WordPress.org
Get WordPress

Plugin Directory

Changeset 1371522


Ignore:
Timestamp:
03/15/2016 12:26:36 PM (10 years ago)
Author:
justincampo
Message:

Security Update

Location:
visitoraudit/trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • visitoraudit/trunk/visitor-audit.admin.php

    r1365893 r1371522  
    8282        $table["columns"] = array("ID", "IP Address","IP Fowarded", "Last Visit", "Page/Error Per Minute", "Status", "Actions");
    8383        $table["rows"] = array();
    84         $results = $this->db->get_results("SELECT * FROM ". $this->db->prefix . "visitor_audit");
     84        $results = $this->db->get_results("SELECT * FROM ". $this->db->prefix . "visitor_audit LIMIT 1000");
    8585        if (isset($results) AND is_array($results) AND count($results)){
    8686            $original_id = $this->system->id;
    … …  
    135135        $table["columns"] = array("ID", "IP Address", "IP Fowarded", "Banned Time", "Action");
    136136        $table["rows"] = array();
    137         $results = $this->db->get_results("SELECT * FROM ". $this->db->prefix . "visitor_audit_banned");
     137        $results = $this->db->get_results("SELECT * FROM ". $this->db->prefix . "visitor_audit_banned LIMIT 1000");
    138138        if (isset($results) AND is_array($results) AND count($results)){
    139139            foreach ($results as $result){
    … …  
    279279        if ($id){
    280280            $divider = "----------------------------------------------------------------------------<br>";
    281             $query = $this->db->prepare("SELECT * FROM ". $this->db->prefix . "visitor_audit_history WHERE visitor_audit_id = %d", $id);
     281            $query = $this->db->prepare("SELECT * FROM ". $this->db->prefix . "visitor_audit_history WHERE visitor_audit_id = %d LIMIT 1000", $id);
    282282            $results = $this->db->get_results($query);         
    283283 
    … …  
    358358        if (!empty($_REQUEST["visitor_audit_id"])){ $id = (int)$_REQUEST["visitor_audit_id"]; }
    359359        if ($id){
    360             $query = $this->db->prepare("SELECT * FROM ". $this->db->prefix . "visitor_audit WHERE visitor_audit_id = %d", $id);
     360            $query = $this->db->prepare("SELECT * FROM ". $this->db->prefix . "visitor_audit WHERE visitor_audit_id = %d LIMIT 1", $id);
    361361            $result = $this->db->get_results($query); 
    362362            if (!empty($result[0]->visitor_audit_ip)){

  • visitoraudit/trunk/visitor-audit.class.php

    r1365893 r1371522  
    155155                $banned_status = true;
    156156                if ($result[0]->visitor_audit_banned_type == 1){ $this->banned_retention = 0; } //indefinite
    157             }           
     157            }
    158158        }
    159159        //if visitor meets critiria block them
    … …  
    243243        $insert["visitor_audit_ip_forwarded"] = $this->ip_forwarded;       
    244244        if (!empty($_SERVER['HTTP_USER_AGENT'])) {
    245             $insert["visitor_audit_useragent"] = $_SERVER['HTTP_USER_AGENT'];
     245            $insert["visitor_audit_useragent"] = preg_replace("/[^a-zA-Z0-9-_. ]/", "", $_SERVER['HTTP_USER_AGENT']);
    246246        }       
    247247        if (!empty($_SERVER['HTTP_REFERER'])) {
    248             $insert["visitor_audit_referer"] = $_SERVER['HTTP_REFERER'];
     248            $insert["visitor_audit_referer"] = preg_replace("/[^a-zA-Z0-9-_. ]/", "", $_SERVER['HTTP_REFERER']);
    249249        }           
    250250        $this->db->insert($this->db->prefix . "visitor_audit", $insert);
    … …  
    423423    {
    424424        if (!empty($_SERVER['REMOTE_ADDR'])){
    425              return $_SERVER['REMOTE_ADDR'];
     425            return preg_replace("/[^0-9:. ]/", "", $_SERVER['REMOTE_ADDR']);
    426426        } else {
    427427            return 0;           
    … …  
    437437    {
    438438        if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])){
    439             return $_SERVER['HTTP_X_FORWARDED_FOR'];
     439            return preg_replace("/[^0-9:. ]/", "", $_SERVER['HTTP_X_FORWARDED_FOR']);
    440440        } else {
    441441            return 0;           
Note: See TracChangeset for help on using the changeset viewer.