mbirth/LuckyCoinkydink
Archived
1
0
Fork 0
Code Issues Pull Requests Activity

Ensure to not be able to call s9y files under circumstances where .htaccess does not deny request AND register_globals is turned on

Browse Source
This commit is contained in:
Garvin Hicking
2006-11-30 21:34:29 +00:00
parent 1549c178ce
commit 14f00d7d9e
23 changed files with 164 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docs/NEWS
View File

@ -350,7 +350,14 @@ Version 1.1-alpha5()
* Removed config option "XHTML11 compliance" and enabled by default
now (garvinhicking)
Version 1.0.3 ()
Version 1.0.4 ()
------------------------------------------------------------------------
* Fix local file inclusion bug on systems with two conditions:
register_globals=on AND missing .htaccess for restricting access to
.inc.php files. (garvinhicking)
Version 1.0.3 (November 7th, 2006)
------------------------------------------------------------------------
* Fix PHP 5.2.0 compatibility issue. (garvinhicking)

4
include/admin/configuration.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
umask(0000);
$umask = 0775;
@define('IN_installer', true);

4
include/admin/installer.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
umask(0000);
$umask = 0775;
@define('IN_installer', true);

4
include/compat.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (defined('S9Y_FRAMEWORK_COMPAT')) {
return;
}

4
include/functions.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (defined('S9Y_FRAMEWORK_FUNCTIONS')) {
return;
}

12
include/functions_calendars.inc.php
View File

@ -2,10 +2,14 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (defined('S9Y_FRAMEWORK_CALENDARS')) {
return;
}
@define('S9Y_FRAMEWORK_CALENDARS', true);
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (defined('S9Y_FRAMEWORK_CALENDARS')) {
return;
}
@define('S9Y_FRAMEWORK_CALENDARS', true);
/**
* Gregorian to Persian Convertor

4
include/functions_comments.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (defined('S9Y_FRAMEWORK_COMMENTS')) {
return;
}

4
include/functions_config.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (defined('S9Y_FRAMEWORK_CONFIG')) {
return;
}

4
include/functions_entries.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (defined('S9Y_FRAMEWORK_ENTRIES')) {
return;
}

4
include/functions_entries_admin.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (defined('S9Y_FRAMEWORK_ENTRIES_ADMIN')) {
return;
}

4
include/functions_images.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (defined('S9Y_FRAMEWORK_IMAGES')) {
return;
}

1
include/functions_images_crop.inc.php
View File

@ -448,4 +448,3 @@ class imgedit {
return true;
}
}
?>

3
include/functions_installer.inc.php
View File

@ -2,6 +2,9 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (defined('S9Y_FRAMEWORK_INSTALLER')) {
return;

4
include/functions_permalinks.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (defined('S9Y_FRAMEWORK_PERMALINKS')) {
return;
}

3
include/functions_plugins_admin.inc.php
View File

@ -2,6 +2,9 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (defined('S9Y_FRAMEWORK_PLUGINS_ADMIN')) {
return;

4
include/functions_rss.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (defined('S9Y_FRAMEWORK_RSS')) {
return;
}

4
include/functions_smarty.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (defined('S9Y_FRAMEWORK_SMARTY')) {
return;
}

4
include/functions_trackbacks.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (defined('S9Y_FRAMEWORK_TRACKBACKS')) {
return;
}

4
include/functions_upgrader.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (defined('S9Y_FRAMEWORK_UPGRADER')) {
return;
}

4
include/genpage.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (!defined('S9Y_FRAMEWORK')) {
include('serendipity_config.inc.php');
}

4
include/lang.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (!defined('serendipity_LANG_LOADED') || serendipity_LANG_LOADED !== true) {
$charset = serendipity_getCharset();

4
include/plugin_internal.inc.php
View File

@ -2,6 +2,10 @@
# Copyright (c) 2003-2005, Jannis Hermanns (on behalf the Serendipity Developer Team)
# All rights reserved. See LICENSE file for licensing details
if (IN_serendipity !== true) {
die ("Don't hack!");
}
if (defined('S9Y_FRAMEWORK_PLUGIN_INTERNAL')) {
return;
}

4
templates/kubrick/config.inc.php
View File

@ -1,5 +1,9 @@
<?php # $Id$
if (IN_serendipity !== true) {
die ("Don't hack!");
}
$probelang = dirname(__FILE__) . '/lang_' . $serendipity['lang'] . '.inc.php';
if (file_exists($probelang)) {
include $probelang;