Download as
Browse Code »

Commit 7c88dae9ccb34af71efe11552fd0a1f10d2a4523

Authored by Edmar Moretti
1 parent 1494bbaf
Exists in master and in 7 other branches composer, doc-root, docker, guia, licenca, readme, unmaintened

--no commit message

Showing 9 changed files with 17 additions and 7 deletions   Show diff stats
admin/php/admin.php
  Diff comments   View file @7c88dae
@@ -198,6 +198,8 @@ function pegaDados($sql,$locaplic="") @@ -198,6 +198,8 @@ function pegaDados($sql,$locaplic="")
198 */ 198 */
199 include(dirname(__FILE__)."/conexao.php"); 199 include(dirname(__FILE__)."/conexao.php");
200 error_reporting(0); 200 error_reporting(0);
  201 + //$dbh deve ser definido com somente leitura, mas por prevencao:
  202 + $sql = str_ireplace(array("update","delete","insert","--","drop",";"),"",$sql);
201 $q = $dbh->query($sql,PDO::FETCH_ASSOC); 203 $q = $dbh->query($sql,PDO::FETCH_ASSOC);
202 if($q) 204 if($q)
203 { 205 {
admin/php/classe_arvore.php
  Diff comments   View file @7c88dae
@@ -873,6 +873,7 @@ class Arvore @@ -873,6 +873,7 @@ class Arvore
873 { 873 {
874 //echo "<br>".$sql; 874 //echo "<br>".$sql;
875 //error_reporting(0); 875 //error_reporting(0);
  876 + $sql = str_ireplace(array("update","delete","insert","--","drop",";"),"",$sql);
876 $q = $this->dbh->query($sql,PDO::FETCH_ASSOC); 877 $q = $this->dbh->query($sql,PDO::FETCH_ASSOC);
877 if($q) 878 if($q)
878 { 879 {
admin/php/classe_metaestat.php
  Diff comments   View file @7c88dae
@@ -183,8 +183,7 @@ class Metaestat{ @@ -183,8 +183,7 @@ class Metaestat{
183 * @return Array 183 * @return Array
184 */ 184 */
185 function execSQL($sql,$id="",$convTexto=true){ 185 function execSQL($sql,$id="",$convTexto=true){
186 - $buscar = array("drop","update","insert","delete");  
187 - $sql = str_ireplace($buscar,"",$sql); 186 + $sql = str_ireplace(array("update","delete","insert","--","drop",";"),"",$sql);
188 try { 187 try {
189 $q = $this->dbh->query($sql,PDO::FETCH_ASSOC); 188 $q = $this->dbh->query($sql,PDO::FETCH_ASSOC);
190 } 189 }
admin/php/login.php
  Diff comments   View file @7c88dae
@@ -268,6 +268,8 @@ function autenticaUsuario($usuario,$senha){ @@ -268,6 +268,8 @@ function autenticaUsuario($usuario,$senha){
268 include(dirname(__FILE__)."/conexao.php"); 268 include(dirname(__FILE__)."/conexao.php");
269 $senhamd5 = md5($senha); 269 $senhamd5 = md5($senha);
270 //verifica se o usuario esta cadastrado no ms_configura.php em $i3geomaster 270 //verifica se o usuario esta cadastrado no ms_configura.php em $i3geomaster
  271 + //echo "select * from ".$esquemaadmin."i3geousr_usuarios where login = '$usuario' and (senha = '$senhamd5' or senha = '$senha') and ativo = 1";exit;
  272 + //exit;
271 if(verificaMaster($usuario,$senha) == true){ 273 if(verificaMaster($usuario,$senha) == true){
272 $pa = pegaDados("select * from ".$esquemaadmin."i3geousr_papelusuario ",$locaplic); 274 $pa = pegaDados("select * from ".$esquemaadmin."i3geousr_papelusuario ",$locaplic);
273 $op = pegadados("SELECT O.codigo FROM ".$esquemaadmin."i3geousr_operacoes AS O"); 275 $op = pegadados("SELECT O.codigo FROM ".$esquemaadmin."i3geousr_operacoes AS O");
classesphp/pega_variaveis.php
  Diff comments   View file @7c88dae
@@ -60,8 +60,10 @@ if (isset($_GET)) @@ -60,8 +60,10 @@ if (isset($_GET))
60 { 60 {
61 foreach(array_keys($_GET) as $k) 61 foreach(array_keys($_GET) as $k)
62 { 62 {
  63 + $k = str_ireplace(array(" ","delete","drop","update","insert","exec","system",";"),"",$k);
63 if ($_GET[$k] != "''"){ 64 if ($_GET[$k] != "''"){
64 $v = strip_tags($_GET[$k]); 65 $v = strip_tags($_GET[$k]);
  66 + $v = str_ireplace(array("delete","drop","update","insert","exec","system",";"),"",$v);
65 eval("\$".$k."='".(trim($v))."';"); 67 eval("\$".$k."='".(trim($v))."';");
66 } 68 }
67 } 69 }
@@ -72,8 +74,11 @@ if (isset($_POST)) @@ -72,8 +74,11 @@ if (isset($_POST))
72 //var_dump($_POST);exit; 74 //var_dump($_POST);exit;
73 foreach(array_keys($_POST) as $k) 75 foreach(array_keys($_POST) as $k)
74 { 76 {
  77 + $k = str_ireplace(array(" ","delete","drop","update","insert","exec","system",";"),"",$k);
  78 + $_POST[$k] = str_ireplace(array("delete","drop","update","insert","exec","system",";"),"",$_POST[$k]);
75 if (($_POST[$k] != "''")) 79 if (($_POST[$k] != "''"))
76 eval("\$".$k."='".(strip_tags(trim($_POST[$k])))."';"); 80 eval("\$".$k."='".(strip_tags(trim($_POST[$k])))."';");
  81 +
77 if (($_POST[$k] != "''") && ($k == "cpaint_argument")) 82 if (($_POST[$k] != "''") && ($k == "cpaint_argument"))
78 { 83 {
79 foreach($_POST["cpaint_argument"] as $argumento_) 84 foreach($_POST["cpaint_argument"] as $argumento_)
ferramentas/parametrossql/exec.php
  Diff comments   View file @7c88dae
@@ -76,9 +76,9 @@ switch (strtoupper($funcao)) @@ -76,9 +76,9 @@ switch (strtoupper($funcao))
76 $chaves = implode(",",$chaves); 76 $chaves = implode(",",$chaves);
77 $filtro = $layer1->getFilterString(); 77 $filtro = $layer1->getFilterString();
78 if(!empty($valores)){ 78 if(!empty($valores)){
79 - $chaves = str_ireplace(array(" and ", " or ", "select","from","where","update","delete","insert","--"),"",$chaves); 79 + $chaves = str_ireplace(array(" and ", " or ", "select","from","where","update","delete","insert","--","drop",";"),"",$chaves);
80 $chaves = explode(",",$chaves); 80 $chaves = explode(",",$chaves);
81 - $valores = str_ireplace(array(" and ", " or ", "select","from","where","update","delete","insert","--"),"",$valores); 81 + $valores = str_ireplace(array(" and ", " or ", "select","from","where","update","delete","insert","--","drop",";"),"",$valores);
82 $valores = explode(",",strip_tags($valores)); 82 $valores = explode(",",strip_tags($valores));
83 $n = count($chaves); 83 $n = count($chaves);
84 for($i = 0; $i < $n; $i++){ 84 for($i = 0; $i < $n; $i++){
ferramentas/parametrossql/index.js
  Diff comments   View file @7c88dae
@@ -270,12 +270,13 @@ i3GEOF.parametrossql = { @@ -270,12 +270,13 @@ i3GEOF.parametrossql = {
270 p = i3GEO.editorOL.layerPorParametro("LAYERS",camada.name); 270 p = i3GEO.editorOL.layerPorParametro("LAYERS",camada.name);
271 //muda os parametros 271 //muda os parametros
272 if(p){ 272 if(p){
  273 + p.setVisibility(false);
  274 + p.clearGrid();
273 $i("i3GEOFparametrosSqlAplicar").innerHTML = "Aguarde..."; 275 $i("i3GEOFparametrosSqlAplicar").innerHTML = "Aguarde...";
274 reg = new RegExp("plugin" + "([=])+([a-zA-Z0-9_]*)"); 276 reg = new RegExp("plugin" + "([=])+([a-zA-Z0-9_]*)");
275 p.url = p.url.replace(reg, ""); 277 p.url = p.url.replace(reg, "");
276 p.url = p.url + "&plugin=" + valores.join(","); 278 p.url = p.url + "&plugin=" + valores.join(",");
277 p.setUrl(p.url+"&"); 279 p.setUrl(p.url+"&");
278 - p.setVisibility(false);  
279 p.setVisibility(true); 280 p.setVisibility(true);
280 } 281 }
281 i3GEO.janela.destroi("i3GEOF.parametrossql"); 282 i3GEO.janela.destroi("i3GEOF.parametrossql");
mashups/openlayers.php
  Diff comments   View file @7c88dae
@@ -277,7 +277,7 @@ if($temas != &quot;&quot;){ @@ -277,7 +277,7 @@ if($temas != &quot;&quot;){
277 if(in_array($tema,$visiveis)){ 277 if(in_array($tema,$visiveis)){
278 $visivel = "true"; 278 $visivel = "true";
279 } 279 }
280 - if($nlayers == 1 && strtoupper($layern->getmetadata("cache")) == "SIM"){ 280 + if($nlayers == 1 && strtoupper($layern->getmetadata("cache")) == "SIM" && $layern->getmetadata("PLUGINI3GEO") == ""){
281 if($layern->type != 2 && $layern->type != 3){ 281 if($layern->type != 2 && $layern->type != 3){
282 $opacidade = 1; 282 $opacidade = 1;
283 } 283 }
mashups/osm.php
  Diff comments   View file @7c88dae
@@ -279,7 +279,7 @@ if($temas != &quot;&quot;){ @@ -279,7 +279,7 @@ if($temas != &quot;&quot;){
279 } 279 }
280 // echo $visivel;exit; 280 // echo $visivel;exit;
281 // var_dump($visiveis);exit; 281 // var_dump($visiveis);exit;
282 - if($nlayers == 1 && strtoupper($layern->getmetadata("cache")) == "SIM"){ 282 + if($nlayers == 1 && strtoupper($layern->getmetadata("cache")) == "SIM" && $layern->getmetadata("PLUGINI3GEO") == ""){
283 if($layern->type != 2 && $layern->type != 3){ 283 if($layern->type != 2 && $layern->type != 3){
284 $opacidade = 1; 284 $opacidade = 1;
285 } 285 }