Уважаемые пользователи!
C 7 ноября 2020 года phpBB Group прекратила выпуск обновлений и завершила дальнейшее развитие phpBB версии 3.2.
С 1 августа 2024 года phpBB Group прекращает поддержку phpBB 3.2 на официальном сайте.
Сайт официальной русской поддержки phpBB Guru продолжит поддержку phpBB 3.2 до 31 декабря 2024 года.
С учетом этого, настоятельно рекомендуется обновить конференции до версии 3.3.

Посмотрите на предмет безопасности (Add field)

Ответы на вопросы, связанные с модами для phpBB 2.0.x, кроме относящихся к форуму Для авторов (phpBB 2.0.x).
Alexgraf

Посмотрите на предмет безопасности (Add field)

Сообщение Alexgraf »

На своём форуме, добавил три поля в форму регистрации (секция, этаж, квартира). Хочется понять, не нарушена ли таким образом безопасность движка.
Вот что я сделал :

Код: Выделить всё

################################################################# 
## MOD Title: 
## MOD Author: 
## MOD Description: 
################################################################# 

#
#-----[ OPEN ]------------------------------
# 
usercp_register.php

#
#-----[ FIND ]-----------------------------------
# 
	$strip_var_list = array('username' => 'username', 'email' => 'email', 'icq' => 'icq', 'aim' => 'aim', 'msn' => 'msn', 'yim' => 'yim', 'website' => 'website', 'location' => 'location', 'occupation' => 'occupation', 'interests' => 'interests');

#-----[ IN-LINE FIND ]---------------------------------------------

);

#
#-----[ IN-LINE BEFORE, ADD ]---------------------------------------
#

, 'section' => 'section', 'floor' => 'floor', 'kvartira' => 'kvartira'

#
#-----[ FIND ]-----------------------------------
# 
		$interests = stripslashes($interests);

# 
#-----[ AFTER, ADD ]---------------------------------------
#
		$section = stripslashes($section);
		$floor = stripslashes($floor);
		$kvartira = stripslashes($kvartira);
#
#-----[ FIND ]-----------------------------------
# 
				SET " . $username_sql . $passwd_sql . "user_email = '" . str_replace("\'", "''", $email) ."', user_icq = '" . str_replace("\'", "''", $icq) . "', user_website = '" . str_replace("\'", "''", $website) . "', user_occ = '" . str_replace("\'", "''", $occupation) . "', user_from = '" . str_replace("\'", "''", $location) . "', user_interests = '" . str_replace("\'", "''", $interests) . "', user_sig = '" . str_replace("\'", "''", $signature) . "', user_sig_bbcode_uid = '$signature_bbcode_uid', user_viewemail = $viewemail, user_aim = '" . str_replace("\'", "''", str_replace(' ', '+', $aim)) . "', user_yim = '" . str_replace("\'", "''", $yim) . "', user_msnm = '" . str_replace("\'", "''", $msn) . "', user_attachsig = $attachsig, user_allowsmile = $allowsmilies, user_allowhtml = $allowhtml, user_allowbbcode = $allowbbcode, user_allow_viewonline = $allowviewonline, user_notify = $notifyreply, user_notify_pm = $notifypm, user_popup_pm = $popup_pm, user_timezone = $user_timezone, user_dateformat = '" . str_replace("\'", "''", $user_dateformat) . "', user_lang = '" . str_replace("\'", "''", $user_lang) . "', user_style = $user_style, user_active = $user_active, user_actkey = '" . str_replace("\'", "''", $user_actkey) . "'" . $avatar_sql . "
# 
#-----[ REPLACE WITH ]---------------------------------------
# 
				SET " . $username_sql . $passwd_sql . "user_email = '" . str_replace("\'", "''", $email) ."', user_icq = '" . str_replace("\'", "''", $icq) . "', user_website = '" . str_replace("\'", "''", $website) . "', user_occ = '" . str_replace("\'", "''", $occupation) . "', user_from = '" . str_replace("\'", "''", $location) . "', user_interests = '" . str_replace("\'", "''", $interests) . "', user_section = '" . str_replace("\'", "''", $section) . "', user_floor = '" . str_replace("\'", "''", $floor) . "', user_kvartira = '" . str_replace("\'", "''", $kvartira) . "', user_sig = '" . str_replace("\'", "''", $signature) . "', user_sig_bbcode_uid = '$signature_bbcode_uid', user_viewemail = $viewemail, user_aim = '" . str_replace("\'", "''", str_replace(' ', '+', $aim)) . "', user_yim = '" . str_replace("\'", "''", $yim) . "', user_msnm = '" . str_replace("\'", "''", $msn) . "', user_attachsig = $attachsig, user_allowsmile = $allowsmilies, user_allowhtml = $allowhtml, user_allowbbcode = $allowbbcode, user_allow_viewonline = $allowviewonline, user_notify = $notifyreply, user_notify_pm = $notifypm, user_popup_pm = $popup_pm, user_timezone = $user_timezone, user_dateformat = '" . str_replace("\'", "''", $user_dateformat) . "', user_lang = '" . str_replace("\'", "''", $user_lang) . "', user_style = $user_style, user_active = $user_active, user_actkey = '" . str_replace("\'", "''", $user_actkey) . "'" . $avatar_sql . "
#
#-----[ FIND ]-----------------------------------
# 
			//
			// Get current date
			//
#
#-----[ BEFORE, ADD ]---------------------------------------
#
               		$section = ($section == $lang['Section_choice']['0']) ? '' : $section;
               		$floor = ($floor == $lang['Floor_choice']['0']) ? '' : $floor;
               		$kvartira = ($kvartira == $lang['Kvartira_choice']['0']) ? '' : $kvartira;
#
#-----[ FIND ]-----------------------------------
#
			$sql = "INSERT INTO " . USERS_TABLE . "	(user_id, username, user_regdate, user_password, user_email, user_icq, user_website, user_occ, user_from, user_interests, user_sig, user_sig_bbcode_uid, user_avatar, user_avatar_type, user_viewemail, user_aim, user_yim, user_msnm, user_attachsig, user_allowsmile, user_allowhtml, user_allowbbcode, user_allow_viewonline, user_notify, user_notify_pm, user_popup_pm, user_timezone, user_dateformat, user_lang, user_style, user_level, user_allow_pm, user_active, user_actkey)
				VALUES ($user_id, '" . str_replace("\'", "''", $username) . "', " . time() . ", '" . str_replace("\'", "''", $new_password) . "', '" . str_replace("\'", "''", $email) . "', '" . str_replace("\'", "''", $icq) . "', '" . str_replace("\'", "''", $website) . "', '" . str_replace("\'", "''", $occupation) . "', '" . str_replace("\'", "''", $location) . "', '" . str_replace("\'", "''", $interests) . "', '" . str_replace("\'", "''", $signature) . "', '$signature_bbcode_uid', $avatar_sql, $viewemail, '" . str_replace("\'", "''", str_replace(' ', '+', $aim)) . "', '" . str_replace("\'", "''", $yim) . "', '" . str_replace("\'", "''", $msn) . "', $attachsig, $allowsmilies, $allowhtml, $allowbbcode, $allowviewonline, $notifyreply, $notifypm, $popup_pm, $user_timezone, '" . str_replace("\'", "''", $user_dateformat) . "', '" . str_replace("\'", "''", $user_lang) . "', $user_style, 0, 1, ";
# 
#-----[ REPLACE WITH ]---------------------------------------
# 
			$sql = "INSERT INTO " . USERS_TABLE . "	(user_id, username, user_regdate, user_password, user_email, user_icq, user_website, user_occ, user_from, user_interests, user_section, user_floor, user_kvartira, user_sig, user_sig_bbcode_uid, user_avatar, user_avatar_type, user_viewemail, user_aim, user_yim, user_msnm, user_attachsig, user_allowsmile, user_allowhtml, user_allowbbcode, user_allow_viewonline, user_notify, user_notify_pm, user_popup_pm, user_timezone, user_dateformat, user_lang, user_style, user_level, user_allow_pm, user_active, user_actkey)
				VALUES ($user_id, '" . str_replace("\'", "''", $username) . "', " . time() . ", '" . str_replace("\'", "''", $new_password) . "', '" . str_replace("\'", "''", $email) . "', '" . str_replace("\'", "''", $icq) . "', '" . str_replace("\'", "''", $website) . "', '" . str_replace("\'", "''", $occupation) . "', '" . str_replace("\'", "''", $location) . "', '" . str_replace("\'", "''", $interests) . "', '" . str_replace("\'", "''", $section) . "', '" . str_replace("\'", "''", $floor) . "', '" . str_replace("\'", "''", $kvartira) . "', '" . str_replace("\'", "''", $signature) . "', '$signature_bbcode_uid', $avatar_sql, $viewemail, '" . str_replace("\'", "''", str_replace(' ', '+', $aim)) . "', '" . str_replace("\'", "''", $yim) . "', '" . str_replace("\'", "''", $msn) . "', $attachsig, $allowsmilies, $allowhtml, $allowbbcode, $allowviewonline, $notifyreply, $notifypm, $popup_pm, $user_timezone, '" . str_replace("\'", "''", $user_dateformat) . "', '" . str_replace("\'", "''", $user_lang) . "', $user_style, 0, 1, ";
#
#-----[ FIND ]-----------------------------------
#
	display_avatar_gallery($mode, $avatar_category, $user_id, $email, $current_email, $coppa, $username, $email, &$new_password, &$cur_password, $password_confirm, $icq, $aim, $msn, $yim, $website, $location, $occupation, $interests, $signature, $viewemail, $notifypm, $popup_pm, $notifyreply, $attachsig, $allowhtml, $allowbbcode, $allowsmilies, $allowviewonline, $user_style, $user_lang, $user_timezone, $user_dateformat, $userdata['session_id']);
# 
#-----[ REPLACE WITH ]---------------------------------------
#
	display_avatar_gallery($mode, $avatar_category, $user_id, $email, $current_email, $coppa, $username, $email, &$new_password, &$cur_password, $password_confirm, $icq, $aim, $msn, $yim, $website, $location, $occupation, $interests, $section, $floor, $kvartira, $signature, $viewemail, $notifypm, $popup_pm, $notifyreply, $attachsig, $allowhtml, $allowbbcode, $allowsmilies, $allowviewonline, $user_style, $user_lang, $user_timezone, $user_dateformat, $userdata['session_id']);
#
#-----[ FIND ]-----------------------------------
#
	if ( $mode == 'editprofile' )
#
#-----[ BEFORE, ADD ]---------------------------------------
#
	$s_section = '<select name="section">';
	for($i = 0; $i < count($lang['Section_choice']); $i++ )
	{
	        $s_section .= '<option value="' . $lang['Section_choice'][$i] . '">' . $lang['Section_choice'][$i]. '</option>';
	}
	$s_section .= '</select>'; 
	$s_section = str_replace("value=\"".$section."\">", "value=\"".$section."\" SELECTED>" ,$s_section);

	$s_floor = '<select name="floor">';
	for($i = 0; $i < count($lang['Floor_choice']); $i++ )
	{
	        $s_floor .= '<option value="' . $lang['Floor_choice'][$i] . '">' . $lang['Floor_choice'][$i]. '</option>';
	}
	$s_floor .= '</select>'; 
	$s_floor = str_replace("value=\"".$floor."\">", "value=\"".$floor."\" SELECTED>" ,$s_floor);

	$s_kvartira = '<select name="kvartira">';
	for($i = 0; $i < count($lang['Kvartira_choice']); $i++ )
	{
	        $s_kvartira .= '<option value="' . $lang['Kvartira_choice'][$i] . '">' . $lang['Kvartira_choice'][$i]. '</option>';
	}
	$s_kvartira .= '</select>'; 
	$s_kvartira = str_replace("value=\"".$kvartira."\">", "value=\"".$kvartira."\" SELECTED>" ,$s_kvartira);
#
#-----[ FIND ]-----------------------------------
#
		'LOCATION' => $location,
#
#-----[ BEFORE, ADD ]---------------------------------------
#
		'S_SECTION' => $s_section,
		'S_FLOOR' => $s_floor,
		'S_KVARTIRA' => $s_kvartira,
#
#-----[ FIND ]-----------------------------------
#
		'L_ALWAYS_ALLOW_SMILIES' => $lang['Always_smile'],
#
#-----[ BEFORE, ADD ]---------------------------------------
#
		'L_SECTION' => $lang['Section'],
		'L_FLOOR' => $lang['Floor'],
		'L_KVARTIRA' => $lang['Kvartira'],
# 
#-----[ CLOSE FILE ]------------------------------------------ 
#
Вопрос возник из за того, что при отправке данных, в форму можно подставить не только те значения, которые даёт форма (выпадающее меню) но и любые другие...


Еще в viewtopic.php после

Код: Выделить всё

$poster_from = ( $postrow[$i]['user_from'] && $postrow[$i]['user_id'] != ANONYMOUS ) ? $lang['Location'] . ': ' . $postrow[$i]['user_from'] : '';
Я добавил вычисление и вывод реального номера квартиры, функция вроде работает, нет ли здесь косяков ?

Код: Выделить всё

	if ( $postrow[$i]['user_section'] != '' && $postrow[$i]['user_floor'] != '' && $postrow[$i]['user_kvartira'] != '' )
	{
		if ( $postrow[$i]['user_section'] > 2)
		{
			$poster_k_num = 52*(6-$postrow[$i]['user_section'])+($postrow[$i]['user_floor']-2)*4+$postrow[$i]['user_kvartira'][0];
		}
		else
		{
			$poster_k_num = 208+44*(2-$postrow[$i]['user_section'])+($postrow[$i]['user_floor']-2)*4+$postrow[$i]['user_kvartira'][0];
		}
	}
	else
	{
	$poster_k_num = 'xxx';
	}

	$poster_located = ( $postrow[$i]['user_id'] != ANONYMOUS && $postrow[$i]['user_section'] != '') ? $lang['Located'] . ': <br />' . $postrow[$i]['user_section'] . ' ñåêöèÿ, ' . $postrow[$i]['user_floor'] . ' ýòàæ, <br />' . $postrow[$i]['user_kvartira'] . '<br /> <b>¹' . $poster_k_num . '</b>' : '';

Вернуться в «Поддержка модов для phpBB 2.0.x»