PHP Security类代码示例

 public static function process()
 {
     $security = new Security();
     $security->verifyPre();
     $data = stream_get_contents(fopen('php://input', 'r'));
     $compressedSize = strlen($data);
     $security->verifyCompressedData($data, $compressedSize);
     $data = @gzdecode($data);
     $uncompressedSize = strlen($data);
     $security->validateData($data, $uncompressedSize);
     $json = json_decode($data, true);
     $security->validateJson($json);
     if (isset($json['icon'])) {
         $img = self::getServerIcon($json['icon']);
         $json['icon'] = $img;
         $data = json_encode($json);
         $uncompressedSize = strlen($data);
     }
     $key = Util::uuid(false);
     $cacheFile = Cache::getFile($key);
     Log::info("Uploaded {$uncompressedSize} bytes as {$key} to {$cacheFile}");
     Cache::put($key, $data);
     header("Location: " . BASE_URL_VIEW . "/?id={$key}");
     self::error("Compressed Size: {$compressedSize}\nUncompressed Size: {$uncompressedSize}\nRaw Upload: " . BASE_URL_VIEW . "/?id={$key}&raw=1");
 }

 function init()
 {
     // Get the member configuration
     $oMemberModel = getModel('member');
     $this->member_config = $oMemberModel->getMemberConfig();
     Context::set('member_config', $this->member_config);
     $oSecurity = new Security();
     $oSecurity->encodeHTML('member_config.signupForm..');
     $mskin = $this->member_config->mskin;
     // Set the template path
     if (!$mskin) {
         $mskin = 'default';
         $template_path = sprintf('%sm.skins/%s', $this->module_path, $mskin);
     } else {
         $template_path = sprintf('%sm.skins/%s', $this->module_path, $mskin);
     }
     // if member_srl exists, set memberInfo
     $member_srl = Context::get('member_srl');
     if ($member_srl) {
         $oMemberModel = getModel('member');
         $this->memberInfo = $oMemberModel->getMemberInfoByMemberSrl($member_srl);
         if (!$this->memberInfo) {
             Context::set('member_srl', '');
         } else {
             Context::set('member_info', $this->memberInfo);
         }
     }
     $this->setTemplatePath($template_path);
     $oLayoutModel = getModel('layout');
     $layout_info = $oLayoutModel->getLayout($this->member_config->mlayout_srl);
     if ($layout_info) {
         $this->module_info->mlayout_srl = $this->member_config->mlayout_srl;
         $this->setLayoutPath($layout_info->path);
     }
 }

 function dispNcenterliteAdminSkinsetting()
 {
     $oModuleModel = getModel('module');
     $oLayoutModel = getModel('layout');
     $oNcenterliteModel = getModel('ncenterlite');
     $config = $oNcenterliteModel->getConfig();
     Context::set('config', $config);
     $layout_list = $oLayoutModel->getLayoutList();
     Context::set('layout_list', $layout_list);
     $mobile_layout_list = $oLayoutModel->getLayoutList(0, 'M');
     Context::set('mlayout_list', $mobile_layout_list);
     $skin_list = $oModuleModel->getSkins($this->module_path);
     Context::set('skin_list', $skin_list);
     $mskin_list = $oModuleModel->getSkins($this->module_path, "m.skins");
     Context::set('mskin_list', $mskin_list);
     if (!$skin_list[$config->skin]) {
         $config->skin = 'default';
     }
     Context::set('colorset_list', $skin_list[$config->skin]->colorset);
     if (!$mskin_list[$config->mskin]) {
         $config->mskin = 'default';
     }
     Context::set('mcolorset_list', $mskin_list[$config->mskin]->colorset);
     $security = new Security();
     $security->encodeHTML('config..');
     $security->encodeHTML('skin_list..title');
     $security->encodeHTML('colorset_list..name', 'colorset_list..title');
 }

 /**
  * the html to select colorset of the skin
  * @return void
  */
 function getCommunicationAdminColorset()
 {
     $skin = Context::get('skin');
     $type = Context::get('type') == 'P' ? 'P' : 'M';
     Context::set('type', $type);
     if ($type == 'P') {
         $dir = 'skins';
     } else {
         $dir = 'm.skins';
     }
     if (!$skin) {
         $tpl = "";
     } else {
         $oModuleModel = getModel('module');
         $skin_info = $oModuleModel->loadSkinInfo($this->module_path, $skin, $dir);
         Context::set('skin_info', $skin_info);
         $oModuleModel = getModel('module');
         $communication_config = $oModuleModel->getModuleConfig('communication');
         if (!$communication_config->colorset) {
             $communication_config->colorset = "white";
         }
         Context::set('communication_config', $communication_config);
         $security = new Security();
         $security->encodeHTML('skin_info.colorset..title', 'skin_info.colorset..name');
         $security->encodeHTML('skin_info.colorset..name');
         $oTemplate = TemplateHandler::getInstance();
         $tpl = $oTemplate->compile($this->module_path . 'tpl', 'colorset_list');
     }
     $this->add('tpl', $tpl);
     $this->add('type', $type);
 }

 /**
  * Display output list (administrative)
  * @return void
  */
 function dispTrackbackAdminList()
 {
     // Wanted set
     $oModuleModel =& getModel('module');
     $config = $oModuleModel->getModuleConfig('trackback');
     Context::set('config', $config);
     // Options to get a list
     $args->page = Context::get('page');
     // / "Page
     $args->list_count = 30;
     // / "One page of posts to show the
     $args->page_count = 10;
     // / "Number of pages that appear in the page navigation
     $args->sort_index = 'list_order';
     // / "Sorting values
     $args->module_srl = Context::get('module_srl');
     // Get a list
     $oTrackbackAdminModel =& getAdminModel('trackback');
     $output = $oTrackbackAdminModel->getTotalTrackbackList($args);
     // To write to a template parameter settings
     Context::set('total_count', $output->total_count);
     Context::set('total_page', $output->total_page);
     Context::set('page', $output->page);
     Context::set('trackback_list', $output->data);
     Context::set('page_navigation', $output->page_navigation);
     //Security
     $security = new Security();
     $security->encodeHTML('config.');
     $security->encodeHTML('trackback_list..');
     // Set a template
     $this->setTemplatePath($this->module_path . 'tpl');
     $this->setTemplateFile('trackback_list');
 }

 function init()
 {
     $oTimelineModel = getModel('timeline');
     $module_srl = Context::get('module_srl');
     $timeline_info = $oTimelineModel->getTimelineInfo($module_srl);
     // 타임라인 게시판 정보 유효성 검증
     if ($timeline_info) {
         $standard_date = sscanf($timeline_info->standard_date, '%04d%02d%02d%02d%02d%02d');
         $limit_date = sscanf($timeline_info->limit_date, '%04d%02d%02d%02d%02d%02d');
         Context::set('timeline_info', $timeline_info);
         Context::set('attach_info', $timeline_info->attach_info);
         Context::set('standard_date', $standard_date);
         Context::set('limit_date', $limit_date);
     } else {
         Context::set('module_srl', '');
     }
     // 모듈 분류 불러오기
     $oModuleModel = getModel('module');
     $module_category = $oModuleModel->getModuleCategories();
     Context::set('module_category', $module_category);
     $security = new Security();
     $security->encodeHTML('module_category..');
     // 모듈 설치 여부 불러오기
     $is_installed = !$this->checkUpdate();
     Context::set('is_installed', $is_installed);
     // 템플릿 경로 설정
     $this->setTemplatePath($this->module_path . 'tpl');
 }

 function init()
 {
     $oSecurity = new Security();
     $oSecurity->encodeHTML('document_srl', 'comment_srl', 'vid', 'mid', 'page', 'category', 'search_target', 'search_keyword', 'sort_index', 'order_type', 'trackback_srl');
     if ($this->module_info->list_count) {
         $this->list_count = $this->module_info->list_count;
     }
     if ($this->module_info->search_list_count) {
         $this->search_list_count = $this->module_info->search_list_count;
     }
     if ($this->module_info->page_count) {
         $this->page_count = $this->module_info->page_count;
     }
     $this->except_notice = $this->module_info->except_notice == 'N' ? false : true;
     // $this->_getStatusNameListecret option backward compatibility
     $oDocumentModel = getModel('document');
     $statusList = $this->_getStatusNameList($oDocumentModel);
     if (isset($statusList['SECRET'])) {
         $this->module_info->secret = 'Y';
     }
     // use_category <=1.5.x, hide_category >=1.7.x
     $count_category = count($oDocumentModel->getCategoryList($this->module_info->module_srl));
     if ($count_category) {
         if ($this->module_info->hide_category) {
             $this->module_info->use_category = $this->module_info->hide_category == 'Y' ? 'N' : 'Y';
         } else {
             if ($this->module_info->use_category) {
                 $this->module_info->hide_category = $this->module_info->use_category == 'Y' ? 'N' : 'Y';
             } else {
                 $this->module_info->hide_category = 'N';
                 $this->module_info->use_category = 'Y';
             }
         }
     } else {
         $this->module_info->hide_category = 'Y';
         $this->module_info->use_category = 'N';
     }
     /**
      * check the consultation function, if the user is admin then swich off consultation function
      * if the user is not logged, then disppear write document/write comment./ view document
      **/
     if ($this->module_info->consultation == 'Y' && !$this->grant->manager) {
         $this->consultation = true;
         if (!Context::get('is_logged')) {
             $this->grant->list = $this->grant->write_document = $this->grant->write_comment = $this->grant->view = false;
         }
     } else {
         $this->consultation = false;
     }
     $oDocumentModel = getModel('document');
     $extra_keys = $oDocumentModel->getExtraKeys($this->module_info->module_srl);
     Context::set('extra_keys', $extra_keys);
     $template_path = sprintf("%sm.skins/%s/", $this->module_path, $this->module_info->mskin);
     if (!is_dir($template_path) || !$this->module_info->mskin) {
         $this->module_info->mskin = 'default';
         $template_path = sprintf("%sm.skins/%s/", $this->module_path, $this->module_info->mskin);
     }
     $this->setTemplatePath($template_path);
     Context::addJsFilter($this->module_path . 'tpl/filter', 'input_password.xml');
 }

 /**
  * Logout current user
  * Since the logout doesn't throw an error, we don't throw one either
  */
 public function logout($message = array())
 {
     if ($member = Member::currentUser()) {
         $security = new Security();
         $security->logout(false);
     }
     return true;
 }

 public function breakJSONObject()
 {
     try {
         $queryCollection = "";
         $shield = new Security();
         $json_file = $_POST['jsonobject'];
         $json_file = str_replace('{"dt_objectTable":[', '{"dt_objectTable":', $json_file);
         $json_file = str_replace('{"dt_relatedTable":[', '{"dt_relatedTable":', $json_file);
         $json_file = str_replace('}]}', '}}', $json_file);
         if ($shield->shield($_POST['MODIFY_STATUS']) == "INS") {
             $fieldtarget = '{"fieldName":"ROADOFSPK","fieldValue":"0","fieldType":"numeric","fieldKey":"0"}';
             $additionalField = "";
             if ($shield->shield($_POST['CARA_BAYAR']) == "KREDIT") {
                 $additionalField .= '{"fieldName":"SISA_BAYAR","fieldValue":"' . $_POST["DP_SYSTEM"] . '","fieldType":"numeric"}';
                 $additionalField .= ',{"fieldName":"STATUS_PO","fieldValue":"1. INDENT","fieldType":"string"}';
                 $additionalField .= ',{"fieldName":"AR_AMOUNT","fieldValue":"' . $_POST["DP_SYSTEM"] . '","fieldType":"numeric"}';
             } else {
                 $additionalField .= '{"fieldName":"SISA_BAYAR","fieldValue":"' . $_POST["HARGA"] . '","fieldType":"numeric"}';
                 $additionalField .= ',{"fieldName":"AR_AMOUNT","fieldValue":"' . $_POST["HARGA"] . '","fieldType":"numeric"}';
             }
             $additionalField .= ',{"fieldName":"STATUS_SPK","fieldValue":"1","fieldType":"string"}';
             $additionalField .= ',{"fieldName":"STATUS_JUAL","fieldValue":"1. SPK","fieldType":"string"}';
             $additionalField .= ',{"fieldName":"STATUS_KIRIM","fieldValue":"N","fieldType":"string"}';
             $additionalField .= ',{"fieldName":"STATUS_ARK","fieldValue":"N","fieldType":"string"}';
             $additionalField .= ',{"fieldName":"CUSTOM_NO","fieldValue":"' . $shield->shield($_POST["NO_SPK"]) . '","fieldType":"string"}';
             $additionalField .= ',{"fieldName":"ROADOFSPK","fieldValue":"0","fieldType":"numeric"}';
             $json_file = str_replace($fieldtarget, $additionalField, $json_file);
         }
         //echo $json_file;
         // convert the string to a json object
         $jfo = json_decode($json_file);
         $relField = "";
         $relCount = 0;
         $relTables = $jfo->dt_objectTable->dt_relatedTables;
         foreach ($relTables as $relTbl) {
             $myTable = $relTbl->dt_relatedTable;
             $relTableName = $myTable->tableName;
             $relautonumFormat = $myTable->autonumFormat;
             $relModifyStatus = $myTable->modify_status;
             $dt_relFields = $myTable->dt_relfieldCollection;
             $queryCollection .= $this->generateQuery($dt_relFields, $relTableName, $relautonumFormat, $relModifyStatus, $relCount);
             $relCount = $relCount + 1;
         }
         $tableName = $jfo->dt_objectTable->tableName;
         $autonumFormat = $jfo->dt_objectTable->autonumFormat;
         $modifystatus = $jfo->dt_objectTable->modify_status;
         $dt_fields = $jfo->dt_objectTable->dt_fieldsCollection;
         $queryCollection .= $this->generateQuery($dt_fields, $tableName, $autonumFormat, $modifystatus, 0);
         //echo $queryCollection;
         $model = new object_Model();
         $result = $model->executeQuery($queryCollection);
         $weblog = new objectupdate();
         $result = $weblog->record_webaccess_log("DML : " . ${$modifystatus} . "-" . $tableName . "-" . $shield->shield($_POST["NO_SPK"]));
         header("Location: entry-spk");
     } catch (Exception $e) {
         throw new Exception($e->getMessage());
     }
 }

 function init()
 {
     $oTextyleHubModel =& getModel('textylehub');
     $this->module_info = $oTextyleHubModel->getTextyleHubInfo();
     Context::set('module_info', $this->module_info);
     Context::set('module_srl', $this->module_info->module_srl);
     $this->setTemplatePath($this->module_path . 'tpl');
     $security = new Security();
     $security->encodeHTML('module_info.');
 }

 /**
  * @brief Output the list of banned words
  */
 function dispSpamfilterAdminDeniedWordList()
 {
     // Get the list of denied IP addresses and words
     $oSpamFilterModel = getModel('spamfilter');
     $word_list = $oSpamFilterModel->getDeniedWordList();
     Context::set('word_list', $word_list);
     $security = new Security();
     $security->encodeHTML('word_list..word');
     // Set a template file
     $this->setTemplateFile('denied_word_list');
 }

 function init()
 {
     $init = new boot();
     if (isset($_GET['app'])) {
         if (empty($_GET['app'])) {
             header("Location: dashboard");
         }
         //$sr = $_GET['sr'];
         if (!isset($_SESSION['user-id'])) {
             $app_get = "login";
         } else {
             $security = new Security();
             $app_get = $security->shield($_GET['app']);
             $app_get_sub = $security->shield($_GET['sub_app']);
         }
         switch ($app_get) {
             case $app_get:
                 if (file_exists(LOCAL_DIR . "/apps/" . $app_get . "/" . $app_get . "_Controller.php")) {
                     $ldr = new autoloader($app_get);
                     if ($app_get_sub) {
                         $dynamic = "ajax_" . $app_get . "_Controller";
                     } else {
                         $dynamic = $app_get . "_Controller";
                         $weblog = new objectupdate();
                         $result = $weblog->record_webaccess_log("module : " . $app_get);
                     }
                     $object = new $dynamic();
                     if ($app_get == "object") {
                         $object->breakJSONObject();
                     }
                     if ($app_get == "ob_update") {
                         $object->breakJSONObject();
                     }
                 } else {
                     if ($app_get == "logout") {
                         //unset($_SESSION["user-id"]);
                         session_destroy();
                         //setcookie("user-id","", time()-3600);
                         header("Location: login");
                     } else {
                         $weblog = new objectupdate();
                         $result = $weblog->record_webaccess_log("Accessing wrong module");
                         header("Location: page-not-found");
                     }
                 }
                 break;
         }
     } else {
         $weblog = new objectupdate();
         $result = $weblog->record_webaccess_log("Accessing wrong module");
         header("Location: dashboard");
     }
 }

 public function __construct()
 {
     $model = new login_Model();
     $shield = new Security();
     if ($_GET["param"] == "exec") {
         $username = $_POST["username"];
         $myuserid = $shield->shield($username);
         $mypassword = $shield->shield($_POST["password"]);
         $datauser = $model->get_userinfo($myuserid, $mypassword);
     } else {
         $datauser = "[]";
     }
     require_once 'login_View.php';
 }

 function dispAndroidpushappAdminConfig()
 {
     $oModuleModel = getModel('module');
     $oAndroidpushappModel = getModel('androidpushapp');
     $config = $oAndroidpushappModel->getConfig();
     Context::set('config', $config);
     $security = new Security();
     $security->encodeHTML('config..');
     $androidpushapp_module_info = $oModuleModel->getModuleInfoXml('androidpushapp');
     Context::set('androidpushapp_module_info', $androidpushapp_module_info);
     $mid_list = $oModuleModel->getMidList(null, array('module_srl', 'mid', 'browser_title', 'module'));
     Context::set('mid_list', $mid_list);
     $this->setTemplateFile('Config');
 }

 public function init($var)
 {
     if (isset($_GET['sr'])) {
         $sr = $_GET['sr'];
         if (!isset($_GET['app'])) {
             die(_GET_APP_DONT_EXIST);
         }
         //$class_methods = get_class_methods("appController");
         $security = new Security();
         $shield_var = $security->shield($_GET['app']);
         $class_methods = get_class_methods($shield_var . "_Controller");
         //var_dump($class_methods);
         foreach ($class_methods as $method_name) {
             //echo "$method_name\n";
             if ($sr == $method_name) {
                 /**
                  						($sr != "__construct") && _
                  						($sr != "__call") && _
                  						($sr != "__callStatic") && _
                  						($sr != "__get") && _
                  						($sr != "__set") && _
                  						($sr != "__isset") && _
                  						($sr != "__unset") && _
                  						($sr != "__sleep") && _
                  						($sr != "__get") && _
                  						($sr != "__wakeup") && _
                  						($sr != "__toString") && _
                  						($sr != "__invoke") && _
                  						($sr != "__destruct")) {
                  						**/
                 switch ($sr) {
                     // llama staticamente
                     //appController::$sr();
                     //appModel::$sr();
                     //AppView::$sr();
                     case $sr:
                         $var->{$sr}();
                         break;
                 }
                 // switch
             }
             // if
         }
         // for each
     } else {
         if (!isset($_GET['sr'])) {
             $var->main();
         }
     }
 }