tyler.durden/pandorafms
1
0
Fork 0
mirror of https://github.com/pandorafms/pandorafms.git synced 2025-07-31 01:35:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

2011-02-08 Sergio Martin <sergio.martin@artica.es>

Browse Source 
* lib/PandoraFMS/Tools.pm
	util/pandora_recode_db.pl: Added characters to translate
	to html entities into safe_input and safe_output. Clean
	repeated code into recode script.



git-svn-id: https://svn.code.sf.net/p/pandora/code/trunk@3812 c3f86ba8-e40f-0410-aaad-9ba5e7f4b01f
This commit is contained in:
zarzuelo 2011-02-08 16:38:38 +00:00
parent 1ff8e2f371
commit 7160564d65
3 changed files with 60 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
pandora_server/ChangeLog
View File

@ -1,3 +1,10 @@
2011-02-08 Sergio Martin <sergio.martin@artica.es>
* lib/PandoraFMS/Tools.pm
util/pandora_recode_db.pl: Added characters to translate
to html entities into safe_input and safe_output. Clean
repeated code into recode script.
2011-02-08 Junichi Satoh <junichi@rworks.jp> 2011-02-08 Junichi Satoh <junichi@rworks.jp>
* util/pandora_manage.pl: Fixed invalid module id with creation of * util/pandora_manage.pl: Fixed invalid module id with creation of

53
pandora_server/lib/PandoraFMS/Tools.pm
View File

@ -107,6 +107,15 @@ sub safe_input($) {
my $hex = ascii_to_html($i); my $hex = ascii_to_html($i);
$value =~ s/$pattern/$hex/gi; $value =~ s/$pattern/$hex/gi;
} }
#//Replace characteres for tildes and others
my $trans = get_html_entities();
foreach(keys(%$trans))
{
my $pattern = chr($_);
$value =~ s/$pattern/$trans->{$_}/gi;
}
return $value; return $value;
} }
@ -139,10 +148,54 @@ sub safe_output($) {
my $hex = ascii_to_html($i); my $hex = ascii_to_html($i);
$value =~ s/$hex/$pattern/gi; $value =~ s/$hex/$pattern/gi;
} }
#//Replace characteres for tildes and others
my $trans = get_html_entities();
foreach(keys(%$trans))
{
my $pattern = chr($_);
$value =~ s/$trans->{$_}/$pattern/gi;
}
return $value; return $value;
} }
##########################################################################
# SUB get_html_entities
# Returns a hash table with the acute and special html entities
# Usefull for future chars addition:
# http://cpansearch.perl.org/src/GAAS/HTML-Parser-3.68/lib/HTML/Entities.pm
##########################################################################
sub get_html_entities {
my %trans = (
225 => '&aacute;',
233 => '&eacute;',
237 => '&iacute;',
243 => '&oacute;',
250 => '&uacute;',
193 => '&Aacute;',
201 => '&Eacute;',
205 => '&Iacute;',
211 => '&Oacute;',
218 => '&Uacute;',
228 => '&auml;',
235 => '&euml;',
239 => '&iuml;',
246 => '&ouml;',
252 => '&uuml;',
196 => '&Auml;',
203 => '&Euml;',
207 => '&Iuml;',
214 => '&Ouml;',
220 => '&Uuml;',
241 => '&ntilde;',
209 => '&Ntilde;'
);
return \%trans;
}
########################################################################## ##########################################################################
# SUB ascii_to_html (string) # SUB ascii_to_html (string)
# Convert an ascii string to hexadecimal # Convert an ascii string to hexadecimal

31
pandora_server/util/pandora_recode_db.pl
View File

@ -150,37 +150,6 @@ sub help_screen{
exit; exit;
} }
##########################################################################
## Convert the $value encode in html entity to clear char string.
##########################################################################
sub safe_input($) {
my $value = shift;
$value = encode_entities ($value, "'<>&");
#//Replace the character '\' for the equivalent html entitie
$value =~ s/\\/&#92;/gi;
#// First attempt to avoid SQL Injection based on SQL comments
#// Specific for MySQL.
$value =~ s/\/\*/&#47;&#42;/gi;
$value =~ s/\*\//&#42;&#47;/gi;
#//Replace ( for the html entitie
$value =~ s/\(/&#40;/gi;
#//Replace ( for the html entitie
$value =~ s/\)/&#41;/gi;
#//Replace some characteres for html entities
for (my $i=0;$i<33;$i++) {
my $pattern = chr($i);
my $hex = ascii_to_html($i);
$value =~ s/$pattern/$hex/gi;
}
return $value;
}
########################################################################## ##########################################################################
# SUB ascii_to_html (string) # SUB ascii_to_html (string)