/**
* Perform HTTP redirect with saving POST params in session.
*
* @param string $url URL redirect to.
* @param array<mixed> $postData List of post params to save.
*/
public static function httpRedirect($url = "", $postData = [])
{
if (preg_match("#^http[s]?://.+#", $url)) {
// absolute url
if (function_exists("http_redirect")) {
http_redirect($url);
} else {
self::http_redirect($url);
}
} else {
// same domain (relative url)
if (!empty($postData)) {
if (is_array($postData)) {
if (!Session::exists('_post') || !is_array($_SESSION['_post'])) {
Session::set('_post', []);
}
foreach ($postData as $fieldName => $fieldValue) {
Session::set("_post[{$fieldName}]", serialize($fieldValue));
}
} else {
throw new HttpException("Wrong POST data.");
}
}
if (function_exists("http_redirect")) {
http_redirect("http://" . $_SERVER['SERVER_NAME'] . "/" . $url);
} else {
self::http_redirect("http://" . $_SERVER['SERVER_NAME'] . "/" . $url);
}
}
}
public function force_login(PlPage $page)
{
$redirect = S::v('loginX');
if (!$redirect) {
$page->trigError('Impossible de s\'authentifier. Problème de configuration de plat/al.');
return;
}
http_redirect($redirect);
}
function handler_set_skin($page)
{
S::assert_xsrf_token();
S::set('skin', Post::s('change_skin'));
if (!empty($_SERVER['HTTP_REFERER'])) {
http_redirect($_SERVER['HTTP_REFERER']);
} else {
pl_redirect('/');
}
}
function handler_exit($page, $level = null)
{
global $globals;
if (S::has('suid')) {
Platal::session()->stopSUID();
pl_redirect('/');
}
Platal::session()->destroy();
http_redirect($globals->baseurl_http);
$page->changeTpl('exit.tpl');
}
function index()
{
$error = $this->codeError($_GET['code']);
if ($error == '/') {
session_start();
session_destroy();
http_redirect('/');
exit;
}
$this->template->vars('error', $error);
$this->template->view('index');
exit;
}
function handler_sso($page)
{
$this->load('sso.inc.php');
// First, perform security checks.
if (!wats4u_sso_check()) {
return PL_BAD_REQUEST;
}
global $globals;
if (!S::logged()) {
// Request auth.
$page->assign('external_auth', true);
$page->assign('ext_url', $globals->wats4u->public_url);
$page->setTitle('Authentification');
$page->setDefaultSkin('group_login');
$page->assign('group', null);
return PL_DO_AUTH;
}
if (!S::user()->checkPerms(PERMS_USER)) {
// External (X.net) account
return PL_FORBIDDEN;
}
// Update the last login information (unless the user is in SUID).
$uid = S::i('uid');
if (!S::suid()) {
global $platal;
S::logger($uid)->log('connexion_wats4u', $platal->path . ' ' . urldecode($_GET['url']));
}
// If we logged in specifically for this 'external_auth' request
// and didn't want to "keep access to services", we kill the session
// just before returning.
// See classes/xorgsession.php:startSessionAs
if (S::b('external_auth_exit')) {
S::logger()->log('deconnexion', @$_SERVER['HTTP_REFERER']);
Platal::session()->killAccessCookie();
Platal::session()->destroy();
}
// Compute return URL
$full_return = wats4u_sso_build_return_url(S::user());
if ($full_return === "") {
// Something went wrong
$page->kill("Erreur dans le traitement de la requête Wats4U.");
}
http_redirect($full_return);
}
function userEvent()
{
$active = $this->isActive();
if ($active < 2) {
http_redirect('/');
exit;
}
session_start();
$id = $_SESSION['user'][0];
$model = new Model_profileEvent();
$modelCor = new Model_correspondence();
$event = $model->allEvents($id, 1);
$result = $modelCor->ajaxMessage(0, $event[0]['id']);
$modelUser = new Model_profileUser();
$event_user = $model->userByEvent($event[0]['id']);
$maxId = $modelCor->maxId();
foreach ($result as $key => $value) {
$user = $modelUser->result_by(array("id" => $value['user_id']));
$ava = explode('static', $user[0]['ava']);
if (!empty($event_user) && $value['user_id'] == $event_user) {
$result[$key]['user'] = true;
} else {
$result[$key]['user'] = false;
if ($value['user_id'] == $id) {
$result[$key]['us'] = true;
} else {
$result[$key]['us'] = false;
}
}
$result[$key]['ava'] = $ava[count($ava) - 1];
$result[$key]['login'] = $user[0]['login'];
}
$this->template->vars('menu', array('Назад' => 'onclick="goHref()"'));
$this->template->vars('event', $event[0]['id']);
$this->template->vars('maxId', $maxId[0]['last_value']);
$this->template->vars('message', $result);
$this->template->vars('events', $event);
$this->template->view('event_mes');
}
/**
* Perform HTTP redirect with saving POST params in session.
*
* @param string $url URL redirect to.
* @param array<mixed> $postData List of post params to save.
*/
public static function httpRedirect($url = "", $postData = array())
{
if (preg_match("#^http[s]?://.+#", $url)) {
// absolute url
http_redirect($url);
} else {
// same domain (relative url)
if (!empty($postData)) {
if (is_array($postData)) {
if (!isset($_SESSION['_post']) || !is_array($_SESSION['_post'])) {
$_SESSION['_post'] = array();
}
foreach ($postData as $fieldName => $fieldValue) {
$_SESSION['_post'][$fieldName] = serialize($fieldValue);
}
} else {
throw new \Exception("Wrong POST data.");
}
}
http_redirect("http://" . $_SERVER['SERVER_NAME'] . "/" . $url);
}
}
public function check($printErr = true)
{
global $AUTH;
$err = null;
try {
$data = $this->handleResponseAuth();
if ($data !== null) {
// Set credentials to authenticate
$AUTH->setTrustUsername(false);
$AUTH->setLogoutPossible(true);
$AUTH->passCredentials($data);
// Try to authenticate the user
$result = $AUTH->isAuthenticated();
if ($result === true) {
if (!isset($data['onetime'])) {
// Success: Store in session
$AUTH->storeInSession();
}
// In case of success do an redirect, to prevent the browser from
// showing up bad warning messages upon page reload about resending
// the logins POST request
http_redirect();
} else {
throw new FieldInputError(null, l('Authentication failed.'));
}
}
} catch (FieldInputError $e) {
$err = $e;
}
// Authentication failed. Show the login dialog with the error message to
// the user again. In case of an ajax request, simply raise an exception
if (!CONST_AJAX) {
return array('LogonDialog', 'view', $err);
} else {
throw new NagVisException(l('You are not authenticated'), null, l('Access denied'));
}
}
echo "Rellena todos los campos";
} else {
// verificamos que el usuario exista en la BDD
$conexion = new mysqli('localhost', 'root', '', 'sistema');
if ($conexion->connect_error) {
die($conexion->connect_error);
}
$existe_email = "SELECT email FROM usuario WHERE email='{$email}'";
$respuesta = $conexion->query($existe_email);
$rows = $respuesta->num_rows;
if ($rows > 0) {
// si el usuario existe en la BDD traemos la contrasena
$get_pass = "******";
$resp = $conexion->query($get_pass);
$row2 = mysqli_fetch_assoc($resp);
//echo $row2['contrasena'];
//echo "in pass: "******"las contrasenas no coiciden";
}
}
}
}
$msg = isset($_GET['exito']) ? $_GET['exito'] : '';
$error = '';
if ($_POST) {
$email = $_POST['email'];
$contrasena = md5($_POST['password']);
$verificar_contrasena = md5($_POST['verif_password']);
if ($email == "" || $contrasena == "" || $verificar_contrasena == "") {
echo '<h2>Ingrese sus datos</h2>';
} else {
if ($contrasena !== $verificar_contrasena) {
$error .= htmlentities('Las contraseñas no coinciden');
echo '<h2>Las contraseñas no coinciden</h2>';
}
if ($error == '') {
$conn = new mysqli('localhost', 'root', '', 'bdd');
if ($conn->connect_error) {
$error .= '<br>No se pudo conectar a la base de datos';
}
//die($conn ->connect_error);
$query = "INSERT INTO usuario \n (\n email, \n password)\n VALUES (\n '{$email}',\n '{$contrasena}'\n )";
$result = $conn->query($query);
if (!$result) {
$error .= '<br>No se pudo guardar los registros en la bdd. Vuelva a intentarlo.';
//die($conn ->error);
}
if ($error == '') {
http_redirect('index.php?exito=' . urlencode('Datos guardados con exito'));
}
}
}
}
function execute($process, $event)
{
$http = eZHTTPTool::instance();
$siteINI = eZINI::instance('site.ini');
$shopINI = eZINI::instance('shop.ini');
$payoneINI = eZINI::instance('xrowpayone.ini');
$processParams = $process->attribute('parameter_list');
$errors = array();
$process_id = $process->ID;
//get the current order
$order_id = $processParams['order_id'];
$order = eZOrder::fetch($order_id);
//checking if its only a redirect and so the preauthorisation is already finished
$paymentObj = xrowPaymentObject::fetchByOrderID($order_id);
if (is_object($paymentObj) && $paymentObj->approved()) {
//now disapprove again because its 3d CC payment and its only paid when capture is successful
$paymentObj->reject();
xrowPayoneCreditCardGateway::setPaymentMethod($order);
eZLog::write("SUCCESS in step 2 ('preauthorisation') ::3D Secure Card detected - FINISHED :: for order ID " . $order_id, $logName = 'xrowpayone.log', $dir = 'var/log');
return eZWorkflowType::STATUS_ACCEPTED;
}
//STEP 2: preauthorisation
if ($http->hasPostVariable('pseudocardpan')) {
//fetching settings
$pseudocardpan = $http->postVariable('pseudocardpan');
$site_url = $siteINI->variable('SiteSettings', 'SiteURL');
$aid = $payoneINI->variable('GeneralSettings', 'AID');
$mid = $payoneINI->variable('GeneralSettings', 'MID');
$portal_id = $payoneINI->variable('GeneralSettings', 'PortalID');
$mode = $payoneINI->variable('GeneralSettings', 'Mode');
$key = $payoneINI->variable('GeneralSettings', 'Key');
$algorithm = $payoneINI->variable('GeneralSettings', 'Algorithm');
$api_version = $payoneINI->variable('GeneralSettings', 'APIVersion');
$response_type = $payoneINI->variable('GeneralSettings', 'ResponseType');
$cc_3d_secure_enabled = $payoneINI->variable('CC3DSecure', 'Enabled');
$error_url = $payoneINI->variable('CC3DSecure', 'ErrorURL');
$success_url = $payoneINI->variable('CC3DSecure', 'SuccessURL');
$siteaccess = $GLOBALS['eZCurrentAccess'];
$siteaccess = $siteaccess["name"];
//prepare some parameter values
$error_url = "https://" . $site_url . "/" . $siteaccess . "/" . $error_url . "/orderID/" . $order_id;
$success_url = "https://" . $site_url . "/" . $siteaccess . "/" . $success_url . "/orderID/" . $order_id;
$order_total_in_cent = (string) $order->totalIncVAT() * 100;
$currency_code = $order->currencyCode();
$order_xml = simplexml_load_string($order->DataText1);
$country_alpha3 = (string) $order_xml->country;
$country = eZCountryType::fetchCountry($country_alpha3, "Alpha3");
$country_alpha2 = $country["Alpha2"];
$last_name = (string) $order_xml->last_name;
//create hash array
$hash_array["aid"] = $aid;
$hash_array["mid"] = $mid;
$hash_array["portalid"] = $portal_id;
$hash_array["api_version"] = $api_version;
$hash_array["mode"] = $mode;
$hash_array["request"] = "preauthorization";
$hash_array["responsetype"] = $response_type;
$hash_array["clearingtype"] = "cc";
$hash_array["reference"] = $order_id;
$hash_array["amount"] = $order_total_in_cent;
$hash_array["currency"] = $currency_code;
if ($cc_3d_secure_enabled == "true") {
$hash_array["successurl"] = $success_url;
$hash_array["errorurl"] = $error_url;
}
//please note: country, lastname and pseudocardpan are not needed to be added to the hash because they are not allwoed (p.25 client doc)
//create param array
$param_array["aid"] = $aid;
$param_array["mid"] = $mid;
$param_array["portalid"] = $portal_id;
$param_array["api_version"] = $api_version;
$param_array["mode"] = $mode;
$param_array["request"] = "preauthorization";
$param_array["responsetype"] = $response_type;
$param_array["hash"] = xrowPayoneHelper::generate_hash($algorithm, $hash_array, $key);
$param_array["clearingtype"] = "cc";
$param_array["reference"] = $order_id;
$param_array["amount"] = $order_total_in_cent;
$param_array["currency"] = $currency_code;
$param_array["lastname"] = urlencode($last_name);
$param_array["country"] = $country_alpha2;
$param_array["pseudocardpan"] = $pseudocardpan;
if ($cc_3d_secure_enabled == "true") {
$param_array["successurl"] = $success_url;
$param_array["errorurl"] = $error_url;
}
//sort params in alphabetic order
ksort($param_array);
$parameter_string = "?";
foreach ($param_array as $key => $parameter) {
$parameter_string .= $key . "=" . $parameter . "&";
}
$url = "https://secure.pay1.de/client-api" . $parameter_string;
if ($siteINI->hasVariable('ProxySettings', 'ProxyServer') && $siteINI->variable('ProxySettings', 'ProxyServer') != "") {
$proxyserver = $siteINI->variable('ProxySettings', 'ProxyServer');
//now get the proxy url
if (strpos($proxyserver, "://") !== false) {
$proxy_parts = explode("://", $proxyserver);
$proxyserver = $proxy_parts[1];
}
$context_array = array('http' => array('method' => 'GET', 'proxy' => $proxyserver));
$context = stream_context_create($context_array);
$json_response = file_get_contents($url, false, $context);
} else {
$json_response = file_get_contents($url);
}
if ($json_response) {
$json_response = json_decode($json_response);
if ($json_response->status != "ERROR" and isset($json_response->txid)) {
//get 'txid' from response and keep it
$txid = $json_response->txid;
//get 'userid' from response and keep it
$userid = $json_response->userid;
//now store it into the order
$db = eZDB::instance();
$db->begin();
$doc = new DOMDocument('1.0', 'utf-8');
$doc->loadXML($order->DataText1);
$shop_account_element = $doc->getElementsByTagName('shop_account');
$shop_account_element = $shop_account_element->item(0);
//handle and store the TXID
//remove first if exists
$txid_elements = $doc->getElementsByTagName('txid');
if ($txid_elements->length >= 1) {
$txid_element = $txid_elements->item(0);
$txid_element->parentNode->removeChild($txid_element);
}
//then create
$txidNode = $doc->createElement("txid", $txid);
$shop_account_element->appendChild($txidNode);
//handle and store the userid
//remove first if exists
$userid_elements = $doc->getElementsByTagName('userid');
if ($userid_elements->length >= 1) {
$userid_element = $userid_elements->item(0);
$userid_element->parentNode->removeChild($userid_element);
}
//then create
$useridNode = $doc->createElement("userid", $userid);
$shop_account_element->appendChild($useridNode);
//handle and store the pseudocardpan
if ($http->hasPostVariable('truncatedcardpan')) {
//remove first if exists
$tpan_elements = $doc->getElementsByTagName('truncatedcardpan');
if ($tpan_elements->length >= 1) {
$tpan_element = $tpan_elements->item(0);
$tpan_element->parentNode->removeChild($tpan_element);
}
//then create
$truncatedcardpan_node = $doc->createElement("truncatedcardpan", $http->postVariable('truncatedcardpan'));
$shop_account_element->appendChild($truncatedcardpan_node);
}
if ($json_response->status === "REDIRECT") {
//remove first if exists
$cc3d_sec_elements = $doc->getElementsByTagName('cc3d_reserved');
if ($cc3d_sec_elements->length >= 1) {
$cc3d_sec_element = $cc3d_sec_elements->item(0);
$cc3d_sec_element->parentNode->removeChild($cc3d_sec_element);
}
//save reserved flag false for now
$reservedFlag = $doc->createElement("cc3d_reserved", "false");
$shop_account_element->appendChild($reservedFlag);
} else {
//remove cc3d_reserved if exists. this case could occure if someone changed from 3d CC to normal CC.
$cc3d_sec_elements = $doc->getElementsByTagName('cc3d_reserved');
if ($cc3d_sec_elements->length >= 1) {
$cc3d_sec_element = $cc3d_sec_elements->item(0);
$cc3d_sec_element->parentNode->removeChild($cc3d_sec_element);
}
}
//i must store here redundant otherwise the order will not be stored since its stuck in a transaction
$db->commit();
//store it
$order->setAttribute('data_text_1', $doc->saveXML());
$order->store();
$db->commit();
if ($json_response->status === "REDIRECT") {
eZLog::write("PENDING in step 2 ('preauthorisation') ::3D Secure Card detected - REDIRECTING to creditcard institute check :: for order ID " . $order_id, $logName = 'xrowpayone.log', $dir = 'var/log');
//do redirect to 3d secure password confirm page
http_redirect($json_response->redirecturl);
exit;
} else {
xrowPayoneCreditCardGateway::setPaymentMethod($order);
eZLog::write("SUCCESS in step 2 ('preauthorisation') for order ID " . $order_id, $logName = 'xrowpayone.log', $dir = 'var/log');
return eZWorkflowType::STATUS_ACCEPTED;
}
} else {
eZLog::write("FAILED in step 2 ('preauthorisation') for order ID " . $order_id . " with ERRORCODE " . $json_response->errorcode . " Message: " . $json_response->errormessage, $logName = 'xrowpayone.log', $dir = 'var/log');
if ($payoneINI->variable('GeneralSettings', 'CustomErrorNode') === "disabled") {
//use default error of payone
$errors = array($json_response->customermessage);
} else {
//use customized errors
$response["errorcode"] = $json_response->errorcode;
$response["errormessage"] = $json_response->errormessage;
$errors = array(xrowPayoneHelper::generateCustomErrorString($order, $response));
}
}
} else {
eZLog::write("ERROR: Remote content not found in file " . __FILE__ . " on line " . __LINE__, $logName = 'xrowpayone.log', $dir = 'var/log');
}
} else {
if (is_object($paymentObj)) {
//that means, that we have a paymentobject which is not approved. its not approved because the payment has failed so we return a array
$errors = array(ezpI18n::tr('extension/xrowpayone', 'Error occured during payment process. Please choose your payment option again.'));
$paymentObj->remove();
}
}
$process->Template = array();
$process->Template['templateName'] = xrowPayoneCreditCardGateway::TEMPLATE;
$process->Template['path'] = array(array('url' => false, 'text' => ezpI18n::tr('extension/xrowpayone', 'Payment Information')));
$process->Template['templateVars'] = array('errors' => $errors, 'order' => $order, 'event' => $event);
// return eZWorkflowType::STATUS_REJECTED;
return eZWorkflowType::STATUS_FETCH_TEMPLATE_REPEAT;
}
<?php
cerrar_sesion();
http_redirect('index.php');
INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN IF AUTHORS HAVE
BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
AUTHORS SPECIFICALLY DISCLAIM ANY WARRANTIES INCLUDING, BUT NOT
LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
THE SOFTWARE IS PROVIDED ON AN "AS-IS" BASIS AND AUTHORS HAVE NO
OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR
MODIFICATIONS.*/
class Input
{
public function getInput()
{
return $_GET['UserData'];
}
}
$temp = new Input();
$tainted = $temp->getInput();
$tainted += 0;
$var = http_redirect("pages/'" . $tainted . "'.php");
LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
THE SOFTWARE IS PROVIDED ON AN "AS-IS" BASIS AND AUTHORS HAVE NO
OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR
MODIFICATIONS.*/
class Input
{
private $input;
public function getInput()
{
return $this->input[1];
}
public function __construct()
{
$this->input = array();
$this->input[0] = 'safe';
$this->input[1] = $_GET['UserData'];
$this->input[2] = 'safe';
}
}
$temp = new Input();
$tainted = $temp->getInput();
$tainted = (int) $tainted;
$var = http_redirect(sprintf("pages/'%d'.php", $tainted));
INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN IF AUTHORS HAVE
BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
AUTHORS SPECIFICALLY DISCLAIM ANY WARRANTIES INCLUDING, BUT NOT
LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
THE SOFTWARE IS PROVIDED ON AN "AS-IS" BASIS AND AUTHORS HAVE NO
OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR
MODIFICATIONS.*/
$string = $_POST['UserData'];
$tainted = unserialize($string);
$re = "/^[a-zA-Z0-9]*\$/";
if (preg_match($re, $tainted) == 1) {
$tainted = $tainted;
} else {
$tainted = "";
}
//flaw
$var = http_redirect("'{$tainted}'");
<?php
require_once "../include/pictures.php";
require_once "../include/comments.php";
require_once "../include/cart.php";
require_once "../include/html_functions.php";
require_once "../include/functions.php";
session_start();
if (!isset($_GET['query'])) {
http_redirect("/error.php?msg=Error, need to provide a query to search");
}
$pictures = Pictures::get_all_pictures_by_tag($_GET['query']);
?>
<?php
our_header("", $_GET['query']);
?>
<div class="column prepend-1 span-24 first last">
<h2>Pictures that are tagged as '<?php
echo $_GET['query'];
?>
'</h2>
<?php
thumbnail_pic_list($pictures);
?>
</div>
<?php
require_once "../include/users.php";
require_once "../include/functions.php";
session_start();
require_login();
Users::logout();
http_redirect("/");
$current_user = $g->get_logged_in_user();
$settings = $current_user->settings();
if (http_is_post()) {
if ($_POST['form_action'] == 'savepage') {
$g->set_page_contents($_POST['contents']);
Fu_Feedback::set_flash('page saved');
if ($settings->remain_edit_mode) {
http_redirect(http_request_uri());
} else {
http_redirect('/' . $g->get_page());
}
}
if ($_POST['form_action'] == 'delpage') {
if ($g->delete_page()) {
Fu_Feedback::set_flash('page deleted');
http_redirect('/');
}
}
}
include 'giiki/theme/_header.php';
$editor = $settings->editor;
?>
<div id="wrapper" class="wat-cf">
<div id="main">
<!-- messages //-->
<?php
app_show_feedback();
?>
<div class="block" id="main-content">
<?php
require_once "include/html_functions.php";
require_once "include/users.php";
session_start();
require_login();
if (!isset($_GET['value'])) {
http_redirect(Users::$HOME_URL);
}
?>
<?php
our_header("home");
?>
<div class="column prepend-1 span-24 first last">
<p>
Your favorite color is <?php
echo $_GET['value'];
?>
! and you've been entered in our contest!
</p>
</div>
<?php
our_footer();
***************************************************************************/
require_once 'xorg.inc.php';
$platal = new Xorg('core');
global $globals;
$path = ltrim($platal->pl_self(), '/');
@(list($username, $path) = explode('/', $path, 2));
if ($username && !is_null($user = User::getSilent($username))) {
$url = XDB::fetchOneCell('SELECT url
FROM carvas
WHERE uid = {?}', $user->id());
if ($url) {
$url = preg_replace('@/+$@', '', $url);
if ($path) {
http_redirect("http://{$url}/{$path}");
} else {
http_redirect("http://{$url}");
}
}
}
header($_SERVER['SERVER_PROTOCOL'] . ' 404 Not Found');
?>
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html>
<head>
<title>404 Not Found</title>
</head>
<body>
<h1>Not Found</h1>
The requested URL <?php
echo $_SERVER['REQUEST_URI'];
?>
function hook_getXFace($headers)
{
$login = null;
foreach (array('x-org-id', 'x-org-mail') as $key) {
if (isset($headers[$key])) {
$login = $headers[$key];
break;
}
}
if (is_null($login)) {
// No login, fallback to default handler
return false;
}
if (isset($headers['x-face'])) {
$user = User::getSilent($login);
$res = XDB::query("SELECT pf.uid\n FROM forum_profiles AS pf\n WHERE pf.uid = {?} AND FIND_IN_SET('xface', pf.flags)", $user->id());
if ($res->numRows()) {
// User wants his xface to be showed, fallback to default handler
return false;
}
}
global $globals;
http_redirect($global->baseurl . '/photo/' . $login);
}
any purpose, provided that the above copyright notice and the following
three paragraphs appear in all copies of this software.
IN NO EVENT SHALL AUTHORS BE LIABLE TO ANY PARTY FOR DIRECT,
INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN IF AUTHORS HAVE
BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
AUTHORS SPECIFICALLY DISCLAIM ANY WARRANTIES INCLUDING, BUT NOT
LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
THE SOFTWARE IS PROVIDED ON AN "AS-IS" BASIS AND AUTHORS HAVE NO
OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR
MODIFICATIONS.*/
$tainted = $_POST['UserData'];
$tainted = preg_replace('/\'/', '', $tainted);
//flaw
$var = http_redirect(sprintf("'%s'.php", $tainted));
}
$baseversion = explode(".", $version);
$baseversion = intval($baseversion[0]);
// check os
if (preg_match('/linux/', $userAgent)) {
$platform = 'linux';
} elseif (preg_match('/macintosh|mac os x/', $userAgent)) {
$platform = 'mac';
} elseif (preg_match('/windows|win32/', $userAgent)) {
$platform = 'windows';
} else {
$platform = 'unrecognized';
}
// redirect in case deprecated browser
if ($browser == "msie" && $baseversion < 8 || $browser == "safari" && $baseversion < 4 || $browser == "chrome" && $baseversion < 10 || $browser == "opera" && $baseversion < 10 || $browser == "firefox" && $baseversion < 3 || $browser == "unrecognized") {
http_redirect($this->base . 'deprecated_browser');
}
$action = $this->request->parameters['action'];
if ($action == 'passwordreset') {
$userToken = sRequest()->parameters['token'];
if ($userId = sUserMgr()->getUserIdByToken($userToken)) {
$user = new User($userId);
$smarty->assign('passwordreset', true);
$smarty->assign('passwordreset_token', $userToken);
if (sRequest()->parameters['newuser'] == '1') {
$smarty->assign('newuser', true);
}
}
}
$windowcfgxml = simplexml_load_string($smarty->fetch('file:' . getrealpath($this->approot) . "/ui/html/windows/windows.xml"));
$smarty->assign("windowconfig", json_encode($windowcfgxml));
BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
AUTHORS SPECIFICALLY DISCLAIM ANY WARRANTIES INCLUDING, BUT NOT
LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
THE SOFTWARE IS PROVIDED ON AN "AS-IS" BASIS AND AUTHORS HAVE NO
OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR
MODIFICATIONS.*/
class Input
{
public function getInput()
{
return $_GET['UserData'];
}
}
$temp = new Input();
$tainted = $temp->getInput();
if (settype($tainted, "integer")) {
$tainted = $tainted;
} else {
$tainted = 0;
}
$var = http_redirect("pages/'{$tainted}'.php");
<?php
if (http_is_post()) {
if ($_POST['form_action'] == 'newuser') {
if ($user = $g->add_user($_POST)) {
Fu_Feedback::set_flash('user added');
http_redirect(http_request_uri());
}
}
}
$users = $g->get_users();
include 'giiki/theme/_header.php';
?>
<div id="wrapper" class="wat-cf">
<div id="main">
<div class="block" id="">
<div class="content">
<h2 class="title">Manage Users</h2>
<div class="inner">
<!-- messages //-->
<?php
app_show_feedback();
?>
<table class="table">
<tr>
<th class="first">Name</th>
<th>Email</th>
<th>Admin?</th>
<th class="last"></th>
three paragraphs appear in all copies of this software.
IN NO EVENT SHALL AUTHORS BE LIABLE TO ANY PARTY FOR DIRECT,
INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN IF AUTHORS HAVE
BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
AUTHORS SPECIFICALLY DISCLAIM ANY WARRANTIES INCLUDING, BUT NOT
LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
THE SOFTWARE IS PROVIDED ON AN "AS-IS" BASIS AND AUTHORS HAVE NO
OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR
MODIFICATIONS.*/
$tainted = $_SESSION['UserData'];
$sanitized = filter_var($tainted, FILTER_SANITIZE_MAGIC_QUOTES);
$tainted = $sanitized;
//flaw
$var = http_redirect("'" . $tainted . ".php'");
$parto = "kontroli";
if (!kontrolu_daton($naskigxdato) or $sekso != "ina" and $sekso != "vira") {
$parto = "korektigi";
}
malplentesto($nomo);
malplentesto($personanomo);
if (KAMPOELEKTO_IJK) {
malplentesto($adreso);
} else {
malplentesto($strato);
}
malplentesto($urbo);
//malplentesto($posxtkodo);
}
$_SESSION["partoprenanto"]->kopiu();
if ($parto == "korektigi") {
require "partoprenanto.php";
} else {
//Enmeti la datumojn en la datumaro
if ($_SESSION["ago"] != "sxangxi") {
$_SESSION["partoprenanto"]->kreu();
}
$_SESSION["partoprenanto"]->skribu();
rekalkulu_agxojn("partoprenanto");
$_SESSION["partoprenanto"] = new Partoprenanto($_SESSION["partoprenanto"]->datoj[ID]);
if (!$_SESSION["sekvontapagxo"]) {
$_SESSION["sekvontapagxo"] = "partopreno.php?sp=partrezultoj.php";
}
unset($parto);
http_redirect($_SESSION["sekvontapagxo"], null, false, 303);
}
any purpose, provided that the above copyright notice and the following
three paragraphs appear in all copies of this software.
IN NO EVENT SHALL AUTHORS BE LIABLE TO ANY PARTY FOR DIRECT,
INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN IF AUTHORS HAVE
BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
AUTHORS SPECIFICALLY DISCLAIM ANY WARRANTIES INCLUDING, BUT NOT
LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
THE SOFTWARE IS PROVIDED ON AN "AS-IS" BASIS AND AUTHORS HAVE NO
OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR
MODIFICATIONS.*/
$tainted = $_GET['UserData'];
//no_sanitizing
//flaw
$var = http_redirect("'{$tainted}'.php");
<?php
cerrar_sesion();
http_redirect('login.php');
