hi, I have applied most of the recommended addons without problems, except the last one : Anit cross site attack.
I added all 3 files in the contribution page.
after adding the contribution, I have the following error.(seems like from the first package)
Warning: Unexpected character in input: '\' (ASCII=92) state=1 in /home/... /catalog/includes/functions/general.php on line 33
Parse error: syntax error, unexpected T_CONSTANT_ENCAPSED_STRING in /home/.../catalog/includes/functions/general.php on line 39
general.php line 33 and 39 are as follows :
$search .= '~`";:?+/={}[]-_|'\'; // this is #33
for ($i = 0; $i < strlen($search); $i++) {
// ;? matches the ;, which is optional
// 0{0,7} matches any padded zeros, which are optional and go up to 8 chars
// @ @ search for the hex values
$val = preg_replace('/(&#[x|X]0{0,8}'.dechex(ord($search[$i])).';?)/i', $search[$i], $val); // with a ; // this is #39
// @ @ 0{0,7} matches '0' zero to seven times
is that line 33 correct? I wonder.
so, I tried with commenting out line 33, then it seemed working fine, except,
I couldn't add any products into shopping cart, and could not login as a customer.
all email address that I enter changed into some other character and says email and password don't match...
so, again I went to includes/application_top.php and commented out some from the addon lines :
removing top 2 lines made my site function normally.
// BOF : Remove XSS ATTACK
// if (!empty($_POST)) array_walk_recursive($_POST, 'RemoveXSS');
// if (!empty($_GET)) array_walk_recursive($_GET, 'RemoveXSS');
if (!empty($_COOKIE)) array_walk_recursive($_COOKIE, 'RemoveXSS');
if (!empty($_SERVER)) array_walk_recursive($_SERVER, 'RemoveXSS');
if (!empty($_SESSION)) array_walk_recursive($_SESSION, 'RemoveXSS');
if (!empty($_REQUEST)) array_walk_recursive($_REQUEST, 'RemoveXSS');
// EOF : Remove XSS ATTACK
can someone help ?
thanks to you all.
genesis
4
themilkman, on Sep 13 2008, 10:52 PM, said:
