3
at first, let me wish you a happy new year 2007.
Second:
IMPORTANT: Security fix for possible vulnerability
Through these days I've tested the snippet again, and found a vulnerability through unmasked userinput if it comes to semicolons in the name, e-mail or homepage field. If somebody knows, that the guestbook uses phps explode function with the semicolon as field delimiter, he can possibly "shift" the output by adding a specific count of semicolons to the input data. No further details here, but I strongly advice all users to make the following modification of the snippet.
The fix
The fix contains of a simple string replacement of semicolons with commas (who needs semicolons in a guest book?). I've implemented the fix like that, to make it as easy as possible and not to destroy other modifications of the script made by the users.
Replace lines 139-144 (Line numbers referring to the version out of the snippet library!)
$entryName = strip_tags($fields['name']); $entryEmail = strip_tags($fields['email']); $entryWeburl = strip_tags($fields['weburl']); $entryMessage = strip_tags($fields['message']); $entryMessage = nl2br($fields['message']); $userIP = $_SERVER['REMOTE_ADDR'];with this ones
$entryName = str_replace(';', ',', strip_tags($fields['name']));
$entryEmail = str_replace(';', ',', strip_tags($fields['email']));
$entryWeburl = str_replace(';', ',', strip_tags($fields['weburl']));
$entryMessage = nl2br(strip_tags($fields['message']));
$userIP = $_SERVER['REMOTE_ADDR'];
This should fix the problem. As a result of this, all semicolons in the name, email and homepage field are replaced with a comma. If you've added some further input fields by yourself, check for this vulnerability!Third: a ready to take version of layouts. On the mentioned site, I've made extensive use of css. Therefore, on the attachment to this post you'll find a layout containing of the chunks and css classes made by me for this site. Use it freely if you wish, oterhwise, take it as a (more or less) good example.
Greetings,
Kastor
Attached Files
-
gbookchunks.txt 2.03K
40 downloads
-
gbookcss.txt 1.43K
21 downloads
