添加全局过滤机制（默认关闭）

FuckingKing · Dec 13, 2014 · e16645a · e16645a
1 parent b7a76e2
commit e16645a
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 4 deletions.
diff --git a/ThinkPHP/Common/functions.php b/ThinkPHP/Common/functions.php
@@ -341,7 +341,7 @@ function I($name,$default='',$filter=null,$datas=null) {
     }else{ // 变量默认值
         $data       =    isset($default)?$default:NULL;
     }
-    is_array($data) && array_walk_recursive($data,'filter_exp');
+    is_array($data) && array_walk_recursive($data,'think_filter');
     return $data;
 }
 
@@ -1468,8 +1468,11 @@ function send_http_status($code) {
     }
 }
 
-function filter_exp(&$value){
-    if(preg_match('/^(EXP|NEQ|GT|EGT|LT|ELT|OR)$/i',$value)){
+function think_filter(&$value){
+	// TODO 其他安全过滤
+
+	// 过滤查询特殊字符
+    if(preg_match('/^(EXP|NEQ|GT|EGT|LT|ELT|OR|LIKE|NOTLIKE|BETWEEN|IN)$/i',$value)){
         $value .= ' ';
     }
 }

diff --git a/ThinkPHP/Library/Think/App.class.php b/ThinkPHP/Library/Think/App.class.php
@@ -22,7 +22,7 @@ class App {
     static public function init() {
         // 加载动态应用公共文件和配置
         load_ext_file(COMMON_PATH);
-        
+
         // 定义当前请求的系统常量
         define('NOW_TIME',      $_SERVER['REQUEST_TIME']);
         define('REQUEST_METHOD',$_SERVER['REQUEST_METHOD']);
@@ -34,6 +34,13 @@ static public function init() {
         // URL调度
         Dispatcher::dispatch();
 
+        if(C('REQUEST_VARS_FILTER')){
+			// 全局安全过滤
+			array_walk_recursive($_GET,		'think_filter');
+			array_walk_recursive($_POST,	'think_filter');
+			array_walk_recursive($_REQUEST,	'think_filter');
+		}
+
         // URL调度结束标签
         Hook::listen('url_dispatch');         
 
@@ -150,6 +157,7 @@ static public function exec() {
                             }
                         }                        
                     }
+					array_walk_recursive($args,'think_filter');
                     $method->invokeArgs($module,$args);
                 }else{
                     $method->invoke($module);