Changeset 3627

Timestamp:

03/07/06 01:47:45 (3 years ago)

Author:

ryan

Message:

Security back ports from masquerade and MarkJaquith?.

Files:

• branches/1.5/wp-admin/admin.php (modified) (1 diff)
• branches/1.5/wp-admin/post.php (modified) (6 diffs)
• branches/1.5/wp-admin/profile.php (modified) (1 diff)
• branches/1.5/wp-admin/user-edit.php (modified) (1 diff)
• branches/1.5/wp-comments-post.php (modified) (1 diff)
• branches/1.5/wp-includes/class-snoopy.php (modified) (46 diffs)
• branches/1.5/wp-includes/functions-formatting.php (modified) (1 diff)
• branches/1.5/wp-includes/template-functions-links.php (modified) (1 diff)
• branches/1.5/wp-mail.php (modified) (4 diffs)
• branches/1.5/wp-settings.php (modified) (1 diff)

branches/1.5/wp-admin/admin.php

@@ -56 +56 @@
-        
-        if (! file_exists(ABSPATH . "wp-content/plugins/$plugin_page"))
-$plugin_page
+htmlentities($plugin_page)
-
-        if (! isset($_GET['noheader']))

branches/1.5/wp-admin/post.php

@@ -30 +30 @@
-switch($action) {
-case 'post':
-
+
-    if ( !user_can_create_draft($user_ID) )
-        die( __('You are not allowed to create posts or drafts on this blog.') );
@@ -269 +269 @@
-
-case 'editpost':
+    check_admin_referer();
-    // die(var_dump('<pre>', $_POST));
-    if (!isset($blog_ID)) {
@@ -496 +497 @@
-
-case 'confirmdeletecomment':
-
+
-    require_once('./admin-header.php');
-
@@ -591 +592 @@
-
-case 'mailapprovecomment':
-
+
-    $comment = (int) $_GET['comment'];
-
@@ -611 +612 @@
-
-case 'approvecomment':
-
+
-    $comment = (int) $_GET['comment'];
-    $p = (int) $_GET['p'];
@@ -640 +641 @@
-
-case 'editedcomment':
-
+
-    $comment_ID = (int) $_POST['comment_ID'];
-    $comment_post_ID = (int) $_POST['comment_post_ID'];

branches/1.5/wp-admin/profile.php

@@ -65 +65 @@
-        if ( $pass1 != $pass2 )
-            die (__("<strong>ERROR</strong>: you typed two different passwords. Go back to correct that."));
-pass1
+wpdb->escape($pass1)
-        $updatepassword = "user_pass=MD5('$newuser_pass'), ";
-        wp_clearcookie();
-newuser_pass
+pass1
-    }
-

branches/1.5/wp-admin/user-edit.php

@@ -24 +24 @@
-switch ($action) {
-case 'update':
+
+check_admin_referer();
-
-get_currentuserinfo();

branches/1.5/wp-comments-post.php

@@ -58 +58 @@
-header('Pragma: no-cache');
-
-empty($_POST['redirect_to'])) ? $_SERVER["HTTP_REFERER"]
+ empty( $_POST['redirect_to'] ) ) ? get_permalink( $comment_post_ID )
-
-wp_redirect($location);

branches/1.5/wp-includes/class-snoopy.php

@@ -6 +6 @@
-Author: Monte Ohrt <monte@ispi.net>
-Copyright (c): 1999-2000 ispi, all rights reserved
-
+1
-
- * This library is free software; you can redistribute it and/or
@@ -32 +32 @@
-
-The latest version of Snoopy can be obtained from:
-
+/
-
-*************************************************/
@@ -40 +40 @@
-{
-    /**** Public variables ****/
-
+
-    /* user definable vars */
-
@@ -47 +47 @@
-    var $proxy_host     =   "";                 // proxy host to use
-    var $proxy_port     =   "";                 // proxy port to use
-
+
+
+
+
-    var $referer        =   "";                 // referer info to pass
-    var $cookies        =   array();            // array of cookies to pass
@@ -60 +63 @@
-    var $expandlinks    =   true;               // expand links to fully qualified URLs.
-                                                // this only applies to fetchlinks()
-or submitlinks
+submitlinks(), and submittext
-    var $passcookies    =   true;               // pass set cookies back through redirects
-                                                // NOTE: this currently does not respect
-                                                // dates, domains or paths.
-
+
-    var $user           =   "";                 // user for http authentication
-    var $pass           =   "";                 // password for http authentication
-
+
-    // http accept types
-    var $accept         =   "image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*";
-
+
-    var $results        =   "";                 // where the content is put
-
+
-    var $error          =   "";                 // error messages sent here
-    var $response_code  =   "";                 // response code returned from server
@@ -82 +85 @@
-    var $timed_out      =   false;              // if a read operation timed out
-    var $status         =   0;                  // http request status
-
-
+
+
+
+
+
+
-                                                // Snoopy will use cURL for fetching
-                                                // SSL content if a full system path to
@@ -94 +101 @@
-                                                // as these functions are not stable
-                                                // as of this Snoopy release.
-
-
-
-
-
-
+
+
+
-    var $_maxlinelen    =   4096;               // max line length (headers)
-
+
-    var $_httpmethod    =   "GET";              // default http request method
-    var $_httpversion   =   "HTTP/1.0";         // default http request version
@@ -111 +115 @@
-    var $_frameurls     =   array();            // frame src urls
-    var $_framedepth    =   0;                  // increments on frame depth
-
+
-    var $_isproxy       =   false;              // set if using a proxy server
-    var $_fp_timeout    =   30;                 // timeout for socket connection
@@ -126 +130 @@
-    function fetch($URI)
-    {
-
+
-        //preg_match("|^([^:]+)://([^:/]+)(:[\d]+)*(.*)|",$URI,$URI_PARTS);
-        $URI_PARTS = parse_url($URI);
@@ -133 +137 @@
-        if (!empty($URI_PARTS["pass"]))
-            $this->pass = $URI_PARTS["pass"];
-
-
+
+
+
+
+
+
-        {
-            case "http":
@@ -149 +157 @@
-                    else
-                    {
-isset($URI_PARTS["query"])
+$URI_PARTS["query"]
-                        // no proxy, send only the path
-                        $this->_httprequest($path, $fp, $URI, $this->_httpmethod);
-                    }
-
+
-                    $this->_disconnect($fp);
-
@@ -176 +184 @@
-                        $frameurls = $this->_frameurls;
-                        $this->_frameurls = array();
-
+
-                        while(list(,$frameurl) = each($frameurls))
-                        {
@@ -187 +195 @@
-                                break;
-                        }
-                  
+
-                }
-                else
@@ -193 +201 @@
-                    return false;
-                }
-                   
+
-                break;
-            case "https":
-
-
+
-                    return false;
-
+
+
+
-                $this->host = $URI_PARTS["host"];
-                if(!empty($URI_PARTS["port"]))
@@ -246 +255 @@
-                            break;
-                    }
-                  
-                   
+
+
-                break;
-            default:
@@ -254 +263 @@
-                return false;
-                break;
-      
+
-        return true;
-    }
-
+/*======================================================================*\
+    Function:   submit
+    Purpose:    submit an http form
+    Input:      $URI    the location to post the data
+                $formvars   the formvars to use.
+                    format: $formvars["var"] = "val";
+                $formfiles  an array of files to submit
+                    format: $formfiles["var"] = "/dir/filename.ext";
+    Output:     $this->results  the text output from the post
+\*======================================================================*/
+
+    function submit($URI, $formvars="", $formfiles="")
+    {
+        unset($postdata);
+
+        $postdata = $this->_prepare_post_body($formvars, $formfiles);
+
+        $URI_PARTS = parse_url($URI);
+        if (!empty($URI_PARTS["user"]))
+            $this->user = $URI_PARTS["user"];
+        if (!empty($URI_PARTS["pass"]))
+            $this->pass = $URI_PARTS["pass"];
+        if (empty($URI_PARTS["query"]))
+            $URI_PARTS["query"] = '';
+        if (empty($URI_PARTS["path"]))
+            $URI_PARTS["path"] = '';
+
+        switch(strtolower($URI_PARTS["scheme"]))
+        {
+            case "http":
+                $this->host = $URI_PARTS["host"];
+                if(!empty($URI_PARTS["port"]))
+                    $this->port = $URI_PARTS["port"];
+                if($this->_connect($fp))
+                {
+                    if($this->_isproxy)
+                    {
+                        // using proxy, send entire URI
+                        $this->_httprequest($URI,$fp,$URI,$this->_submit_method,$this->_submit_type,$postdata);
+                    }
+                    else
+                    {
+                        $path = $URI_PARTS["path"].($URI_PARTS["query"] ? "?".$URI_PARTS["query"] : "");
+                        // no proxy, send only the path
+                        $this->_httprequest($path, $fp, $URI, $this->_submit_method, $this->_submit_type, $postdata);
+                    }
+
+                    $this->_disconnect($fp);
+
+                    if($this->_redirectaddr)
+                    {
+                        /* url was redirected, check if we've hit the max depth */
+                        if($this->maxredirs > $this->_redirectdepth)
+                        {
+                            if(!preg_match("|^".$URI_PARTS["scheme"]."://|", $this->_redirectaddr))
+                                $this->_redirectaddr = $this->_expandlinks($this->_redirectaddr,$URI_PARTS["scheme"]."://".$URI_PARTS["host"]);
+
+                            // only follow redirect if it's on this site, or offsiteok is true
+                            if(preg_match("|^http://".preg_quote($this->host)."|i",$this->_redirectaddr) || $this->offsiteok)
+                            {
+                                /* follow the redirect */
+                                $this->_redirectdepth++;
+                                $this->lastredirectaddr=$this->_redirectaddr;
+                                if( strpos( $this->_redirectaddr, "?" ) > 0 )
+                                    $this->fetch($this->_redirectaddr); // the redirect has changed the request method from post to get
+                                else
+                                    $this->submit($this->_redirectaddr,$formvars, $formfiles);
+                            }
+                        }
+                    }
+
+                    if($this->_framedepth < $this->maxframes && count($this->_frameurls) > 0)
+                    {
+                        $frameurls = $this->_frameurls;
+                        $this->_frameurls = array();
+
+                        while(list(,$frameurl) = each($frameurls))
+                        {
+                            if($this->_framedepth < $this->maxframes)
+                            {
+                                $this->fetch($frameurl);
+                                $this->_framedepth++;
+                            }
+                            else
+                                break;
+                        }
+                    }
+
+                }
+                else
+                {
+                    return false;
+                }
+                return true;
+                break;
+            case "https":
+                if(!$this->curl_path)
+                    return false;
+                if(function_exists("is_executable"))
+                    if (!is_executable($this->curl_path))
+                        return false;
+                $this->host = $URI_PARTS["host"];
+                if(!empty($URI_PARTS["port"]))
+                    $this->port = $URI_PARTS["port"];
+                if($this->_isproxy)
+                {
+                    // using proxy, send entire URI
+                    $this->_httpsrequest($URI, $URI, $this->_submit_method, $this->_submit_type, $postdata);
+                }
+                else
+                {
+                    $path = $URI_PARTS["path"].($URI_PARTS["query"] ? "?".$URI_PARTS["query"] : "");
+                    // no proxy, send only the path
+                    $this->_httpsrequest($path, $URI, $this->_submit_method, $this->_submit_type, $postdata);
+                }
+
+                if($this->_redirectaddr)
+                {
+                    /* url was redirected, check if we've hit the max depth */
+                    if($this->maxredirs > $this->_redirectdepth)
+                    {
+                        if(!preg_match("|^".$URI_PARTS["scheme"]."://|", $this->_redirectaddr))
+                            $this->_redirectaddr = $this->_expandlinks($this->_redirectaddr,$URI_PARTS["scheme"]."://".$URI_PARTS["host"]);
+
+                        // only follow redirect if it's on this site, or offsiteok is true
+                        if(preg_match("|^http://".preg_quote($this->host)."|i",$this->_redirectaddr) || $this->offsiteok)
+                        {
+                            /* follow the redirect */
+                            $this->_redirectdepth++;
+                            $this->lastredirectaddr=$this->_redirectaddr;
+                            if( strpos( $this->_redirectaddr, "?" ) > 0 )
+                                $this->fetch($this->_redirectaddr); // the redirect has changed the request method from post to get
+                            else
+                                $this->submit($this->_redirectaddr,$formvars, $formfiles);
+                        }
+                    }
+                }
+
+                if($this->_framedepth < $this->maxframes && count($this->_frameurls) > 0)
+                {
+                    $frameurls = $this->_frameurls;
+                    $this->_frameurls = array();
+
+                    while(list(,$frameurl) = each($frameurls))
+                    {
+                        if($this->_framedepth < $this->maxframes)
+                        {
+                            $this->fetch($frameurl);
+                            $this->_framedepth++;
+                        }
+                        else
+                            break;
+                    }
+                }
+                return true;
+                break;
+
+            default:
+                // not a valid protocol
+                $this->error    =   'Invalid protocol "'.$URI_PARTS["scheme"].'"\n';
+                return false;
+                break;
+        }
+        return true;
+    }
+
+/*======================================================================*\
+    Function:   fetchlinks
+    Purpose:    fetch the links from a web page
+    Input:      $URI    where you are fetching from
+    Output:     $this->results  an array of the URLs
+\*======================================================================*/
+
+    function fetchlinks($URI)
+    {
+        if ($this->fetch($URI))
+        {
+            if($this->lastredirectaddr)
+                $URI = $this->lastredirectaddr;
+            if(is_array($this->results))
+            {
+                for($x=0;$x<count($this->results);$x++)
+                    $this->results[$x] = $this->_striplinks($this->results[$x]);
+            }
+            else
+                $this->results = $this->_striplinks($this->results);
+
+            if($this->expandlinks)
+                $this->results = $this->_expandlinks($this->results, $URI);
+            return true;
+        }
+        else
+            return false;
+    }
+
+/*======================================================================*\
+    Function:   fetchform
+    Purpose:    fetch the form elements from a web page
+    Input:      $URI    where you are fetching from
+    Output:     $this->results  the resulting html form
+\*======================================================================*/
+
+    function fetchform($URI)
+    {
+
+        if ($this->fetch($URI))
+        {
+
+            if(is_array($this->results))
+            {
+                for($x=0;$x<count($this->results);$x++)
+                    $this->results[$x] = $this->_stripform($this->results[$x]);
+            }
+            else
+                $this->results = $this->_stripform($this->results);
+
+            return true;
+        }
+        else
+            return false;
+    }
+
+
+/*======================================================================*\
+    Function:   fetchtext
+    Purpose:    fetch the text from a web page, stripping the links
+    Input:      $URI    where you are fetching from
+    Output:     $this->results  the text from the web page
+\*======================================================================*/
+
+    function fetchtext($URI)
+    {
+        if($this->fetch($URI))
+        {
+            if(is_array($this->results))
+            {
+                for($x=0;$x<count($this->results);$x++)
+                    $this->results[$x] = $this->_striptext($this->results[$x]);
+            }
+            else
+                $this->results = $this->_striptext($this->results);
+            return true;
+        }
+        else
+            return false;
+    }
+
+/*======================================================================*\
+    Function:   submitlinks
+    Purpose:    grab links from a form submission
+    Input:      $URI    where you are submitting from
+    Output:     $this->results  an array of the links from the post
+\*======================================================================*/
+
+    function submitlinks($URI, $formvars="", $formfiles="")
+    {
+        if($this->submit($URI,$formvars, $formfiles))
+        {
+            if($this->lastredirectaddr)
+                $URI = $this->lastredirectaddr;
+            if(is_array($this->results))
+            {
+                for($x=0;$x<count($this->results);$x++)
+                {
+                    $this->results[$x] = $this->_striplinks($this->results[$x]);
+                    if($this->expandlinks)
+                        $this->results[$x] = $this->_expandlinks($this->results[$x],$URI);
+                }
+            }
+            else
+            {
+                $this->results = $this->_striplinks($this->results);
+                if($this->expandlinks)
+                    $this->results = $this->_expandlinks($this->results,$URI);
+            }
+            return true;
+        }
+        else
+            return false;
+    }
+
+/*======================================================================*\
+    Function:   submittext
+    Purpose:    grab text from a form submission
+    Input:      $URI    where you are submitting from
+    Output:     $this->results  the text from the web page
+\*======================================================================*/
+
+    function submittext($URI, $formvars = "", $formfiles = "")
+    {
+        if($this->submit($URI,$formvars, $formfiles))
+        {
+            if($this->lastredirectaddr)
+                $URI = $this->lastredirectaddr;
+            if(is_array($this->results))
+            {
+                for($x=0;$x<count($this->results);$x++)
+                {
+                    $this->results[$x] = $this->_striptext($this->results[$x]);
+                    if($this->expandlinks)
+                        $this->results[$x] = $this->_expandlinks($this->results[$x],$URI);
+                }
+            }
+            else
+            {
+                $this->results = $this->_striptext($this->results);
+                if($this->expandlinks)
+                    $this->results = $this->_expandlinks($this->results,$URI);
+            }
+            return true;
+        }
+        else
+            return false;
+    }
+
+
+
+/*======================================================================*\
+    Function:   set_submit_multipart
+    Purpose:    Set the form submission content type to
+                multipart/form-data
+\*======================================================================*/
+    function set_submit_multipart()
+    {
+        $this->_submit_type = "multipart/form-data";
+    }
+
+
+/*======================================================================*\
+    Function:   set_submit_normal
+    Purpose:    Set the form submission content type to
+                application/x-www-form-urlencoded
+\*======================================================================*/
+    function set_submit_normal()
+    {
+        $this->_submit_type = "application/x-www-form-urlencoded";
+    }
+
+
-
-
@@ -263 +611 @@
-    Private functions
-\*======================================================================*/
-
-
+
+
-/*======================================================================*\
-    Function:   _striplinks
@@ -273 +621 @@
-
-    function _striplinks($document)
-  
-+.*
+
+.*?
-                        ([\"\'])?                   # find single or double quote
-                        (?(1) (.*?)\\1 | ([^\s\>]+))        # if quote found, match up to next matching
-                                                    # quote, otherwise match up to next space
-                        'isx",$document,$links);
-
+
-
-        // catenate the non-empty matches from the conditional subpattern
@@ -287 +635 @@
-            if(!empty($val))
-                $match[] = $val;
-              
-
+
+
-        while(list($key,$val) = each($links[3]))
-        {
-            if(!empty($val))
-                $match[] = $val;
-      
-
+
+
-        // return the links
-        return $match;
@@ -307 +655 @@
-
-    function _stripform($document)
-  
+
-        preg_match_all("'<\/?(FORM|INPUT|SELECT|TEXTAREA|(OPTION))[^<>]*>(?(2)(.*(?=<\/?(option|select)[^<>]*>[\r\n]*)|(?=[\r\n]*))|(?=[\r\n]*))'Usi",$document,$elements);
-
+
-        // catenate the matches
-        $match = implode("\r\n",$elements[0]);
-
+
-        // return the links
-        return $match;
-    }
-
-
-
+
+
-/*======================================================================*\
-    Function:   _striptext
@@ -328 +676 @@
-    function _striptext($document)
-    {
-
+
-        // I didn't use preg eval (//e) since that is only available in PHP 4.0.
-        // so, list your entities one by one here. I included some of the
-        // more common ones.
-
+
-        $search = array("'<script[^>]*?>.*?</script>'si",   // strip out javascript
-                        "'<[\/\!]*?[^<>]*?>'si",            // strip out html tags
-                        "'([\r\n])[\s]+'",                  // strip out white space
-e|#34);'i",            
-);'i",
-
-
-
+|#34|#034|#x22);'i",
+|#038|#x26);'i",            // added hexadecimal values
+|#060|#x3c
+|#062|#x3e
+|#xa0
-                        "'&(iexcl|#161);'i",
-                        "'&(cent|#162);'i",
-                        "'&(pound|#163);'i",
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
-        $replace = array(   "",
-                            "",
@@ -357 +716 @@
-                            chr(162),
-                            chr(163),
-
-
+
+
+
+
+
+
+
+
+
+
+
+
-        $text = preg_replace($search,$replace,$document);
-
+
-        return $text;
-    }
@@ -374 +743 @@
-    function _expandlinks($links,$URI)
-    {
-
+
-        preg_match("/^[^\?]+/",$URI,$match);
-
-        $match = preg_replace("|/[^\/\.]+\.[^\/\.]+$|","",$match[0]);
-
+
+
+
+
+
-        $search = array(    "|^http://".preg_quote($this->host)."|i",
-
+
+
-                            "|/\./|",
-                            "|/[^\/]+/\.\./|"
-                        );
-
+
-        $replace = array(   "",
+                            $match_root."/",
-                            $match."/",
-                            "/",
-                            "/"
-         
-
+
+
-        $expandedLinks = preg_replace($search,$replace,$links);
-
@@ -403 +778 @@
-                $URI        the full URI
-                $body       body contents to send if any (POST)
-        
-
-
+
+
+
-    function _httprequest($url,$fp,$URI,$http_method,$content_type="",$body="")
-    {
+        $cookie_headers = '';
-        if($this->passcookies && $this->_redirectaddr)
-            $this->setcookies();
-
+
-        $URI_PARTS = parse_url($URI);
-        if(empty($url))
-            $url = "/";
-       
+
-        if(!empty($this->agent))
-            $headers .= "User-Agent: ".$this->agent."\r\n";
-
-
+
+
+
+
+
+
-        if(!empty($this->accept))
-            $headers .= "Accept: ".$this->accept."\r\n";
-        
-        if($this->use_gzip) {
-            // make sure PHP was built with --with-zlib
-            // and we can handle gzipp'ed data
-            if ( function_exists(gzinflate) ) {
-               $headers .= "Accept-encoding: gzip\r\n";
-            }
-            else {
-               trigger_error(
-                "use_gzip is on, but PHP was built without zlib support.".
-                "  Requesting file(s) without gzip encoding.", 
-                E_USER_NOTICE);
-            }
-        }
-        
-        if(!empty($this->referer))
-            $headers .= "Referer: ".$this->referer."\r\n";
-        if(!empty($this->cookies))
-          
+
-            if(!is_array($this->cookies))
-                $this->cookies = (array)$this->cookies;
-
+
-            reset($this->cookies);
-            if ( count($this->cookies) > 0 ) {
@@ -465 +830 @@
-            $headers .= "\r\n";
-        }
-  
+
-            $headers .= "Content-length: ".strlen($body)."\r\n";
-
-
+
+
+
+
+
+