Changeset 15056 for branches/beta/html/frontparts

Timestamp:

2007/07/18 10:17:57 (17 years ago)

Author:

adati

Message:

relブランチのマージ(r12156-r15055)

File:

• branches/beta/html/frontparts/login_check.php (modified) (3 diffs)

branches/beta/html/frontparts/login_check.php

@@ -6 +6 @@
  */
 require_once("../require.php");
+
+// ÉÔÀµ¤ÊURL¤¬POST¤µ¤ì¤¿¾ì¹ç¤Ï¥¨¥é¡¼É½¼¨
+if (isset($_POST['url']) && lfIsValidURL() !== true) {
+    gfPrintLog('invalid access :login_check.php $POST["url"]=' . $_POST['url']);
+    sfDispSiteError(PAGE_ERROR);
+}
 
 $objCustomer = new SC_Customer();
@@ -22 +28 @@
     $arrErr = $objFormParam->checkError();
     $arrForm =  $objFormParam->getHashArray();
-    
     // ¥¯¥Ã¥­¡¼ÊݸȽÄê
     if ($arrForm['login_memory'] == "1" && $arrForm['login_email'] != "") {
@@ -73 +78 @@
     $objFormParam->addParam("¥Ñ¥¹¥ï¡¼¥É", "login_pass", STEXT_LEN, "", array("EXIST_CHECK", "MAX_LENGTH_CHECK"));
 }
+
+/* POST¤µ¤ì¤ëURL¤Î¥Á¥§¥Ã¥¯*/
+function lfIsValidURL() {
+    $site_url  = sfIsHTTPS() ? SSL_URL : SITE_URL;
+    $check_url = trim($_POST['url']);
+    
+    // ¥É¥á¥¤¥ó¥Á¥§¥Ã¥¯
+    $pattern = "|^$site_url|";
+    if (!preg_match($pattern, $check_url)) {
+        return false;
+    }
+
+    // ²þ¹Ô¥³¡¼¥É(CR¡¦LF)¡¦NULL¥Ð¥¤¥È¥Á¥§¥Ã¥¯
+    $pattern = '/\r|\n|\0|%0D|%0A|%00/';
+    if (preg_match_all($pattern, $check_url, $matches)) {
+        return false;
+    }
+    
+    return true;
+}
+
 ?>