Download as
Browse Code »

Commit 7c88dae9ccb34af71efe11552fd0a1f10d2a4523

Authored by Edmar Moretti
1 parent 1494bbaf
Exists in master and in 7 other branches composer, doc-root, docker, guia, licenca, readme, unmaintened

--no commit message

Showing 9 changed files with 17 additions and 7 deletions   Show diff stats
admin/php/admin.php
  Diff comments   View file @7c88dae
... ... @@ -198,6 +198,8 @@ function pegaDados($sql,$locaplic="")
198 198 */
199 199 include(dirname(__FILE__)."/conexao.php");
200 200 error_reporting(0);
  201 + //$dbh deve ser definido com somente leitura, mas por prevencao:
  202 + $sql = str_ireplace(array("update","delete","insert","--","drop",";"),"",$sql);
201 203 $q = $dbh->query($sql,PDO::FETCH_ASSOC);
202 204 if($q)
203 205 {
... ...
admin/php/classe_arvore.php
  Diff comments   View file @7c88dae
... ... @@ -873,6 +873,7 @@ class Arvore
873 873 {
874 874 //echo "<br>".$sql;
875 875 //error_reporting(0);
  876 + $sql = str_ireplace(array("update","delete","insert","--","drop",";"),"",$sql);
876 877 $q = $this->dbh->query($sql,PDO::FETCH_ASSOC);
877 878 if($q)
878 879 {
... ...
admin/php/classe_metaestat.php
  Diff comments   View file @7c88dae
... ... @@ -183,8 +183,7 @@ class Metaestat{
183 183 * @return Array
184 184 */
185 185 function execSQL($sql,$id="",$convTexto=true){
186   - $buscar = array("drop","update","insert","delete");
187   - $sql = str_ireplace($buscar,"",$sql);
  186 + $sql = str_ireplace(array("update","delete","insert","--","drop",";"),"",$sql);
188 187 try {
189 188 $q = $this->dbh->query($sql,PDO::FETCH_ASSOC);
190 189 }
... ...
admin/php/login.php
  Diff comments   View file @7c88dae
... ... @@ -268,6 +268,8 @@ function autenticaUsuario($usuario,$senha){
268 268 include(dirname(__FILE__)."/conexao.php");
269 269 $senhamd5 = md5($senha);
270 270 //verifica se o usuario esta cadastrado no ms_configura.php em $i3geomaster
  271 + //echo "select * from ".$esquemaadmin."i3geousr_usuarios where login = '$usuario' and (senha = '$senhamd5' or senha = '$senha') and ativo = 1";exit;
  272 + //exit;
271 273 if(verificaMaster($usuario,$senha) == true){
272 274 $pa = pegaDados("select * from ".$esquemaadmin."i3geousr_papelusuario ",$locaplic);
273 275 $op = pegadados("SELECT O.codigo FROM ".$esquemaadmin."i3geousr_operacoes AS O");
... ...
classesphp/pega_variaveis.php
  Diff comments   View file @7c88dae
... ... @@ -60,8 +60,10 @@ if (isset($_GET))
60 60 {
61 61 foreach(array_keys($_GET) as $k)
62 62 {
  63 + $k = str_ireplace(array(" ","delete","drop","update","insert","exec","system",";"),"",$k);
63 64 if ($_GET[$k] != "''"){
64 65 $v = strip_tags($_GET[$k]);
  66 + $v = str_ireplace(array("delete","drop","update","insert","exec","system",";"),"",$v);
65 67 eval("\$".$k."='".(trim($v))."';");
66 68 }
67 69 }
... ... @@ -72,8 +74,11 @@ if (isset($_POST))
72 74 //var_dump($_POST);exit;
73 75 foreach(array_keys($_POST) as $k)
74 76 {
  77 + $k = str_ireplace(array(" ","delete","drop","update","insert","exec","system",";"),"",$k);
  78 + $_POST[$k] = str_ireplace(array("delete","drop","update","insert","exec","system",";"),"",$_POST[$k]);
75 79 if (($_POST[$k] != "''"))
76 80 eval("\$".$k."='".(strip_tags(trim($_POST[$k])))."';");
  81 +
77 82 if (($_POST[$k] != "''") && ($k == "cpaint_argument"))
78 83 {
79 84 foreach($_POST["cpaint_argument"] as $argumento_)
... ...
ferramentas/parametrossql/exec.php
  Diff comments   View file @7c88dae
... ... @@ -76,9 +76,9 @@ switch (strtoupper($funcao))
76 76 $chaves = implode(",",$chaves);
77 77 $filtro = $layer1->getFilterString();
78 78 if(!empty($valores)){
79   - $chaves = str_ireplace(array(" and ", " or ", "select","from","where","update","delete","insert","--"),"",$chaves);
  79 + $chaves = str_ireplace(array(" and ", " or ", "select","from","where","update","delete","insert","--","drop",";"),"",$chaves);
80 80 $chaves = explode(",",$chaves);
81   - $valores = str_ireplace(array(" and ", " or ", "select","from","where","update","delete","insert","--"),"",$valores);
  81 + $valores = str_ireplace(array(" and ", " or ", "select","from","where","update","delete","insert","--","drop",";"),"",$valores);
82 82 $valores = explode(",",strip_tags($valores));
83 83 $n = count($chaves);
84 84 for($i = 0; $i < $n; $i++){
... ...
ferramentas/parametrossql/index.js
  Diff comments   View file @7c88dae
... ... @@ -270,12 +270,13 @@ i3GEOF.parametrossql = {
270 270 p = i3GEO.editorOL.layerPorParametro("LAYERS",camada.name);
271 271 //muda os parametros
272 272 if(p){
  273 + p.setVisibility(false);
  274 + p.clearGrid();
273 275 $i("i3GEOFparametrosSqlAplicar").innerHTML = "Aguarde...";
274 276 reg = new RegExp("plugin" + "([=])+([a-zA-Z0-9_]*)");
275 277 p.url = p.url.replace(reg, "");
276 278 p.url = p.url + "&plugin=" + valores.join(",");
277 279 p.setUrl(p.url+"&");
278   - p.setVisibility(false);
279 280 p.setVisibility(true);
280 281 }
281 282 i3GEO.janela.destroi("i3GEOF.parametrossql");
... ...
mashups/openlayers.php
  Diff comments   View file @7c88dae
... ... @@ -277,7 +277,7 @@ if($temas != &quot;&quot;){
277 277 if(in_array($tema,$visiveis)){
278 278 $visivel = "true";
279 279 }
280   - if($nlayers == 1 && strtoupper($layern->getmetadata("cache")) == "SIM"){
  280 + if($nlayers == 1 && strtoupper($layern->getmetadata("cache")) == "SIM" && $layern->getmetadata("PLUGINI3GEO") == ""){
281 281 if($layern->type != 2 && $layern->type != 3){
282 282 $opacidade = 1;
283 283 }
... ...
mashups/osm.php
  Diff comments   View file @7c88dae
... ... @@ -279,7 +279,7 @@ if($temas != &quot;&quot;){
279 279 }
280 280 // echo $visivel;exit;
281 281 // var_dump($visiveis);exit;
282   - if($nlayers == 1 && strtoupper($layern->getmetadata("cache")) == "SIM"){
  282 + if($nlayers == 1 && strtoupper($layern->getmetadata("cache")) == "SIM" && $layern->getmetadata("PLUGINI3GEO") == ""){
283 283 if($layern->type != 2 && $layern->type != 3){
284 284 $opacidade = 1;
285 285 }
... ...