123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258 |
- <?php
- class Security {
- public static $clean = array();
-
- public static function check_abs_path ($abs_path,$checker_path) {
- if (empty($checker_path)) {return false;}
- $true_path=str_replace("\\", "/", realpath($abs_path));
- $found = strpos($true_path.'/',$checker_path);
- if ($found===0) {
- return true;
- }
- return false;
- }
-
- public static function check_rel_path ($rel_path,$checker_path) {
- if (empty($checker_path)){return false;}
- $current_path = getcwd();
- if (substr($rel_path,-1,1)!='/') {
- $rel_path = '/'.$rel_path;
- }
- $abs_path = $current_path.$rel_path;
- $true_path=str_replace("\\", "/", realpath($abs_path));
- $found = strpos($true_path.'/',$checker_path);
- if ($found===0) {
- return true;
- }
- return false;
- }
-
- public static function filter_filename ($filename) {
- require_once(api_get_path(LIBRARY_PATH).'fileUpload.lib.php');
- return disable_dangerous_file($filename);
- }
-
- public static function check_token ($array='post') {
- switch ($array) {
- case 'get':
- if (isset($_SESSION['sec_token']) && isset($_GET['sec_token']) && $_SESSION['sec_token'] === $_GET['sec_token']) {
- return true;
- }
- return false;
- case 'post':
- if (isset($_SESSION['sec_token']) && isset($_POST['sec_token']) && $_SESSION['sec_token'] === $_POST['sec_token']) {
- return true;
- }
- return false;
- default:
- if (isset($_SESSION['sec_token']) && isset($array) && $_SESSION['sec_token'] === $array) {
- return true;
- }
- return false;
- }
- return false;
- }
-
- public static function check_ua () {
- if (isset($_SESSION['sec_ua']) and $_SESSION['sec_ua'] === $_SERVER['HTTP_USER_AGENT'].$_SESSION['sec_ua_seed']) {
- return true;
- }
- return false;
- }
-
- public static function clear_token () {
- $_SESSION['sec_token'] = null;
- unset($_SESSION['sec_token']);
- }
-
- public static function get_HTML_token () {
- $token = md5(uniqid(rand(),TRUE));
- $string = '<input type="hidden" name="sec_token" value="'.$token.'"/>';
- $_SESSION['sec_token'] = $token;
- return $string;
- }
-
- public static function get_token () {
- $token = md5(uniqid(rand(),TRUE));
- $_SESSION['sec_token'] = $token;
- return $token;
- }
-
- public static function get_ua () {
- $_SESSION['sec_ua_seed'] = uniqid(rand(),TRUE);
- $_SESSION['sec_ua'] = $_SERVER['HTTP_USER_AGENT'].$_SESSION['sec_ua_seed'];
- }
-
- public static function filter ($var,$type='string',$options=array()) {
-
- $result = false;
-
- $args = func_get_args();
- $names =array_keys($args);
- $name = $names[0];
- $value = $args[$name];
- switch ($type) {
- case 'bool':
- $result = (bool) $var;
- break;
- case 'int':
- $result = (int) $var;
- break;
- case 'float':
- $result = (float) $var;
- break;
- case 'string':
- break;
- case 'array':
-
- return false;
- default:
- return false;
- }
- if (!empty($option['save'])) {
- $this->clean[$name]=$result;
- }
- return $result;
- }
-
- public static function get ($varname) {
- if (isset(self::$clean[$varname])) {
- return self::$clean[$varname];
- }
- return NULL;
- }
-
- public static function remove_XSS ($var,$user_status=ANONYMOUS) {
- global $charset;
- $purifier = new HTMLPurifier(null,$user_status);
- if (is_array($var)) {
- return $purifier->purifyArray($var);
- } else {
- return $purifier->purify($var);
- }
- }
- }
|