Quote from: ranlo on June 28, 2015, 07:21:25 AM

Quote from: Kazuldur on June 21, 2015, 09:31:09 PM

Quote from: minifrij on June 21, 2015, 09:15:59 PM

Either way, it seems pretty easy to implement. Just checking against the referrer and returning to the homepage if it was found to be elsewhere should be sufficient.
Something like this maybe:

Code:

if($_SERVER['HTTP_REFERER'] != 'http://yoursitewhatever.com'){
header('Location: /');
}

Once the form has submitted (~line 1138 on index.php).

I'm not that good with PHP, but I think that

Code:

header('Location: /');

won't end the script. So it will send the coins either way and only redirect to main page after that.

Code:

header('Location: /'); die();

should work though.

As soon as that header hits, the page forwards, so there's no need for closing out the PHP connection -- it's done by default. Even if you have other code after that, it will stop parsing at that line.

I myself wouldn't trust referer headers as they could be fabricated.

Quote from: minifrij on July 08, 2015, 11:15:53 AM

Quote from: ranlo on July 08, 2015, 08:02:39 AM

Even with your code changes (such as escaping strings), there are many vulnerabilities still open. I'm actually somewhat surprised something as important as dealing with people's finances (in the sense that the script has access to the wallet's funds) is even using SQLi, much less in a very unsecure method. real_escape_string only prevents a small portion of injections from being possible, and if you really want to use that route, you should fix all of them.

As I said, the best way to do it without completely changing the DB software would be to use prepared statements, though that would still leave the script open to some forms of injection. What would you suggest to fix it?

I think PDO would do just fine. That plus validating the input (which in this case is only a wallet address) with base58 encoding/decoding (if anyones interested I can provide a simple script).

Anyway, you're doing a great job guys! Keep it up.