[geeklog-devel] code scrubbing: stripslashes

[Vincent Furia]

Joe,

Just out of curiosity, have you done any timing comparisons to see if
this has an impact on performance (either for good or ill)?

-Vinny

On 9/15/07, Joe Mucchiello <joe at throwingdice.com> wrote:
> At 04:44 AM 8/13/2007, Michael Jervis wrote:
> >I think the /concept/ is right, doing an auto-and-correct stripslashes
> >on all HTTP globals on start of the page. Obviously as noted the
> >implementation is incorrect.
> >
> >Should be reasonably easy to clean up everything.
>
> Okay, here's what I've come up with and I did test it on my hosted
> website under GL1.4.1 with magic quotes on under
> Linux/Apache/MySQL/PHP4. I tested it with the polls plugin mostly as
> I knew that used arrays in POSTed forms.
>
> I placed this rcode ight after the 'have_pear" code in
> lib-common.php. Alternatively, it could be placed right after the timer start.
>
> if (get_magic_quotes_gpc() == 1) {
>      if (!function_exists('array_walk_recursive')) {
>          require_once 'PHP/Compat.php';
>          PHP_Compat::loadFunction('array_walk_recursive');
>      }
>      $_STRIP_SLASHES = create_function('&$v,$k', '$v = stripslashes($v);');
>      array_walk_recursive($_POST, $_STRIP_SLASHES);
>      array_walk_recursive($_GET, $_STRIP_SLASHES);
>      array_walk_recursive($_REQUEST, $_STRIP_SLASHES);
>      array_walk_recursive($_COOKIE, $_STRIP_SLASHES);
>      unset($_STRIP_SLASHES);
> }
>
> And of course you must do this:
>
> function COM_stripslashes($text)
> {
>      return $text;
> }
>
> And if you like, update COM_applyFilter() and COM_checkHTML() too so
> that at least lib-common is fixed.
>
> >Only problem is if someone badly upgrades their lib-common.php when
> >upgrading, they may have a gaping hole in their security...
>
> If this is a real concern, rather than unsetting the $_STRIP_SLASHES
> variable at the end of the if, check for it in lib-security or lib-session:
>
> if (get_magic_quotes_gpc() == 1 AND !isset($_STRIP_SLASHES)) {
>      die('You lib-common.php is not up to date.');
> }
>
> ----
> Joe Mucchiello
> Throwing Dice Games
> http://www.throwingdice.com
>
> _______________________________________________
> geeklog-devel mailing list
> geeklog-devel at lists.geeklog.net
> http://eight.pairlist.net/mailman/listinfo/geeklog-devel
>