diff --git a/epp/src/epp-check.php b/epp/src/epp-check.php index bd8bc5f..bf760e4 100644 --- a/epp/src/epp-check.php +++ b/epp/src/epp-check.php @@ -76,7 +76,7 @@ function processHostCheck($conn, $db, $xml, $trans) { $host = (string)$host; // Validation for host name - if (!preg_match('/^([A-Z0-9]([A-Z0-9-]{0,61}[A-Z0-9]){0,1}\\.){1,125}[A-Z0-9]([A-Z0-9-]{0,61}[A-Z0-9])$/i', $host) && strlen($host) > 254) { + if (!validateHostName($host)) { sendEppError($conn, $db, 2005, 'Invalid host name', $clTRID, $trans); return; } diff --git a/epp/src/epp-create.php b/epp/src/epp-create.php index d82b6e0..3f16c98 100644 --- a/epp/src/epp-create.php +++ b/epp/src/epp-create.php @@ -392,7 +392,7 @@ function processHostCreate($conn, $db, $xml, $clid, $database_type, $trans) { $hostName = $xml->command->create->children('urn:ietf:params:xml:ns:host-1.0')->create->name; $clTRID = (string) $xml->command->clTRID; - if (preg_match('/^([A-Z0-9]([A-Z0-9-]{0,61}[A-Z0-9]){0,1}\.){1,125}[A-Z0-9]([A-Z0-9-]{0,61}[A-Z0-9])$/i', $hostName) && strlen($hostName) < 254) { + if (validateHostName($hostName)) { $host_id_already_exist = $db->query("SELECT id FROM host WHERE name = '$hostName' LIMIT 1")->fetchColumn(); if ($host_id_already_exist) { sendEppError($conn, $db, 2302, 'host:name already exists', $clTRID, $trans); diff --git a/epp/src/epp-delete.php b/epp/src/epp-delete.php index 9766e5d..63a065a 100644 --- a/epp/src/epp-delete.php +++ b/epp/src/epp-delete.php @@ -98,6 +98,12 @@ function processHostDelete($conn, $db, $xml, $clid, $database_type, $trans) { return; } + // Validation for host name + if (!validateHostName($hostName)) { + sendEppError($conn, $db, 2005, 'Invalid host name', $clTRID, $trans); + return; + } + $query = "SELECT id, clid FROM host WHERE name = :name LIMIT 1"; $stmt = $db->prepare($query); $stmt->execute([':name' => $hostName]); diff --git a/epp/src/epp-info.php b/epp/src/epp-info.php index 5e08f42..e4ac453 100644 --- a/epp/src/epp-info.php +++ b/epp/src/epp-info.php @@ -103,13 +103,13 @@ function processHostInfo($conn, $db, $xml, $trans) { sendEppError($conn, $db, 2003, 'Specify your host name', $clTRID, $trans); return; } - + // Validation for host name - if (!preg_match('/^([A-Z0-9]([A-Z0-9-]{0,61}[A-Z0-9]){0,1}\\.){1,125}[A-Z0-9]([A-Z0-9-]{0,61}[A-Z0-9])$/i', $hostName) && strlen($hostName) > 254) { + if (!validateHostName($hostName)) { sendEppError($conn, $db, 2005, 'Invalid host name', $clTRID, $trans); return; } - + try { $stmt = $db->prepare("SELECT * FROM host WHERE name = :name"); $stmt->execute(['name' => $hostName]); diff --git a/epp/src/epp-update.php b/epp/src/epp-update.php index 5fa2497..06d8e58 100644 --- a/epp/src/epp-update.php +++ b/epp/src/epp-update.php @@ -828,9 +828,7 @@ function processHostUpdate($conn, $db, $xml, $clid, $database_type, $trans) { if (isset($hostChg)) { $chg_name = $xml->xpath('//host:name[1]')[0]; - $pattern = '/^([A-Z0-9]([A-Z0-9-]{0,61}[A-Z0-9]){0,1}\.){1,125}[A-Z0-9]([A-Z0-9-]{0,61}[A-Z0-9])$/i'; - - if (preg_match($pattern, $chg_name) && strlen($chg_name) < 254) { + if (validateHostName($chg_name)) { $stmt = $db->prepare("SELECT id FROM host WHERE name = ? LIMIT 1"); $stmt->execute([$chg_name]); $chg_name_id = $stmt->fetchColumn(); @@ -926,19 +924,19 @@ function processHostUpdate($conn, $db, $xml, $clid, $database_type, $trans) { $addr = normalize_v4_address($addr); } - try { - $stmt = $db->prepare("INSERT INTO host_addr (host_id,addr,ip) VALUES(?,?,?)"); - $stmt->execute([$hostId, $addr, $addr_type]); - } catch (PDOException $e) { - if ($database_type === 'mysql' && $e->errorInfo[1] == 1062) { - // Duplicate entry error for MySQL. Silently ignore. - } elseif ($database_type === 'pgsql' && $e->errorInfo[1] == 23505) { - // Duplicate entry error for PostgreSQL. Silently ignore. - } else { - sendEppError($conn, $db, 2400, 'Database error', $clTRID, $trans); - return; + try { + $stmt = $db->prepare("INSERT INTO host_addr (host_id,addr,ip) VALUES(?,?,?)"); + $stmt->execute([$hostId, $addr, $addr_type]); + } catch (PDOException $e) { + if ($database_type === 'mysql' && $e->errorInfo[1] == 1062) { + // Duplicate entry error for MySQL. Silently ignore. + } elseif ($database_type === 'pgsql' && $e->errorInfo[1] == 23505) { + // Duplicate entry error for PostgreSQL. Silently ignore. + } else { + sendEppError($conn, $db, 2400, 'Database error', $clTRID, $trans); + return; + } } - } } @@ -1195,7 +1193,7 @@ function processDomainUpdate($conn, $db, $xml, $clid, $database_type, $trans) { } // Additional checks related to domain TLDs and existing records - if (preg_match('/^([A-Z0-9]([A-Z0-9-]{0,61}[A-Z0-9]){0,1}\.){1,125}[A-Z0-9]([A-Z0-9-]{0,61}[A-Z0-9])$/i', $hostObj) && strlen($hostObj) < 254) { + if (validateHostName($hostObj)) { $stmt = $db->prepare("SELECT tld FROM domain_tld"); $stmt->execute(); $tlds = $stmt->fetchAll(PDO::FETCH_COLUMN);