System Modifications
miwoshop_system
1.0.0
http://www.miwisoft.com
Miwisoft LLC
session = $registry->get('session');]]>
loginOFromJ($this, null, true);
#miwoshop-end
]]>
session->data['user_id'] = $user_query->row['user_id'];]]>
session->data['token'])) {
$this->session->data['token'] = md5(mt_rand());
$this->request->get['token'] = $this->session->data['token'];
}
#miwoshop-end
]]>
db->query("SELECT * FROM " . DB_PREFIX . "user WHERE username = '" . $this->db->escape($username) . "' AND (password = SHA1(CONCAT(salt, SHA1(CONCAT(salt, SHA1('" . $this->db->escape($password) . "'))))) OR password = '" . $this->db->escape(md5($password)) . "') AND status = '1'");]]>
getEncryptedOPassword($username, $password, 'Username');
$user_query = $this->db->query("SELECT * FROM " . DB_PREFIX . "user WHERE username = '" . $this->db->escape($username) . "' AND (password = SHA1(CONCAT(salt, SHA1(CONCAT(salt, SHA1('" . $this->db->escape($password) . "'))))) OR password = '" . $this->db->escape(md5($password)) . "' OR password = '" . $this->db->escape($encrypted_password) . "') AND status = '1'");
#miwoshop-end
]]>
getEncryptedOPassword($email, $password);
$parts = explode(':', $encrypted_password);
$encrypted_password2 = $parts[0];
#miwoshop-end
]]>
db->query("SELECT * FROM " . DB_PREFIX . "customer WHERE LOWER(email) = '" . $this->db->escape(utf8_strtolower($email)) . "' AND (password = SHA1(CONCAT(salt, SHA1(CONCAT(salt, SHA1('" . $this->db->escape($password) . "'))))) OR password = '" . $this->db->escape(md5($password)) . "') AND status = '1' AND approved = '1'");]]>
db->query("SELECT * FROM " . DB_PREFIX . "customer WHERE LOWER(email) = '" . $this->db->escape(utf8_strtolower($email)) . "' AND (password = SHA1(CONCAT(salt, SHA1(CONCAT(salt, SHA1('" . $this->db->escape($password) . "'))))) OR password = '" . $this->db->escape(md5($password)) . "' OR password = '" . $encrypted_password . "' OR password = '" . $encrypted_password2 . "') AND status = '1' AND approved = '1'"); #miwoshop-start]]>
customer_group_id = $customer_query->row['customer_group_id'];]]>
config->set('config_customer_group_id', $customer_query->row['customer_group_id']);
#miwoshop-end
]]>
db->query("UPDATE " . DB_PREFIX . "customer SET ip = '" . $this->db->escape($this->request->server['REMOTE_ADDR']) . "' WHERE customer_id = '" . (int)$this->customer_id . "'");]]>
loginJFromO($email, $password);
#miwoshop-end
]]>
getEncryptedOPassword($email, $password);
$parts = explode(':', $encrypted_password);
$encrypted_password2 = $parts[0];
#miwoshop-end
]]>
db->query("SELECT * FROM " . DB_PREFIX . "affiliate WHERE LOWER(email) = '" . $this->db->escape(utf8_strtolower($email)) . "' AND (password = SHA1(CONCAT(salt, SHA1(CONCAT(salt, SHA1('" . $this->db->escape($password) . "'))))) OR password = '" . $this->db->escape(md5($password)) . "') AND status = '1' AND approved = '1'");]]>
db->query("SELECT * FROM " . DB_PREFIX . "affiliate WHERE LOWER(email) = '" . $this->db->escape(utf8_strtolower($email)) . "' AND (password = SHA1(CONCAT(salt, SHA1(CONCAT(salt, SHA1('" . $this->db->escape($password) . "'))))) OR password = '" . $this->db->escape(md5($password)) . "' OR password = '" . $encrypted_password . "' OR password = '" . $encrypted_password2 . "') AND status = '1' AND approved = '1'"); #miwoshop-start]]>
code = $affiliate_query->row['code'];]]>
loginJFromO($email, $password);
#miwoshop-end
]]>
filename = $filename;
#miwoshop-end
]]>
data[$key]) ? $this->data[$key] : $key);]]>
filename;
$trace = debug_backtrace();
if (!empty($trace)) {
$file_path = $trace[0]['file'];
$file_path = str_replace('\\', '/', $file_path);
$file_path = str_replace('.php', '', $file_path);
$as_file = strpos($file_path, str_replace('\\','/',$file_name));
if ($as_file === false) {
if (strpos($file_path, 'modification') !== false){
$_file_name = strstr($file_path, 'modification');
}
else {
$_file_name = strstr($file_path, 'opencart');
}
$_path_array = explode('/', $_file_name);
$path_array = array();
if(count($_path_array) > 4) {
$path_array[0] = $_path_array[3];
$path_array[1] = $_path_array[4];
$file_name = implode('/', $path_array);
}
}
}
$string = 'COM_MIWOSHOP_'.strtoupper(str_replace('/', '_', $this->filename)).'_'.strtoupper($key);
$text = MText::_($string);
if ( ($text == $string or $text == '??'. $string .'??') and !MFactory::getApplication()->isAdmin() and !(isset($_GET['view']) and $_GET['view'] == 'admin') ) {
$string = 'COM_MIWOSHOP_'.strtoupper(str_replace('/', '_', $file_name)).'_'.strtoupper($key);
$text = MText::_($string);
}
if (isset($path_array[0]) and $path_array[0] == 'checkout' and ($text == $string or $text == '??'. $string .'??')) {
$string = 'COM_MIWOSHOP_'.strtoupper(str_replace('/', '_', 'checkout/checkout')).'_'.strtoupper($key);
$text = MText::_($string);
}
if ($text == $string or $text == '??'. $string .'??') {
$string = 'COM_MIWOSHOP_'.strtoupper($key);
$text = MText::_($string);
}
if (($text != $string) and ($text != '??'. $string .'??')) {
return $text;
}
$lang = MFactory::getLanguage();
$_directory =strtolower($lang->getTag());
$_directory =str_replace('-', '_', $_directory);
$text = $this->loadSecond($_directory, $this->filename, $key);
if (!empty($text)) {
return $text;
}
#miwoshop-end
]]>
$value) {]]>
$product_option_id,
'product_option_value_id' => $value,
'option_id' => 0,
'option_value_id' => 0,
'name' => 'Price',
'option_value' => $value,
'type' => 'text',
'quantity' => 1,
'subtract' => 0,
'price' => $value,
'price_prefix' => '+',
'points' => 0,
'points_prefix' => '+',
'weight' => 0,
'weight_prefix' => '+'
);
$option_price += $option_value;
continue;
}
#miwoshop-end
]]>
db->query("SELECT * FROM `" . DB_PREFIX .]]>
session->data['currency'])) && (array_key_exists($this->session->data['currency'], $this->currencies))) {]]>
request->post['currency_code']) && (array_key_exists($this->request->post['currency_code'], $this->currencies))) { #miwoshop-start
$this->set($this->request->post['currency_code']); #miwoshop-end]]>
$result['value']]]>
$result['status'], #miwoshop-start]]>
currencies[$currency]['status'])) {
$currency = $this->config->get('config_currency');
}
#miwoshop-end
]]>
url)]]>
route(str_replace('{page}', 1, $this->url))]]>
url)]]>
route(str_replace('{page}', $i, $this->url))]]>
url)]]>
route(str_replace('{page}', $page + 1, $this->url))]]>
url)]]>
route(str_replace('{page}', $page - 1, $this->url))]]>
url)]]>
route(str_replace('{page}', $num_pages, $this->url))]]>
route($url);
}
#miwoshop-finish
]]>
get('config_miwoshop');
$this->checkSecurity($config_miwoshop, $this->get, 'get');
$this->checkSecurity($config_miwoshop, $this->post, 'post');
}
public function checkSecurity($config, $data, $request) {
$uri = urldecode(http_build_query($data));
if (($config['firewall_lfi'] == $request) or ($config['firewall_lfi'] == 'both')) {
$this->_checkLFI($uri);
}
if (($config['firewall_rfi'] == $request) or ($config['firewall_rfi'] == 'both')) {
$this->_checkRFI($uri);
}
if (($config['firewall_sql'] == $request) or ($config['firewall_sql'] == 'both')) {
$this->_checkSQL($uri);
}
if (($config['firewall_xss'] == $request) or ($config['firewall_xss'] == 'both')) {
$this->_checkXSS($uri);
}
}
public function _checkLFI($uri) {
if (preg_match('#\.\/#is', $uri, $match)) {
die('LFI attack attempt.');
}
}
public function _checkRFI($uri) {
static $exceptions;
if (!is_array($exceptions)) {
$exceptions = array();
// attempt to remove instances of our website from the URL...
$domain = MUri::getInstance()->getHost();
$exceptions[] = 'http://'.$domain;
$exceptions[] = 'https://'.$domain;
// also remove blank entries that do not pose a threat
$exceptions[] = 'http://&';
$exceptions[] = 'https://&';
}
$uri = str_replace($exceptions, '', $uri);
if (preg_match('#=https?:\/\/.*#is', $uri, $match)) {
die('RFI attack attempt.');
}
}
public function _checkSQL($uri) {
if (preg_match('#[\d\W](union select|union join|union distinct)[\d\W]#is', $uri, $match)) {
die('SQL Injection attack attempt.');
}
// check for SQL operations with DB_PREFIX in the URI
if (preg_match('#[\d\W](union|union select|insert|from|where|concat|into|cast|truncate|select|delete|having)[\d\W]#is', $uri, $match) && preg_match('/'.preg_quote(DB_PREFIX).'/', $uri, $match)) {
die('SQL Injection attack attempt.');
}
}
public function _checkXSS($uri) {
if (preg_match('#<[^>]*\w*\"?[^>]*>#is', $uri, $match)) {
die('XSS attack attempt.');
}
}
]]>
addHeadLink($href, 'canonical', 'rel');
} else {
$this->links[$href] = array(
'href' => $href,
'rel' => $rel
);
}
}]]>
]]>