/usr/share/knowledgeroot/extension/libsecure/class-libsecure.php is in knowledgeroot 0.9.9.5-6.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 | <?php
/******************************
* Knowledgeroot
* Frank Habermann
* 15.04.2007
*
* Version 0.1
* This Class will help to secure knowledgeroot and to disable XSS
******************************/
class libsecure extends extension_base {
/**
* main Function to start Extension
*/
function main() {
$this->CLASS['hooks']->execAtHook("kr_header","check_vars","start","libsecure","doCheck");
}
/**
* This function starts black and white listing in the right order
*/
function doCheck() {
$order = explode(",", $this->CONF['order']);
foreach($order as $key => $value) {
$value = trim($value);
if($value == "whitelist" && $this->CONF['whitelist'] == 1) $this->doWhitelisting();
if($value == "blacklist" && $this->CONF['blacklist'] == 1) $this->doBlacklisting();
}
// check if fileuploads should be checked
if($this->CONF['fileuploads'] == 1) $this->doFileUploadFilter();
}
/**
* This function start the whitelisting
*/
function doWhitelisting() {
// do blacklisting on global vars if enabled in the config
if($this->CONF['whitelistitems']['POST'] == 1) $this->whitelistVar($_POST,true);
if($this->CONF['whitelistitems']['GET'] == 1) $this->whitelistVar($_GET,true);
if($this->CONF['whitelistitems']['COOKIE'] == 1) $this->whitelistVar($_COOKIE,true);
if($this->CONF['whitelistitems']['SESSION'] == 1) $this->whitelistVar($_SESSION);
if($this->CONF['whitelistitems']['SERVER'] == 1) $this->whitelistVar($_SERVER,true);
if($this->CONF['whitelistitems']['REQUEST'] == 1) $this->whitelistVar($_REQUEST,true);
}
/**
* This function is doing whitelisting on variables
*/
function whitelistVar(&$var, $convertslashes = false) {
require_once('htmlpurifier/HTMLPurifier.auto.php');
$config = HTMLPurifier_Config::createDefault();
$config->set('Core', 'Encoding', $this->CLASS['vars']['knowledgeroot']['charset']); //replace with your encoding
$config->set('Core', 'XHTML', $this->CONF['whitelistconfig']['useXhtml']); //replace with false if HTML 4.01
$purifier = new HTMLPurifier($config);
if(is_array($var)) {
reset($var);
while(list($key,$val)=each($var)) {
if(is_array($val)) {
$this->whitelistVar($var[$key],$convertslashes);
} else {
if($convertslashes) $var[$key] = addslashes($purifier->purify(stripslashes($val)));
else $var[$key] = $purifier->purify($val);
}
}
reset($var);
} else {
if($convertslashes) $var = addslashes($purifier->purify(stripslashes($var)));
else $var = $purifier->purify($var);
}
}
/**
* This function start the blacklisting
*/
function doBlacklisting() {
// do blacklisting on global vars if enabled in the config
if($this->CONF['blacklistitems']['POST'] == 1) $this->blacklistVar($_POST,true);
if($this->CONF['blacklistitems']['GET'] == 1) $this->blacklistVar($_GET,true);
if($this->CONF['blacklistitems']['COOKIE'] == 1) $this->blacklistVar($_COOKIE,true);
if($this->CONF['blacklistitems']['SESSION'] == 1) $this->blacklistVar($_SESSION);
if($this->CONF['blacklistitems']['SERVER'] == 1) $this->blacklistVar($_SERVER,true);
if($this->CONF['blacklistitems']['REQUEST'] == 1) $this->blacklistVar($_REQUEST,true);
}
/**
* This function is doing blacklisting on variables
*/
function blacklistVar(&$var,$convertslashes = false) {
// load safehtml
if(!defined('XML_HTMLSAX3')) define('XML_HTMLSAX3', dirname(__FILE__)."/safehtml/classes/");
require_once('safehtml/classes/safehtml.php');
// init safehtml
$safehtml =& new safehtml();
if(is_array($var)) {
reset($var);
while(list($key,$val)=each($var)) {
if(is_array($val)) {
$this->blacklistVar($var[$key],$convertslashes);
} else {
if($convertslashes) $var[$key] = addslashes($safehtml->parse(stripslashes($val)));
else $var[$key] = $safehtml->parse($val);
$safehtml->clear();
}
}
reset($var);
} else {
if($convertslashes) $var = addslashes($safehtml->parse(stripslashes($var)));
else $var = $safehtml->parse($var);
$safehtml->clear();
}
}
/**
* Do check on Fileuploads
*/
function doFileUploadFilter() {
if(isset($_FILES) && is_array($_FILES)) {
foreach($_FILES as $key => $value) {
if(is_array($_FILES[$key]['name'])) {
foreach($_FILES[$key]['name'] as $keymulti => $valuemulti) {
$_FILES[$key]['name'][$keymulti] = $this->doFileUploadWhiteList($_FILES[$key]['name'][$keymulti]);
if(isset($_FILES[$key]['type'][$keymulti])) $_FILES[$key]['type'][$keymulti] = $this->doFileUploadWhiteList($_FILES[$key]['type'][$keymulti]);
}
} else {
$_FILES[$key]['name'] = $this->doFileUploadWhiteList($_FILES[$key]['name']);
if(isset($_FILES[$key]['type'])) $_FILES[$key]['type'] = $this->doFileUploadWhiteList($_FILES[$key]['type']);
}
}
}
}
/**
* Do a whitelist check on a filename or type
*/
function doFileUploadWhiteList($name) {
if(function_exists('mb_ereg_replace')) $name = mb_ereg_replace('/[^a-zA-Z0-9 .\-_\/]/m', '', $name);
else $name = preg_replace('/[^a-zA-Z0-9 .\-_\/]/m', '', $name);
return $name;
}
}
?>
|