Project continued:

[mailer.git] / inc / libs / security_functions.php

diff --git a/inc/libs/security_functions.php b/inc/libs/security_functions.php
index ae23cbf22f5837e0f082d3f7495db01028b79dcf..2c0ca74bff50a8fc224c7e5f7f0abc2d2328b21b 100644 (file)
--- a/inc/libs/security_functions.php
+++ b/inc/libs/security_functions.php
@@ -16,7 +16,7 @@
  * $Author::                                                          $ *
  * -------------------------------------------------------------------- *
  * Copyright (c) 2003 - 2009 by Roland Haeder                           *
- * Copyright (c) 2009 - 2011 by Mailer Developer Team                   *
+ * Copyright (c) 2009 - 2013 by Mailer Developer Team                   *
  * For more information visit: http://mxchange.org                      *
  *                                                                      *
  * This program is free software; you can redistribute it and/or modify *
@@ -41,13 +41,13 @@ if (defined('__SECURITY')) {
 } // END - if
 
 // Some security stuff...
-if (strpos($_SERVER['PHP_SELF'], basename(__FILE__)) !== false) {
+if (strpos($_SERVER['PHP_SELF'], basename(__FILE__)) !== FALSE) {
        die();
 } // END - if
 
 // Include ctracker, recommended place!
-require_once('ctracker.php');
-require_once('ipfilter.php');
+//require_once('ctracker.php');
+//require_once('ipfilter.php');
 
 /**
  * Function to secure input strings
@@ -56,9 +56,9 @@ require_once('ipfilter.php');
  * @param      $stripTags      Strip tags
  * @return     $str            A (hopefully) secured string against XSS and other bad things
  */
-function secureString ($str, $stripTags = true, $encode = false) {
+function secureString ($str, $stripTags = TRUE, $encode = FALSE) {
        // Shall we strip HTML code?
-       if ($stripTags === true) {
+       if ($stripTags === TRUE) {
                $str = strip_tags($str);
        } // END - if
 
@@ -66,7 +66,7 @@ function secureString ($str, $stripTags = true, $encode = false) {
        $str = trim($str);
 
        // Encode in entities if requested
-       if ($encode === true) {
+       if ($encode === TRUE) {
                // Encode in entities (this breakes UTF-8!)
                $str = htmlentities($str, ENT_QUOTES);
        } // END - if
@@ -98,7 +98,7 @@ function securePhpSelf () {
        $phpSelfFile      = basename($_SERVER['PHP_SELF']);
 
        // Check for a .php inside the $phpSelfDirectory...
-       while (strpos($phpSelfDirectory, '.php') !== false) {
+       while (strpos($phpSelfDirectory, '.php') !== FALSE) {
                // Correct the dirname
                $phpSelfDirectory = substr($phpSelfDirectory, 0, (strpos($phpSelfDirectory, '.php') + 4));
                // Rewrite filename...
@@ -111,7 +111,7 @@ function securePhpSelf () {
        $_SERVER['PHP_SELF'] = $phpSelfDirectory . '/' . $phpSelfFile;
 
        // Did run...
-       $GLOBALS['php_self_secured'] = true;
+       $GLOBALS['php_self_secured'] = TRUE;
 
        // Remove uneccessary variables
        unset($phpSelfDirectory);
@@ -151,8 +151,8 @@ function detectPhpCaching () {
 }
 
 // Runtime/GPC quoting is off now...
-ini_set('magic_quotes_runtime', false);
-ini_set('magic_quotes_gpc', false); // This may not work on some systems
+ini_set('magic_quotes_runtime', FALSE);
+ini_set('magic_quotes_gpc', FALSE); // This may not work on some systems
 
 /*
  * No compatibility with Zend Engine 1, else an error like 'Implicit cloning'
@@ -181,7 +181,7 @@ if (!isset($_POST)) {
 // Generate arrays which holds the relevante chars to replace
 $GLOBALS['security_chars'] = array(
        // The chars we are looking for...
-       'from' => array('/', '.', chr(39), '$', '(', ')', '{--', '--}', '{?', '?}', '%', ';', '[', ']', ':', '--', chr(92)),
+       'from' => array('/', '.', chr(39), '$', '(', ')', '{--', '--}', '{%', '%}', '{?', '?}', '%', ';', '[', ']', ':', '--', chr(92), chr(39), '<', '>'),
        // ... and we will replace to.
        'to'   => array(
                '{SLASH}',
@@ -190,6 +190,8 @@ $GLOBALS['security_chars'] = array(
                '{DOLLAR}',
                '{OPEN_ANCHOR}',
                '{CLOSE_ANCHOR}',
+               '{OPEN_LANGUAGE}',
+               '{CLOSE_LANGUAGE}',
                '{OPEN_TEMPLATE}',
                '{CLOSE_TEMPLATE}',
                '{OPEN_CONFIG}',
@@ -200,12 +202,15 @@ $GLOBALS['security_chars'] = array(
                '{CLOSE_INDEX}',
                '{DBL_DOT}',
                '{COMMENT}',
-               '{BACKSLASH}'
+               '{BACKSLASH}',
+               '{SQUOTE}',
+               '{OPEN_TAG}',
+               '{CLOSE_TAG}'
        ),
 );
 
 /*
- * Characters allowed in URLs
+ * Characters allowed in booked URLs
  *
  * Note: Do not replace 'to' with 'from' and vise-versa! When you do this all booked URLs will be
  *       rejected because of the {SLASH}, {DOT} and all below listed items inside the URL.