SimpleMachines /
SMF2.1
| @@ 403-449 (lines=47) @@ | ||
| 400 | } |
|
| 401 | ||
| 402 | // First, we clean strings out of the query, reduce whitespace, lowercase, and trim - so we can check it over. |
|
| 403 | if (empty($modSettings['disableQueryCheck'])) |
|
| 404 | { |
|
| 405 | $clean = ''; |
|
| 406 | $old_pos = 0; |
|
| 407 | $pos = -1; |
|
| 408 | // Remove the string escape for better runtime |
|
| 409 | $db_string_1 = str_replace('\\\'','',$db_string); |
|
| 410 | while (true) |
|
| 411 | { |
|
| 412 | $pos = strpos($db_string_1, '\'', $pos + 1); |
|
| 413 | if ($pos === false) |
|
| 414 | break; |
|
| 415 | $clean .= substr($db_string_1, $old_pos, $pos - $old_pos); |
|
| 416 | ||
| 417 | while (true) |
|
| 418 | { |
|
| 419 | $pos1 = strpos($db_string_1, '\'', $pos + 1); |
|
| 420 | $pos2 = strpos($db_string_1, '\\', $pos + 1); |
|
| 421 | if ($pos1 === false) |
|
| 422 | break; |
|
| 423 | elseif ($pos2 === false || $pos2 > $pos1) |
|
| 424 | { |
|
| 425 | $pos = $pos1; |
|
| 426 | break; |
|
| 427 | } |
|
| 428 | ||
| 429 | $pos = $pos2 + 1; |
|
| 430 | } |
|
| 431 | $clean .= ' %s '; |
|
| 432 | ||
| 433 | $old_pos = $pos + 1; |
|
| 434 | } |
|
| 435 | $clean .= substr($db_string_1, $old_pos); |
|
| 436 | $clean = trim(strtolower(preg_replace($allowed_comments_from, $allowed_comments_to, $clean))); |
|
| 437 | ||
| 438 | // Comments? We don't use comments in our queries, we leave 'em outside! |
|
| 439 | if (strpos($clean, '/*') > 2 || strpos($clean, '--') !== false || strpos($clean, ';') !== false) |
|
| 440 | $fail = true; |
|
| 441 | // Trying to change passwords, slow us down, or something? |
|
| 442 | elseif (strpos($clean, 'sleep') !== false && preg_match('~(^|[^a-z])sleep($|[^[_a-z])~s', $clean) != 0) |
|
| 443 | $fail = true; |
|
| 444 | elseif (strpos($clean, 'benchmark') !== false && preg_match('~(^|[^a-z])benchmark($|[^[a-z])~s', $clean) != 0) |
|
| 445 | $fail = true; |
|
| 446 | ||
| 447 | if (!empty($fail) && function_exists('log_error')) |
|
| 448 | smf_db_error_backtrace('Hacking attempt...', 'Hacking attempt...' . "\n" . $db_string, E_USER_ERROR, __FILE__, __LINE__); |
|
| 449 | } |
|
| 450 | ||
| 451 | // Debugging. |
|
| 452 | if (isset($db_show_debug) && $db_show_debug === true) |
|
| @@ 394-440 (lines=47) @@ | ||
| 391 | } |
|
| 392 | ||
| 393 | // First, we clean strings out of the query, reduce whitespace, lowercase, and trim - so we can check it over. |
|
| 394 | if (empty($modSettings['disableQueryCheck'])) |
|
| 395 | { |
|
| 396 | $clean = ''; |
|
| 397 | $old_pos = 0; |
|
| 398 | $pos = -1; |
|
| 399 | // Remove the string escape for better runtime |
|
| 400 | $db_string_1 = str_replace('\'\'','',$db_string); |
|
| 401 | while (true) |
|
| 402 | { |
|
| 403 | $pos = strpos($db_string_1, '\'', $pos + 1); |
|
| 404 | if ($pos === false) |
|
| 405 | break; |
|
| 406 | $clean .= substr($db_string_1, $old_pos, $pos - $old_pos); |
|
| 407 | ||
| 408 | while (true) |
|
| 409 | { |
|
| 410 | $pos1 = strpos($db_string_1, '\'', $pos + 1); |
|
| 411 | $pos2 = strpos($db_string_1, '\\', $pos + 1); |
|
| 412 | if ($pos1 === false) |
|
| 413 | break; |
|
| 414 | elseif ($pos2 === false || $pos2 > $pos1) |
|
| 415 | { |
|
| 416 | $pos = $pos1; |
|
| 417 | break; |
|
| 418 | } |
|
| 419 | ||
| 420 | $pos = $pos2 + 1; |
|
| 421 | } |
|
| 422 | $clean .= ' %s '; |
|
| 423 | ||
| 424 | $old_pos = $pos + 1; |
|
| 425 | } |
|
| 426 | $clean .= substr($db_string_1, $old_pos); |
|
| 427 | $clean = trim(strtolower(preg_replace($allowed_comments_from, $allowed_comments_to, $clean))); |
|
| 428 | ||
| 429 | // Comments? We don't use comments in our queries, we leave 'em outside! |
|
| 430 | if (strpos($clean, '/*') > 2 || strpos($clean, '--') !== false || strpos($clean, ';') !== false) |
|
| 431 | $fail = true; |
|
| 432 | // Trying to change passwords, slow us down, or something? |
|
| 433 | elseif (strpos($clean, 'sleep') !== false && preg_match('~(^|[^a-z])sleep($|[^[_a-z])~s', $clean) != 0) |
|
| 434 | $fail = true; |
|
| 435 | elseif (strpos($clean, 'benchmark') !== false && preg_match('~(^|[^a-z])benchmark($|[^[a-z])~s', $clean) != 0) |
|
| 436 | $fail = true; |
|
| 437 | ||
| 438 | if (!empty($fail) && function_exists('log_error')) |
|
| 439 | smf_db_error_backtrace('Hacking attempt...', 'Hacking attempt...' . "\n" . $db_string, E_USER_ERROR, __FILE__, __LINE__); |
|
| 440 | } |
|
| 441 | ||
| 442 | // Set optimize stuff |
|
| 443 | if (isset($query_opt[$identifier])) |
|
