Файл: inc/guard.php
Строк: 27
<?php
/* Предостережение */
ini_set ('register_globals', 0);
if (!$user || $user['group_access'] < 15)
{
ini_set ('display_errors', 0);
}
/* Фильтрация GET и POST входящих данных */
$serverReqs = get_defined_vars();
if (!preg_match ('/adm_panel/mysql.php/i', $_SERVER['PHP_SELF']))
{
foreach ($serverReqs['_POST'] as $key=>$val)
{
if (is_array ($_POST[$key]))
{
foreach ($_POST[$key] as $key=>$val)
{
$_POST[$key] = stripslashes (trim ($_POST[$key]));
if ($guardSets['guard']['post_filter'] == 'html_chars')
$_POST[$key] = htmlspecialchars ($_POST[$key], null, 'UTF-8');
elseif ($guardSets['guard']['post_filter'] == 'strip_tags' OR empty ($guardSets['guard']['post_filter']))
$_POST[$key] = strip_tags ($_POST[$key]);
}
}
}
}
foreach ($serverReqs['_GET'] as $key=>$val)
{
if (!is_array ($_GET[$key]))
$_GET[$key] = mysql_real_escape_string (strip_tags ($_GET[$key]));
}
foreach ($serverReqs['_SERVER'] as $key=>$val)
{
if (!is_array ($_SERVER[$key]))
$_SERVER[$key] = mysql_real_escape_string (strip_tags ($_SERVER[$key]));
}
foreach ($serverReqs['_COOKIE'] as $key=>$val)
{
if (!is_array ($_COOKIE[$key]))
$_COOKIE[$key] = mysql_real_escape_string (strip_tags ($_COOKIE[$key]));
}
/* Проверка принятного URL */
if ((preg_match ('/['"$@^<>]/', $_SERVER['QUERY_STRING']) && preg_match ('/(/obmen/)|(/loads/)/i', $_SERVER['PHP_SELF'])) || preg_match ('/['"$@+^<>]/', $_SERVER['QUERY_STRING']))
{
$guard->dossier ('guard', 'url');
$guard->notific ('guard', 'url');
$guard->punish ('guard', 'url');
}
/* Проверка расширений принятых файлов */
foreach ($serverReqs['_FILES'] as $key=>$val)
{
if (preg_match ('/^.|.php|.name$|.opis$|.html?$|.sql$|.ini$|.db$|.dat$|.xml$|.xhtml$|.wml$/i', $_FILES[$key]['name']))
{
$guard->dossier ('guard', 'file');
$guard->notific ('guard', 'file');
$guard->punish ('guard', 'file');
}
}
/* Проверка вторжения в админ-панель */
if (!user_access ('adm_panel_show') && preg_match ('/adm_panel/i', $_SERVER['PHP_SELF']))
{
$guard->dossier ('guard', 'admin_panel');
$guard->notific ('guard', 'admin_panel');
$guard->punish ('guard', 'admin_panel');
}
?>