]>
src.bluestatic.org Git - isso.git/blob - Input.php
2 /*=====================================================================*\
3 || ###################################################################
4 || # Blue Static ISSO Framework
5 || # Copyright ©2002-[#]year[#] Iris Studios, Inc.
7 || # This program is free software; you can redistribute it and/or modify
8 || # it under the terms of the GNU General Public License as published by
9 || # the Free Software Foundation; version [#]gpl[#] of the License.
11 || # This program is distributed in the hope that it will be useful, but
12 || # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 || # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
16 || # You should have received a copy of the GNU General Public License along
17 || # with this program; if not, write to the Free Software Foundation, Inc.,
18 || # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
19 || ###################################################################
20 \*=====================================================================*/
23 * Input sanitizer (Input.php)
29 * Input cleaning type constant
34 define('TYPE_INT', 1);
39 define('TYPE_UINT', 2);
44 define('TYPE_FLOAT', 4);
49 define('TYPE_BOOL', 8);
54 define('TYPE_STR', 16);
57 * String - deliberate unclean
59 define('TYPE_STRUN', 32);
62 * No cleaning - here for use in API
64 define('TYPE_NONE', 64);
67 * Macro for using DB->escape_binary() without cleaning - used in API
69 define('TYPE_BIN', 128);
75 * This class is responsible for cleaning input.
78 * ISSO_CHECK_POST_REFERER - Will check to make sure that on POSTed
79 * data, the referer matches the host
82 * @copyright Copyright ©2002 - [#]year[#], Blue Static
90 * An array of sanitized variables that have been cleaned for HTML tag openers and double quotes
96 * If we are running with magic_quotes_gpc on or off
99 private $magicquotes = 0;
101 // ###################################################################
103 * Constructor: set instance variables and execute input cleaning
105 public function __construct()
108 $this->magicquotes
= get_magic_quotes_gpc();
109 set_magic_quotes_runtime(0);
111 // some debug info that's always useful
112 BSApp
::Debug('magic_quotes_gpc = ' . $this->magicquotes
);
113 BSApp
::Debug('register_globals = ' . ini_get('register_globals'));
115 $this->_sanitizeInputData();
117 if (defined('ISSO_CHECK_POST_REFERER'))
119 $this->_checkPostReferer();
123 // ###################################################################
125 * Recursive XSS cleaner
127 * @param mixed Unsanitized REQUEST data
129 * @return mixed Sanitized data
131 private function _sanitizeDataRecursive($data)
133 foreach ($data AS $key => $value)
135 if (is_array($value))
137 $data["$key"] = $this->_sanitizeDataRecursive($value);
141 if ($this->magicquotes)
143 $value = str_replace("\'
", "'", $value);
145 $data["$key"] = $this->sanitize($value);
151 // ###################################################################
153 * Simple way to protect against HTML attacks with Unicode support
155 * @param string Unsanitzed text
157 * @return string Properly protected text that only encodes potential threats
159 public function sanitize($text)
161 if ($this->magicquotes)
163 return str_replace(array('<', '>', '\"
', '"'), array('<', '>', '"', '"'), $text);
167 return str_replace(array('<', '>', '"'), array('<
;', '>
;', '"
;'), $text);
171 // ###################################################################
173 * Unicode-safe entity encoding system; similar to sanitize()
175 * @param string Unsanitized text
177 * @return string Unicode-safe sanitized text with entities preserved
179 public function entityEncode($text)
181 $text = str_replace('&', '&
;', $text);
182 $text = $this->sanitize($text);
186 // ###################################################################
188 * Takes text that has been processed for HTML and unsanitizes it
190 * @param string Text that needs to be turned back into HTML
192 * @return string Unsanitized text
194 public function unsanitize($text)
196 return str_replace(array('<
;', '>
;', '"
;'), array('<', '>', '"'), $text);
199 // ###################################################################
201 * Smart addslashes() that only applies itself it the Magic Quotes GPC
202 * is off. This should only be run on database query values that come
203 * from ISSO->in[] input; data that needs sanitization should be run
204 * through Db->escapeString()
206 * @param string Some string
207 * @param bool Force magic quotes to be off
209 * @return string String that has slashes added
211 public function escape($str, $force = true)
213 $db = BSApp::Registry()->getType('Db');
214 if ($this->magicquotes AND !$force)
218 return $db->escapeString(str_replace(array("\'
", '\"'), array("'", '"'), $str));
226 return $db->escapeString($str);
228 return addslashes($str);
232 // ###################################################################
234 * Runs through all of the input data and sanitizes it.
236 private function _sanitizeInputData()
238 $this->in = $this->_sanitizeDataRecursive(array_merge($_GET, $_POST, $_COOKIE));
241 // ###################################################################
243 * Sanitize function for something other than a string (which
244 * everything is sanitized for if you use _sanitizeInputData(). Cleaned
245 * data is placed back into Input->in; this makes it so you don't have
246 * to constantly intval() [etc.] data.
248 * @param array Array of elements to clean as varname => type
250 public function inputCleanArray($vars)
252 foreach ($vars AS $varname => $type)
254 $this->inputClean($varname, $type);
258 // ###################################################################
260 * Sanitize function that does a single variable as oppoesd to an array
261 * (see inputCleanArray() for more details)
263 * @param string Variable name in ISSO->in[]
264 * @param integer Sanitization type constant
266 public function inputClean($varname, $type)
268 if (isset($this->in["$varname"]))
270 $this->in
["$varname"] = $this->clean($this->in["$varname"], $type);
274 $this->in
["$varname"] = $this->clean(null, $type);
277 return $this->in["$varname"];
280 // ###################################################################
282 * Runs Input->escape() on a variable on Input->in[]. This is just a
283 * short-hand wrapper so that queries can be shortened. When this is used,
284 * the actual value in Input->in[] is not changed, only the return value
287 * @param string Input variable
289 * @return string Escaped input
291 public function inputEscape($varname)
293 if (isset($this->in
["$varname"]))
295 return $this->escape($this->in["$varname"]);
299 return $this->escape(null);
303 // ###################################################################
305 * Cleaning function that does the work for inputClean(); this is
306 * moved here so it can be used to clean things that aren't in
310 * @param integer Sanitization type constant
312 * @return mixed Cleaned data
314 public function clean($value, $type)
316 if (is_array($value))
318 return $this->_cleanArray($value, $type);
321 if ($type == TYPE_INT
)
323 $value = intval($value);
325 else if ($type == TYPE_UINT
)
327 $value = (($val = intval($value)) < 0 ? 0 : $val);
329 else if ($type == TYPE_FLOAT
)
331 $value = floatval($value);
333 else if ($type == TYPE_BOOL
)
335 $value = (bool)$value;
337 else if ($type == TYPE_STR
)
341 else if ($type == TYPE_STRUN
)
343 $value = $this->unsanitize($value);
345 else if ($type == TYPE_NONE
)
347 if ($this->magicquotes
)
349 $value = str_replace(array('\"', "\'"), array('"', "'"), $value);
356 else if ($type == TYPE_BIN
)
362 throw new Exception('Invalid clean type specified in BSInput::clean()');
369 // ###################################################################
371 * Recursion function for Input->clean()
373 * @param array Uncleaned array
374 * @param integer Sanitization type constant
376 * @return array Cleaned array of data
378 private function _cleanArray($array, $type)
380 foreach ($array AS $key => $value)
382 $array["$key"] = $this->clean($value, $type);
388 // ###################################################################
390 * Returns the lowercase version of the HTTP method (post or get)
392 * @return string HTTP method
394 public function getHttpMethod()
396 $method = strtolower($_SERVER['REQUEST_METHOD']);
397 if (!in_array($method, array('get', 'post')))
399 throw new Exception('Invalid server request method: ' . $method);
404 // ###################################################################
406 * Checks to see if a POST refer is actually from us
408 private function _checkPostReferer()
410 if ($this->getHttpMethod() == 'post')
412 $host = ($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : $_ENV['HTTP_HOST'];
414 if ($host AND $_SERVER['HTTP_REFERER'])
416 $parts = parse_url($_SERVER['HTTP_REFERER']);
417 $ourhost = $parts['host'] . (isset($parts['port']) ? ":$parts[port
]" : '');
419 if ($ourhost != $host)
421 throw new Exception('No external hosts are allowed to POST to this application');
424 BSApp::Debug('remote post check = ok');
428 BSApp::Debug('remote post check = FAILED');
434 /*=====================================================================*\
435 || ###################################################################
438 || ###################################################################
439 \*=====================================================================*/