_Dejan_

Statistika

Pridružen/a:
16 jun 2010, 06:33
Zadnjič aktiven:
Prispevki:
Teme:
3 | Vse teme
227
23
3
#274

NikoB:

Potrjujem uspešno menjavo z uporabnikom Dejan




Tudi jaz potrjujem uspešno menjavo.


všeč(0) ni všeč(0) spam(0)
#266

Moj problem z transakcijo, ki je bila opravljena dne 31. avg 2011 z uporabnikom Pikeln(Pikcov@gmail.com) v višini 25€ je rešena s PayPal-ovo pomočjo v mojo korist...


všeč(6) ni všeč(0) spam(0)
#8

Jaz pa uporabljam tole funkcijo:


function getClientIPAddress()
{
if (!empty($_SERVER['HTTP_CLIENT_IP']))
{
$ip=$_SERVER['HTTP_CLIENT_IP'];
}
elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
{
$ip=$_SERVER['HTTP_X_FORWARDED_FOR'];
}
else
{
$ip=$_SERVER['REMOTE_ADDR'];
}
return $ip;
}
všeč(0) ni všeč(0) spam(0)
#175

Opozoril bi na uporabnika Pikeln kateremu sem 31. avg 2011 nakazal denar in še vedno nisem prejel nakazila...

9. sep 2011 sem ga ponovno opozoril da še nisem dobil nakazano vendar nisem prejel nobenega odgovora...


všeč(6) ni všeč(0) spam(0)
#4

Jaz pa imam dobre izkušnje z funtech.si


všeč(0) ni všeč(0) spam(0)
#7

@Roky: Sem šele zdele opazil glede validateXMLFile ...

v kodi že preverim če je struktura XML-ja pravilna:


try {
$request_xml = new SimpleXMLElement($HTTP_RAW_POST_DATA);
} catch (Exception $e) {}

if (!$request_xml)
{
//NAPAKA XML NIMA PRAVILNE STRUKTURE IN KOT REZULTAT VRNE ERROR XML DOKUMENT
$response_xml = new SimpleXMLElement("<?xml version='1.0' encoding=\"iso-8859-1\" ?><error></error>");
foreach(libxml_get_errors() as $error)
{
$response_xml->addChild('message', trim($error->message));
}
libxml_clear_errors();
header('Content-Type: text/xml');
echo $response_xml->asXML();
}
else
{
//XML STRUKTURA JE OK
}

Če pogledaš sem imel to narejeno v drugem postu... tako da trenutna koda izgleda takole:


<?php
include('config.php');

libxml_use_internal_errors(true);
libxml_clear_errors();

function getClientIPAddress()
{
if (!empty($_SERVER['HTTP_CLIENT_IP']))
{
$ip=$_SERVER['HTTP_CLIENT_IP'];
}
elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
{
$ip=$_SERVER['HTTP_X_FORWARDED_FOR'];
}
else
{
$ip=$_SERVER['REMOTE_ADDR'];
}
return $ip;
}

function validate_macaddress($val)
{
if(preg_match('/^([0-9a-fA-F][0-9a-fA-F]:){5}([0-9a-fA-F][0-9a-fA-F])$/', $val))
{
return $val;
}
else
{
return "00:00:00:00:00:00";
}
}

function validate_serial($val)
{
if(preg_match('/^[0-9]{6}$/', $val))
{
return $val;
}
else
{
return "000000";
}
}

function validate_hostname($val)
{
if(preg_match('/(?=^.{1,254}$)(^(?:(?!\d+\.|-)[a-zA-Z0-9_\-]{1,63}(?<!-)\.?)+(?:[a-zA-Z]{2,})$)/', $val))
{
return $val;
}
else
{
return "default";
}
}

function validate_sw_version($val)
{
if(preg_match('/^(\d+)((\.{1}\d+)*)(\.{0})$/', $val))
{
return $val;
}
else
{
return "0.00.0000";
}
}

function validate_hw_version($val)
{
if(preg_match('/^(\d+)((\.{1}\d+)*)(\.{0})$/', $val))
{
return $val;
}
else
{
return "0.00";
}
}

$db = mysql_connect($dbhost, $dbuser, $dbpasswd);
mysql_select_db ($dbname) or die ("Cannot connect to database");
mysql_query("SET NAMES 'utf8'");

try {
$request_xml = new SimpleXMLElement($HTTP_RAW_POST_DATA);
} catch (Exception $e) {}

if (!$request_xml)
{
$response_xml = new SimpleXMLElement("<?xml version='1.0' encoding=\"iso-8859-1\" ?><error></error>");
foreach(libxml_get_errors() as $error)
{
$response_xml->addChild('message', trim($error->message));
}
libxml_clear_errors();
header('Content-Type: text/xml');
echo $response_xml->asXML();
}
else
{
$mac_address = mysql_real_escape_string(validate_macaddress($request_xml->mac_address));
$serial = mysql_real_escape_string(validate_serial($request_xml->serial));
$hostname = mysql_real_escape_string(validate_hostname($request_xml->hostname));
$sw_version = mysql_real_escape_string(validate_sw_version($request_xml->sw_version));
$hw_version = mysql_real_escape_string(validate_hw_version($request_xml->hw_version));

$sql = "SELECT id, active, REPLACE(UUID(),'-', '') AS session FROM devices WHERE mac_address='" . $mac_address . "' AND serial='" . $serial . "' AND hostname='" . $hostname . "'";
$result = mysql_query($sql);
$device = mysql_fetch_object($result);

$response_xml = new SimpleXMLElement("<?xml version='1.0' encoding=\"iso-8859-1\" ?><packet></packet>");
$response_xml->addChild('device_id', $device->id);
$response_xml->addChild('active', $device->active);
$response_xml->addChild('session', $device->session);

if(is_null($device->id))
{}
else
{
if($device->active = 1)
{
mysql_query("UPDATE devices SET status='01', dt_last_online=Now(), session='" . $device->session . "', sw_version='" . $sw_version . "', hw_version='" . $hw_version . "', ip_address='" . getClientIPAddress() . "' WHERE id=" . $device->id . ";");
mysql_query("INSERT INTO events (dt, device_id, event, response, description) VALUES (Now(), " . $device->id . ", '0001', '01', '" . $device->session . "');");
}
else
{
mysql_query("UPDATE devices SET status='02', dt_last_online=Now(), session='', sw_version='" . $sw_version . "', hw_version='" . $hw_version . "', ip_address='" . getClientIPAddress() . "' WHERE id=" . $device->id . ";");
mysql_query("INSERT INTO events (dt, device_id, event, response, description) VALUES (Now(), " . $device->id . ", '0001', '02', '');");
}
}
header('Content-Type: text/xml');
echo $response_xml->asXML();
}
mysql_free_result($result);
mysql_close($db);
?>
všeč(0) ni všeč(0) spam(0)
#6

Hvala obema za odgovore.

1.)Kar se tiče validacije sem v kodo dodal funkcije za validacijo:


function validate_macaddress($val)
{
if(preg_match('/^([0-9a-fA-F][0-9a-fA-F]:){5}([0-9a-fA-F][0-9a-fA-F])$/', $val))
{
return $val;
}
else
{
return "00:00:00:00:00:00"
}
}

function validate_serial($val)
{
if(preg_match('/^[0-9]{6}$/', $val))
{
return $val;
}
else
{
return "000000"
}
}

function validate_hostname($val)
{
if(preg_match('/(?=^.{1,254}$)(^(?:(?!\d+\.|-)[a-zA-Z0-9_\-]{1,63}(?<!-)\.?)+(?:[a-zA-Z]{2,})$)/', $val))
{
return $val;
}
else
{
return "default"
}
}

function validate_sw_version($val)
{
if(preg_match('/^(\d+)((\.{1}\d+)*)(\.{0})$/', $val))
{
return $val;
}
else
{
return "0.00.0000"
}
}

function validate_hw_version($val)
{
if(preg_match('/^(\d+)((\.{1}\d+)*)(\.{0})$/', $val))
{
return $val;
}
else
{
return "0.00"
}
}

In nato spremenil validacijo spremeljivk:


$mac_address = mysql_real_escape_string(validate_macaddress($request_xml->mac_address));
$serial = mysql_real_escape_string(validate_serial($request_xml->serial));
$hostname = mysql_real_escape_string(validate_hostname($request_xml->hostname));
$sw_version = mysql_real_escape_string(validate_sw_version($request_xml->sw_version));
$hw_version = mysql_real_escape_string(validate_hw_version($request_xml->hw_version));

2.)Bom dodal preverjanje XML-ja.

3.)Sem popravil manjkajoči $ v query-u in na koncu predno zaprem bazo dodal mysqlfreeresult().

4.)login requestov bo zelo malo oz. samo takrat ko bo naprava izgubila povezavo s strežnikom ali se resetirala. Bodo pa še drugi requesti in sicer pošiljanje statusa naprave ki bo vsakih 10-30s(Odvisno od konfiguracije) in pa pošiljanje statusa modula priklopljenega na napravo(max. 4 moduli) vsakih 5-20sekund. dosti manjši interval pomoje itak ni možen zaradi samega pinga gprs/3g omrežja :) Ti xml-ji bodo tudi malo večji kot login ker bodo vsebovali več podatkov...


všeč(0) ni všeč(0) spam(0)
#3

Roky:

Ne razumem sploh kje je težava. Iščeš koncept ... ali ti dejansko kaj ne dela?




V bistvu zadeva dela, zanima me predvsem če sem glede security-a kje mimo vsekal in je skripta potencialno nevarna, oz. če sem kje kaj spregledal in bo zadeva požirala preveč resoursev. Z 1 clientom to ne morem testirat, ko pa bo laufalo na produkcijskem strežniku in gor 100-200 naprav pa je tudi težko narediti kakšne večje spremembe :)


všeč(0) ni všeč(0) spam(0)
#1

hm ali nihče ne zna pomagati svetovati kako naj se lotim zadeve oz. ali je tak način ok?

Ker ne morem urejati prvega posta bom dodal kodo v kateri sem v večini primerov "preprečil" SQL Injection me pa zanima ali je smiselno dodati še stripslashes() preden kličem mysqlrealescape_string() ???

Nova koda:


<?php
include('config.php');

error_reporting(0);
libxml_use_internal_errors(true);
libxml_clear_errors();

function getClientIPAddress()
{
if (!empty($_SERVER['HTTP_CLIENT_IP']))
{
$ip=$_SERVER['HTTP_CLIENT_IP'];
}
elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
{
$ip=$_SERVER['HTTP_X_FORWARDED_FOR'];
}
else
{
$ip=$_SERVER['REMOTE_ADDR'];
}
return $ip;
}

$db = mysql_connect($dbhost, $dbuser, $dbpasswd);
mysql_select_db ($dbname) or die ("Cannot connect to database");
mysql_query("SET NAMES 'utf8'");

try {
$request_xml = new SimpleXMLElement($HTTP_RAW_POST_DATA);
} catch (Exception $e) {}

if (!$request_xml)
{
$response_xml = new SimpleXMLElement("<?xml version='1.0' encoding=\"iso-8859-1\" ?><error></error>");
foreach(libxml_get_errors() as $error)
{
$response_xml->addChild('message', trim($error->message));
}
libxml_clear_errors();
header('Content-Type: text/xml');
echo $response_xml->asXML();
}
else
{
$mac_address = mysql_real_escape_string($request_xml->mac_address);
$serial = mysql_real_escape_string($request_xml->serial);
$hostname = mysql_real_escape_string($request_xml->hostname);
$sw_version = mysql_real_escape_string($request_xml->sw_version);
$hw_version = mysql_real_escape_string($request_xml->hw_version);

$sql = "SELECT id, active, REPLACE(UUID(),'-', '') AS session FROM devices WHERE mac_address='" . $mac_address . "' AND serial='" . $serial . "' AND hostname='" . $hostname . "'";
$result = mysql_query($sql);
$device = mysql_fetch_object($result);

$response_xml = new SimpleXMLElement("<?xml version='1.0' encoding=\"iso-8859-1\" ?><packet></packet>");
$response_xml->addChild('device_id', $device->id);
$response_xml->addChild('active', $device->active);
$response_xml->addChild('session', $device->session);

if(is_null($device->id))
{
header('Content-Type: text/xml');
echo $response_xml->asXML();
}
else
{
if($device->active = 1)
{
mysql_query("UPDATE devices SET status='01', dt_last_online=Now(), session='" . $device->session . "', sw_version='" . $sw_version . "', hw_version='" . hw_version . "', ip_address='" . getClientIPAddress() . "' WHERE id=" . $device->id . ";");
mysql_query("INSERT INTO events (dt, device_id, event, response, description) VALUES (Now(), " . $device->id . ", '0001', '01', '" . $device->session . "');");
header('Content-Type: text/xml');
echo $response_xml->asXML();
}
else
{
mysql_query("UPDATE devices SET status='02', dt_last_online=Now(), session='', sw_version='" . $sw_version . "', hw_version='" . hw_version . "', ip_address='" . getClientIPAddress() . "' WHERE id=" . $device->id . ";");
mysql_query("INSERT INTO events (dt, device_id, event, response, description) VALUES (Now(), " . $device->id . ", '0001', '02', '');");
header('Content-Type: text/xml');
echo $response_xml->asXML();
}
}
}
mysql_close($db);
?>
všeč(0) ni všeč(0) spam(0)
#3

hm glede Abanke nisem pravi naslov :) Mislim pa da če ne, da nebi bilo problema pod pogojem da bi pri njih "vzel depozit" in naredil revolving kredit oz. kakorkoli se že reče :)


všeč(0) ni všeč(0) spam(0)