flow.php line 375,flow.php found 375 rows:
* Save Consignee Information */$consignee = array (' address_id ' = = Empty ($_post[' address_id ')? 0 : Intval ($_post[' address_id '), ' consignee ' = = Empty ($_post[' consignee '])? ': Compile_str (Trim ($_post[' consignee ')), ' country ' = = Empty ($_post[' country '])? ': Intval ($_post[' country '), ' province ' = = Empty ($_post[' province '])? ': Intval ($_post[' province '), ' city ' = Empty ($_post[' city ')? ': Intval ($_post[' city '), ' district ' = Empty ($_post[' district '])? ': Intval ($_post[' district '), ' email ' = ' empty ' ($_post[' email ')? ': compile_str ($_post[' email ']), ' address ' = = Empty ($_post[' address ')? ': Compile_str ($_post[' address '), ' zipcode ' = Empty ($_post[' zipcode '])? ': Compile_str (Make_semiangle (Trim ($_post[' zipcode '))), ' Tel ' = = Empty ($_post[' tel '])? ": Compile_str (Make_semiangle ($_post[' tel '))), ' mobile ' = Empty ($_post[' mobile '])? ': Compile_str (Make_semiangle (Trim ($_post[' mobile))), ' sign_building ' = = Empty ($_post[' sign_building ') ) ? ': Compile_str ($_post[' sign_building '), ' best_time ' = = Empty ($_post[' best_time '])? ': Compile_str ($_post[' best_time '),);
The code here has a function Compile_str. The function is ecshop latest patch new entry. The original piece of code is
' address_id ' = Empty ($_post[' address_id ')? 0:intval ($_post[' address_id '), ' consignee ' = = Empty ($_post[' consignee '])? ': Trim ($_post[' consignee '), ' country ' = Empty ($_post[' country '])? ": $_post[' Country '", ' Province ' = Empty ($_post[' province '])? ": $_post[' Province '", ' City ' = Empty ($_post[' city ')? ': $_post[' city ', ' district ' = ' = Empty ($_post[' district ')? ": $_post[' District '], ' email ' = ' empty ($_post[' email ')? ": $_post[' email '], ' address ' = = Empty ($_post[' address ')? ": $_post[' address '], ' zipcode ' = = Empty ($_post[' zipcode '])? ': Make_semiangle (Trim ($_post[' zipcode ')), ' tel ' = = Empty ($_post[' tel '])? ': Make_semiangle (Trim ($_post[' tel ')), ' mobile ' = Empty ($_post[' mobile ')? ": make_sEmiangle (Trim ($_post[' mobile ')), ' sign_building ' = Empty ($_post[' sign_building '])? ": $_post[' sign_building '", ' best_time ' = Empty ($_post[' best_time '])? ": $_post[' Best_time '),
The function is for the vulnerability. In the file lib_base.php 776 lines.
/** * Filter User input basic data, prevent script attack * * @access public * @return string */function compile_str ($str) { $arr = array (' < ' = ', ' > ' + ' '; '; Return Strtr ($str, $arr);}
Filter the basic data entered by the user to prevent script attack! So if the site hints that this function is missing, you can just fill in the function. Sticking to the bottom of the flow.php , the problem is solved.
Error Compile_str () flow.php on line 375 workaround