From aa38097c07def6d31481dfeeb2bcba520d323b2d Mon Sep 17 00:00:00 2001 From: Dries Buytaert Date: Fri, 6 Jun 2003 21:37:11 +0000 Subject: - Dropped check_input(); use check_query() instead. - Made the statistics module use referer_uri() for security's sake. --- modules/statistics.module | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'modules/statistics.module') diff --git a/modules/statistics.module b/modules/statistics.module index 3b8d7d8ca..294b67135 100644 --- a/modules/statistics.module +++ b/modules/statistics.module @@ -53,7 +53,7 @@ function statistics_exit() { if ((variable_get("statistics_enable_access_log", 0)) && (throttle_status() < 5)) { // statistical logs are enabled - $referrer = getenv("HTTP_REFERER"); + $referrer = referer_uri(); $hostname = getenv("REMOTE_ADDR"); // log this page access if ((arg(0) == "node") && (arg(1) == "view") && arg(2)) { @@ -333,11 +333,11 @@ function statistics_recent_refer() { $query = "SELECT url,timestamp FROM accesslog WHERE url <> '' ORDER BY timestamp DESC"; } elseif ($view == "internal") { - $query = "SELECT url,timestamp FROM accesslog WHERE url LIKE '%". check_input($_SERVER["HTTP_HOST"]) ."%' ORDER BY timestamp DESC"; + $query = "SELECT url,timestamp FROM accesslog WHERE url LIKE '%". check_query($_SERVER["HTTP_HOST"]) ."%' ORDER BY timestamp DESC"; $describe = "internal "; } else { - $query = "SELECT url,timestamp FROM accesslog WHERE url NOT LIKE '%". check_input($_SERVER["HTTP_HOST"]) ."%' AND url <> '' ORDER BY timestamp DESC"; + $query = "SELECT url,timestamp FROM accesslog WHERE url NOT LIKE '%". check_query($_SERVER["HTTP_HOST"]) ."%' AND url <> '' ORDER BY timestamp DESC"; $describe = "external "; } @@ -363,12 +363,12 @@ function statistics_top_refer() { $query = "SELECT url, COUNT(url) AS count FROM accesslog WHERE url <> '' GROUP BY url ORDER BY count DESC"; } elseif ($view == "internal") { - $query = "SELECT url, COUNT(url) AS count FROM accesslog WHERE url LIKE '%". check_input($_SERVER["HTTP_HOST"]) ."%' GROUP BY url ORDER BY count DESC"; + $query = "SELECT url, COUNT(url) AS count FROM accesslog WHERE url LIKE '%". check_query($_SERVER["HTTP_HOST"]) ."%' GROUP BY url ORDER BY count DESC"; $describe = "internal "; } else { /* default to external */ - $query = "SELECT url, COUNT(url) AS count FROM accesslog WHERE url NOT LIKE '%". check_input($_SERVER["HTTP_HOST"]) ."%' AND url <> '' GROUP BY url ORDER BY count DESC"; + $query = "SELECT url, COUNT(url) AS count FROM accesslog WHERE url NOT LIKE '%". check_query($_SERVER["HTTP_HOST"]) ."%' AND url <> '' GROUP BY url ORDER BY count DESC"; $describe = "external "; } -- cgit v1.2.3