2 /*=====================================================================*\
3 || ###################################################################
4 || # Blue Static ISSO Framework
5 || # Copyright (c)2005-2008 Iris Studios, Inc.
7 || # This program is free software; you can redistribute it and/or modify
8 || # it under the terms of the GNU General Public License as published by
9 || # the Free Software Foundation; version 2 of the License.
11 || # This program is distributed in the hope that it will be useful, but
12 || # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 || # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
16 || # You should have received a copy of the GNU General Public License along
17 || # with this program; if not, write to the Free Software Foundation, Inc.,
18 || # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
19 || ###################################################################
20 \*=====================================================================*/
23 * Input sanitizer (Input.php)
29 * Input cleaning type constant
34 define('TYPE_INT', 1);
39 define('TYPE_UINT', 2);
44 define('TYPE_FLOAT', 4);
49 define('TYPE_BOOL', 8);
54 define('TYPE_STR', 16);
57 * String - deliberate unclean
59 define('TYPE_STRUN', 32);
62 * No cleaning - here for use in API
64 define('TYPE_NONE', 64);
67 * Macro for using DB->escape_binary() without cleaning - used in API
69 define('TYPE_BIN', 128);
75 * This class is responsible for cleaning input.
78 * @copyright Copyright (c)2005 - 2008, Blue Static
85 * An array of sanitized variables that have been cleaned for HTML tag openers and double quotes
91 * If we are running with magic_quotes_gpc on or off
94 private $magicquotes = 0;
96 // ###################################################################
98 * Constructor: set instance variables and execute input cleaning
100 public function __construct()
103 $this->magicquotes
= get_magic_quotes_gpc();
104 set_magic_quotes_runtime(0);
106 // some debug info that's always useful
107 BSApp
::debug('magic_quotes_gpc = ' . $this->magicquotes
);
108 BSApp
::debug('register_globals = ' . ini_get('register_globals'));
110 $this->_sanitizeInputData();
113 // ###################################################################
115 * Recursive XSS cleaner
117 * @param mixed Unsanitized REQUEST data
119 * @return mixed Sanitized data
121 private function _sanitizeDataRecursive($data)
123 foreach ($data as $key => $value)
125 if (is_array($value))
127 $data["$key"] = $this->_sanitizeDataRecursive($value);
131 if ($this->magicquotes
)
133 $value = str_replace("\'", "'", $value);
135 $data["$key"] = $this->sanitize($value);
141 // ###################################################################
143 * Simple way to protect against HTML attacks with Unicode support
145 * @param string Unsanitzed text
147 * @return string Properly protected text that only encodes potential threats
149 public function sanitize($text)
151 if ($this->magicquotes
)
153 return str_replace(array('<', '>', '\"', '"'), array('<', '>', '"', '"'), $text);
157 return str_replace(array('<', '>', '"'), array('<', '>', '"'), $text);
161 // ###################################################################
163 * Unicode-safe entity encoding system; similar to sanitize()
165 * @param string Unsanitized text
167 * @return string Unicode-safe sanitized text with entities preserved
169 public function entityEncode($text)
171 $text = str_replace('&', '&', $text);
172 $text = $this->sanitize($text);
176 // ###################################################################
178 * Takes text that has been processed for HTML and unsanitizes it
180 * @param string Text that needs to be turned back into HTML
182 * @return string Unsanitized text
184 public function unsanitize($text)
186 return str_replace(array('<', '>', '"'), array('<', '>', '"'), $text);
189 // ###################################################################
191 * Smart addslashes() that only applies itself it the Magic Quotes GPC
192 * is off. This should only be run on database query values that come
193 * from ISSO->in[] input; data that needs sanitization should be run
194 * through Db->escapeString()
196 * @param string Some string
197 * @param bool Force magic quotes to be off
199 * @return string String that has slashes added
201 public function escape($str, $force = true
)
204 if ($this->magicquotes
&& !$force)
208 return $db->escapeString(str_replace(array("\'", '\"'), array("'", '"'), $str));
216 return $db->escapeString($str);
218 return addslashes($str);
222 // ###################################################################
224 * Runs through all of the input data and sanitizes it.
226 private function _sanitizeInputData()
228 $this->in
= $this->_sanitizeDataRecursive(array_merge($_GET, $_POST, $_COOKIE));
231 // ###################################################################
233 * Sanitize function for something other than a string (which
234 * everything is sanitized for if you use _sanitizeInputData(). Cleaned
235 * data is placed back into Input->in; this makes it so you don't have
236 * to constantly intval() [etc.] data.
238 * @param array Array of elements to clean as varname => type
240 public function inputCleanArray($vars)
242 foreach ($vars as $varname => $type)
244 $this->inputClean($varname, $type);
248 // ###################################################################
250 * Sanitize function that does a single variable as oppoesd to an array
251 * (see inputCleanArray() for more details)
253 * @param string Variable name in ISSO->in[]
254 * @param integer Sanitization type constant
256 public function inputClean($varname, $type)
258 if (isset($this->in
["$varname"]))
260 $this->in
["$varname"] = $this->clean($this->in
["$varname"], $type);
264 $this->in
["$varname"] = $this->clean(null
, $type);
267 return $this->in
["$varname"];
270 // ###################################################################
272 * Runs Input->escape() on a variable on Input->in[]. This is just a
273 * short-hand wrapper so that queries can be shortened. When this is used,
274 * the actual value in Input->in[] is not changed, only the return value
277 * @param string Input variable
279 * @return string Escaped input
281 public function inputEscape($varname)
283 if (isset($this->in
["$varname"]))
285 return $this->escape($this->in
["$varname"]);
289 return $this->escape(null
);
293 // ###################################################################
295 * Cleaning function that does the work for inputClean(); this is
296 * moved here so it can be used to clean things that aren't in
300 * @param integer Sanitization type constant
302 * @return mixed Cleaned data
304 public function clean($value, $type)
306 if (is_array($value))
308 return $this->_cleanArray($value, $type);
311 if ($type == TYPE_INT
)
313 $value = intval($value);
315 else if ($type == TYPE_UINT
)
317 $value = (($val = intval($value)) < 0 ?
0 : $val);
319 else if ($type == TYPE_FLOAT
)
321 $value = floatval($value);
323 else if ($type == TYPE_BOOL
)
325 $value = (bool
)$value;
327 else if ($type == TYPE_STR
)
331 else if ($type == TYPE_STRUN
)
333 $value = $this->unsanitize($value);
335 else if ($type == TYPE_NONE
)
337 if ($this->magicquotes
)
339 $value = str_replace(array('\"', "\'"), array('"', "'"), $value);
346 else if ($type == TYPE_BIN
)
352 throw new Exception('Invalid clean type specified in BSInput::clean()');
359 // ###################################################################
361 * Recursion function for Input->clean()
363 * @param array Uncleaned array
364 * @param integer Sanitization type constant
366 * @return array Cleaned array of data
368 private function _cleanArray($array, $type)
370 foreach ($array as $key => $value)
372 $array["$key"] = $this->clean($value, $type);
378 // ###################################################################
380 * Returns the lowercase version of the HTTP method (post or get)
382 * @return string HTTP method
384 public function getHttpMethod()
386 $method = strtolower($_SERVER['REQUEST_METHOD']);
387 if (!in_array($method, array('get', 'post')))
389 throw new Exception('Invalid server request method: ' . $method);
394 // ###################################################################
396 * Checks to see if a POST refer is actually from us
398 public function checkPostReferer()
400 if ($this->getHttpMethod() == 'post')
402 $host = ($_SERVER['HTTP_HOST']) ?
$_SERVER['HTTP_HOST'] : $_ENV['HTTP_HOST'];
404 if ($host && $_SERVER['HTTP_REFERER'])
406 $parts = parse_url($_SERVER['HTTP_REFERER']);
407 $ourhost = $parts['host'] . (isset($parts['port']) ?
":$parts[port]" : '');
409 if ($ourhost != $host)
411 throw new Exception('No external hosts are allowed to POST to this application');
414 BSApp
::debug('remote post check = ok');
418 BSApp
::debug('remote post check = FAILED');