PDA

View Full Version : Guestbook - problema fastidioso


moon.eclipse
25-11-2009, 13:05
Salve a tutti!

Da inizio anno con l'aiuto di amici abbiamo inserito un Guestbook nel sito di una scuola. Ma da un paio di mesi capita che troviamo messaggi vuoti firmati come Anonimo.
All'inizio pensavamo che fosse qualcuno che si divertiva ma poi abbiamo visto con un nostro portatile che ogni volta che entriamo nella pagina del sito dedicata al Guestbook lascia quel messaggio automaticamente ad ogni accesso. Questo capita con + pc ma non con tutti!

Cosa può essere? Come posso risolvere? :confused:

BlackAuron
25-11-2009, 22:58
Se si potesse dare uno sguardo al sorgente del guestbook, sarebbe più facile dare una risposta...

moon.eclipse
26-11-2009, 14:12
Ovviamente, ma non li posso avere finchè non sono in sede :muro:

BlackAuron
26-11-2009, 20:52
Buttandola li, richieste get che partono causa ajax o qualcosa di simile, oppure hai memorizzato l'indirizzo direttamente di quando hai fatto una richiesta per postare?

moon.eclipse
27-11-2009, 08:39
La prima cosa non so, non me ne intendo, in cosa comprende? :mc:

La seconda non penso

BlackAuron
27-11-2009, 09:30
Son ipotesi buttate li un po' a caso, aspettiamo di vedere il sorgente così potrai avere certezze piuttosto che ipotesi :)

moon.eclipse
27-11-2009, 14:31
Stasera in teoria dovrei riuscire ad andare in sede, così da poter postare i codici in php.

Grazie :)

moon.eclipse
27-11-2009, 19:11
pages.php

<?
/*
Silentum Guestbook v1.2.1
Modified October 29, 2007
pages.php copyright 2006, 2007 "HyperSilence"
*/

$guestbook_file = "guestbook.txt";
$lines = file($guestbook_file);
$total_entries = count($lines);

if(!$_SERVER["QUERY_STRING"]) {
$page = 1;
}
else {
$page = $_GET["page"];
}

$sum = $total_entries / 5;
$floor = floor($sum);
if($sum == $floor) {
$pagenumber = $floor;
}
else {
$pagenumber = $floor + 1;
}

if($page > 1) {
echo "<a href=\"".$PHP_SELF."?page=".($page - 1)."\">&laquo;</a> ";
}
else {
echo "&laquo; ";
}
for($i = 1; $i <= $pagenumber; $i++) {
if($i == $page) {
echo $i." ";
}
else {
echo "<a href=\"".$PHP_SELF."?page=".$i."\">".$i."</a> ";
}
}
if($page < $pagenumber) {
echo "<a href=\"".$PHP_SELF."?page=".($page + 1)."\">&raquo;</a> ";
}
else {
echo " &raquo;";
}
?>

sing:
<?
/*
Silentum Guestbook v1.2.1
Modified October 29, 2007
sign.php copyright 2006, 2007 "HyperSilence"
*/

$date_format = "F d, Y";
$time_format = "h:i:sa";

$guestbook_file = "guestbook.txt";
$guestbook_page = "guestbook.php";
$html_allowed = "0"; // Change this to 1 if you want to allow HTML to be posted

// What is displayed if the fields are left blank when an entry is added

$blank_name = "Anonymous";
$blank_message = "N/A";

// Begin censored word filter
// A lot of these words were acquired from bots posting spam links in my guestbook
// Feel free to remove or add words as you wish

$filter = array(".biz", ".info", "adipex", "adult", "affiliat", "afford", "allegra", "ambien", "apartment", "asshole", "baccarat", "beer", "bitch", "black jack", "blackjack", "blow", "bontril", "breast", "buy", "carisoprodol", "carookee", "cash", "casino", "cell", "cheap", "check", "cialis", "cigar", "claritin", "clit", "cock", "cok", "commerc", "crack", "crap", "credit", "cum", "cunt", "dating", "debt", "dexone", "dick", "diet", "dildo", "discount", "drug", "dvd", "ebay", "ephedra", "erection", "fack", "fag", "fck", "fock", "fuck", "fuk", "fvck", "gambl", "gay", "gift", "goatse", "health", "hentai", "homo", "horny", "horo scope", "horoscope", "hotbox", "hotel", "idiot", "insuran", "incest", "ipod", "jew", "join", "keno", "lesbian", "levitra", "license", "lipitor", "lottery", "master card", "mastercard", "masturbat", "medic", "member", "meridia", "money", "mortgage", "movie", "mp3", "naked", "nigg", "nokia", "nude", "offer", "onsize", "paxil", "pedo", "penis", "pharm", "phent", "phone", "pill", "play", "poker", "porn", "prescription", "prize", "product", "prozac", "ps2", "ps3", "psp", "purchase", "pussy", "requip", "reward", "ring tone", "ringtone", "roul", "screen saver", "screensaver", "serial", "sex", "shat", "shit", "shop", "slot", "soft ware", "software", "soma", "sponsor", "sprint", "suck", "ticket", "tourna", "tramadol", "travel", "tubgirl", "ultram", "url=", "vagina", "valium", "verizon", "vernulsa", "viagra", "visa", "voyeur", "wall paper", "wallpaper", "web cam", "webcam", "weight", "whore", "xanax", "xbox", "xxx", "zoloft", "zyrtec");

// End censored word filter

// Begin functions

function remove_tags($source) {
$source = strip_tags($source);
return preg_replace('/<(.*?)>/ie', "'<'.'\\1'.'>'", $source);
}

function word_wrap($message) {
$cut = " ";
$max_length = 60;
$result = "";
$word_length = 0;

// End functions

$length = strlen($message);

$tag = FALSE;
for($i = 0; $i < $length; $i++) {
$character = substr($message, $i, 1);
if($character == "<") {
$tag = TRUE;
}
elseif($character == ">") {
$tag = FALSE;
}
elseif(!$tag && $character == " ") {
$word_length = 0;
}
elseif(!$tag) {
$word_length++;
}
if(!$tag && !($word_length%$max_length)) {
$character .= $cut;
}
$result .= $character;
}
return $result;
}

// Begin field manipulation

$layout = "!date! at !time!<br />
<em></em><br />
!name!, <br />
!message!<br /><br />";

$_POST["message"] = str_replace("
", "<br />", $_POST["message"]);
$message = word_wrap(remove_tags($message));
$message = stripslashes($_POST["message"]);
$message = str_replace(array("&", "\r\n\r\n"), array("&amp;", " "), $message);
$message = str_replace(array("&amp;gt;", "&amp;lt;", "\r\n"), array("&gt;", "&lt;", "<br />"), $message);

if($html_allowed == "0") {
$message = str_replace(array("<", ">"), array("&lt;", "&gt;"), $message);
$message = strip_tags(stripslashes($_POST["message"]));
}

$name = strip_tags(stripslashes($_POST["name"]));
$email = urlencode(strip_tags(stripslashes($_POST["email"])));
$uri = urlencode(strip_tags(stripslashes($_POST["uri"])));
$uri = str_replace(array("%2F", "%3A"), array("/", ":"), $uri);

$ip = explode(".", $_SERVER["REMOTE_ADDR"]);
$display_ip = $ip[0].".".$ip[1];

if(trim($name) == "") $name = $blank_name;
if(trim($email) == "") $email = $blank_email;
if(trim($uri) == "") $uri = $blank_uri;
if(stristr($uri, "http://") === false) $uri = "http://".$uri;
if(trim($message) == "") $message = $blank_message;

$transition = $layout;
$variables = array("\n", "!name!", "!email!", "!uri!", "!message!", "!date!", "!time!");
$input = array("", $name, $email, $uri, $message, date($date_format), date($time_format), $display_ip);

$input = str_replace(":)", "<img alt=\":)\" src=\"smileys/smile.gif\" style=\"vertical-align: middle\" title=\":)\" />", $input);
$input = str_replace(":(", "<img alt=\":(\" src=\"smileys/frown.gif\" style=\"vertical-align: middle\" title=\":(\" />", $input);
$input = str_replace(";)", "<img alt=\";)\" src=\"smileys/wink.gif\" style=\"vertical-align: middle\" title=\";)\" />", $input);
$input = str_replace(":D", "<img alt=\":D\" src=\"smileys/happy.gif\" style=\"vertical-align: middle\" title=\":D\" />", $input);
$input = str_replace(":P", "<img alt=\":P\" src=\"smileys/tongue.gif\" style=\"vertical-align: middle\" title=\":P\" />", $input);

if(strlen($message) >= 260) {
header("Location: ".$guestbook_page."?page=1&message=1&l=".strlen($message));
exit;
}

if(strlen($name) >= 36 || strlen($email) >= 126 || strlen($uri) >= 126) {
header("Location: ".$guestbook_page."?page=1");
exit;
}

if($_POST["ve6riZfi4caYti2onXco0de1"] != $_POST["ve6riZfi4caYti2onXco0de2"]) {
header("Location: ".$guestbook_page."?page=1&message=3");
exit;
}

if($_COOKIE["signed"] == "true") {
header("Location: ".$guestbook_page."?page=1&message=4");
exit;
}

// End field manipulation

$transition = str_replace($variables, $input, $transition);

$past_entries = fopen($guestbook_file, "r");
$content = fread($past_entries, filesize($guestbook_file));
fclose($past_entries);

$new_entry = $transition."\n".$content;

foreach($filter as $censored_word) {
if(stristr($new_entry, $censored_word)) {
header("Location: ".$guestbook_page."?page=1&message=2&cw=".$censored_word);
exit;
}
}

$all_entries = fopen($guestbook_file, "w");
fwrite($all_entries, $new_entry);
fclose($all_entries);

setcookie("signed", "true", time()+2419200);

header("Location: ".$guestbook_page."?page=1&message=5");
?>

view.php
<?
/*
Silentum Guestbook v1.2.1
Modified October 29, 2007
view.php copyright 2006, 2007 "HyperSilence"
*/

$guestbook_file = "guestbook.txt";
$lines = file($guestbook_file);
$total_entries = count($lines);

if(!$_SERVER["QUERY_STRING"]) {
$page = 1;
}
else {
$page = $_GET["page"];
}
$minimum = 5 * ($page - 1);
$maximum = 5 * $page - 1;

foreach($lines as $line_number => $line) {
if($line_number < $minimum) {}
elseif($line_number > $maximum) {
break;
}
else {
$entrynumber = $total_entries - $line_number;
echo $line;
}
}
?>

moon.eclipse
29-11-2009, 16:22
Sapete qualcosa in più ora? :cry: