[oscommerce] [email重大漏洞修正] 請所有OSC網站立即更新

function tep_mail($to_name, $to_email_address, $email_subject, $email_text, $from_email_name, $from_email_address) {
if (SEND_EMAILS != 'true') return false;
改成

function tep_mail($to_name, $to_email_address, $email_subject, $email_text, $from_email_name, $from_email_address) {
if (SEND_EMAILS != 'true') return false;//Dont send any injection type mails.
if (eregi('Content-Type:', $to_name)) return false;
if (eregi('Content-Type:', $email_subject)) return false;
if (eregi('Content-Type:', $from_email_name)) return false;
if (eregi('Content-Type:', $email_text)) return false;//Remove any newline and anything after it on the header fields of the mail.
//$to_email_address and $from_email_address are checked with tep_validate_email().
$to_name = preg_replace('/[n|r].*/', '', $to_name);
$email_subject = preg_replace('/[n|r].*/', '', $email_subject);
$from_email_name = preg_replace('/[n|r].*/', '', $from_email_name);
在1.1版本中又新增了一個漏洞修補：
6.Contact Us Spam Relay
參考資料：http://www.anders.com/cms/75/Crack.Attempt/Spam.Relay在catalog/includes/functions/general.php=>原文有錯是在catalog/contact_us.php，在下一個修正版本就更正了
找到：$error = false;
if (isset($HTTP_GET_VARS['action']) && ($HTTP_GET_VARS['action'] == 'send')) {
$name = tep_db_prepare_input($HTTP_POST_VARS['name']);
$email_address = tep_db_prepare_input($HTTP_POST_VARS['email']);
$enquiry = tep_db_prepare_input($HTTP_POST_VARS['enquiry']);
改成： $error = false;
if (isset($HTTP_GET_VARS['action']) && ($HTTP_GET_VARS['action'] == 'send')) {
// http://www.anders.com/cms/75/Crack.Attempt/Spam.Relay$_POST['email'] = preg_replace( "/n/", " ", $_POST['email'] );
$_POST['name'] = preg_replace( "/n/", " ", $_POST['name'] );
$_POST['email'] = preg_replace( "/r/", " ", $_POST['email'] );
$_POST['name'] = preg_replace( "/r/", " ", $_POST['name'] );
$_POST['email'] = str_replace("Content-Type:","",$_POST['email']);
$_POST['name'] = str_replace("Content-Type:","",$_POST['name']);$name = tep_db_prepare_input($_POST['name']);
$email_address = tep_db_prepare_input($_POST['email']);
$enquiry = tep_db_prepare_input($_POST['enquiry']);
$enquiry = tep_db_prepare_input($enquiry . "nn IP: " . $_SERVER['REMOTE_ADDR']);
在v1.2版本中，有很多A,B,C...的修補方法，不過因為還沒試，就先暫時保留原味的。在v1.3版本中，又加強了漏洞的修補
1.避免email從你的網域寄出.
在contact_us.php 前面找到：
if (isset($HTTP_GET_VARS['action']) && ($HTTP_GET_VARS['action'] == 'send')) {
替換成： if (isset($HTTP_GET_VARS['action']) && ($HTTP_GET_VARS['action'] == 'send') && tep_email_isfromdomain($_POST['email']))
{
$error = true;
$messageStack->add('contact', ENTRY_EMAIL_ADDRESS_ISFROMDOMAIN_ERROR);
}
elseif (isset($HTTP_GET_VARS['action']) && ($HTTP_GET_VARS['action'] == 'send')) {在/includes/functions/validations.php 前面新增這個函式：
function tep_email_isfromdomain($email) {
list($username,$domain)=split('@',$email);
$domain = strtolower($domain);
if ($domain == 'ENTER YOUR DOMAIN HERE'){
return true;
}else{
return false;
}
}
在/includes/langueges/english/english.php 以及類似的語系檔案中新增：
define('ENTRY_EMAIL_ADDRESS_ISFROMDOMAIN_ERROR', 'Your E-Mail Address appears to be from BuyLDSproducts.com. To contact us, please use your valid email address.');
在v1.4版本中加強了對v1.3版的漏洞修補及更正在catalog/includes/configure.php 前面找到define('HTTP_COOKIE_DOMAIN', 'www.yourdomain.com');替換為define('HTTP_COOKIE_DOMAIN', 'www.yourdomain.com');
define('HTTP_MAIL_DOMAIN', 'yourdomain.com');
在/includes/functions/validations.php 新增這個函式，注意這個函式在v1.3中已新增，所以就把原先的給替換掉
function tep_email_isfromdomain($email) {
list($username,$domain)=split('@',$email);
$domain = strtolower($domain);
if ($domain == '' . HTTP_MAIL_DOMAIN . ''){
return true;
}else{
return false;
}
}以上就是最新的修補!