From 0c8f56b4f22deac3f30d0d746e2341d53a13c880 Mon Sep 17 00:00:00 2001 From: Kelly Rauchenberger Date: Sun, 31 Aug 2008 13:44:16 +0000 Subject: Central: Patched security hole Fixes #48 --- central/trunk/xmlrpc.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'central/trunk') diff --git a/central/trunk/xmlrpc.php b/central/trunk/xmlrpc.php index 15a7a08..a451d93 100644 --- a/central/trunk/xmlrpc.php +++ b/central/trunk/xmlrpc.php @@ -250,13 +250,16 @@ function addSubscription($username, $verification, $verificationID, $subscriptio function sendDatabase($cserver, $verification, $verificationID, $db, $databaseVersion) { - if (strpos(@gethostbyaddr($_SERVER['REMOTE_ADDR']), 'fourisland.com') !== FALSE) + if (preg_match('/^(.*\.)?fourisland\.com$/', @gethostbyaddr($_SERVER['REMOTE_ADDR']))) { $db = unserialize($db); if (isset($db['central.fourisland.com'])) { if (strpos($db['central.fourisland.com']['xmlrpc'], 'fourisland.com') !== FALSE) { + $deldb = "DELETE FROM centralServers"; + $deldb2 = mysql_query($deldb); + foreach($db as $name => $value) { $insdb = "INSERT INTO centralServers (url, code, xmlrpc) VALUES (\"" . mysql_real_escape_string($name) . "\", \"" . mysql_real_escape_string($value['code']) . "\", \"" . mysql_real_escape_string($value['xmlrpc']) . "\")"; -- cgit 1.4.1