• slider image 58
:::

ols3 - XOOPS 安全問題 | 2007-06-14 | 人氣:10157
phpmailer 是許多套件採用的 PHP 類別, 用來提供傳遞電子郵件的功能。

phpmailer 在 sendmail_send 函式的處理有 bug,可造成執行任意程式碼的漏洞。

修補方法: 利用 escapeshellcmd 和 escapeshellarg 做安全過濾。

方法一: 自行手動修改

XOOPS 2.0.x 的使用者,請編輯 class/mail/phpmailer/class.phpmailer.php

把:

function SendmailSend($header, $body) {
        if ($this->Sender != "")
            $sendmail = sprintf("%s -oi -f %s -t", $this->Sendmail, $this->Sender);
        else    
            $sendmail = sprintf("%s -oi -t", $this->Sendmail);


function SendmailSend($header, $body) {
        if ($this->Sender != "")
            $sendmail = sprintf("%s -oi -f %s -t", escapeshellcmd($this->Sendmail), escapeshellarg($this->Sender));
        else    
            $sendmail = sprintf("%s -oi -t", escapeshellcmd($this->Sendmail));



XOOPS 2.2.x 的使用者,請編輯 class/mail/phpmailer/class.phpmailer.php

把:

function sendmail_send($header, $body) {
        if ($this->Sender != "")
            $sendmail = sprintf("%s -oi -f %s -t", $this->Sendmail, $this->Sender);
        else
            $sendmail = sprintf("%s -oi -t", $this->Sendmail);


改成:

function sendmail_send($header, $body) {
        if ($this->Sender != "")
            $sendmail = sprintf("%s -oi -f %s -t", escapeshellcmd($this->Sendmail), escapeshellarg($this->Sender));
        else
            $sendmail = sprintf("%s -oi -t", escapeshellcmd($this->Sendmail));


====
方法二:

或者把以下的修正檔放入 class/mail/phpmailer 目錄中, 解壓覆蓋掉 class.phpmailer.php

XOOPS 2.0.x 的使用者,請下載:
http://xoops.tnc.edu.tw/uploads/xoops-2.0-phpmailer-class.zip

XOOPS 2.2.x 的使用者,請下載:
http://xoops.tnc.edu.tw/uploads/xoops-2.2-phpmailer-class.zip


消息來源:

http://h.root.tw/modules/news/article.php?storyid=40
網友個人意見,不代表本站立場,對於發言內容,由發表者自負責任。
發表者
樹狀展開
 

 Im happy I now registered

You actually make it seem so easy with your presentation but I find this topic to be really something which I think I would never understand. It seems too complicated and extremely broad for me. I'm looking forward for your next post, I will try to get the hang of it!

 

 Im glad I now registered

Hello there, I discovered your web site by the use of Google at the same time as looking for a comparable topic, your site got here up, it looks great. I've bookmarked it in my google bookmarks. Hi there, just turned into alert to your blog through Google, and located that it's really informative. I am gonna be careful for brussels. I'll be grateful if you continue this in future. Numerous other folks shall be benefited from your writing. Cheers!

 

 Just want to say Hi!

An outstanding share! I have just forwarded this onto a coworker who was doing a little research on this. And he actually ordered me dinner because I stumbled upon it for him... lol. So let me reword this.... Thank YOU for the meal!! But yeah, thanks for spending some time to talk about this matter here on your web site.

 

 Just want to say Hello!

Great beat ! I wish to apprentice while you amend your web site, how can i subscribe for a blog web site? The account aided me a acceptable deal. I had been a little bit acquainted of this your broadcast provided bright clear concept

 

 I am the new one

This excellent website really has all of the information I needed concerning this subject and didn't know who to ask.

 

 Im happy I now registered

Your style is very unique in comparison to other people I've read stuff from. Thank you for posting when you have the opportunity, Guess I'll just book mark this page.

 

 I am the new guy

Incredible! This blog looks just like my old one! It's on a entirely different topic but it has pretty much the same layout and design. Wonderful choice of colors!

 

 Just want to say Hello.

Incredible story there. What happened after? Thanks!

 

 I am the new one

I'm very happy to discover this web site. I wanted to thank you for your time just for this fantastic read!! I definitely appreciated every part of it and i also have you book marked to look at new stuff on your blog.

 

 I am the new one

This post presents clear idea for the new users of blogging, that really how to do blogging and site-building.

 

 Just wanted to say Hello.

Hey, I think your site might be having browser compatibility issues. When I look at your blog site in Ie, it looks fine but when opening in Internet Explorer, it has some overlapping. I just wanted to give you a quick heads up! Other then that, very good blog!

 

 I am the new guy

My coder is trying to persuade me to move to .net from PHP. I have always disliked the idea because of the expenses. But he's tryiong none the less. I've been using Movable-type on a variety of websites for about a year and am concerned about switching to another platform. I have heard fantastic things about blogengine.net. Is there a way I can import all my wordpress content into it? Any kind of help would be greatly appreciated!

 

 I am the new one

If you would like to obtain much from this article then you have to apply these methods to your won web site.

 

 Just wanted to say Hello!

It's not my first time to go to see this website, i am visiting this website dailly and take fastidious information from here everyday.

 

 Im happy I now registered

Howdy, i read your blog from time to time and i own a similar one and i was just wondering if you get a lot of spam feedback? If so how do you reduce it, any plugin or anything you can suggest? I get so much lately it's driving me insane so any support is very much appreciated.

 

 I am the new one

I don't know if it's just me or if everybody else experiencing issues with your website. It looks like some of the written text in your content are running off the screen. Can somebody else please comment and let me know if this is happening to them too? This might be a problem with my web browser because I've had this happen previously. Kudos

 

 Im glad I now signed up

Thanks for sharing such a good opinion, paragraph is fastidious, thats why i have read it fully

 

 I am the new guy

Hey there, You have done a great job. I will definitely digg it and personally suggest to my friends. I am confident they will be benefited from this web site.

 

 I am the new one

Pretty nice post. I just stumbled upon your weblog and wished to say that I have really enjoyed surfing around your blog posts. After all I will be subscribing to your rss feed and I hope you write again soon!

 

 I am the new girl

I know this web page provides quality dependent content and additional data, is there any other web page which provides these things in quality?

 

 I am the new one

Awesome article.

 

 I am the new guy

I think the admin of this website is in fact working hard in support of his web site, since here every information is quality based information.

 

 Im glad I finally registered

Incredible points. Great arguments. Keep up the amazing effort.

 

 Just wanted to say Hi!

you're in point of fact a excellent webmaster. The website loading pace is incredible. It kind of feels that you are doing any distinctive trick. Furthermore, The contents are masterpiece. you've done a fantastic task in this topic!

 

 Im glad I finally signed up

Wow that was odd. I just wrote an very long comment but after I clicked submit my comment didn't show up. Grrrr... well I'm not writing all that over again. Anyway, just wanted to say wonderful blog!

 

 I am the new guy

I do accept as true with all the ideas you've introduced on your post. They're really convincing and will definitely work. Nonetheless, the posts are too quick for beginners. Could you please prolong them a bit from next time? Thank you for the post.

:::

即時留言簿


計數器

今天: 1663166316631663
昨天: 2140214021402140
總計: 2166582216658221665822166582216658221665822166582