LinkBack URL
About LinkBacks
Sicherheitsfragen in eigenem Code
Hallo liebe Joomlagemeinde
Ich habe mir vor kurzen nen kleines Gästebuch geschrieben weil ich die bisherigen irgendwie als etwas überladen empfand.... Da ich auch sonst meine Scripte in diesem Schreibstil schreibe und mir noch nicht so viele Gedanken über mögliche SicherheitsRisiken gemacht habe, wollt ich einfach mal Fragen ob der Code so okay wär.
Bin da noch nich lange dabei, hoffe aber noch viel zu lernen
Code is verkürzt.... überfliegen reicht aus
Hab schon einiges über MySql Injection gelesen, mich jedoch darauf verlassen das das von Joomla verwendete JRequest::getVar() ausreicht.PHP-Code:<?php
// TOBI Guestbook Extension
defined('_JEXEC') or die('Restricted access');
require_once (JPATH_COMPONENT.DS.'controller.php');
$controller = new lostrommelController();
$controller->execute( true );
$controller->redirect();
$language = &JFactory::getLanguage();
$language->load('com_jwallet', JPATH_BASE .DS.'components'.DS.'com_jwallet');
$task = JRequest::getVar('extension');
$profileid = JRequest::getVar('profileid');
switch ($task){
case "showuserguestbook":
show_user_guestbook($option);
break;
case "showmyguestbook":
show_my_guestbook($option);
break;
case "composeguestbookentry";
compose_guestbook_entry($option);
break;
default:
compose_guestbook_entry($option);
}
function show_user_guestbook() {
$user = & JFactory::getUser();
$userid = $user->get('id');
$username = $user->get('username');
$profileid = JRequest::getVar('profileid');
$db = &JFactory::getDbo();
$query = "SELECT username FROM #__users WHERE id = '".$profileid."'";
$db->setQuery($query);
$profilename = $db->loadResult();
echo $profilename."'s Guestbook";
if ($userid!=$profileid){
echo '<br><a href="index.php?option=com_jwallet&todo=guestbook&extension=composeguestbookentry&profileid='.$profileid;
echo '">Beitrag schreiben</a>';
}
echo '<link rel="stylesheet" type="text/css" href="components/com_jwallet/views/jwallet/tmpl/table.css">';
$query = "SELECT * FROM #__jwallet_guestbook Where recieverid = '".$profileid."' ORDER BY date DESC";
$db->setQuery($query);
if ( !$db->query() ) {
echo "<script type='text/javascript'>
alert('".$db->getErrorMsg()."');
</script>";
return false;
} else {
$rows = $db->loadObjectList();
}
echo '<div class="tbody">';
echo '</div><br>';
echo '<table >';
echo '<div class="tbody">';
echo '<td>Von</td><td>Bild</td><td>Headline</td><td>Text</td><td>Datum</td>';
foreach( $rows as $row ) {
$headline = $row->headline;
$text = $row->text;
$senderid = $row->senderid;
$date = $row->date;
$query = "SELECT thumb FROM #__community_users WHERE userid = '".$senderid."'";
$db->setQuery($query);
$thumb = $db->loadResult();
$query = "SELECT username FROM #__users WHERE id = '".$senderid."'";
$db->setQuery($query);
$sendername = $db->loadResult();
$datum = date("d.m.Y",$date);
$uhrzeit = date("H:i",$date);
$text=str_replace(":DD",'<img src="components/com_jwallet/smileys/grin.png" border=0 height=30 width=30>',$text);
echo '<tr>';
echo '<td>';
echo '<a href = "index.php?&option=com_community&view=profile&userid='.$senderid.'">'.$sendername.'</a>';
echo '<td/>';
echo '<a href = "index.php?&option=com_community&view=profile&userid='.$senderid.'"><img src="'.$thumb.'" width="60" height="60" alt="BILD"></a>';
echo '</td>';
echo '<td>';
echo $headline;
echo '</td>';
echo '<td>';
echo '<div class="ssmed">';
echo $text;
echo '</div>';
echo '</td>';
echo '<td>';
echo $datum.'<br>'.$uhrzeit.' Uhr';
echo '</td>';
echo '</div>';
echo '</tr>';
}
echo '</div>';
echo '</table>';
}
function show_my_guestbook() {
$user = & JFactory::getUser();
$userid = $user->get('id');
$username = $user->get('username');
$profileid = JRequest::getVar('profileid');
$read = JRequest::getVar('read');
$db = &JFactory::getDbo();
$message = JRequest::getVar('message');
if($message=="1") {
echo JText::_( 'JWALLETENTRYDELETESUCCESS' ).'<br>';
} else if($message=="2") {
echo JText::_( 'JWALLETENTRYDELETEFAILED' ).'<br>';
}
if ($read=1) {
$query = "UPDATE #__jwallet_guestbook SET unread = 0 WHERE recieverid='".$userid."'";
$db->setQuery($query);
$result = $db->query();
if (mysql_errno()) die ("MySQL-Error: " . mysql_error());
}
echo $username."'s Guestbook";
echo '<link rel="stylesheet" type="text/css" href="components/com_jwallet/views/jwallet/tmpl/table.css">';
$query = "SELECT * FROM #__jwallet_guestbook Where recieverid = '".$userid."' ORDER BY date DESC";
$db->setQuery($query);
if ( !$db->query() ) {
echo "<script type='text/javascript'>
alert('".$db->getErrorMsg()."');
</script>";
return false;
} else {
$rows = $db->loadObjectList();
}
if (empty($rows)) {
echo '<br><br><div align="center"><img src="http://www.joomlaportal.de/images/totehose.jpg" align="center" alt="Keine Einträge" width="230" height="250"></div>';
} else {
echo '<div class="tbody">';
echo '</div><br>';
echo '<table >';
echo '<div class="tbody">';
echo '<td>Von</td><td>Bild</td><td>Headline</td><td>Text</td><td>Datum</td><td>löschen</td>';
foreach( $rows as $row ) {
$headline = $row->headline;
$text = $row->text;
$senderid = $row->senderid;
$date = $row->date;
$id = $row->id;
$query = "SELECT thumb FROM #__community_users WHERE userid = '".$senderid."'";
$db->setQuery($query);
$thumb = $db->loadResult();
$query = "SELECT username FROM #__users WHERE id = '".$senderid."'";
$db->setQuery($query);
$sendername = $db->loadResult();
$datum = date("d.m.Y",$date);
$uhrzeit = date("H:i",$date);
$eraseentrylink='<a href="index.php?option=com_jwallet&todo=eraseentry&site=guestbook&id='.$id.'"><img src="http://www.joomlaportal.de/images/cancel_f2.png" alt="löschen" width="15" height="15"></a>';
$text=str_replace(":DD",'<img src="components/com_jwallet/smileys/grin.png" border=0 height=30 width=30>',$text);
echo '<tr>';
echo '<td>';
echo '<a href = "index.php?&option=com_community&view=profile&userid='.$senderid.'">'.$sendername.'</a>';
echo '<td/>';
echo '<a href = "index.php?&option=com_community&view=profile&userid='.$senderid.'"><img src="'.$thumb.'" width="60" height="60" alt="BILD"></a>';
echo '</td>';
echo '<td>';
echo $headline;
echo '</td>';
echo '<td>';
echo '<div class="ssmed">';
echo $text;
echo '</div>';
echo '</td>';
echo '<td>';
echo $datum.'<br>'.$uhrzeit.' Uhr';
echo '</td>';
echo '<td>';
echo $eraseentrylink;
echo '</td>';
echo '</div>';
echo '</tr>';
}
echo '</div>';
echo '</table>';
}}
function compose_guestbook_entry() {
$user = & JFactory::getUser();
$userid = $user->get('id');
$username = $user->get('username');
$profileid = JRequest::getVar('profileid');
$submit = JRequest::getVar('submit');
$timestamp = time();
$db = &JFactory::getDbo();
$query = "SELECT username FROM #__users WHERE id = '".$profileid."'";
$db->setQuery($query);
$profilename = $db->loadResult();
if (isset($submit)){
$headline = JRequest::getVar('headline');
$textbox = JRequest::getVar('textbox');
$link = '<a href="index.php?option=com_community&view=profile&userid='.$profileid.'">'.JTEXT::_('GUESTBOOKREDIRECT4').'</a><br><br>';
if ($userid!=$profileid) {
$query = "INSERT INTO #__jwallet_guestbook" . "\n ( `senderid`,`recieverid`,`date`,`headline`,`text` )" . "\n VALUES" . "\n ( '$userid','$profileid','$timestamp','$headline','$textbox');";
$db->setQuery($query);
$result = $db->query();
if (mysql_errno()) die ("MySQL-Error: " . mysql_error());
echo JTEXT::_('GUESTBOOKCOMPOSEFINISH1').' '.$profilename.' '.JTEXT::_('GUESTBOOKCOMPOSEFINISH2').'<br>';
echo '<br><br>';
echo '<img src="http://www.joomlaportal.de/images/checkmark.jpg" align="right" "alt="" width="80" height="90" border="2">';
echo '<meta **********=*********
content="3; url=index.php?option=com_community&view=profile&userid='.$profileid.'">';
echo '<br><br>';
echo JTEXT::_('GUESTBOOKREDIRECT').$profilename.JTEXT::_('GUESTBOOKREDIRECT2').'<br><br>'.JTEXT::_('GUESTBOOKREDIRECT3').$link;
echo '<br>';
} else {
echo JTEXT::_('GUESTBOOKMISTAKE');
}} else {
echo $profilename.' '.JTEXT::_('GUESTBOOKCOMPOSE').'<br>';
?>
<script languag="JavaScript">
function addsmiley(smiley)
{
document.guestbook.textbox.value=document.guestbook.textbox.value+' '+smiley;
document.guestbook.textbox.focus();
}
</script>
<a href="javascript: addsmiley(':DD')"><img src="components/com_jwallet/smileys/grin.png" alt="" width="60" height="60" border="0"></a>
<?php
echo '<form id="guestbook" name="guestbook" action="index.php?option=com_jwallet&todo=guestbook&extension=composeguestbookentry&profileid='.$profileid.'" method="post"><br>';
echo 'Headline: <br><textarea name="headline" cols="60" rows="1" value="'.$headline.'"></textarea><br>';
echo 'Text:<br><textarea name="textbox" size="300" cols="60" rows="10" value="'.$text.'"></textarea><br>';
echo '<input type="submit" name="submit">';
echo '</form>';
}}
?>
Auch würd ich gerne Wissen obs okay ist wenn man die Pfade in Klartext überall reinschreibt oder ob das egal ist ....
hoffe ihr habt nen guten Rat, das ich mich auf den sicheren Weg befinde
Gruß
Tobi
Zitieren
Zitat von rollerueckwaerts
Lesezeichen