WooYun.org

function onprofile() {
    $navtitle = '个人资料';
    if (isset($this->post['submit'])) {
        $gender = $this->post['gender'];
        $bday = $this->post['birthyear'] . '-' . $this->post['birthmonth'] . '-' . $this->post['birthday'];
        $phone = $this->post['phone'];
        $qq = $this->post['qq'];
        $msn = $this->post['msn'];
        $messagenotify = isset($this->post['messagenotify']) ? 1 : 0;
        $mailnotify = isset($this->post['mailnotify']) ? 2 : 0;
        $isnotify = $messagenotify + $mailnotify;
        $introduction = htmlspecialchars($this->post['introduction']);
        $signature = htmlspecialchars($this->post['signature']);
        if (($this->post['email'] != $this->user['email']) && (!preg_match("/^[a-z'0-9]+([._-][a-z'0-9]+)*@([a-z0-9]+([._-][a-z0-9]+))+$/", $this->post['email']) || $this->db->fetch_total('user', " email='" . $this->post['email'] . "' "))) {
            $this->message("邮件格式不正确或已被占用!", 'user/profile');
        }
        $_ENV['user']->update($this->user['uid'], $gender, $bday, $phone, $qq, $msn, $introduction, $signature, $isnotify);
        isset($this->post['email']) && $_ENV['user']->update_email($this->post['email'], $this->user['uid']);
        $this->message("个人资料更新成功", 'user/profile');
    }
    include template('profile');
}

/* XSS 检测 */
function checkattack($reqarr, $reqtype = 'post') {
    $filtertable = array(
        'get' => '\'|(and|or)\\b.+?(>|<|=|in|like)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)',
        'post' => '\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)',
        'cookie' => '\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)'
    );
    foreach ($reqarr as $reqkey => $reqvalue) {
        if (preg_match("/" . $filtertable[$reqtype] . "/is", $reqvalue) == 1 && !in_array($reqkey, array('content'))) {
            print('Illegal operation!');
            exit(-1);
        }
    }
}