diff --git a/stamp/common.php b/stamp/common.php
index ff814dd..d99a23a 100644
--- a/stamp/common.php
+++ b/stamp/common.php
@@ -41,9 +41,9 @@
if($row['certid'] > 0)
{
if($row['org'] == 0)
- $query = "select * from `domaincerts` where `id`='$row[certid]' and `expire`>NOW() and `revoked`=0";
+ $query = "select * from `domaincerts` where `id`='".intval($row['certid'])."' and `expire`>NOW() and `revoked`=0";
else
- $query = "select * from `orgdomaincerts` where `id`='$row[certid]' and `expire`>NOW() and `revoked`=0";
+ $query = "select * from `orgdomaincerts` where `id`='".intval($row['certid'])."' and `expire`>NOW() and `revoked`=0";
if($_REQUEST['debug'] == 1)
echo $query."
\n";
$res = mysql_query($query);
@@ -117,7 +117,7 @@
if($org == 0)
{
$query = "SELECT *, sum(`points`) AS `total` FROM `users`, `notary` WHERE `users`.`id` = '$cert[memid]' AND
- `notary`.`to` = `users`.`id` and `notary`.`when` <= '$cert[issued]' GROUP BY `notary`.`to`";
+ `notary`.`to` = `users`.`id` and `notary`.`when` <= '$cert[issued]' and `notary`.`deleted`=0 GROUP BY `notary`.`to`";
$user = mysql_fetch_assoc(mysql_query($query));
} else {
$query = "select * from `orginfo` where `id`='$cert[orgid]'";
diff --git a/www/api/ccsr.php b/www/api/ccsr.php
index 403882f..b223168 100644
--- a/www/api/ccsr.php
+++ b/www/api/ccsr.php
@@ -31,7 +31,7 @@ require_once '../../includes/lib/check_weak_key.php';
foreach($_REQUEST['email'] as $email)
{
$email = mysql_real_escape_string(trim($email));
- $query = "select * from `email` where `memid`='$memid' and `hash`='' and `deleted`=0 and `email`='$email'";
+ $query = "select * from `email` where `memid`='".intval($memid)."' and `hash`='' and `deleted`=0 and `email`='$email'";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
{
@@ -42,7 +42,7 @@ require_once '../../includes/lib/check_weak_key.php';
}
if(count($emails) <= 0)
die("404,Wasn't able to match any emails sent against your account");
- $query = "select sum(`points`) as `points` from `notary` where `to`='$memid' group by `to`";
+ $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($memid)."' and `notary`.`deleted`=0 group by `to`";
$row = mysql_fetch_assoc(mysql_query($query));
$points = $row['points'];
@@ -62,12 +62,12 @@ require_once '../../includes/lib/check_weak_key.php';
$codesign = 1;
$CSR = trim($_REQUEST['optionalCSR']);
-
+
if (($weakKey = checkWeakKeyCSR($CSR)) !== "")
{
die("403, $weakKey");
}
-
+
$incsr = tempnam("/tmp", "ccsrIn");
$checkedcsr = tempnam("/tmp", "ccsrOut");
$fp = fopen($incsr, "w");
@@ -84,9 +84,9 @@ require_once '../../includes/lib/check_weak_key.php';
foreach($emails as $id => $email)
$csrsubject .= "/emailAddress=".$email;
- $query = "insert into `emailcerts` set `CN`='".$user['email']."', `keytype`='MS',
- `memid`='".$user['id']."', `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
- `subject`='$csrsubject', `codesign`='$codesign'";
+ $query = "insert into `emailcerts` set `CN`='".mysql_real_escape_string($user['email'])."', `keytype`='MS',
+ `memid`='".intval($user['id'])."', `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
+ `subject`='".mysql_real_escape_string($csrsubject)."', `codesign`='".intval($codesign)."'";
mysql_query($query);
$certid = mysql_insert_id();
$CSRname = generatecertpath("csr","client",$certid);
@@ -95,14 +95,14 @@ require_once '../../includes/lib/check_weak_key.php';
mysql_query("update `emailcerts` set `csr_name`='$CSRname' where `id`='$certid'");
foreach($emails as $emailid => $email)
- mysql_query("insert into `emaillink` set `emailcertsid`='$certid', `emailid`='$emailid'");
+ mysql_query("insert into `emaillink` set `emailcertsid`='$certid', `emailid`='".intval($emailid)."'");
$do = `../../scripts/runclient`;
sleep(10); // THIS IS BROKEN AND SHOULD BE FIXED
$query = "select * from `emailcerts` where `id`='$certid' and `crt_name` != ''";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
- die("404,Your certificate request has failed. ID: $certid");
+ die("404,Your certificate request has failed. ID: ".intval($certid));
$cert = mysql_fetch_assoc($res);
echo "200,Authentication Ok\n";
readfile("../".$cert['crt_name']);
diff --git a/www/api/cemails.php b/www/api/cemails.php
index 0d067ea..f937069 100644
--- a/www/api/cemails.php
+++ b/www/api/cemails.php
@@ -25,7 +25,7 @@
echo "200,Authentication Ok\n";
$user = mysql_fetch_assoc($res);
$memid = $user['id'];
- $query = "select sum(`points`) as `points` from `notary` where `to`='$memid' group by `to`";
+ $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($memid)."' and `notary`.`deleted`=0 group by `to`";
$row = mysql_fetch_assoc(mysql_query($query));
$points = $row['points'];
echo "CS=".intval($user['codesign'])."\n";
@@ -40,8 +40,9 @@
if($user['mname'] != "" && $user['suffix'] != "")
echo "NAME=".sanitizeHTML($user['fname'])." ".sanitizeHTML($user['mname'])." ".sanitizeHTML($user['lname'])." ".sanitizeHTML($user['suffix'])."\n";
}
- $query = "select * from `email` where `memid`='$memid' and `hash`='' and `deleted`=0";
+ $query = "select * from `email` where `memid`='".intval($memid)."' and `hash`='' and `deleted`=0";
$res = mysql_query($query);
- while($row = mysql_fetch_assoc($res))
- echo "EMAIL=".$row['email']."\n";
+ while($row = mysql_fetch_assoc($res)) {
+ echo "EMAIL=".sanitizeHTML($row['email'])."\n";
+ }
?>
diff --git a/www/index.php b/www/index.php
index c7cc03e..40a8e86 100644
--- a/www/index.php
+++ b/www/index.php
@@ -125,7 +125,7 @@ require_once('../includes/lib/l10n.php');
showfooter();
exit;
}
- }
+ }
}
if($oldid == 5 && $process != "")
@@ -153,13 +153,13 @@ require_once('../includes/lib/l10n.php');
include_once("../includes/lib/general.php");
$user_id = get_user_id_from_cert($_SERVER['SSL_CLIENT_M_SERIAL'],
$_SERVER['SSL_CLIENT_I_DN_CN']);
-
+
if($user_id >= 0)
{
$_SESSION['profile'] = mysql_fetch_assoc(mysql_query(
- "select * from `users` where
+ "select * from `users` where
`id`='$user_id' and `deleted`=0 and `locked`=0"));
-
+
if($_SESSION['profile']['id'] != 0)
{
$_SESSION['profile']['loggedin'] = 1;
@@ -307,19 +307,19 @@ require_once('../includes/lib/l10n.php');
$_SESSION['profile'] = "";
unset($_SESSION['profile']);
$_SESSION['profile'] = mysql_fetch_assoc($res);
- $query = "update `users` set `modified`=NOW(), `password`=sha1('$pword') where `id`='".$_SESSION['profile']['id']."'";
+ $query = "update `users` set `modified`=NOW(), `password`=sha1('$pword') where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
if($_SESSION['profile']['language'] == "")
{
$query = "update `users` set `language`='".L10n::get_translation()."'
- where `id`='".$_SESSION['profile']['id']."'";
+ where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
} else {
L10n::set_translation($_SESSION['profile']['language']);
L10n::init_gettext();
}
- $query = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`";
+ $query = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted`=0 group by `to`";
$res = mysql_query($query);
$row = mysql_fetch_assoc($res);
$_SESSION['profile']['points'] = $row['total'];
@@ -499,7 +499,7 @@ require_once('../includes/lib/l10n.php');
if($checkemail != "OK")
{
$id = 1;
- if (substr($checkemail, 0, 1) == "4")
+ if (substr($checkemail, 0, 1) == "4")
{
$_SESSION['_config']['errmsg'] .= _("The mail server responsible for your domain indicated a temporary failure. This may be due to anti-SPAM measures, such as greylisting. Please try again in a few minutes.");
} else {
@@ -566,9 +566,9 @@ require_once('../includes/lib/l10n.php');
$subject = stripslashes($_REQUEST['subject']);
$message = stripslashes($_REQUEST['message']);
$secrethash = $_REQUEST['secrethash2'];
-
+
//check for spam via honeypot
- if(!isset($_REQUEST['robotest']) || !empty($_REQUEST['robotest'])){
+ if(!isset($_REQUEST['robotest']) || !empty($_REQUEST['robotest'])){
echo _("Form could not be sent.");
showfooter();
exit;
@@ -641,7 +641,7 @@ require_once('../includes/lib/l10n.php');
$newUrl = $protocol . '://wiki.cacert.org/FAQ/AboutUs';
header('Location: '.$newUrl, true, 301); // 301 = Permanently Moved
}
-
+
if ($id == 19)
{
$protocol = $_SERVER['HTTPS'] ? 'https' : 'http';
@@ -655,7 +655,7 @@ require_once('../includes/lib/l10n.php');
$newUrl = $protocol . '://wiki.cacert.org/Board';
header('Location: '.$newUrl, true, 301); // 301 = Permanently Moved
}
-
+
showheader(_("Welcome to CAcert.org"));
includeit($id);
showfooter();
diff --git a/www/stats.php b/www/stats.php
index 1599e17..d4d892d 100644
--- a/www/stats.php
+++ b/www/stats.php
@@ -32,7 +32,7 @@
$stats['timestamp'] = $ar['timestamp'];
return $stats;
}
-
+
return null;
}
@@ -40,7 +40,7 @@
if ($stats === null) {
echo '
', _("Error while retrieving the statistics!"), '
'; showfooter(); - die(); + die(); } ?>- printf(_("Your email has been sent to %s."), $user['fname']); ?> + printf(_("Your email has been sent to %s."), sanitizeHTML($user['fname'])); ?>