Changeset 805 for trunk/Modules


Ignore:
Timestamp:
May 24, 2014, 11:35:47 PM (11 years ago)
Author:
chronos
Message:
  • Fixed: Do not log client proxy IP address as remote address because it can be faked and also there can be multiple client proxy addresses.
  • Modified: Do not use directly $_SERVER variables REMOTE_ADDR and REQUEST_URI as they are not initialized if script is executed from command line.
  • Fixed: Default configuration was not complete.
Location:
trunk/Modules
Files:
9 edited

Legend:

Unmodified
Added
Removed

  • trunk/Modules/Export/ProcessAoWoWExport.php

    r737 r805  
    22
    33ini_set('memory_limit', '100M');
    4 
    5 $_SERVER['REMOTE_ADDR'] = '127.0.0.1';
    6 $_SERVER['REQUEST_URI'] = __FILE__;
    74
    85include_once('../../includes/global.php');
    … …  
    1411  $System->DoNotShowPage = true;
    1512        $System->Run();
    16 
    17 $_SERVER['REQUEST_URI'] = __FILE__;
    1813
    1914$Output = '';

  • trunk/Modules/Export/ProcessTask.php

    r776 r805  
    22
    33ini_set('memory_limit', '100M');
    4 
    5 $_SERVER['REMOTE_ADDR'] = '127.0.0.1';
    6 $_SERVER['REQUEST_URI'] = __FILE__;
    74
    85include_once(dirname(__FILE__).'/../../includes/global.php');

  • trunk/Modules/Export/cmdmpqexport.php

    r741 r805  
    22
    33ini_set('memory_limit', '100M');
    4 
    5 $_SERVER['REMOTE_ADDR'] = '127.0.0.1';
    6 $_SERVER['REQUEST_URI'] = __FILE__;
    74
    85include_once(dirname(__FILE__).'/../../includes/global.php');

  • trunk/Modules/Forum/Forum.php

    r792 r805  
    261261                $this->System->Database->query('INSERT INTO `'.$Table.'` ( `User`, `UserName` , `Text` , `Date` , `IP` , `Thread` ) '.
    262262                                                                ' VALUES ('.$this->System->User->Id.', "'.$this->System->User->Name.
    263                                                                 '", "'.$Text.'", NOW(), "'.$_SERVER['REMOTE_ADDR'].'","'.$_GET['Thread'].'")');
     263                                                                '", "'.$Text.'", NOW(), "'.GetRemoteAddress().'","'.$_GET['Thread'].'")');
    264264              } else $Output .= ShowMessage(T('Item not found'), MESSAGE_CRITICAL);
    265265             } else
    266266            $this->System->Database->query('INSERT INTO `'.$Table.'` ( `User`, `UserName` , `Text` , `Date` , `IP`) '.
    267267                                                                ' VALUES ('.$this->System->User->Id.', "'.$this->System->User->Name.
    268                                                                 '", "'.$Text.'", NOW(), "'.$_SERVER['REMOTE_ADDR'].'")');
     268                                                                '", "'.$Text.'", NOW(), "'.GetRemoteAddress().'")');
    269269                                                $Output .= ShowMessage(T('Added.'));
    270270                                        }

  • trunk/Modules/Import/cmd.php

    r727 r805  
    11<?php
    2 
    3 $_SERVER['REMOTE_ADDR'] = '127.0.0.1';
    4 $_SERVER['REQUEST_URI'] = __FILE__;
    5 
    62
    73include_once('../../includes/global.php');
    … …  
    139        $System->Run();
    1410$Import = new Import($System);
    15 $_SERVER['REQUEST_URI'] = __FILE__;
    1611
    1712$Output = '';

  • trunk/Modules/Log/Log.php

    r765 r805  
    3333  function WriteLog($Text, $Type)
    3434  {
    35         if(!isset($_SERVER['REMOTE_ADDR'])) $IP = 'Konzole';
    36           else $IP = addslashes($_SERVER['REMOTE_ADDR']);
    37        
    38         if(isset($this->System->User) and !is_null($this->System->User->Id)) $UserId = $this->System->User->Id;
     35        if(isset($this->System->User) and !is_null($this->System->User->Id))
     36          $UserId = $this->System->User->Id;
    3937          else $UserId = 'NULL';
    4038        $Query = 'INSERT INTO `Log` ( `User` , `Type` , `Text` , `Date` , `IP`, `URL` ) '.
    41                 'VALUES ('.$UserId.', '.$Type.', "'.addslashes($Text).'", NOW(), "'.$IP.'", "'.$_SERVER['REQUEST_URI'].'")';
     39          'VALUES ('.$UserId.', '.$Type.', "'.addslashes($Text).'", NOW(), "'.
     40          GetRemoteAddress().'", "'.GetRequestURI().'")';
    4241        $this->System->Database->query($Query);
    4342  }
    … …  
    6059{
    6160        global $System, $User;
    62 
    63         if(!isset($_SERVER['REMOTE_ADDR'])) $IP = 'Konzole';
    64           else $IP = addslashes($_SERVER['REMOTE_ADDR']);
    65 
     61       
    6662        if(isset($User) and !is_null($User->Id)) $UserId = $User->Id;
    6763          else $UserId = 'NULL';
    6864        $Query = 'INSERT INTO `Log` ( `User` , `Type` , `Text` , `Date` , `IP`, `URL` ) '.
    69           'VALUES ('.$UserId.', '.$Type.', "'.addslashes($Text).'", NOW(), "'.$IP.'", "'.$_SERVER['REQUEST_URI'].'")';
     65          'VALUES ('.$UserId.', '.$Type.', "'.addslashes($Text).'", NOW(), "'.
     66      GetRemoteAddress().'", "'.GetRequestURI().'")';
    7067        $System->Database->query($Query);
    7168}

  • trunk/Modules/Referrer/Referrer.php

    r804 r805  
    4040      if(!in_array($HostName, $this->Excludes))
    4141      {
    42         if(!isset($_SERVER['REMOTE_ADDR'])) $IP = 'Konzole';
    43           else $IP = addslashes($_SERVER['REMOTE_ADDR']);
    44 
     42        $IP = GetRemoteAddress();
     43       
    4544        // Check if client IP is not blocked as spam source
    4645        $DbResult = $this->System->Database->query('SELECT COUNT(*) FROM `Referrer` WHERE `LastIP` = "'.$IP.'" AND (`Visible` = 0)');

  • trunk/Modules/ShoutBox/ShoutBox.php

    r765 r805  
    125125                                                $this->System->Database->query('INSERT INTO `ShoutBox` ( `User`, `UserName` , `Text` , `Date` , `IP` ) '.
    126126                                                                ' VALUES ('.$this->System->User->Id.', "'.$this->System->User->Name.
    127                                                                 '", "'.$Text.'", NOW(), "'.$_SERVER['REMOTE_ADDR'].'")');
     127                                                                '", "'.$Text.'", NOW(), "'.GetRemoteAddress().'")');
    128128                                                $Output .= ShowMessage('Zpráva vložena.');
    129129                                        }

  • trunk/Modules/User/User.php

    r801 r805  
    137137      $this->Database->query('UPDATE `UserTrace` SET '.
    138138        '`LastLogin` = NOW(), '.
    139         '`LastIP` = "'.$_SERVER['REMOTE_ADDR'].'", '.
     139        '`LastIP` = "'.GetRemoteAddress().'", '.
    140140        '`UserAgent` = "'.$this->System->Database->real_escape_string($_SERVER['HTTP_USER_AGENT']).'" '.
    141141        ' WHERE `User` = '.$this->Id);
    … …  
    194194  function Licence($Licence)
    195195  {
    196     if(!isset($_SERVER['REMOTE_ADDR'])) return(true); // Execution from command line
    197     else return($this->Role >= $Licence);
     196    if(GetRemoteAddress() == '') return(true); // Execution from command line
     197      else return($this->Role >= $Licence);
    198198  }
    199199
    … …  
    229229      // Refresh time of last access
    230230      $this->Database->update('UserOnline', 'SessionId="'.$SID.'"', array('ActivityTime' => 'NOW()'));
    231     } else $this->Database->insert('UserOnline', array('SessionId' => $SID,
     231    } else {
     232        if(GetRemoteAddress() != '') $HostName = gethostbyaddr(GetRemoteAddress());
     233          else $HostName = '';
     234        $this->Database->insert('UserOnline', array('SessionId' => $SID,
    232235      'User' => null, 'LoginTime' => 'NOW()', 'ActivityTime' => 'NOW()',
    233       'IpAddress' => GetRemoteAddress(), 'HostName' => gethostbyaddr(GetRemoteAddress()),
    234       'ScriptName' => $_SERVER['REQUEST_URI']));
    235 
     236      'IpAddress' => GetRemoteAddress(), 'HostName' => $HostName,
     237      'ScriptName' => GetRequestURI()));
     238    }
     239       
    236240    // Logged permanently?
    237241          if(array_key_exists('LoginHash', $_COOKIE))
    … …  
    281285    $UserId = $this->Database->insert_id;
    282286    $this->Database->query('INSERT INTO `UserTrace` (`User`, `LastIP`, `UserAgent`) '.
    283         'VALUES ('.$UserId.', "'.$_SERVER['REMOTE_ADDR'].'", '.
     287        'VALUES ('.$UserId.', "'.GetRemoteAddress().'", '.
    284288        '"'.$this->Database->real_escape_string($_SERVER['HTTP_USER_AGENT']).'")');
    285289  }
Note: See TracChangeset for help on using the changeset viewer.