hello
I’ve just looked at the dbapi... so I explain you my wish to see modX being strengthen there.
When I develop, I usually block SQL injection risk at the core level ... so if I ever forget one time at the frontend, it less risky. I’d like modX help doing so.
I’d like the query function to be improved, including (before the mysql_query) a call to a check_hacking function
function check_hacking($req)
{
$fail = false;
if (strpos($req, 'union') !== false && preg_match('~(^|[^a-z])union($|[^[a-z])~s', $req) != 0)
$fail = true;
// pas de comentaire dans les requêtes...
// pas de ; qui sépare 2 requêtes
elseif (strpos($req, '/*') > 2 || strpos($req, '--') !== false || strpos($req, ';') !== false)
$fail = true;
// Tentative de chagement des mots de passe, de ralentissement ?
elseif (strpos($req, 'set password') !== false && preg_match('~(^|[^a-z])set password($|[^[a-z])~s', $req) != 0)
$fail = true;
elseif (strpos($req, 'benchmark') !== false && preg_match('~(^|[^a-z])benchmark($|[^[a-z])~s', $req) != 0)
$fail = true;
if($fail)
die("Tentative de Hacking");
Return ;
}
The only drawback is the query function would one accept queries one by one...
I’ve got a second wish, inspired by SMF code :
instead of showing a message when the mysql_query return false, could you test the reason of the error ?
For instance, when SMF has lost connexion with DBserver, it tries once again the whole bunch and send a mail to the webmaster saying there are SQL problems. thus, when operating a small server, the web admin knows when reaching the limits... and visitors are not bored with error pages.
MODX Staff
