Reverted of changes in 1704, see ticket #160

[mailer.git] / inc / libs / security_functions.php

diff --git a/inc/libs/security_functions.php b/inc/libs/security_functions.php
index 3922624fb74e17b664c87d5b6a37a311a4f80a0a..1d1327364d43522cddf478e239486ae2d90e156d 100644 (file)
--- a/inc/libs/security_functions.php
+++ b/inc/libs/security_functions.php
@@ -1,7 +1,7 @@
 <?php
 /************************************************************************
- * MXChange v0.2.1                                    Start: 09/20/2005 *
- * ===============                              Last change: 09/20/2005 *
+ * Mailer v0.2.1-FINAL                                Start: 09/20/2005 *
+ * ===================                          Last change: 09/20/2005 *
  *                                                                      *
  * -------------------------------------------------------------------- *
  * File              : security_functions.php                           *
@@ -18,6 +18,7 @@
  * svn:keywords Date Revision" (autoprobset!) at least!!!!!!            *
  * -------------------------------------------------------------------- *
  * Copyright (c) 2003 - 2009 by Roland Haeder                           *
+ * Copyright (c) 2009, 2010 by Mailer Developer Team                    *
  * For more information visit: http://www.mxchange.org                  *
  *                                                                      *
  * This program is free software; you can redistribute it and/or modify *
@@ -51,15 +52,20 @@ if (ereg(basename(__FILE__), $_SERVER['PHP_SELF'])) {
  * @param      $strip  Strip tags
  * @return     $str    A (hopefully) secured string against XSS and other bad things
  */
-function secureString ($str, $strip=true) {
+function secureString ($str, $strip = true, $encode = false) {
        // Shall we strip HTML code?
        if ($strip === true) $str = strip_tags($str);
 
        // Trim string
        $str = trim($str);
 
-       // Encode in entities
-       $str = htmlentities($str, ENT_QUOTES);
+       // Encode in entities if requested
+       if ($encode === true) {
+               // Encode in entities (this breakes UTF-8!)
+               $str = htmlentities($str, ENT_QUOTES);
+       } // END - if
+
+       // Return result
        return $str;
 }
 
@@ -71,25 +77,25 @@ ini_set('magic_quotes_gpc', false); // This may not work on some systems
 if (!isset($_SERVER)) {
        global $_SERVER;
        $_SERVER = $GLOBALS['_SERVER'];
-}
+} // END - if
 
 if (!isset($_GET)) {
        global $_GET;
        $_GET = $GLOBALS['_GET'];
-}
+} // END - if
 
 if (!isset($_POST)) {
        global $_POST;
        $_POST = $GLOBALS['_POST'];
-}
+} // END - if
 
 // Include IP-Filter here
-//require("/usr/share/php/ipfilter.php");
+//include("/usr/share/php/ipfilter.php");
 
 // Generate arrays which holds the relevante chars to replace
 $GLOBALS['security_chars'] = array(
        // The chars we are looking for...
-       'from' => array('{', '}', '/', '.', "'", "$", '(', ')', '{--', '--}', '{?', '?}', '%', ';', '[', ']', ':', '--'),
+       'from' => array('{', '}', '/', '.', "'", '$', '(', ')', '{--', '--}', '{?', '?}', '%', ';', '[', ']', ':', '--'),
        // ... and we will replace to.
        'to'   => array(
                '{OPEN_ANCHOR2}',
@@ -162,28 +168,28 @@ if (phpversion() >= '4.0.4pl1' && (strstr(getenv('HTTP_USER_AGENT'),'compatible'
 $_SERVER['PHP_SELF'] = secureString($_SERVER['PHP_SELF']);
 
 // Split it up into path and filename
-$SELF_DIR  = dirname($_SERVER['PHP_SELF']);
-$SELF_FILE = basename($_SERVER['PHP_SELF']);
+$phpSelfDirectory = dirname($_SERVER['PHP_SELF']);
+$phpSelfFile      = basename($_SERVER['PHP_SELF']);
 
-// Check for a .php inside the $SELF_DIR...
-while (ereg('.php', $SELF_DIR)) {
+// Check for a .php inside the $phpSelfDirectory...
+while (ereg('.php', $phpSelfDirectory)) {
        // Correct the dirname
-       $SELF_DIR = substr($SELF_DIR, 0, (strpos($SELF_DIR, '.php') + 4));
+       $phpSelfDirectory = substr($phpSelfDirectory, 0, (strpos($phpSelfDirectory, '.php') + 4));
        // Rewrite filename...
-       $SELF_FILE = basename($SELF_DIR);
+       $phpSelfFile = basename($phpSelfDirectory);
        // ... and dirname
-       $SELF_DIR = dirname($SELF_DIR);
+       $phpSelfDirectory = dirname($phpSelfDirectory);
 } // END - while
 
 // Put both together again and let's pray it is secured now...
-$_SERVER['PHP_SELF'] = $SELF_DIR . '/' . $SELF_FILE;
+$_SERVER['PHP_SELF'] = $phpSelfDirectory . '/' . $phpSelfFile;
 
 // Remove uneccessary variables
-unset($SELF_DIR);
-unset($SELF_FILE);
+unset($phpSelfDirectory);
+unset($phpSelfFile);
 
 // Security system loaded...
-define('__SECURITY', '1');
+define('__SECURITY', 1);
 
 // [EOF]
 ?>