note 69456 deleted from function.ini-set by nlopess

Note Submitter: Michiel ---- The recent aloith.debian.org security breach made me make this function. It will fix 2 bugs with register_globals=On Like in the comments, Alan Hogan already implemented a function that cought one of the bugs. <?php /* _handle_php_bugs {{{ */ /** * Handle some php bugs. * * There's some weird bugs when register_globals is on. * You can clear them with stuff like this: ?GLOBALS&GLOBALS[bla]=test * So what we do is detect this and bail out. * We also make sure that if register_globals is on the gpc stuff will be removed from the globals stuff */ protected function _handle_php_bugs() { /** * catch "PHP5 Globals Vulnerability". * code taken from Advisory ttp://www.ush.it/2006/01/25/php5-globals-vulnerability/ */ if (isset($HTTP_POST_VARS['GLOBALS']) || isset($_POST['GLOBALS']) || isset($HTTP_POST_FILES['GLOBALS']) || isset($_FILES['GLOBALS']) || isset($HTTP_GET_VARS['GLOBALS']) || isset($_GET['GLOBALS']) || isset($HTTP_COOKIE_VARS['GLOBALS']) || isset($_COOKIE['GLOBALS'])) die("GLOBAL GPC hacking attemt!"); /** * if register_globals is on, you cannot turn it off with ini_set. * The vars will be registered before the ini_set is executed. * We can fake register_globals is off by removing the GPCFR keys from * the global var space :) I got the idea from Alan Hogan with his comment on php.net ini_set function docs. * I rewrote it to match mvblog codestyle */ if (ini_get("register_globals")) { foreach ($_GET as $key => $value) if (preg_match("/^([a-z]|_){1}([a-z0-9]|_)*$/si", $key)) unset($GLOBALS[$key]); foreach ($_POST as $key => $value) if (preg_match('/^([a-zA-Z]|_){1}([a-zA-Z0-9]|_)*$/', $key)) unset($GLOBALS[$key]); foreach ($_COOKIE as $key => $value) if (preg_match('/^([a-zA-Z]|_){1}([a-zA-Z0-9]|_)*$/', $key)) unset($GLOBALS[$key]); foreach ($_FILES as $key => $value) if (preg_match('/^([a-zA-Z]|_){1}([a-zA-Z0-9]|_)*$/', $key)) unset($GLOBALS[$key]); foreach ($_REQUEST as $key => $value) if (preg_match('/^([a-zA-Z]|_){1}([a-zA-Z0-9]|_)*$/', $key)) unset($GLOBALS[$key]); } } /* }}} */ ?>