php dosyasında html inj açığı var napabiliriz?

14-08-2013, 12:23:57

on2

<?php if( $D->p->error ) { ?>
		
		<?php } elseif( $D->p->is_system_post ) { ?>
		
			<div class="mpost" id="post_<?= $D->p->post_tmp_id ?>" postdate="<?= $D->p->post_date ?>" style="display:<?= isset($D->post_show_slow)&&$D->post_show_slow?'none':'block' ?>;">
				 
					<?= $D->p->parse_text() ?>
					<small><?= post::parse_date($D->p->post_date) ?>
					<a href="javascript:;" id="postlink_del_<?= $D->p->post_tmp_id ?>"  title="<?= $this->lang('post_delete_link') ?>"  onfocus="this.blur();" onclick="post_delete('<?= $D->p->post_tmp_id ?>');">&middot; Kaldır</a>
					</small>
				 
			</div>
			
		<?php } else { ?>



<!----POST---->
 
 
<div class="post" id="post_<?= $D->p->post_tmp_id ?>"  onmouseover="show_post_topbtns('<?= $D->p->post_tmp_id ?>');"  onmouseout="hide_post_topbtns('<?= $D->p->post_tmp_id ?>');" postdate="<?= $D->p->post_date ?>" style="overflow:visible; display:<?= isset($D->post_show_slow)&&$D->post_show_slow?'none':'block' ?>;">
 
 

<!-------------------------------FLYBOX-------------------------------------->
<div class="pavatarz_out" id="postuserbox_show_<?= $D->p->post_tmp_id ?>"  style="display:none;">

<script type="text/javascript">
var draggers=document.getElementsByTagName('div')
for (var i_tem = 0; i_tem < draggers.length; i_tem++)
if ( draggers[i_tem].className=='pavatarz' )
Drag.init(draggers[i_tem])
</script>
 

<!-------------------PAVATARZ-------------> 
<div class="pavatarz">
 				
<div id="pfhdr">
<div id="pfhdrleft">
<?php if($D->p->post_user->verified) { ?>
<div class="verified"></div>
<?php } ?> 
<b>About <?= htmlspecialchars($D->p->post_user->username) ?></b>
</div>
<div id="pfhdrright">
<a href="javascript:;" onclick="postuserbox_close_ev('<?= $D->p->post_tmp_id ?>');"  title="Close" onfocus="this.blur();"></a>
</div>
</div>
				 
				 
<div class="upm">
<div class="boxavatar">
<a href="<?= userlink($D->p->post_user->username) ?>"><img src="<?= $C->IMG_URL ?>avatars/thumbs1/<?= $D->p->post_user->avatar ?>" style="width:50px; height:50px;" alt="<?= htmlspecialchars($D->p->post_user->fullname) ?>" /></a> 
</div>

<div class="vbox_left">

<a href="<?= userlink($D->p->post_user->username) ?>"><h3>
<?php if( !empty($D->p->post_user->fullname) ) { ?>
<?= str_cut($D->p->post_user->fullname,20) ?>  
<?php } else { ?>
<?= str_cut($D->p->post_user->username,20) ?> 
<?php } ?><b> @<?= htmlspecialchars($D->p->post_user->username) ?></b></h3> </a>


<?php if( !empty($D->p->post_user->location) ) { ?>
<div class="vbox_leftp"><?= htmlspecialchars( mb_substr( $D->p->post_user->location, 0, 30 ) ) ?></div>
<?php } ?>

<?php if(!$D->protected_profile){ ?>
<?php if( !empty($D->p->post_user->about_me) ) { ?>
<span><?= htmlspecialchars( mb_substr( $D->p->post_user->about_me, 0, 100 ) ) ?> </span>
<?php } ?>
<?php } else{ ?>	
<span><?= $this->lang('post_profile_protected') ?></span>
<?php } ?>

</div>
</div>
										
										
											

											
											
											
											
<div class="boxview">
<div class="bothbox" style="border:0;">
<b><?= number_format($D->p->post_user->num_posts) ?> </b><br />Voob
</div>
 
<div class="bothbox">
<b><?= number_format($D->p->post_user->num_followers) ?></b><br /> Takipçi
</div>

<?php $D->he_follows 	= $this->network->get_user_follows($D->p->post_user->id, FALSE, 'hefollows')->follow_users; ?>
<div class="bothbox">
<b><?= number_format(count($D->he_follows)) ?></b><br /> Takipte
</div>

<div class="bothbox">
<b><?= number_format($D->p->post_user->user_rating) ?></b><br /> Puan
</div>

</div>

<?php if( !empty($D->p->post_user->aktifitas) ) { ?>
<p><?= htmlspecialchars( mb_substr( $D->p->post_user->aktifitas, 0, 200 ) ) ?> </p>
<?php } ?>	
											 
<div class="boxview2">
<?php if( $this->user->is_logged && $D->p->post_user && $this->user->id!=$D->p->post_user->id ) { ?>
<div id="usermenu">
<a href="javascript:;" id="pubx_f_<?= $D->p->post_tmp_id ?>" style="display:<?= isset($D->i_follow[$D->p->post_user->id])?'none':'block' ?>;" onclick="user_follow('<?= $D->p->post_user->username ?>', this, 'pubx_unf_<?= $D->p->post_tmp_id ?>', false);" onfocus="this.blur();" class="um_follow"><b><?= $this->lang('postubox_follow') ?></b></a>
<span id="pubx_unf_<?= $D->p->post_tmp_id ?>" style="display:<?= isset($D->i_follow[$D->p->post_user->id])?'block':'none' ?>;">
<a href="javascript:;" onclick="user_unfollow('<?= $D->p->post_user->username ?>', this.parentNode, 'pubx_f_<?= $D->p->post_tmp_id ?>', '<?= $this->lang('user_unfollow_confirm',array('#USERNAME#'=>$D->p->post_user->username)) ?>', false);" onfocus="this.blur();" class="um_following" ><b><?= $this->lang('postubox_following') ?></b></a>
</span>
<a style="padding-left:9px;" href="<?= $C->SITE_URL.$D->p->post_user->username ?>"><?= $this->lang('more_about_me') ?></a>
</div>



<?php } else { ?>
<div id="usermenu">
<a class="um_edit_myprofile" href="<?= $C->SITE_URL ?>settings"><?= 'Edit your profile' ?></a>
<a class="um_me" href="<?= $C->SITE_URL.$D->p->post_user->username ?>"><?= 'View your profile' ?></a>
</div>
<?php } ?>
</div>
		
<!-----------------RECENTPOST-------------->	
 
									
	<?php
	$has_post = FALSE;
	$post_details = new stdClass;
	$something = $this->db2->query('SELECT * FROM posts WHERE user_id="'.$D->p->post_user->id.'" ORDER BY id DESC LIMIT 1');
	while( $o = $this->db2->fetch_object($something) ) {
		$post_details->message = stripslashes($o->message);
	}
	?>
<?php if( !empty($post_details->message) ) { ?>
<div id="recent_post">	
<div class="postavatar">
<a href="<?= userlink($D->p->post_user->username) ?>" ><img src="<?= $C->IMG_URL ?>avatars/thumbs1/<?= $D->p->post_user->avatar ?>"  alt="<?= htmlspecialchars($D->p->post_user->fullname) ?>" /></a>
</div>

<div class="postbody_flybox">
<div class="topareaname">
<a href="<?= userlink($D->p->post_user->username) ?>"><b><?= str_cut($D->p->post_user->fullname,20) ?> </b> <?= '@'.str_cut($D->p->post_user->username,20) ?> </a>	
<?php if($D->p->post_user->verified) { ?>
<div class="verified"></div>
<?php } ?> 
</div>								
<span><?= $post_details->message ?></span>
</div>
</div>				
<?php } ?>										
<!-------------------RECENTPOST END-------------->
</div>	
<!-------------------PAVATARZ END-------------->

			
</div>
<!-------------------FLYBOX-------------->



<div class="reshare_popup" id="reshare2_<?= $D->p->post_tmp_id ?>" style="display:none;"><!------RESHARE POPUP------>
<div class="reshare_popup_container">

<div id="pfhdr">
<div id="pfhdrleft">
<?php if( $D->p->if_can_reshare() ) { ?>
<b><?= $this->lang('reshare_confirm') ?></b>
<?php }elseif( $D->p->if_can_unshare() ) { ?>
<b><?= $this->lang('unshare_confirm') ?></b>
<?php }elseif( $D->p->if_can_delete() ) { ?>
<b><?= $this->lang('post_delete_confirm') ?></b>
<?php } ?>
</div>
<div id="pfhdrright">
<a href="javascript:;" onclick="reshare_close('<?= $D->p->post_tmp_id ?>');" title="Close" onfocus="this.blur();"></a>
</div>
</div>

<div class="postcover">


<?php if( ($D->p->post_user || $D->p->post_user->id==0) && $D->p->post_group ) { ?>
<div class="postavatar">
<a href="<?= userlink($D->p->post_group->groupname) ?>" title="<?= htmlspecialchars($D->p->post_group->title) ?>"><img src="<?= $C->IMG_URL ?>avatars/thumbs1/<?= $D->p->post_group->avatar ?>" alt="<?= htmlspecialchars($D->p->post_group->title) ?>" /></a>
</div>
<?php } else { ?>
<div class="postavatar">
<a href="<?= userlink($D->p->post_user->username) ?>" ><img src="<?= $C->IMG_URL ?>avatars/thumbs1/<?= $D->p->post_user->avatar ?>"  alt="<?= htmlspecialchars($D->p->post_user->fullname) ?>" /></a>
</div>
<?php } ?>


<div class="postbody">
<a href="<?= userlink($D->p->post_user->username) ?>" ><b><?= str_cut($D->p->post_user->username,25) ?></b></a><br />
<?= nl2br($D->p->parse_text()) ?>

<?php if( isset($D->p->post_attached['link']) ) { ?>
<a href="<?= htmlspecialchars($D->p->post_attached['link']->link) ?>" target="_blank" rel="nofollow"><?= htmlspecialchars($D->p->post_attached['link']->link) ?></a>
<?php } ?>
</div>
</div>

<div class="reshare_popup_footer">

<?php if( $D->p->if_can_reshare() ) { ?>
<a href="javascript:;" class="blue_button" onfocus="this.blur();" onclick="reshare_post('<?= $D->p->post_id ?>');"><?= $this->lang('postresharelink') ?></a>
<?php }elseif( $D->p->if_can_unshare() ) { ?>
<a class="blue_button" href="javascript:;"  onfocus="this.blur();" onclick="unshare_post('<?= $D->p->post_id ?>');"><?= $this->lang('postresharelink_undo') ?></a>
<?php } ?>
<?php if( $D->p->if_can_delete() ) { ?>
<a class="blue_button" href="javascript:;" id="postlink_del_<?= $D->p->post_tmp_id ?>" title="<?= $this->lang('post_delete_link') ?>" onfocus="this.blur();" onclick="post_delete('<?= $D->p->post_tmp_id ?>');"><?= $this->lang('postdeletelink') ?></a>
<?php } ?>

<?php if($this->user->is_logged && $this->user->id != $D->p->post_user->id && $this->user->info->is_network_admin){ ?>
<a class="blue_button" href="<?= $C->SITE_URL ?>admin/suspendusers?usrtosusp=<?= trim(urlencode($D->p->post_user->username)) ?>">Banla</a>
<a class="blue_button" href="<?= $C->SITE_URL ?>admin/editusers/user:<?= trim(urlencode($D->p->post_user->username)) ?>">Üye düzenle</a>
<?php } ?>

<a href="javascript:;" class="cancel_button" onclick="reshare_close('<?= $D->p->post_tmp_id ?>');" title="Close" onfocus="this.blur();">Vazgeç</a>


</div>

</div>
</div>



 
<div class="postcover"><!--POSTCOVER-->
 


 

 <?php if( $D->p->post_type=='public' ) { ?>
<a href="javascript:;" id="postlink_unfave_<?= $D->p->post_tmp_id ?>" class="favit"  style="<?= $D->p->is_post_faved()?'display:block;':'display:none;' ?>" onfocus="this.blur();" onclick="post_unfave('<?= $D->p->post_tmp_id ?>',<?= $this->request[0]=='dashboard'&&isset($D->tab)&&$D->tab=='bookmarks' ? 'true' :'false' ?>);"></a>
<?php } ?>


<?php if( $D->p->post_type == 'private' ) { ?>
<a href="<?= userlink($D->p->post_to_user->username) ?>" title="<?= htmlspecialchars($D->p->post_to_user->fullname) ?>">
<div class="cyrcleavatar" style="background-image:url(<?= $C->IMG_URL ?>avatars/thumbs1/<?= $D->p->post_to_user->avatar ?>); float:right; position:relative; margin-left:20px;"></div></a>
<?php } ?>



<?php if( $this->user->is_logged && $D->p->post_user && $this->user->id!=$D->p->post_user->id ) { ?>
<a href="javascript:;" onclick="postuserbox_open('<?= $D->p->post_tmp_id ?>');" title="<?= htmlspecialchars($D->p->post_user->fullname) ?>"><div class="cyrcleavatar" style="background-image:url(<?= $C->IMG_URL ?>avatars/thumbs1/<?= $D->p->post_user->avatar ?>);"></div></a>	
			 
<?php } else { ?>
<a href="javascript:;" onclick="postuserbox_open('<?= $D->p->post_tmp_id ?>');"  title="<?= htmlspecialchars($D->p->post_user->fullname) ?>"><div class="cyrcleavatar" style="background-image:url(<?= $C->IMG_URL ?>avatars/thumbs1/<?= $D->p->post_user->avatar ?>);"></div></a>
<?php } ?>




<div class="postbody_convo"><!----POSTBODY----->

 
<div class="topareaname">


<div class="date"><?= post::parse_date($D->p->post_date) ?> <?= $D->p->parse_group() ?></div>

<?php if( $this->user->is_logged && $D->p->post_user && $this->user->id!=$D->p->post_user->id ) { ?>

<a href="javascript:;" onclick="postuserbox_open('<?= $D->p->post_tmp_id ?>');"  title="<?= htmlspecialchars($D->p->post_user->fullname) ?>"><b>
<?php if( !empty($D->p->post_user->fullname) ) { ?>
<?= str_cut($D->p->post_user->fullname,20) ?> 
<?php } else { ?>
<?= str_cut($D->p->post_user->username,20) ?> 
<?php } ?>
<strong>@<?= $D->p->post_user->username ?></strong></b></a>


 
<?php } else { ?>


<a href="javascript:;" onclick="postuserbox_open('<?= $D->p->post_tmp_id ?>');" title="<?= htmlspecialchars($D->p->post_user->fullname) ?>"><b>
<?php if( !empty($D->p->post_user->fullname) ) { ?>
<?= str_cut($D->p->post_user->fullname,20) ?> 
<?php } else { ?>
<?= str_cut($D->p->post_user->username,20) ?> 
<?php } ?>

 <strong>@<?= $D->p->post_user->username ?></strong></b></a>

 <?php } ?>
 
<?php if($D->p->post_user->verified) { ?>
<div class="verified"></div>
<?php } ?> 
 
 

 	
 
 </div>
					 
 <?php if( isset($D->p->post_attached['image']) ) { ?>
<a href="<?= $C->SITE_URL ?><?= $D->p->post_user->username ?>/media:slides/images:<?= $D->p->post_id ?>
">
<img class="thumbnails" src="<?= $C->IMG_URL ?>attachments/<?= $this->network->id ?>/<?= $D->p->post_attached['image']->file_thumbnail ?>" alt="<?= htmlspecialchars($D->p->post_attached['image']->title) ?>" />
</a>
<?php } ?>

<div class="posttext" >




<?= $D->p->parse_text() ?>
 		
<!--------ATTACHEDLINK----------->
<?php if( isset($D->p->post_attached['link']) ) {
	if( !empty($D->p->post_attached['link']->title) ) {
       $text = $D->p->post_attached['link']->title;
    } else {
    $text = $D->p->post_attached['link']->link; 
	} ?>
<div id="attached_link">
<?php if ( !empty($D->p->post_attached['link']->rawimg) ) { ?>
<a href="<?= htmlspecialchars($D->p->post_attached['link']->link) ?>" target="_blank" rel="nofollow">
<img src="<?= htmlspecialchars($D->p->post_attached['link']->rawimg) ?>" /></a>
<?php } ?>
<b><?= $D->p->post_attached['link']->title ?></b>  
<?= htmlspecialchars($D->p->post_attached['link']->desc) ?> 
<a href="<?= htmlspecialchars($D->p->post_attached['link']->link) ?>" target="_blank" rel="nofollow"><?= htmlspecialchars($D->p->post_attached['link']->link) ?></a>
</div>
 
<?php } ?>
<!--------ATTACHEDLINK-END---------->

 





 <?php if( $D->p->post_resharesnum > 0 ) { ?>
 <div  class="footer_resh_likes">
  <?= $D->p->parse_reshares(); ?>
 </div>
 <?php } ?>
 
</div>



 
<?php if( $this->user->is_logged ) { ?> 




<div class="postftr"><!----POSTFTR---->
  <?php if( $D->p->post_commentsnum == 0 ) { ?>
<?php } else { ?>
<?php } if( !isset($D->do_not_check_new_comments) ){ ?>
<span class="newcomments" id="post_newcomments_<?= $D->p->post_tmp_id ?>" style="<?= $D->p->if_new_comments()==0?'display:none;':'' ?>"><a href="javascript:;" onclick="reshout_open('<?= $D->p->post_tmp_id ?>');"><?= $this->lang($D->p->if_new_comments()==1?'post_newcomments_1':'post_newcomments_more', array('#NUM#'=>$D->p->if_new_comments())) ?> </a>
</span>
<?php } ?>

<?php if( isset($D->p->post_attached['videoembed']) ) { ?>
<a class="video" onclick="postmidle_open('<?= $D->p->post_tmp_id ?>');"><b></b>Video</a> 

 
<?php } ?>
 




<div id="post_btns_top_<?= $D->p->post_tmp_id ?>" style="display:none;">

<?php if( $D->p->post_resharesnum > 0 ) { ?>
<a href="javascript:;"  onclick="postmidle_open('<?= $D->p->post_tmp_id ?>');"><b></b>Aç</a>
<?php } elseif( $D->p->post_likesnum > 0 ) { ?>
<a href="javascript:;"  onclick="postmidle_open('<?= $D->p->post_tmp_id ?>');"><b></b>Aç</a>
<?php } ?>

<a class="reply" href="javascript:;" onclick="reshout_open('<?= $D->p->post_tmp_id ?>');"><b></b><?= $this->lang('ttl_comment') ?></a>
 
<a href="javascript:;" class="mention" onclick="postform_mention('<?= $D->p->post_user->username ?>',true);" onfocus="this.blur();" ><b></b><?= $this->lang('ttl_mention') ?></a>
 
<?php if( $D->p->if_can_reshare() ) { ?>
<a class="reshare" href="javascript:;"  onfocus="this.blur();" onclick="reshare_open('<?= $D->p->post_tmp_id ?>');"><b></b><?= $this->lang('postresharelink') ?></a>

<?php }elseif( $D->p->if_can_unshare() ) { ?>
 
<a class="reshare" href="javascript:;"  onfocus="this.blur();" onclick="reshare_open('<?= $D->p->post_tmp_id ?>');"><b></b><?= $this->lang('postresharelink_undo') ?></a>
<?php } ?>

<?php if( $D->p->could_be_liked() ) { ?>
<?php if( !$D->p->is_post_liked() ) { ?>
<a href="javascript:;" id="postlink_like_<?= $D->p->post_tmp_id ?>" class="like" title="<?= $this->lang('post_like_value') ?>" onfocus="this.blur();" onclick="post_like('<?= $D->p->post_tmp_id ?>', 'on');"><b></b><?= $this->lang('post_like_value') ?></a>
<?php }else{ ?>
<a href="javascript:;" class="dislike" id="postlink_like_<?= $D->p->post_tmp_id ?>" title="<?= $this->lang('post_unlike_value') ?>" onfocus="this.blur();" onclick="post_like('<?= $D->p->post_tmp_id ?>', 'off');"><b></b><?= $this->lang('post_unlike_value') ?> </a>
<?php } ?>
<?php }?>

<?php if( $D->p->post_type=='public' ) { ?>
<a href="javascript:;" id="postlink_fave_<?= $D->p->post_tmp_id ?>" class="favorite"  style="<?= $D->p->is_post_faved()?'display:none;':'display:block;' ?>" onfocus="this.blur();" onclick="post_fave('<?= $D->p->post_tmp_id ?>');"><b></b><?= 'Favorite' ?></a>
<?php } ?>

 


<?php if( $D->p->if_can_delete() ) { ?>

<a class="delete" href="javascript:;"  onfocus="this.blur();" onclick="reshare_open('<?= $D->p->post_tmp_id ?>');"><b></b><?= $this->lang('postdeletelink') ?></a>
<?php } ?>

 <a href="<?= $D->p->permalink ?>">&middot; Details</a>
 
 
</div>

</div><!---POSTFTR-END--->
<?php } ?> 
 
 
 

</div><!----POSTBODY-END---->

 

</div><!-------POSTCOVEREND-------------->



 
<!------POSTMIDLE------------->
<div id="postmidle_<?= $D->p->post_tmp_id ?>"  class="postmidle">

  

  
<?php if( $D->p->post_resharesnum > 0 ) { ?>
<div class="postmidle_resh ">
<b><?= $D->p->post_resharesnum ?> <?= $this->lang('postresharelink') ?>  </b>
<?php $i=0; foreach($D->p->post_reshares as $u) { ?>
<a href="<?= userlink($u->username) ?>"  style="float:left;"  title="<?= htmlspecialchars($u->username) ?>"><img src="<?= $C->IMG_URL ?>avatars/thumbs3/<?= $u->avatar ?>"  alt=""  /></a>
<?php if(++$i==5) { break; } } ?>
</div>
<?php } ?>

<?php if( $D->p->post_likesnum > 0 && isset($D->p->post_likes['post']) && is_array($D->p->post_likes['post']) ) { ?>
<div class="postmidle_resh">
<b><?= $D->p->post_likesnum ?> <?= $this->lang('post_like_value') ?>  </b>
<?php $i=0; foreach($D->p->post_likes['post'] as $u) { ?>
<a href="<?= userlink($u[0]) ?>"  style="float:left;"  title="<?= htmlspecialchars($u[0]) ?>"><img src="<?= $C->IMG_URL ?>avatars/thumbs3/<?= $u[1] ?>" alt=""  /></a>
<?php if(++$i==5) { break; } } ?>
</div>
<?php } ?>
 
 
 
 <div class="klear"></div>
					

<div class="post_attachment">
<?php if( isset($D->p->post_attached['videoembed']) ) { ?>
<?= $D->p->post_attached['videoembed']->embed_code ?>
<?php } ?>
</div>
 

</div>
 <!------POSTMIDLE END------------->





<!----------COMENT----------------->

<?php  $display = $this->param('opencomments')? 'block' : 'none';
if(isset($D->display_comments) && $D->display_comments){
$display = 'block'; } ?>



<div class="pavatarz_out" id="reshout_<?= $D->p->post_tmp_id ?>" style="display:none;"><!-------COMMENT POPUP------>


 

<div class="popup_box">

<div id="box_hdr">
<div id="pfhdrleft">
<b>Reply to <?= str_cut($D->p->post_user->username,25) ?></b>
</div>
<div id="pfhdrright">
<a href="javascript:;" onclick="reshout_close('<?= $D->p->post_tmp_id ?>');" title="Close" onfocus="this.blur();"></a>
</div>
</div>




<div class="comment_form">


<textarea id="postcomments_<?= $D->p->post_tmp_id ?>_textarea" class="comment_textarea transition" maxlength="140"   onkeyup="textarea_autoheight(this);" name="comment" rel="autocomplete" autocompleteoffset="0,3"></textarea>
<div class="comment_form_bottom">

<div class="postftr" style="float:left; padding:7px 0;">
<?php if( $D->p->if_can_reshare() ) { ?>
<a class="reshare" href="javascript:;"  onfocus="this.blur();" onclick="reshare_post('<?= $D->p->post_id ?>', '<?= $this->lang('reshare_confirm') ?>', '<?= $this->lang('reshare_done') ?>');"><b></b><?= $this->lang('postresharelink') ?></a>
<?php }elseif( $D->p->if_can_unshare() ) { ?>
<a class="reshare" href="javascript:;"  onfocus="this.blur();" onclick="unshare_post('<?= $D->p->post_id ?>', '<?= $this->lang('unshare_confirm') ?>', '<?= $this->lang('unshare_done') ?>');"><b></b><?= $this->lang('postresharelink_undo') ?></a>
<?php } ?>

<?php if( $D->p->could_be_liked() ) { ?>
<?php if( !$D->p->is_post_liked() ) { ?>
<a href="javascript:;" id="postlink_like_<?= $D->p->post_tmp_id ?>" class="like" title="<?= $this->lang('post_like_value') ?>" onfocus="this.blur();" onclick="post_like('<?= $D->p->post_tmp_id ?>', 'on');"><b></b><?= $this->lang('post_like_value') ?></a>
<?php }else{ ?>
<a href="javascript:;" class="dislike" id="postlink_like_<?= $D->p->post_tmp_id ?>" title="<?= $this->lang('post_unlike_value') ?>" onfocus="this.blur();" onclick="post_like('<?= $D->p->post_tmp_id ?>', 'off');"><b></b><?= $this->lang('post_unlike_value') ?> </a>
<?php } ?>
<?php } ?>

 <?php if( $D->p->post_type=='public' ) { ?>
<a href="javascript:;" id="postlink_fave_<?= $D->p->post_tmp_id ?>" class="favorite"  style="<?= $D->p->is_post_faved()?'display:none;':'display:block;' ?>" onfocus="this.blur();" onclick="post_fave('<?= $D->p->post_tmp_id ?>');"><b></b><?= $this->lang('ttl_favorite') ?></a>
<?php } ?>

 

</div>
 
<input id="postcomments_<?= $D->p->post_tmp_id ?>_submitbtn" class="reply_button" style="float:right;" onclick="postcomments_submit('<?= $D->p->post_tmp_id ?>');" type="submit" value="<?= $this->lang('post_comments_submit') ?>" /> 
</div>
</div> 

<div class="postcover" style="background:#f1f1f1; padding-bottom:8px;">
<div class="postavatar">
<a href="<?= userlink($D->p->post_user->username) ?>" ><img src="<?= $C->IMG_URL ?>avatars/thumbs1/<?= $D->p->post_user->avatar ?>"  alt="<?= htmlspecialchars($D->p->post_user->fullname) ?>" /></a>
</div>
<div class="postbody">
<div class="topareaname">
<a href="<?= userlink($D->p->post_user->username) ?>" ><b><?= str_cut($D->p->post_user->username,25) ?></b></a>
<?php if($D->p->post_user->verified) { ?>
<div class="verified"></div>
<?php } ?> 
</div>
<?= nl2br($D->p->parse_text()) ?>
<!--------ATTACHEDLINK----------->
<?php if( isset($D->p->post_attached['link']) ) {
	if( !empty($D->p->post_attached['link']->title) ) {
       $text = $D->p->post_attached['link']->title;
    } else {
    $text = $D->p->post_attached['link']->link; 
	} ?>
<div class="attached_link_comment">
<?= htmlspecialchars($D->p->post_attached['link']->desc) ?> 
<a href="<?= htmlspecialchars($D->p->post_attached['link']->link) ?>" target="_blank" rel="nofollow"><?= htmlspecialchars($D->p->post_attached['link']->link) ?></a>
</div>
 
<?php } ?>
<!--------ATTACHEDLINK-END---------->
<?php if( $D->p->post_resharesnum > 0 ) { ?>
<div class="footer_resh_likes" style="margin-top:5px;">
<?= $D->p->parse_reshares(); ?>
</div>
<?php } ?>
</div>
</div>

<?php $i=0; foreach($D->p->get_last_comments() as $c) { ?>
<div class="postcomments" id="postcomment_<?= $c->comment_id ?>">
<div class="commentavatar">	
<a href="<?= userlink($c->comment_user->username) ?>"  title="<?= htmlspecialchars($c->comment_user->fullname) ?>"><img src="<?= $C->IMG_URL.'avatars/thumbs1/'.$c->comment_user->avatar ?>" alt="" /></a>
</div>                              
<div class="postbody" style="margin-bottom:4px; cursor:default;">
<div class="topareaname">
<a href="<?= userlink($c->comment_user->username) ?>" title="<?= htmlspecialchars($c->comment_user->fullname) ?>"><b><?= str_cut($c->comment_user->username,25) ?></b></a> 
<?php if($c->comment_user->verified) { ?>
<div class="verified"></div>
<?php } ?>
</div>
				
<?= nl2br($c->parse_text()) ?>

<small style="display:block; padding-top:1px;">
<?= post::parse_date($c->comment_date) ?> 
<?php if( $c->if_can_delete() ) { ?>&middot;
<a onclick="postcomment_delete('<?= $c->post->post_tmp_id ?>', <?= $c->comment_id ?>, '<?= $this->lang('post_delcomment_cnfrm') ?>');" href="javascript:;" ><?= $this->lang('postdeletelink') ?></a>
<?php } ?>
</small>

</div>
			
</div>
<?php $i++; } ?>

 


<?php if( $D->p->post_commentsnum > $C->POST_LAST_COMMENTS ) { ?>
<div class="comment_left">
<?= $this->lang($D->p->post_commentsnum==1?'post_opncomments_1':'post_opncomments_more', array('#NUM#'=>$D->p->post_commentsnum)) ?>
<a href="<?= $D->p->permalink ?>#comments"> <?= $this->lang('post_viwcomments_link') ?> &rarr;</a>
</div> 
<?php } ?>
 


</div>

 
</div><!-------POUCOMMENT-END------->




</div><!----POSTEND------>

<?php } ?>

Bu kodda html inj açığı var post napıcaz arkadaşlar

--R10.NET; Flood Engellendi -->-> Yeni yazılan mesaj 12:23:57 -->-> Daha önceki mesaj 12:03:02 --

lütfen. uzman biri yokmu sitemizi açmak istiyoruz.

birileri anasayfaya twet atınca, html yönlendiriyor ana sayfadan başka siteye.

14-08-2013, 13:43:18

#2

tiesto

Kimlik doğrulama veya yönetimden onay bekliyor.

htmlspecialchars komutu ile açığı kapatabilirsiniz,baktım çoğu yerde kullanılmış zaten bir yerde gözden kaçırılmış büyük ihtimal ile.Ekrana hangi satırda yazdırdığını gösterirseniz yardımcı olmaya çalışırım
14-08-2013, 13:45:12

#3

~~Cas~~

Üyeliği durduruldu
ona Xss deniyor. basit şöyle bişe yapa bilirsin.
bi html veya javascript kod kuullancak ise < mutlaka kullanması gerekir şöyle bir mantıkla adres cubuğunda *_* gidip sarki falan dinlesene ne zorun var ?</center>";
die();
}
```
config ine vs.. eklersen bütün sayfalara etki eder.

--R10.NET; Flood Engellendi -->-> Yeni yazılan mesaj 13:45:12 -->-> Daha önceki mesaj 13:43:46 --

not bunu uzatırsan script - javascript - > ' gibi kelimelerinide yasaklamanı öneririm. iyi forumlar
14-08-2013, 14:53:19

#4

on2
tiesto adlı üyeden alıntı: mesajı görüntüle

htmlspecialchars komutu ile açığı kapatabilirsiniz,baktım çoğu yerde kullanılmış zaten bir yerde gözden kaçırılmış büyük ihtimal ile.Ekrana hangi satırda yazdırdığını gösterirseniz yardımcı olmaya çalışırım
Cas adlı üyeden alıntı: mesajı görüntüle
ona Xss deniyor. basit şöyle bişe yapa bilirsin.
bi html veya javascript kod kuullancak ise < mutlaka kullanması gerekir şöyle bir mantıkla adres cubuğunda *_* gidip sarki falan dinlesene ne zorun var ?</center>"; die(); }
config ine vs.. eklersen bütün sayfalara etki eder.

--R10.NET; Flood Engellendi -->-> Yeni yazılan mesaj 13:45:12 -->-> Daha önceki mesaj 13:43:46 --

not bunu uzatırsan script - javascript - > ' gibi kelimelerinide yasaklamanı öneririm. iyi forumlar
şuanki satıra eklenmiş halini verebilirmisiniz acaba ben anlayamadım özür dilerim.

14-08-2013, 15:28:12

~~Cas~~

Üyeliği durduruldu

config dosyanızı açın ve içine şunu ekleyin.

$s4=$_SERVER['REQUEST_URI']; 
$yasak="<"; 

if(preg_match_all("@".$yasak."@", $s4, $a)) { 

echo "<center><font size='10' color='darkred'>*_* <br> gidip sarki falan dinlesene ne zorun var ?</center></font>"; 
die(); 
}

işinizi görücektir

14-08-2013, 15:41:35

#6

~~Davout~~

Üyeliği durduruldu

Ayrıca veritabanında bilgi girerken verileri escape etmelisiniz.