diff --git a/src/system/common.inc.php b/src/system/common.inc.php index 41c908c3..55c9f5ae 100755 --- a/src/system/common.inc.php +++ b/src/system/common.inc.php @@ -6,12 +6,16 @@ * @license https://www.dedebiz.com/license * @link https://www.dedebiz.com */ -//生产环境使用production，如果采用dev模式，会有一些php的报错信息提示，便于开发调试 +//生产环境使用`production`，如果采用`dev`模式，会有一些php的报错信息提示，便于开发调试 if (!defined('DEDE_ENVIRONMENT')) { - define('DEDE_ENVIRONMENT', 'production'); + define('DEDE_ENVIRONMENT', 'dev'); } if (!defined('DEBUG_LEVEL')) { - define('DEBUG_LEVEL', FALSE);//如果设置为TRUE则会打印执行SQL的时间和标签加载时间方便调试 + if (DEDE_ENVIRONMENT == 'production') { + define('DEBUG_LEVEL', FALSE); + } else { + define('DEBUG_LEVEL', TRUE); + } } if (DEDE_ENVIRONMENT == 'production') { ini_set('display_errors', 0); diff --git a/src/system/dedetag.class.php b/src/system/dedetag.class.php index 6b10dd4d..b85f9ff5 100755 --- a/src/system/dedetag.class.php +++ b/src/system/dedetag.class.php @@ -567,6 +567,14 @@ class DedeTagParse $phpcode = $refObj->GetInnerText(); } $phpcode = preg_replace("/'@me'|\"@me\"|@me/i", '$DedeMeValue', $phpcode); + // 校验代码安全 + $error = checkCode($phpcode); + if ($error) { + if (DEBUG_LEVEL) { + echo htmlErrors($error); + } + return; + } try { @eval($phpcode); $this->CTags[$i]->TagValue = $DedeMeValue; @@ -807,6 +815,13 @@ class DedeTagParse $functionname = str_replace("\"}", "\"]", $functionname); $functionname = preg_replace("/'@me'|\"@me\"|@me/i", '$DedeFieldValue', $functionname); $functionname = "\$DedeFieldValue = ".$functionname; + $error = checkCode($functionname); + if ($error) { + if (DEBUG_LEVEL) { + echo htmlErrors($error); + } + return ""; + } try { @eval($functionname.";"); if (empty($DedeFieldValue)) { diff --git a/src/system/helpers/channelunit.helper.php b/src/system/helpers/channelunit.helper.php index f74b6805..b3d3c26a 100755 --- a/src/system/helpers/channelunit.helper.php +++ b/src/system/helpers/channelunit.helper.php @@ -412,10 +412,15 @@ function FormatScript($atme) function FillAttsDefault(&$atts, $attlist) { $attlists = explode(',', (string)$attlist); - for ($i = 0; isset($attlists[$i]); $i++) { - list($k, $v) = explode('|', $attlists[$i]); - if (!isset($atts[$k])) { - $atts[$k] = $v; + if (is_array($attlists)) { + for ($i = 0; isset($attlists[$i]); $i++) { + if (empty($attlists[$i])) { + continue; + } + list($k, $v) = explode('|', $attlists[$i]); + if (!isset($atts[$k])) { + $atts[$k] = $v; + } } } } diff --git a/src/system/helpers/code.helper.php b/src/system/helpers/code.helper.php new file mode 100644 index 00000000..eb1a176d --- /dev/null +++ b/src/system/helpers/code.helper.php @@ -0,0 +1,459 @@ +'); + $errors = array(); + $braces = 0; + foreach ($tokens as $token) { + if ($token == '{') $braces = $braces + 1; + else if ($token == '}') $braces = $braces - 1; + if ($braces < 0) { + $errors[0]['name'] = 'Syntax error.'; + break; + } + } + if (empty($errors)) { + if ($braces) $errors[0]['name'] = 'Unbalanced braces.'; + } else if (!evalCode($code)) { + $errors[0]['name'] = 'Syntax error.'; + } + if (empty($errors)) foreach ($disallowedExpressions as $disallowedExpression) { + unset($matches); + preg_match($disallowedExpression, $code, $matches); + if ($matches) { + $errors[0]['name'] = 'Execution operator / variable function name / variable variable name detected.'; + break; + } + } + if (empty($errors)) { + unset($tokens[0]); + unset($tokens[0]); + array_pop($tokens); + array_pop($tokens); + $i = 0; + foreach ($tokens as $key => $token) { + $i++; + if (is_array($token)) { + $id = token_name($token[0]); + switch ($id) { + case ('T_STRING'): + if (in_array($token[1], $allowedCalls) === false) { + $errors[$i]['name'] = 'Illegal function: ' . $token[1]; + $errors[$i]['line'] = $token[2]; + } + break; + default: + if (in_array($id, $allowedTokens) === false) { + $errors[$i]['name'] = 'Illegal token: ' . $token[1]; + $errors[$i]['line'] = $token[2]; + } + break; + } + } + } + } + if (!empty($errors)) { + return $errors; + } +} +// 错误提示 +function htmlErrors($errors = null) +{ + if ($errors) { + $errorsHTML = "
"; + $errorsHTML .= 'PHP内嵌脚本错误：'; + $errorsHTML .= '
'; + foreach ($errors as $error) { + if ($error['line']) { + $errorsHTML .= '
Line ' . $error['line'] . '
'; + } + $errorsHTML .= '
' . $error['name'] . '
'; + } + $errorsHTML .= '
'; + $errorsHTML .= "
\r\n"; + echo $errorsHTML; + } +} diff --git a/src/system/taglib/php.lib.php b/src/system/taglib/php.lib.php index e6c8bf95..a1be0cd2 100755 --- a/src/system/taglib/php.lib.php +++ b/src/system/taglib/php.lib.php @@ -12,10 +12,16 @@ if (!defined('DEDEINC')) exit('dedebiz'); function lib_php(&$ctag, &$refObj) { global $dsql; - global $db; $phpcode = trim($ctag->GetInnerText()); if ($phpcode == '') return ''; + $error = checkCode($phpcode); + if ($error) { + if (DEBUG_LEVEL) { + echo htmlErrors($error); + } + return ""; + } ob_start(); extract($GLOBALS, EXTR_SKIP); @eval($phpcode); diff --git a/src/system/taglib/tag.lib.php b/src/system/taglib/tag.lib.php index 86158609..7ccef6ff 100755 --- a/src/system/taglib/tag.lib.php +++ b/src/system/taglib/tag.lib.php @@ -1,4 +1,5 @@ {dede:field.title/}-{dede:global.cfg_webname/} - - + + + + + - {dede:include filename="head.htm"/} -
-
-
- 当前位置: 主页 > {dede:field name='title'/} -
-
-
-

{dede:field.title/}

-
-
- 　{dede:field.body/} -
-
+ {dede:include filename='top.htm'/} + {dede:include filename='header.htm'/} + {dede:include filename='navbar.htm'/} +
+
+
-
-
-
-
相关页面
-
- -
-
+
+
+
+
+

{dede:field.title/}

+
{dede:field.body/}
+ +
-
+ {dede:include filename="footer.htm"/} \ No newline at end of file