webstart.php 1.5 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455
  1. <?php
  2. if ( ini_get( 'register_globals' ) ) {
  3. if ( isset( $_REQUEST['GLOBALS'] ) ) {
  4. die( '<a href="http://www.hardened-php.net/index.76.html">$GLOBALS overwrite vulnerability</a>');
  5. }
  6. $verboten = array(
  7. 'GLOBALS',
  8. '_SERVER',
  9. 'HTTP_SERVER_VARS',
  10. '_GET',
  11. 'HTTP_GET_VARS',
  12. '_POST',
  13. 'HTTP_POST_VARS',
  14. '_COOKIE',
  15. 'HTTP_COOKIE_VARS',
  16. '_FILES',
  17. 'HTTP_POST_FILES',
  18. '_ENV',
  19. 'HTTP_ENV_VARS',
  20. '_REQUEST',
  21. '_SESSION',
  22. 'HTTP_SESSION_VARS'
  23. );
  24. foreach ( $_REQUEST as $name => $value ) {
  25. if( in_array( $name, $verboten ) ) {
  26. header( "HTTP/1.x 500 Internal Server Error" );
  27. echo "register_globals security paranoia: trying to overwrite superglobals, aborting.";
  28. die( -1 );
  29. }
  30. unset( $GLOBALS[$name] );
  31. }
  32. }
  33. function &fix_magic_quotes( &$arr ) {
  34. if ( get_magic_quotes_gpc() ) {
  35. foreach( $arr as $key => $val ) {
  36. if( is_array( $val ) ) {
  37. fix_magic_quotes( $arr[$key] );
  38. } else {
  39. $arr[$key] = stripslashes( $val );
  40. }
  41. }
  42. }
  43. return $arr;
  44. }
  45. fix_magic_quotes( $_COOKIE );
  46. fix_magic_quotes( $_ENV );
  47. fix_magic_quotes( $_GET );
  48. fix_magic_quotes( $_POST );
  49. fix_magic_quotes( $_REQUEST );
  50. ?>