5
Taipo, on 22 May 2011 - 11:06 AM, said:
Nothing else filters the GET requests. The two other actions that happen are 1/ back in the osc.php the setlocale( LC_TIME, "en_NZ" ); is where setlocale determines the time, so unless that has been changed to the wrong settings it should not interfere with the output, and the other place is where $_REQUEST is reset as a merge of $_GET and $_POST vars. see: $_REQUEST = array_merge( $_GET, $_POST );
The difficulty I am having in trying to debug this is that it tests correct on my test system here. And by the looks of the output it is reporting correctly. The only other thing is the way the browser may be converting the output itself. What is the charset set to in the html head of your page, and what is the charset set to in your browser?
ps if you dont mind, can you PM me the url to your website so I can see it for myself?
The difficulty I am having in trying to debug this is that it tests correct on my test system here. And by the looks of the output it is reporting correctly. The only other thing is the way the browser may be converting the output itself. What is the charset set to in the html head of your page, and what is the charset set to in your browser?
ps if you dont mind, can you PM me the url to your website so I can see it for myself?
Ok, the site is using
<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN">
<html dir="LTR" lang="de">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
and the browser is switching according to it (iso-8859-1).
Hmm...
I see this filtering is a problematic topic. I am just a PHP beginner but had this idea for a workaround:
What if we had a global flag for disable the filter once, until the string is sent.
At the place where a problematc string is send, just before set the filter disable flag, send the string and the
filter activates itself after sending one string.
Here is my proposal, you are welcome to make it better or safer
/*
Inside the problematic function, just before the string is send add:
$oscsec_filter_once_off=true;
This disables the filter once. After the string is sent the filter is automatic switched on again.
*/
/**
* Clean up GET request vars
* as well as multidimensional arrays
*/
function scrubster( $nodes ) {
global $oscsec_filter_once_off; // Flag can be set in any function
if (!$oscsec_filter_once_off) // If $oscsec_filter_once_off is set to TRUE skip filtering one time
{
/* For testing only
unlink("scrubster.txt"); // Erase old logfile first
$file = fopen("scrubster.txt", "a+"); // Open debug file
fwrite($file, 'in ='.$nodes.chr(10)); // Write input to file
*/
if ( is_array( $nodes ) ) {
foreach( $nodes as $key=>$value ) {
if ( is_array( $value ) ) {
scrubster( $value );
} else {
$nodes = getCleaner( $nodes, TRUE );
$nodes = preg_replace("/[^ a-zA-Z0-9?,=@%:{}\/_.-]/i", "", urldecode( $nodes ) );
$nodes = getCleaner( $nodes, FALSE );
}
}
} else {
$nodes = getCleaner( $nodes, TRUE );
$nodes = preg_replace("/[^ a-zA-Z0-9?,=@%:{}\/_.-]/i", "", urldecode( $nodes ) );
$nodes = getCleaner( $nodes, FALSE );
}
/* For testing only
fwrite($file, 'out='.$nodes.chr(10).chr(13)); // Write output to file and add new Line
fclose($file); // Close file
*/
}
$oscsec_filter_once_off = False; // Now automatic enable filtering again for security
return $nodes;
}
Sorry, there is no web access to my store. I hope to be able to open it in august.
:
