Changeset 218

Timestamp:

10/19/07 23:26:25 (15 months ago)

Author:

jonas

Message:

 

Location:

trunk

Files:

• ChangeLog (modified) (1 diff)
• includes/func.inc.php (modified) (3 diffs)
• includes/sites/domain_add.php (modified) (2 diffs)
• includes/sites/domain_view.php (modified) (1 diff)
• includes/sites/email_add.php (modified) (1 diff)
• includes/sites/email_view.php (modified) (3 diffs)
• includes/sites/user_spam.php (modified) (2 diffs)
• system_scripts/create_mailboxes.pl (modified) (1 diff)
• templates/error_messages.tpl (modified) (2 diffs)

trunk/ChangeLog

@@ -3 +3 @@
         o Fixed: recipient classes VIEW
         o Improved: display mailbox size with units
+        o Improved: fist step to better inputchecks for XSS protection
+          Thanks to Sven Tantau (http://beastiebytes.com)
 CpVES 0.10 2007-10-11 - Jonas Genannt - <jonas.genannt@brachium-system.net>
         o Improved: sa_learn.pl no longer debug output

trunk/includes/func.inc.php

@@ -50 +50 @@
 }
 
+function domain_valid($domain) {
+        if (preg_match("/^([0-9a-zA-Z\._\-]+)$/", $domain)) {
+                return true;
+        }
+        return false;
+}
+
+function clean_input($string) {
+        if (get_magic_quotes_gpc()) {
+                $string=stripslashes($string);
+        }
+        $string=strip_tags($string);
+        return $string;
+        
+}
+
 function get_all_langs() {
 $table_lang = array();
@@ -545 +561 @@
 function email_valid($mail)
 {
-        if (ereg("^([a-zA-Z0-9._-]+)$", $mail))
+        if (ereg("^([a-zA-Z0-9._\-]+)$", $mail))
         {
                 return true;
@@ -840 +856 @@
                 $msg=stripslashes($msg);
         }
+        $esubject=clean_input($esubject);
+        $msg=clean_input($msg);
         if ($result->numRows()==1) 
         {

trunk/includes/sites/domain_add.php

@@ -27 +27 @@
                         $smarty->assign('if_error_domain_exits', 'y');
                         $smarty->assign('dnsname', $_POST['dnsname']);
+                }
+                elseif(!domain_valid($_POST['dnsname'])) {
+                        $smarty->assign('error_msg','y');
+                        $smarty->assign('if_error_domain_wrong', 'y');
                 }
                 else
@@ -67 +71 @@
                                 $db->escapeSimple($max_email),
                                 $db->escapeSimple($max_forward),
-                                $db->escapeSimple(substr($_POST['dnote'],0,30)),
+                                $db->escapeSimple(clean_input(substr($_POST['dnote'],0,30)) ),
                                 $db->escapeSimple($_POST['p_spamassassin']),
                                 $db->escapeSimple($bogofilter),

trunk/includes/sites/domain_view.php

@@ -147 +147 @@
         if (isset($_POST['dnote'])) {
                 $sql=sprintf("UPDATE domains SET dnote='%s' WHERE id='%d'",
-                        $db->escapeSimple($_POST['dnote']),
+                        $db->escapeSimple(clean_input(substr($_POST['dnote'],0,30))),
                         $db->escapeSimple($_GET['did']));
                 $db->query($sql);

trunk/includes/sites/email_add.php

@@ -131 +131 @@
                                 $db->escapeSimple($_GET['did']),
                                 $db->escapeSimple($cleartext),
-                                $db->escapeSimple($_POST['full_name']),
+                                $db->escapeSimple(clean_input(trim($_POST['full_name']))),
                                 $db->escapeSimple($imap),
                                 $db->escapeSimple($pop3),

trunk/includes/sites/email_view.php

@@ -98 +98 @@
                         $smarty->assign('if_wrong_sa_subjecttag','y');
                 }
+                elseif (!preg_match("/^([0-9A-Za-z*\s\+\.\-_\]\[]+)$/",$_POST['rewrite_subject_header'])) {
+                        $smarty->assign('error_msg', 'y');
+                        $smarty->assign('if_illegal_sa_subjecttag','y');
+                }
                 else
                 {
@@ -106 +110 @@
                         elseif ($_POST['rewrite_subject']==1)
                         {
-                                $rewrite_subject=$_POST['rewrite_subject_header'];
+                                $rewrite_subject=clean_input(trim($_POST['rewrite_subject_header']));
                         
                         }
@@ -587 +591 @@
                                 $sql=sprintf("UPDATE users SET passwd='%s', full_name='%s',p_imap='%d', p_pop3='%d',p_webmail='%d',     cpasswd='%s', p_forwarding='%s',p_spamassassin='%s',p_mailarchive='%d',p_bogofilter='%d',p_spam_del='%d',p_sa_learn='%d',p_fetchmail='%d',p_webinterface='%d',p_autores_xheader='%d',p_check_polw='%d',p_check_grey='%d',p_spam_fwd='%d' WHERE id='%d' ",
                                         $db->escapeSimple($cleartext),
-                                        $db->escapeSimple($_POST['full_name']),
+                                        $db->escapeSimple(clean_input(trim($_POST['full_name']))),
                                         $db->escapeSimple($imap),
                                         $db->escapeSimple($pop3),

trunk/includes/sites/user_spam.php

@@ -51 +51 @@
                         $smarty->assign('if_wrong_sa_subjecttag','y');
                 }
+                elseif (!preg_match("/^([0-9A-Za-z*\s\+\.\-_\]\[]+)$/",$_POST['rewrite_subject_header'])) {
+                        $smarty->assign('error_msg', 'y');
+                        $smarty->assign('if_illegal_sa_subjecttag','y');
+                }
                 else
                 {
@@ -59 +63 @@
                         elseif ($_POST['rewrite_subject']==1)
                         {
-                                $rewrite_subject=$_POST['rewrite_subject_header'];
+                                $rewrite_subject=clean_input(trim($_POST['rewrite_subject_header']));
                         
                         }

trunk/system_scripts/create_mailboxes.pl

@@ -66 +66 @@
         my $id = $data[1];
         my $emailaddr = $data[0];
+        die ("Error: emailaddress contains illegal chars!\n") unless ($emailaddr=~m/^([a-zA-Z0-9._\-]+)$/);
+        die ("Error: domainname contains illegal chars!\n") unless ($dnsname=~m/^([a-zA-Z0-9._\-]+)$/);
         if ( ! -d "$config{'vmail_home'}/$dnsname") {
                 `mkdir -p $config{'vmail_home'}/$dnsname`;

trunk/templates/error_messages.tpl

@@ -3 +3 @@
 {elseif $if_error_domain_exits == 'y' }
 {t}domain already exists!{/t}
+{elseif $if_error_domain_wrong == 'y'}
+{t}domainname contains illegal characters!{/t}
 {elseif $if_error_email_exits == 'y' }
 {t}emailaddress already exists!{/t}
@@ -40 +42 @@
 {elseif $if_new_passwd_not_same == 'y'}
 {t}new passwords does not match!{/t}
+{elseif $if_illegal_sa_subjecttag == 'y'}
+{t}subject contains illegal characters!{/t}
 {elseif $if_submit_email_wrong == 'y' }
 {t}emailaddress is not valid!{/t}