WordPress.org
Get WordPress

Plugin Directory

Changeset 503776


Ignore:
Timestamp:
02/11/2012 10:24:01 PM (14 years ago)
Author:
tobig
Message:

Check for sql injection by '";
Plugin work automatic without code in 404 template

Location:
404like/trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • 404like/trunk/404Like.php

    r317709 r503776  
    44 Plugin URI: http://www.gnetos.de/projekte/404Like
    55 Description: Es wird keine 404 Fehlermeldung ausgegeben, sondern nach ähnlichen Seiten gesucht und auf eventuelle Treffer weitergeleitet oder eine Liste möglicher Treffer ausgegeben / It is not issued any 404 error message, but looking for similar sites and forwarded to any results or output a list of possible matches
    6  Version: 1.0
     6 Version: 1.0.2
    77 Author: Tobias Gafner
    88 Author URI: http://www.gnetos.de
    … …  
    2929 */
    3030function findPostWhereLikeNameTitle($title = "") {
     31    $title = strtolower($title);
    3132    $where .= " (post_type = 'post' OR post_type = 'page') AND
    32     post_status = 'publish' AND (post_name like '%".$title."%' OR post_title like '%".$title."%')";
     33    post_status = 'publish' AND (LOWER(post_name) like '%".$title."%' OR post_title like '%".$title."%')";
    3334    return $where;
    3435}
    … …  
    3738 */
    3839function findPostWhereLike($title = "") {
     40    $title = strtolower($title);
    3941    $where = " (post_type = 'post' OR post_type = 'page') AND
    40     post_status = 'publish' AND (post_title like '%".$title."%')";
     42    post_status = 'publish' AND (LOWER(post_title) like '%".$title."%')";
    4143    return $where;
    4244}
    … …  
    5355function checkPage() {
    5456    global $wpdb;
     57   
     58    if ( !is_404() )
     59    return;
    5560
    5661  $urltext =  $_SERVER['REQUEST_URI'];
    … …  
    5863    $urltext = trim($urltext);
    5964  //Letztes / loeschen
     65  //schuetzen
    6066  $urltext = htmlspecialchars($urltext);
    6167  if(strlen($urltext) != 0)   {
    … …  
    6773    $searchWord =   substr (strrchr ($urltext, "/"), 1);
    6874    //SQL
     75    $searchWord = stripslashes($searchWord);
     76    $searchWord = str_replace ("'", "", $searchWord);
     77    $searchWord = str_replace ('"', "", $searchWord);
     78    $searchWord = str_replace (';', "", $searchWord);
    6979    $querystr = "SELECT * FROM $wpdb->posts WHERE ".findPostWhereLike($searchWord);
    7080    $pageposts = $wpdb->get_col($querystr);
    7181    if ($pageposts) {
    7282      ob_start();
    73         if (count($pageposts) == 1) {
     83     
     84        if (count($pageposts) == 1 || ($searchWord == "404Like" || $searchWord == "404like")) {
    7485        foreach ($pageposts as $id) {
    7586          $url = get_permalink($id);
    … …  
    7788          wp_redirect($url,301);
    7889          // Okay, stop.
     90          break;
    7991        }         
    8092       
    … …  
    113125    if ($pageposts) {
    114126    //Ausgabe
    115       echo '<div id="errorresults"><h2 class="twost">Folgendes Gesucht ?</h2><ul>';
     127      echo '<div id="errorresults"><h2 class="twost">'.__("Folgendes Gesucht").' ?</h2><ul>';
    116128        foreach ($pageposts as $id) {
    117129        $post_id_7 = get_post($id);
    … …  
    126138    }
    127139}
     140
     141function plugin404Like_filter($redirect, $request) {
     142
     143    if ( is_404() ) {return false;}
     144    return $redirect;
     145}
     146
     147add_action( 'template_redirect', 'checkPage' );
     148add_filter( 'redirect_canonical', 'plugin404Like_filter', 10, 2 );
    128149?>

  • 404like/trunk/readme.txt

    r317709 r503776  
    44Tags: 404, not found
    55Requires at least: 2.7.0
    6 Tested up to: 3.0
     6Tested up to: 3.3.0
    77Stable tag: trunk
    88
    … …  
    17171. Upload `404Like.php` to the `/wp-content/plugins/` directory
    18182. Activate the plugin through the 'Plugins' menu in WordPress
    19 3. Place `<?php checkPage(); ? >` in first line of your 404 template page.
     193. Nothing, it works without any other activities - you can test it
    20204. Optional add < ? php new404ErrorPage(); ? >  to your 404 template page.
Note: See TracChangeset for help on using the changeset viewer.