getLanguageHtmlFields () {
-        $aRet = array ();
-        $a = $GLOBALS['MySQL']->getAll ("SELECT `ID` FROM `sys_localization_languages`");
-        foreach ($a as $r) {
-            $aRet[] = 'POST.string_for_'.$r['ID'];
-            $aRet[] = 'REQUEST.string_for_'.$r['ID'];
-        }
-        return $aRet;        
-    }
-
     function addHtmlFields ($a) {
-        $s = getParam('sys_html_fields');
-        $this->_aConfig['home_uri'];
+        $this->_addFields ('html', $a);      
+    }
+
+    function removeHtmlFields () {        
+        $this->_removeFields('html');
+    }
+
+    function addJsonFields ($a) {
+        $this->_addFields ('json', $a);      
+    }
+
+    function removeJsonFields () {        
+        $this->_removeFields('json');
+    }
+
+    function addExceptionsFields ($a) {
+        $this->_addFields ('exceptions', $a);      
+    }
+
+    function removeExceptionsFields () {        
+        $this->_removeFields('exceptions');
+    }
+
+    //--- Protected methods ---//
+    
+    function _addFields ($sType, $a) {
+        switch ($sType) {
+        case 'html':
+        case 'json':
+        case 'exceptions':
+            break;
+        default:
+            return array();
+        }        
+
+        $s = getParam("sys_{$sType}_fields");
         if (!$s) {
-            $a = array (
-                $this->_aConfig['home_uri'] => $a, 
-                'system_email_templates' => $this->_getEmailTemplatesHtmlFields(),
-                'system_langs' => $this->_getLanguageHtmlFields(),
-            );
+            $a = array ($this->_aConfig['home_uri'] => $a);
+            if ('exceptions' == $sType) {
+                $a['system_email_templates'] = $this->_getEmailTemplatesHtmlFields();
+            }
         } else {
             $a = array_merge (unserialize($s), array ($this->_aConfig['home_uri'] => $a));
+            if ('exceptions' == $sType) {
+                unset($a['system_email_templates']);
+                $a['system_email_templates'] = $this->_getEmailTemplatesHtmlFields();
+            }
+        }
+        $s = serialize ($a);
+        setParam ("sys_{$sType}_fields", $s);
+        // recreate cache
+        $GLOBALS['MySQL']->cleanCache ("sys_{$sType}_fields");
+        $GLOBALS['MySQL']->fromCache ("sys_{$sType}_fields", 'getOne', "SELECT `VALUE` FROM `sys_options` WHERE `Name` = 'sys_{$sType}_fields' LIMIT 1");
+    }
+
+    function _removeFields ($sType) {
+        switch ($sType) {
+        case 'html':
+        case 'json':
+        case 'exceptions':
+            break;
+        default:
+            return array();
+        }        
+
+        $s = getParam('sys_html_fields');
+        if (!$s) {
+            return;
+        } 
+        $a = unserialize($s);
+        unset ($a[$this->_aConfig['home_uri']]);
+        if ('exceptions' == $sType) {
             unset($a['system_email_templates']);
-            unset($a['system_langs']);
             $a['system_email_templates'] = $this->_getEmailTemplatesHtmlFields();
-            $a['system_langs'] = $this->_getLanguageHtmlFields();
         }
         $s = serialize ($a);
@@ -666 +716 @@
         $GLOBALS['MySQL']->fromCache ('sys_html_fields', 'getOne', "SELECT `VALUE` FROM `sys_options` WHERE `Name` = 'sys_html_fields' LIMIT 1");
     }
-
-    function removeHtmlFields () {
-        $s = getParam('sys_html_fields');
-        $this->_aConfig['home_uri'];
-        if (!$s) {
-            return;
-        } 
-        $a = unserialize($s);
-        unset ($a[$this->_aConfig['home_uri']]);
-        unset($a['system_email_templates']);
-        unset($a['system_langs']);
-        $a['system_email_templates'] = $this->_getEmailTemplatesHtmlFields();
-        $a['system_langs'] = $this->_getLanguageHtmlFields();
-        $s = serialize ($a);
-        setParam ('sys_html_fields', $s);
-        // recreate cache
-        $GLOBALS['MySQL']->cleanCache ('sys_html_fields');
-        $GLOBALS['MySQL']->fromCache ('sys_html_fields', 'getOne', "SELECT `VALUE` FROM `sys_options` WHERE `Name` = 'sys_html_fields' LIMIT 1");
-    }
-
-    //--- Protected methods ---//
+    
     function _updateLanguage($bInstall, $aLanguage, $iCategoryId = 0) {
         if(empty($iCategoryId))

trunk/inc/security.inc.php

@@ -22 +22 @@
         $init->config['General']['tmp_path'] = '../../../tmp/';
         $init->config['Caching']['path'] = '../../../tmp/default_filter.cache';
-        $init->config['General']['html'] = bx_sys_security_get_html_fileds ();
+
+
+        if (defined('BX_SECURITY_JSON') && is_array($aBxSecurityJSON)) {
+            $init->config['General']['json'] = array_merge ($init->config['General']['json'], $aBxSecurityJSON);
+        }
+        $init->config['General']['json'] = array_merge($init->config['General']['json'], bx_sys_security_get_fields ('json'));
+
+
+        if (defined('BX_SECURITY_HTML') && is_array($aBxSecurityHTML)) {
+            $init->config['General']['html'] = array_merge ($init->config['General']['html'], $aBxSecurityHTML);
+        }
+        $init->config['General']['html'] = array_merge($init->config['General']['html'], bx_sys_security_get_fields ('html'));
+
+
+        if (defined('BX_SECURITY_EXCEPTIONS') && is_array($aBxSecurityExceptions)) {
+            $init->config['General']['exceptions'] = array_merge ($init->config['General']['exceptions'], $aBxSecurityExceptions);
+        }
+        $init->config['General']['exceptions'] = array_merge($init->config['General']['exceptions'], bx_sys_security_get_fields ('exceptions'));
+
 
         $init->config['General']['HTML_Purifier_Path'] = BX_DIRECTORY_PATH_PLUGINS . 'htmlpurifier/HTMLPurifier.standalone.php';
@@ -47 +65 @@
     }
 
-    function bx_sys_security_get_html_fileds () {
-        $sCacheFile = BX_DIRECTORY_PATH_CACHE . 'db_sys_html_fields.php';
+
+    function bx_sys_security_get_fields ($sType) {
+        switch ($sType) {
+        case 'html':
+        case 'json':
+        case 'exceptions':
+            break;
+        default:
+            return array();
+        }
+
+        $sCacheFile = BX_DIRECTORY_PATH_CACHE . "db_sys_{$sType}_fields.php";
         if (!file_exists($sCacheFile)) {
             require_once( BX_DIRECTORY_PATH_INC . 'db.inc.php' );
-            $mixedVar = $GLOBALS['MySQL']->fromCache ('sys_html_fields', 'getOne', "SELECT `VALUE` FROM `sys_options` WHERE `Name` = 'sys_html_fields' LIMIT 1");
+            $mixedVar = $GLOBALS['MySQL']->fromCache ("sys_{$sType}_fields", 'getOne', "SELECT `VALUE` FROM `sys_options` WHERE `Name` = 'sys_html_fields' LIMIT 1");
         } else {
             include $sCacheFile;

trunk/install/sql/v70.sql

@@ -1082 +1082 @@
 INSERT INTO `sys_options` VALUES('license_expiration', '', 0, 'Dolphin License Expiration', 'digit', '', '', 0, '');
 INSERT INTO `sys_options` VALUES('license_checksum', '', 0, 'Dolphin License Checksum', 'digit', '', '', 0, '');
-INSERT INTO `sys_options` VALUES('sys_html_fields', 'a:1:{s:6:"system";a:18:{i:0;s:20:"POST.DescriptionMe.0";i:1;s:23:"REQUEST.DescriptionMe.0";i:2;s:20:"POST.DescriptionMe.1";i:3;s:23:"REQUEST.DescriptionMe.1";i:4;s:12:"POST.message";i:5;s:15:"REQUEST.message";i:6;s:9:"POST.body";i:7;s:12:"REQUEST.body";i:8;s:9:"POST.Text";i:9;s:12:"REQUEST.Text";i:10;s:12:"POST.Content";i:11;s:15:"REQUEST.Content";i:12;s:17:"POST.content_text";i:13;s:20:"REQUEST.content_text";i:14;s:12:"POST.content";i:15;s:15:"REQUEST.content";i:16;s:12:"POST.CmtText";i:17;s:15:"REQUEST.CmtText";}}', 0, 'HTML fields', 'text', '', '', 0, '');
+INSERT INTO `sys_options` VALUES('sys_html_fields', 'a:1:{s:6:"system";a:4:{i:0;s:12:"POST.message";i:1;s:15:"REQUEST.message";i:2;s:12:"POST.CmtText";i:3;s:15:"REQUEST.CmtText";}}', 0, 'HTML fields', 'text', '', '', 0, '');
+INSERT INTO `sys_options` VALUES('sys_json_fields', '', 0, 'JSON fields', 'text', '', '', 0, '');
+INSERT INTO `sys_options` VALUES('sys_exceptions_fields', '', 0, 'Exceptions fields', 'text', '', '', 0, '');
 INSERT INTO `sys_options` VALUES('enable_dolphin_footer', 'on', 0, 'enable boonex footers', 'checkbox', '', '', NULL, '');
 INSERT INTO `sys_options` VALUES('enable_modrewrite', 'on', 26, 'Enable friendly profile permalinks', 'checkbox', '', '', 1, '');

trunk/join.php

@@ -20 +20 @@
 * see license.txt file; if not, write to marketing@boonex.com
 ***************************************************************************/
+
+define('BX_SECURITY_HTML', true);
+$aBxSecurityHTML = array(
+    'POST.DescriptionMe.0', 
+    'REQUEST.DescriptionMe.0', 
+    'POST.DescriptionMe.1', 
+    'REQUEST.DescriptionMe.1',
+);
 
 define('BX_INDEX_PAGE', 1);

trunk/modules/boonex/map_profiles/install/installer.php

@@ -27 +27 @@
         parent::BxDolInstaller($aConfig);
     }
+
+    function install($aParams) {
+
+        $aResult = parent::install($aParams);
+
+        $this->addExceptionsFields (array ('POST.bx_map_key', 'REQUEST.bx_map_key')); 
+
+        return $aResult;
+    }    
+    
+    function uninstall() {        
+
+        $ret = parent::uninstall(array());
+
+        $this->removeExceptionsFields ();
+
+        return $ret;
+    }    
 }
 ?>

trunk/modules/boonex/open_social/os.php

@@ -18 +18 @@
 * see license.txt file; if not, write to marketing@boonex.com
 ***************************************************************************/
+
+define('BX_SECURITY_EXCEPTIONS', true);
+$aBxSecurityExceptions = array(
+    'POST.request',
+    'GET.request',
+    'REQUEST.request',
+);
 
 require_once( '../../../inc/header.inc.php' );

trunk/pedit.php

@@ -21 +21 @@
 ***************************************************************************/
 
+define('BX_SECURITY_HTML', true);
+$aBxSecurityHTML = array(
+    'POST.DescriptionMe.0',
+    'REQUEST.DescriptionMe.0', 
+    'POST.DescriptionMe.1', 
+    'REQUEST.DescriptionMe.1',
+);
+
 require_once( './inc/header.inc.php' );
 require_once( BX_DIRECTORY_PATH_INC     . 'admin.inc.php' );

trunk/plugins/phpids/IDS/Config/Config.ini

@@ -35 +35 @@
     exceptions[]    = REQUEST.__utmz
     exceptions[]    = REQUEST.__utmc
+    exceptions[]    = REQUEST.__gads
     exceptions[]    = COOKIE.__utmz
-    exceptions[]    = COOKIE.__utmc
-    exceptions[]    = REQUEST.bx_map_key
-    exceptions[]    = POST.bx_map_key
+    exceptions[]    = COOKIE.__utmc    
+    exceptions[]    = COOKIE.__gads
 
     ; PHPIDS should run with PHP 5.1.2 but this is untested - set 

trunk/plugins/phpids/IDS/default_filter.xml

@@ -61 +61 @@
     </filter>
     <filter>
-        <id>6</id>
-        <rule><![CDATA[(?:with\s*\(\s*.+\s*\)\s*\w+\s*\()|(?:(?:do|while|for)\s*\([^)]*\)\s*\{)|(?:\/[\w\s]*\[\W*\w)]]></rule>
-        <description>Detects self contained xss via with(), common loops and regex to string conversion</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
         <id>7</id>
         <rule><![CDATA[(?:\d\s*[|&]{2}\s*\w)|(?:[=(].+\?.+:)|(?:with\([^)]*\)\))|(?:\.\s*source\W)|(?:\?[^:=]+:[^;]+(;|$))]]></rule>
@@ -424 +414 @@
     </filter>   
     <filter>
-        <id>39</id>
-        <rule><![CDATA[(?:\\x[01fe][\db-ce-f])|(?:%[01fe][\db-ce-f])|(?:&#[01fe][\db-ce-f])|(?:\\[01fe][\db-ce-f])|(?:&#x[01fe][\db-ce-f])]]></rule>
-        <description>Detects nullbytes and other dangerous characters</description>
-        <tags>
-            <tag>id</tag>
-            <tag>rfe</tag>
-            <tag>xss</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>   
-    <filter>
         <id>40</id>
         <rule><![CDATA[(?:"\s*(?:#|--|{))|(?:\/\*!\s?\d+)|(?:ch(?:a)?r\s*\(\s*\d)|(?:(?:(n?and|x?or|not)\s+|\|\||\&\&)\s*\w+\()]]></rule>
@@ -477 +456 @@
         </tags>
         <impact>6</impact>
-    </filter> 
-    <filter>
-        <id>44</id>
-        <rule><![CDATA[(?:\d"\s+"\s+\d)|(?:^admin\s*"|(\/\*)+"+\s?(?:--|#|\/\*|{)?)|(?:"\s*or[\w\s-]+\s*[+<>=(),-]\s*[\d"])|(?:"\s*[^\w\s]?=\s*")|(?:"\W*[+=]+\W*")|(?:"\s*[!=|][\d\s!=+-]+.*["(].*$)|(?:"\s*[!=|][\d\s!=]+.*\d+$)|(?:"\s*like\W+[\w"(])|(?:\sis\s*0\W)|(?:where\s[\s\w\.,-]+\s=)|(?:"[<>~]+")]]></rule>
-        <description>Detects basic SQL authentication bypass attempts 1/3</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>7</impact>
-    </filter> 
-    <filter>
-        <id>45</id>
-        <rule><![CDATA[(?:union\s*(?:all|distinct|[(!@]*)?\s*[([]\s*select)|(?:\w+\s+like\s+\")|(?:like\s*"\%)|(?:"\s*like\W*["\d])|(?:"\s*(?:n?and|x?or|not |\|\||\&\&)\s+[\s\w]+=\s*\w+\s*having)|(?:"\s*\*\s*\w+\W+")|(?:"\s*[^?\w\s=.,;)(]+\s*[(@]*\s*\w+\W+\w)|(?:select\s*[\[\]()\s\w\.,-]+from)]]></rule>
-        <description>Detects basic SQL authentication bypass attempts 2/3</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>7</impact>
-    </filter>
-     <filter>
-        <id>46</id>
-        <rule><![CDATA[(?:(?:n?and|x?or|not |\|\||\&\&)\s+[\s\w+]+(?:regexp\s*\(|sounds\s+like\s*"|[=\d]+x))|("\s*\d\s*(?:--|#))|(?:"[%&<>^=]+\d\s*(=|or))|(?:"\W+[\w+-]+\s*=\s*\d\W+")|(?:"\s*is\s*\d.+"?\w)|(?:"\|?[\w-]{3,}[^\w\s.,]+")|(?:"\s*is\s*[\d.]+\s*\W.*")]]></rule>
-        <description>Detects basic SQL authentication bypass attempts 3/3</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>7</impact>
-    </filter> 
+    </filter>
     <filter>
         <id>47</id>
@@ -690 +636 @@
         <impact>5</impact>
     </filter>
+    <!--        
     <filter>
         <id>67</id>
@@ -703 +650 @@
         <impact>7</impact>
     </filter>
+    -->    
     <filter>
         <id>68</id>