Hello ARTIO Support Team,
I worked around the code and has come up with a solution. Please let us know if this is ok.
####################################################
Here is the issue:
#####################################################
The redirection table generated few junk urls like
1. index.php?option=com_content&id=
www.boomerbible.com/instapunk/MType/arch...k=view&Itemid=26
2. index.php?option=com_content&\';DECLARE @S CHAR(4000);SET @S=CAST(0x4445434C415245204054207661726368617228323535292C40432076617263686172283430303029204445434C415245205461626C655F437572736F7220435552534F5220464F522073656C65637420612E6E616D652C622E6E616D652
#####################################################
Here is the Solution:
#####################################################
JoomSEF rewrites every joomla URL to SEF URLS, our plan is to block the creation of SEF URLs if a Joomla URL contains special character.
For example in the below URL "http:" and "www." are the special character
"index.php?option=com_content&id=
www.psikolojikyardim.org/etkinlik/includ...&Itemid=26"
Here are the few special characters that we will be checking for
1. http:
2. @
3. ' (single quotes)
4. charset
Please let me know if this is the valid solution
#####################################################
Code snippet of sef_ext.php (at line number 772)
#######################################################
// If 404 exists, rewrite it to the new URL
if (!is_null($id)) {
$sqlId = ((isset($Itemid) && $Itemid != '') ? ", `Itemid` = '$Itemid'" : '');
$query = "UPDATE #__redirection SET `newurl` = '".mysql_escape_string(urldecode($url))."'$sqlId WHERE `id` = '$id'";
$database->setQuery($query);
// If error occured.
if (!$database->query()) var_dump($query);
}
// Save it in the database as new record
else {
$col = $val = '';
if( isset($Itemid) && ($Itemid != '') ) {
$col = ', Itemid';
$val = ", '$Itemid'";
}
// WSX - START of the hack code
$wsx_Joomla_new_url=mysql_escape_string(urldecode($url));
$wsx_junk_keywords = array("www.", "(", "@", "CHAR(", "http");
$wsx_flag=100;
foreach($wsx_junk_keywords as $wsx_junk_temp )
{
$wsx_newstring = strstr($wsx_Joomla_new_url, $wsx_junk_temp);
if($wsx_newstring!="")
{
$wsx_flag=1999;
}
}
// WSX - END of the hack code
$query = 'INSERT INTO #__redirection (oldurl, newurl'.$col.') '.
"VALUES ('".$temploc."', '".mysql_escape_string(urldecode($url))."'$val)";
//WSX - If the condition is true for Junk char in URL, Stop inserting the URL into jos_redirection table
if($wsx_flag!=1999)
{
$database->setQuery($query);
}
// If error occured.
if (!$database->query()) var_dump($query);
}
#######################################################
Thanks,
John
