Commit 74a34d23 authored by Chris Graham's avatar Chris Graham
Browse files

Fixed MANTIS-4231 (Better protect against bots going deep into member list)

parent 6ce40a6a

sources/blocks/main_members.php

+7 −1
Original line number Diff line number Diff line
@@ -319,13 +319,19 @@ class Block_main_members 
        $count_sql = 'SELECT COUNT(DISTINCT r.id) FROM ' . $main_sql;



        inform_non_canonical_parameter($block_id . '_max');

        $max = get_param_integer($block_id . '_max', array_key_exists('max', $map) ? intval($map['max']) : 30);

        $default_max = array_key_exists('max', $map) ? intval($map['max']) : 30;

        $max = get_param_integer($block_id . '_max', $default_max);

        if ($max == 0) {

            $max = 30;

        }

        inform_non_canonical_parameter($block_id . '_start');

        $start = get_param_integer($block_id . '_start', array_key_exists('start', $map) ? intval($map['start']) : 0);



        // Don't allow guest bots to probe too deep into the member directory, it gets very slow; the XML Sitemap is for guiding to topics like this

        if (($start > $default_max * 5) && (is_guest()) && (!is_null(get_bot_type()))) {

            access_denied('NOT_AS_GUEST');

        }



        $max_rows = $GLOBALS['FORUM_DB']->query_value_if_there($count_sql);



        $rows = $GLOBALS['FORUM_DB']->query($sql, ($display_mode == 'media') ? ($max + $start) : $max, ($display_mode == 'media') ? null : $start);

sources/templates_pagination.php

+0 −7
Original line number Diff line number Diff line
@@ -161,13 +161,6 @@ function pagination($title, $start, $start_name, $max, $max_name, $max_rows, $ke 
    inform_non_canonical_parameter($start_name);

    inform_non_canonical_parameter($start_name . '__keyed');



    if (get_page_name() == 'members') {

        // Don't allow guest bots to probe too deep into the forum index, it gets very slow; the XML Sitemap is for guiding to topics like this

        if (($start > $max * 5) && (is_guest()) && (!is_null(get_bot_type()))) {

            access_denied('NOT_AS_GUEST');

        }

    }



    $post_array = array();

    if ($keep_post) {

        foreach ($_POST as $key => $val) {