| ############################################################################### |
| ############################################################################### |
| # Guardian.pl # |
| # Guardian.pm # |
| |
| # $Date: 01.05.16 $ # |
| ############################################################################### |
| ############################################################################### |
| # YaBB: Yet another Bulletin Board # |
| # YaBB: Yet another Bulletin Board # |
| # Open-Source Community Software for Webmasters # |
| # Open-Source Community Software for Webmasters # |
| # Version: YaBB 2.5.2 # |
| # Version: YaBB 2.6.12 # |
| # Packaged: October 21, 2012 # |
| # Packaged: January 5, 2016 # |
| # Distributed by: http://www.yabbforum.com # |
| # Distributed by: http://www.yabbforum.com # |
| # =========================================================================== # |
| # =========================================================================== # |
| # Copyright (c) 2000-2012 YaBB (www.yabbforum.com) - All Rights Reserved. # |
| # Copyright (c) 2000-2016 YaBB (www.yabbforum.com) - All Rights Reserved. # |
| # Software by: The YaBB Development Team # |
| # Software by: The YaBB Development Team # |
| # with assistance from the YaBB community. # |
| # with assistance from the YaBB community. # |
| ############################################################################### |
| ############################################################################### |
| |
| # use strict; |
| |
| # use warnings; |
| |
| no warnings qw(uninitialized once redefine); |
| |
| use CGI::Carp qw(fatalsToBrowser); |
| |
| our $VERSION = '2.6.12'; |
| |
| |
| $guardianplver = 'YaBB 2.5.2 $Revision: 1.2 $'; |
| $guardianpmver = 'YaBB 2.6.12 $Revision: 1651 $'; |
| |
| |
| $not_from = qq~$webmaster_email~; |
| $not_from = qq~$webmaster_email~; |
| $not_to = qq~$webmaster_email~; |
| $not_to = qq~$webmaster_email~; |
| $abuse_time = &timeformat($date,1,1,1); |
| |
| $abuse_time =~ s/<.*?>(.*?)<\/.*?>/$1/g; |
| |
| |
| |
| sub guard { |
| sub guard { |
| if (!$use_guardian) { return; } |
| if ( !$use_guardian ) { return; } |
| |
| |
| # Proxy Blocker |
| # Proxy Blocker |
| $proxy0 = &get_remote_addr; |
| $proxy0 = get_remote_addr(); |
| $proxy1 = &get_x_ip_client; |
| $proxy1 = get_x_ip_client(); |
| $proxy2 = &get_x_forwarded; |
| $proxy2 = get_x_forwarded(); |
| $proxy3 = &get_http_via; |
| $proxy3 = get_http_via(); |
| |
| |
| @white_list = split(/\|/, $whitelist); |
| @white_list = split /\|/xsm, $whitelist; |
| foreach (@white_list) { |
| foreach (@white_list) { |
| chomp $_; |
| chomp $_; |
| if (($proxy0 =~ m/$_/ || $proxy1 =~ m/$_/ || $proxy2 =~ m/$_/ || $proxy3 =~ m/$_/ || $username eq $_) && $_ ne "") { $whitelisted = 1; last; } |
| if ( |
| } |
| ( |
| if ($disallow_proxy_on && !$whitelisted && !$iamadmin && ($proxy1 ne "empty" || $proxy2 ne "empty" || $proxy3 ne "empty")) { |
| $proxy0 =~ m/$_/xsm |
| if ($disallow_proxy_notify) { |
| || $proxy1 =~ m/$_/xsm |
| &LoadLanguage('Guardian'); |
| || $proxy2 =~ m/$_/xsm |
| $not_subject = qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'proxy_abuse'} $guardian_txt{'abuse'}~; |
| || $proxy3 =~ m/$_/xsm |
| $not_body = qq~$guardian_txt{'proxy_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| || $username eq $_ |
| $not_body .= qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| ) |
| $not_body .= qq~$guardian_txt{'abuse_ip'}: (REMOTE_ADDR)->$proxy0, (X_IP_CLIENT)->$proxy1, (HTTP_X_FORWARDED_FOR)->$proxy2, (HTTP_VIA)->$proxy3\n~; |
| && $_ ne q{} |
| if ($use_htaccess && $disallow_proxy_htaccess && !$iamadmin && !$iamgmod) { |
| ) |
| $not_body .= qq~$guardian_txt{'htaccess_added'}: $user_ip,\n\n~; |
| { |
| } |
| $whitelisted = 1; |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| last; |
| $not_subject =~ s~\&trade\;~~g; |
| } |
| $not_body =~ s~\&trade\;~~g; |
| } |
| &guardian_notify($not_to, $not_subject, $not_body, $not_from); |
| if ( $disallow_proxy_on |
| } |
| && !$whitelisted |
| if ($use_htaccess && $disallow_proxy_htaccess && !$iamadmin && !$iamgmod) { |
| && !$iamadmin |
| &update_htaccess("add", $user_ip); |
| && ( $proxy1 ne 'empty' || $proxy2 ne 'empty' || $proxy3 ne 'empty' ) ) |
| } |
| { |
| &fatal_error("proxy_reason"); |
| if ($disallow_proxy_notify) { |
| } |
| LoadLanguage('Guardian'); |
| |
| $abuse_time = timeformat($date, 1, 'rfc', 1); |
| # Basic Value Setup |
| $not_subject = |
| $remote = &get_ip; |
| qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'proxy_abuse'} $guardian_txt{'abuse'}~; |
| if (index($remote, ", ")) { |
| $not_body = |
| @remotes = split("\, ", $remote); |
| qq~$guardian_txt{'proxy_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| if ($remotes[0] ne "unknown" && $remotes[0] ne "empty" && $remotes[0] ne "127.0.0.1" && $remotes[0] ne "") { |
| $not_body .= |
| $remote = $remotes[0]; |
| qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| } else { |
| $not_body .= |
| $remote = $remotes[1]; |
| qq~$guardian_txt{'abuse_ip'}: (REMOTE_ADDR)->$proxy0, (X_IP_CLIENT)->$proxy1, (HTTP_X_FORWARDED_FOR)->$proxy2, (HTTP_VIA)->$proxy3\n~; |
| } |
| if ( $use_htaccess |
| } |
| && $disallow_proxy_htaccess |
| $querystring = &get_query_string; |
| && !$iamadmin |
| |
| && !$iamgmod ) |
| # Check for Referer |
| { |
| if ($referer_on) { |
| $not_body .= qq~$guardian_txt{'htaccess_added'}: $user_ip,\n\n~; |
| @refererlist = split(/\|/, lc($banned_referers)); |
| } |
| $streferer = lc(&get_referer); |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| foreach (@refererlist) { |
| $not_subject =~ s/\&trade\;//gxsm; |
| chomp $_; |
| $not_body =~ s/\&trade\;//gxsm; |
| if ($streferer =~ m/$_/ && $_ ne "") { |
| $not_body = qq~<pre>$not_body</pre>~; |
| &LoadLanguage('Guardian'); |
| guardian_notify( $not_to, $not_subject, $not_body, $not_from ); |
| if ($referer_notify) { |
| } |
| $not_subject = qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'referer_abuse'} $guardian_txt{'abuse'}~; |
| if ( $use_htaccess |
| $not_body = qq~$guardian_txt{'referer_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| && $disallow_proxy_htaccess |
| $not_body .= qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| && !$iamadmin |
| $not_body .= qq~$guardian_txt{'abuse_ip'}: $user_ip\n~; |
| && !$iamgmod ) |
| if ($use_htaccess && $referer_htaccess && !$iamadmin && !$iamgmod) { |
| { |
| $not_body .= qq~$guardian_txt{'htaccess_added'}: $user_ip,\n~; |
| update_htaccess( 'add', $user_ip ); |
| } |
| } |
| $not_body .= qq~$guardian_txt{'abuse_referer'}: $streferer\n\n~; |
| fatal_error('proxy_reason'); |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| } |
| $not_subject =~ s~\&trade\;~~g; |
| |
| $not_body =~ s~\&trade\;~~g; |
| # Basic Value Setup |
| &guardian_notify($not_to, $not_subject, $not_body, $not_from); |
| $remote = get_ip(); |
| } |
| if ( index $remote, q{, } ) { |
| if ($use_htaccess && $referer_htaccess && !$iamadmin && !$iamgmod) { |
| @remotes = split /\, /sm, $remote; |
| &update_htaccess("add", $user_ip); |
| if ( $remotes[0] ne 'unknown' |
| } |
| && $remotes[0] ne 'empty' |
| &fatal_error("referer_reason"); |
| && $remotes[0] ne '127.0.0.1' |
| } |
| && $remotes[0] ne q{} ) |
| } |
| { |
| } |
| $remote = $remotes[0]; |
| |
| } |
| # Check for Harvester |
| else { |
| if ($harvester_on) { |
| $remote = $remotes[1]; |
| @harvesterlist = split(/\|/, lc($banned_harvesters)); |
| } |
| $agent = lc(&get_user_agent); |
| } |
| foreach (@harvesterlist) { |
| $querystring = get_query_string(); |
| chomp $_; |
| |
| if ($agent =~ m/$_/ && $_ ne "") { |
| # Check for Referer |
| if ($harvester_notify) { |
| if ($referer_on) { |
| &LoadLanguage('Guardian'); |
| @refererlist = split /\|/xsm, lc $banned_referers; |
| $not_subject = qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'harvester_abuse'} $guardian_txt{'abuse'}~; |
| $streferer = lc get_referer(); |
| $not_body = qq~$guardian_txt{'harvester_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| foreach (@refererlist) { |
| $not_body .= qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| chomp $_; |
| $not_body .= qq~$guardian_txt{'abuse_ip'}: $user_ip\n~; |
| if ( $streferer =~ m/$_/xsm && $_ ne q{} ) { |
| if ($use_htaccess && $harvester_htaccess && !$iamadmin && !$iamgmod) { |
| LoadLanguage('Guardian'); |
| $not_body .= qq~$guardian_txt{'htaccess_added'}: $user_ip,\n~; |
| $abuse_time = timeformat($date, 1, 'rfc', 1); |
| } |
| if ($referer_notify) { |
| $not_body .= qq~$guardian_txt{'abuse_harvester'}: $agent\n\n~; |
| $not_subject = |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'referer_abuse'} $guardian_txt{'abuse'}~; |
| $not_subject =~ s~\&trade\;~~g; |
| $not_body = |
| $not_body =~ s~\&trade\;~~g; |
| qq~$guardian_txt{'referer_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| &guardian_notify($not_to, $not_subject, $not_body, $not_from); |
| $not_body .= |
| } |
| qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| if ($use_htaccess && $harvester_htaccess && !$iamadmin && !$iamgmod) { |
| $not_body .= qq~$guardian_txt{'abuse_ip'}: $user_ip\n~; |
| &update_htaccess("add", $user_ip); |
| if ( $use_htaccess |
| } |
| && $referer_htaccess |
| &fatal_error("harvester_reason"); |
| && !$iamadmin |
| } |
| && !$iamgmod ) |
| } |
| { |
| } |
| $not_body .= |
| |
| qq~$guardian_txt{'htaccess_added'}: $user_ip,\n~; |
| # Check for Request |
| } |
| if ($request_on) { |
| $not_body .= |
| @requestlist = split(/\|/, lc($banned_requests)); |
| qq~$guardian_txt{'abuse_referer'}: $streferer\n\n~; |
| $method = lc(&get_request_method); |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| foreach (@requestlist) { |
| $not_subject =~ s/\&trade\;//gxsm; |
| chomp $_; |
| $not_body =~ s/\&trade\;//gxsm; |
| if ($method =~ m/$_/ && $_ ne "") { |
| guardian_notify( $not_to, $not_subject, $not_body, |
| if ($request_notify) { |
| $not_from ); |
| &LoadLanguage('Guardian'); |
| } |
| $not_subject = qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'request_abuse'} $guardian_txt{'abuse'}~; |
| if ( $use_htaccess |
| $not_body = qq~$guardian_txt{'request_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| && $referer_htaccess |
| $not_body .= qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| && !$iamadmin |
| $not_body .= qq~$guardian_txt{'abuse_ip'}: $user_ip\n~; |
| && !$iamgmod ) |
| if ($use_htaccess && $request_htaccess && !$iamadmin && !$iamgmod) { |
| { |
| $not_body .= qq~$guardian_txt{'htaccess_added'}: $user_ip,\n~; |
| update_htaccess( 'add', $user_ip ); |
| } |
| } |
| $not_body .= qq~$guardian_txt{'abuse_request'}: $method\n\n~; |
| fatal_error('referer_reason'); |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| } |
| $not_subject =~ s~\&trade\;~~g; |
| } |
| $not_body =~ s~\&trade\;~~g; |
| } |
| &guardian_notify($not_to, $not_subject, $not_body, $not_from); |
| |
| } |
| # Check for Harvester |
| if ($use_htaccess && $request_htaccess && !$iamadmin && !$iamgmod) { |
| if ($harvester_on) { |
| &update_htaccess("add", $user_ip); |
| @harvesterlist = split /\|/xsm, lc $banned_harvesters; |
| } |
| $agent = lc get_user_agent(); |
| &fatal_error("request_reason"); |
| foreach (@harvesterlist) { |
| } |
| chomp $_; |
| } |
| if ( $agent =~ m/$_/xsm && $_ ne q{} ) { |
| } |
| if ($harvester_notify) { |
| |
| LoadLanguage('Guardian'); |
| # Check for Strings |
| $abuse_time = timeformat($date, 1, 'rfc', 1); |
| if ($string_on) { |
| $not_subject = |
| require "$sourcedir/SubList.pl"; |
| qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'harvester_abuse'} $guardian_txt{'abuse'}~; |
| my ($temp_query, $testkey); |
| $not_body = |
| $temp_query = lc($querystring); |
| qq~$guardian_txt{'harvester_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| @stringlist = split(/\|/, lc($banned_strings)); |
| $not_body .= |
| foreach (@stringlist) { |
| qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| chomp $_; |
| $not_body .= qq~$guardian_txt{'abuse_ip'}: $user_ip\n~; |
| foreach $testkey(keys %director){ ## strip off all existing command strings from the temporary query ## |
| if ( $use_htaccess |
| chomp $testkey; |
| && $harvester_htaccess |
| $temp_query =~ s/$testkey//g; |
| && !$iamadmin |
| } |
| && !$iamgmod ) |
| if ($temp_query =~ m/$_/ && $_ ne "") { |
| { |
| if ($string_notify) { |
| $not_body .= |
| &LoadLanguage('Guardian'); |
| qq~$guardian_txt{'htaccess_added'}: $user_ip,\n~; |
| $not_subject = qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'string_abuse'} $guardian_txt{'abuse'}~; |
| } |
| $not_body = qq~$guardian_txt{'string_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| $not_body .= |
| $not_body .= qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| qq~$guardian_txt{'abuse_harvester'}: $agent\n\n~; |
| $not_body .= qq~$guardian_txt{'abuse_ip'}: $user_ip\n~; |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| if ($use_htaccess && $string_htaccess && !$iamadmin && !$iamgmod && $action ne "downloadfile") { |
| $not_subject =~ s/\&trade\;//gxsm; |
| $not_body .= qq~$guardian_txt{'htaccess_added'}: $user_ip,\n~; |
| $not_body =~ s/\&trade\;//gxsm; |
| } |
| guardian_notify( $not_to, $not_subject, $not_body, |
| $not_body .= qq~$guardian_txt{'abuse_string'}: $_\n~; |
| $not_from ); |
| $not_body .= qq~$guardian_txt{'abuse_environment'}: $querystring\n\n~; |
| } |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| if ( $use_htaccess |
| $not_subject =~ s~\&trade\;~~g; |
| && $harvester_htaccess |
| $not_body =~ s~\&trade\;~~g; |
| && !$iamadmin |
| &guardian_notify($not_to, $not_subject, $not_body, $not_from); |
| && !$iamgmod ) |
| } |
| { |
| if ($use_htaccess && $string_htaccess && !$iamadmin && !$iamgmod) { |
| update_htaccess( 'add', $user_ip ); |
| &update_htaccess("add", $user_ip); |
| } |
| } |
| fatal_error('harvester_reason'); |
| &fatal_error("string_reason","($_)"); |
| } |
| } |
| } |
| } |
| } |
| } |
| |
| |
| # Check for Request |
| # Check for UNION attack (for MySQL database protection only) |
| if ($request_on) { |
| if ($union_on) { |
| @requestlist = split /\|/xsm, lc $banned_requests; |
| if ($querystring =~ m/%20union%20/ || $querystring =~ m/\*\/union\/\*/) { |
| $method = lc get_request_method(); |
| if ($union_notify) { |
| foreach (@requestlist) { |
| &LoadLanguage('Guardian'); |
| chomp $_; |
| $not_subject = qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'union_abuse'} $guardian_txt{'abuse'}~; |
| if ( $method =~ m/$_/xsm && $_ ne q{} ) { |
| $not_body = qq~$guardian_txt{'union_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| if ($request_notify) { |
| $not_body .= qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| LoadLanguage('Guardian'); |
| $not_body .= qq~$guardian_txt{'abuse_ip'}: $user_ip\n~; |
| $abuse_time = timeformat($date, 1, 'rfc', 1); |
| if ($use_htaccess && $union_htaccess && !$iamadmin && !$iamgmod) { |
| $not_subject = |
| $not_body .= qq~$guardian_txt{'htaccess_added'}: $user_ip,\n~; |
| qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'request_abuse'} $guardian_txt{'abuse'}~; |
| } |
| $not_body = |
| $not_body .= qq~$guardian_txt{'abuse_environment'}: $querystring\n\n~; |
| qq~$guardian_txt{'request_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| $not_body .= |
| $not_subject =~ s~\&trade\;~~g; |
| qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| $not_body =~ s~\&trade\;~~g; |
| $not_body .= qq~$guardian_txt{'abuse_ip'}: $user_ip\n~; |
| &guardian_notify($not_to, $not_subject, $not_body, $not_from); |
| if ( $use_htaccess |
| } |
| && $request_htaccess |
| if ($use_htaccess && $union_htaccess && !$iamadmin && !$iamgmod) { |
| && !$iamadmin |
| &update_htaccess("add", $user_ip); |
| && !$iamgmod ) |
| } |
| { |
| &fatal_error("union_reason"); |
| $not_body .= |
| } |
| qq~$guardian_txt{'htaccess_added'}: $user_ip,\n~; |
| } |
| } |
| |
| $not_body .= |
| # Check for CLIKE attack (for MySQL database protection only) |
| qq~$guardian_txt{'abuse_request'}: $method\n\n~; |
| if ($clike_on) { |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| if ($querystring =~ m/\/\*/) { |
| $not_subject =~ s/\&trade\;//gxsm; |
| if ($clike_notify) { |
| $not_body =~ s/\&trade\;//gxsm; |
| &LoadLanguage('Guardian'); |
| guardian_notify( $not_to, $not_subject, $not_body, |
| $not_subject = qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'clike_abuse'} $guardian_txt{'abuse'}~; |
| $not_from ); |
| $not_body = qq~$guardian_txt{'clike_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| } |
| $not_body .= qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| if ( $use_htaccess |
| $not_body .= qq~$guardian_txt{'abuse_ip'}: $user_ip\n~; |
| && $request_htaccess |
| if ($use_htaccess && $clike_htaccess && !$iamadmin && !$iamgmod) { |
| && !$iamadmin |
| $not_body .= qq~$guardian_txt{'htaccess_added'}: $user_ip,\n~; |
| && !$iamgmod ) |
| } |
| { |
| $not_body .= qq~$guardian_txt{'abuse_environment'}: $querystring\n\n~; |
| update_htaccess( 'add', $user_ip ); |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| } |
| $not_subject =~ s~\&trade\;~~g; |
| fatal_error('request_reason'); |
| $not_body =~ s~\&trade\;~~g; |
| } |
| &guardian_notify($not_to, $not_subject, $not_body, $not_from); |
| } |
| } |
| } |
| if ($use_htaccess && $clike_htaccess && !$iamadmin && !$iamgmod) { |
| |
| &update_htaccess("add", $user_ip); |
| # Check for Strings |
| } |
| if ($string_on) { |
| &fatal_error("clike_reason"); |
| require Sources::SubList; |
| } |
| my ( $temp_query, $testkey ); |
| } |
| $temp_query = lc $querystring; |
| |
| @stringlist = split /\|/xsm, lc $banned_strings; |
| # Check for SCRIPTING attack |
| foreach (@stringlist) { |
| if ($script_on) { |
| chomp $_; |
| while (($key, $secvalue) = each(%INFO)) { |
| foreach my $testkey ( keys %director ) |
| $secvalue = lc($secvalue); |
| { ## strip off all existing command strings from the temporary query ## |
| &str_replace("%3c", "<", $secvalue); |
| chomp $testkey; |
| &str_replace("%3e", ">", $secvalue); |
| $temp_query =~ s/$testkey//gxsm; |
| if (($secvalue =~ m/<[^>]script*\"?[^>]*>/) || ($secvalue =~ m/<[^>]*object*\"?[^>]*>/) || ($secvalue =~ m/<[^>]*iframe*\"?[^>]*>/) || ($secvalue =~ m/<[^>]*applet*\"?[^>]*>/) || ($secvalue =~ m/<[^>]*meta*\"?[^>]*>/) || ($secvalue =~ m/<[^>]*style*\"?[^>]*>/) || ($secvalue =~ m/<[^>]*form*\"?[^>]*>/) || ($secvalue =~ m/\([^>]*\"?[^)]*\)/) || ($secvalue =~ m/\"/)) { |
| } |
| if ($script_notify) { |
| if ( $temp_query =~ m/$_/xsm && $_ ne q{} ) { |
| &LoadLanguage('Guardian'); |
| if ($string_notify) { |
| $not_subject = qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'script_abuse'} $guardian_txt{'abuse'}~; |
| LoadLanguage('Guardian'); |
| $not_body = qq~$guardian_txt{'script_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| $abuse_time = timeformat($date, 1, 'rfc', 1); |
| $not_body .= qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| $not_subject = |
| $not_body .= qq~$guardian_txt{'abuse_ip'}: $user_ip\n~; |
| qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'string_abuse'} $guardian_txt{'abuse'}~; |
| if ($use_htaccess && $script_htaccess && !$iamadmin && !$iamgmod) { |
| $not_body = |
| $not_body .= qq~$guardian_txt{'htaccess_added'}: $user_ip,\n~; |
| qq~$guardian_txt{'string_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| } |
| $not_body .= |
| $not_body .= qq~$guardian_txt{'abuse_url_environment'}: $secvalue\n\n~; |
| qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| $not_body .= qq~$guardian_txt{'abuse_ip'}: $user_ip\n~; |
| $not_subject =~ s~\&trade\;~~g; |
| if ( $use_htaccess |
| $not_body =~ s~\&trade\;~~g; |
| && $string_htaccess |
| &guardian_notify($not_to, $not_subject, $not_body, $not_from); |
| && !$iamadmin |
| } |
| && !$iamgmod |
| if ($use_htaccess && $script_htaccess && !$iamadmin && !$iamgmod) { |
| && $action ne 'downloadfile' ) |
| &update_htaccess("add", $user_ip); |
| { |
| } |
| $not_body .= |
| &fatal_error("script_reason"); |
| qq~$guardian_txt{'htaccess_added'}: $user_ip,\n~; |
| } |
| } |
| } |
| $not_body .= qq~$guardian_txt{'abuse_string'}: $_\n~; |
| while (($key, $secvalue) = each(%FORM)) { |
| $not_body .= |
| $secvalue = lc($secvalue); |
| qq~$guardian_txt{'abuse_environment'}: $querystring\n\n~; |
| $secvalue =~ s/\[code.*?\/code\]//gs if $key eq 'message' and $action =~ /^(post|modify|imsend)2$/; |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| &str_replace("%3c", "<", $secvalue); |
| $not_subject =~ s/\&trade\;//gxsm; |
| &str_replace("%3e", ">", $secvalue); |
| $not_body =~ s/\&trade\;//gxsm; |
| if (($secvalue =~ m/<[^>]script*\"?[^>]*>/) || ($secvalue =~ m/<[^>]style*\"?[^>]*>/)) { |
| guardian_notify( $not_to, $not_subject, $not_body, |
| if ($script_notify) { |
| $not_from ); |
| &LoadLanguage('Guardian'); |
| } |
| $not_subject = qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'script_abuse'} $guardian_txt{'abuse'}~; |
| if ( $use_htaccess |
| $not_body = qq~$guardian_txt{'script_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| && $string_htaccess |
| $not_body .= qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| && !$iamadmin |
| $not_body .= qq~$guardian_txt{'abuse_ip'}: $user_ip\n~; |
| && !$iamgmod ) |
| if ($use_htaccess && $script_htaccess && !$iamadmin && !$iamgmod) { |
| { |
| $not_body .= qq~$guardian_txt{'htaccess_added'}: $user_ip,\n~; |
| update_htaccess( 'add', $user_ip ); |
| } |
| } |
| $not_body .= qq~$guardian_txt{'abuse_form_environment'}: $secvalue\n\n~; |
| fatal_error( 'string_reason', "($_)" ); |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| } |
| $not_subject =~ s~\&trade\;~~g; |
| } |
| $not_body =~ s~\&trade\;~~g; |
| } |
| &guardian_notify($not_to, $not_subject, $not_body, $not_from); |
| |
| } |
| # Check for UNION attack (for MySQL database protection only) |
| if ($use_htaccess && $script_htaccess && !$iamadmin && !$iamgmod) { |
| if ($union_on) { |
| &update_htaccess("add", $user_ip); |
| if ( $querystring =~ m/%20union%20/xsm |
| } |
| || $querystring =~ m/\*\/union\/\*/xsm ) |
| &fatal_error("script_reason"); |
| { |
| } |
| if ($union_notify) { |
| } |
| LoadLanguage('Guardian'); |
| } |
| $abuse_time = timeformat($date, 1, 'rfc', 1); |
| return; |
| $not_subject = |
| |
| qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'union_abuse'} $guardian_txt{'abuse'}~; |
| |
| $not_body = |
| |
| qq~$guardian_txt{'union_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| |
| $not_body .= |
| |
| qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| |
| $not_body .= qq~$guardian_txt{'abuse_ip'}: $user_ip\n~; |
| |
| if ( $use_htaccess |
| |
| && $union_htaccess |
| |
| && !$iamadmin |
| |
| && !$iamgmod ) |
| |
| { |
| |
| $not_body .= |
| |
| qq~$guardian_txt{'htaccess_added'}: $user_ip,\n~; |
| |
| } |
| |
| $not_body .= |
| |
| qq~$guardian_txt{'abuse_environment'}: $querystring\n\n~; |
| |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| |
| $not_subject =~ s/\&trade\;//gxsm; |
| |
| $not_body =~ s/\&trade\;//gxsm; |
| |
| guardian_notify( $not_to, $not_subject, $not_body, $not_from ); |
| |
| } |
| |
| if ( $use_htaccess && $union_htaccess && !$iamadmin && !$iamgmod ) { |
| |
| update_htaccess( 'add', $user_ip ); |
| |
| } |
| |
| fatal_error('union_reason'); |
| |
| } |
| |
| } |
| |
| |
| |
| # Check for CLIKE attack (for MySQL database protection only) |
| |
| if ($clike_on) { |
| |
| if ( $querystring =~ m/\/\*/xsm ) { |
| |
| if ($clike_notify) { |
| |
| LoadLanguage('Guardian'); |
| |
| $abuse_time = timeformat($date, 1, 'rfc', 1); |
| |
| $not_subject = |
| |
| qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'clike_abuse'} $guardian_txt{'abuse'}~; |
| |
| $not_body = |
| |
| qq~$guardian_txt{'clike_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| |
| $not_body .= |
| |
| qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| |
| $not_body .= qq~$guardian_txt{'abuse_ip'}: $user_ip\n~; |
| |
| if ( $use_htaccess |
| |
| && $clike_htaccess |
| |
| && !$iamadmin |
| |
| && !$iamgmod ) |
| |
| { |
| |
| $not_body .= |
| |
| qq~$guardian_txt{'htaccess_added'}: $user_ip,\n~; |
| |
| } |
| |
| $not_body .= |
| |
| qq~$guardian_txt{'abuse_environment'}: $querystring\n\n~; |
| |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| |
| $not_subject =~ s/\&trade\;//gxsm; |
| |
| $not_body =~ s/\&trade\;//gxsm; |
| |
| guardian_notify( $not_to, $not_subject, $not_body, $not_from ); |
| |
| } |
| |
| if ( $use_htaccess && $clike_htaccess && !$iamadmin && !$iamgmod ) { |
| |
| update_htaccess( 'add', $user_ip ); |
| |
| } |
| |
| fatal_error('clike_reason'); |
| |
| } |
| |
| } |
| |
| |
| |
| # Check for SCRIPTING attack |
| |
| if ($script_on) { |
| |
| while ( ( $key, $secvalue ) = each %INFO ) { |
| |
| $secvalue = lc $secvalue; |
| |
| str_replace( '%3c', '<', $secvalue ); |
| |
| str_replace( '%3e', '>', $secvalue ); |
| |
| if ( ( $secvalue =~ m/<[^>]script*\x22?[^>]*>/xsm ) |
| |
| || ( $secvalue =~ m/<[^>]*object*\x22?[^>]*>/xsm ) |
| |
| || ( $secvalue =~ m/<[^>]*iframe*\x22?[^>]*>/xsm ) |
| |
| || ( $secvalue =~ m/<[^>]*applet*\x22?[^>]*>/xsm ) |
| |
| || ( $secvalue =~ m/<[^>]*meta*\x22?[^>]*>/xsm ) |
| |
| || ( $secvalue =~ m/<[^>]*style*\x22?[^>]*>/xsm ) |
| |
| || ( $secvalue =~ m/<[^>]*form*\x22?[^>]*>/xsm ) |
| |
| || ( $secvalue =~ m/\([^>]*\x22?[^)]*\)/xsm ) |
| |
| || ( $secvalue =~ m/\x22/xsm ) ) |
| |
| { |
| |
| if ($script_notify) { |
| |
| LoadLanguage('Guardian'); |
| |
| $abuse_time = timeformat($date, 1, 'rfc', 1); |
| |
| $not_subject = |
| |
| qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'script_abuse'} $guardian_txt{'abuse'}~; |
| |
| $not_body = |
| |
| qq~$guardian_txt{'script_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| |
| $not_body .= |
| |
| qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| |
| $not_body .= qq~$guardian_txt{'abuse_ip'}: $user_ip\n~; |
| |
| if ( $use_htaccess |
| |
| && $script_htaccess |
| |
| && !$iamadmin |
| |
| && !$iamgmod ) |
| |
| { |
| |
| $not_body .= |
| |
| qq~$guardian_txt{'htaccess_added'}: $user_ip,\n~; |
| |
| } |
| |
| $not_body .= |
| |
| qq~$guardian_txt{'abuse_url_environment'}: $secvalue\n\n~; |
| |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| |
| $not_subject =~ s/\&trade\;//gxsm; |
| |
| $not_body =~ s/\&trade\;//gxsm; |
| |
| guardian_notify( $not_to, $not_subject, $not_body, |
| |
| $not_from ); |
| |
| } |
| |
| if ( $use_htaccess |
| |
| && $script_htaccess |
| |
| && !$iamadmin |
| |
| && !$iamgmod ) |
| |
| { |
| |
| update_htaccess( 'add', $user_ip ); |
| |
| } |
| |
| fatal_error('script_reason'); |
| |
| } |
| |
| } |
| |
| while ( ( $key, $secvalue ) = each %FORM ) { |
| |
| $secvalue = lc $secvalue; |
| |
| if ( $key eq 'message' |
| |
| and $action =~ /^(post|modify|imsend|eventcal)2$/xsm ) |
| |
| { |
| |
| $secvalue =~ s/\[code.*?\/code\]//gsxm; |
| |
| } |
| |
| if ( $key eq 'message' |
| |
| and $action =~ /^(ajxmessage|ajximmessage|ajxcal)$/xsm ) |
| |
| { |
| |
| $secvalue =~ s/\[code.*?\/code\]//gsxm; |
| |
| } |
| |
| str_replace( '%3c', '<', $secvalue ); |
| |
| str_replace( '%3e', '>', $secvalue ); |
| |
| if ( ( $secvalue =~ m/<[^>]script*\"?[^>]*>/xsm ) |
| |
| || ( $secvalue =~ m/<[^>]style*\"?[^>]*>/xsm ) ) |
| |
| { |
| |
| if ($script_notify) { |
| |
| LoadLanguage('Guardian'); |
| |
| $abuse_time = timeformat($date, 1, 'rfc', 1); |
| |
| $not_subject = |
| |
| qq~$guardian_txt{'main'}-($mbname): $guardian_txt{'script_abuse'} $guardian_txt{'abuse'}~; |
| |
| $not_body = |
| |
| qq~$guardian_txt{'script_abuse'} $guardian_txt{'abuse'} $maintxt{'30'} $abuse_time\n\n~; |
| |
| $not_body .= |
| |
| qq~$guardian_txt{'abuse_user'}: $username -> (${$uid.$username}{'realname'})\n~; |
| |
| $not_body .= qq~$guardian_txt{'abuse_ip'}: $user_ip\n~; |
| |
| if ( $use_htaccess |
| |
| && $script_htaccess |
| |
| && !$iamadmin |
| |
| && !$iamgmod ) |
| |
| { |
| |
| $not_body .= |
| |
| qq~$guardian_txt{'htaccess_added'}: $user_ip,\n~; |
| |
| } |
| |
| $not_body .= |
| |
| qq~$guardian_txt{'abuse_form_environment'}: $secvalue\n\n~; |
| |
| $not_body .= qq~$mbname, $guardian_txt{'main'}~; |
| |
| $not_subject =~ s/\&trade\;//gxsm; |
| |
| $not_body =~ s/\&trade\;//gxsm; |
| |
| guardian_notify( $not_to, $not_subject, $not_body, |
| |
| $not_from ); |
| |
| } |
| |
| if ( $use_htaccess |
| |
| && $script_htaccess |
| |
| && !$iamadmin |
| |
| && !$iamgmod ) |
| |
| { |
| |
| update_htaccess( 'add', $user_ip ); |
| |
| } |
| |
| fatal_error('script_reason'); |
| |
| } |
| |
| } |
| |
| } |
| |
| return; |
| } |
| } |
| |
| |
| |
| |
| sub guardian_notify { |
| sub guardian_notify { |
| require "$sourcedir/Mailer.pl"; |
| my ( $to, $subject, $body, $from ) = @_; |
| my ($to, $subject, $body, $from) = @_; |
| require Sources::Mailer; |
| my $result = &sendmail($to, $subject, $body, $from); |
| my $result = sendmail( $to, $subject, $body, $from ); |
| |
| return; |
| } |
| } |
| |
| |
| sub get_remote_port { |
| sub get_remote_port { |
| if ($ENV{'REMOTE_PORT'}) { |
| if ( $ENV{'REMOTE_PORT'} ) { |
| return $ENV{'REMOTE_PORT'}; |
| return $ENV{'REMOTE_PORT'}; |
| } else { |
| } |
| return "empty"; |
| else { |
| } |
| return 'empty'; |
| |
| } |
| } |
| } |
| |
| |
| sub get_request_method { |
| sub get_request_method { |
| if ($ENV{'REQUEST_METHOD'}) { |
| if ( $ENV{'REQUEST_METHOD'} ) { |
| return $ENV{'REQUEST_METHOD'}; |
| return $ENV{'REQUEST_METHOD'}; |
| } else { |
| } |
| return "empty"; |
| else { |
| } |
| return 'empty'; |
| |
| } |
| } |
| } |
| |
| |
| sub get_script_name { |
| sub get_script_name { |
| if ($ENV{'SCRIPT_NAME'}) { |
| if ( $ENV{'SCRIPT_NAME'} ) { |
| return $ENV{'SCRIPT_NAME'}; |
| return $ENV{'SCRIPT_NAME'}; |
| } else { |
| } |
| return "empty"; |
| else { |
| } |
| return 'empty'; |
| |
| } |
| } |
| } |
| |
| |
| sub get_http_host { |
| sub get_http_host { |
| if ($ENV{'HTTP_HOST'}) { |
| if ( $ENV{'HTTP_HOST'} ) { |
| return $ENV{'HTTP_HOST'}; |
| return $ENV{'HTTP_HOST'}; |
| } else { |
| } |
| return "empty"; |
| else { |
| } |
| return 'empty'; |
| |
| } |
| } |
| } |
| |
| |
| sub get_query_string { |
| sub get_query_string { |
| if ($ENV{'QUERY_STRING'}) { |
| if ( $ENV{'QUERY_STRING'} ) { |
| my $tempstring = &str_replace("%09", "%20", $ENV{'QUERY_STRING'}); |
| my $tempstring = str_replace( '%09', '%20', $ENV{'QUERY_STRING'} ); |
| return &str_replace("%09", "%20", $ENV{'QUERY_STRING'}); |
| return str_replace( '%09', '%20', $ENV{'QUERY_STRING'} ); |
| } else { |
| } |
| return "empty"; |
| else { |
| } |
| return 'empty'; |
| |
| } |
| } |
| } |
| |
| |
| sub get_user_agent { |
| sub get_user_agent { |
| if ($ENV{'HTTP_USER_AGENT'}) { |
| if ( $ENV{'HTTP_USER_AGENT'} ) { |
| return $ENV{'HTTP_USER_AGENT'}; |
| return $ENV{'HTTP_USER_AGENT'}; |
| } else { |
| } |
| return "empty"; |
| else { |
| } |
| return 'empty'; |
| |
| } |
| } |
| } |
| |
| |
| sub get_referer { |
| sub get_referer { |
| if ($ENV{'HTTP_REFERER'}) { |
| if ( $ENV{'HTTP_REFERER'} ) { |
| return $ENV{'HTTP_REFERER'}; |
| return $ENV{'HTTP_REFERER'}; |
| } else { |
| } |
| return "empty"; |
| else { |
| } |
| return 'empty'; |
| |
| } |
| } |
| } |
| |
| |
| sub get_ip { |
| sub get_ip { |
| $client_ip = &get_client_ip; ## HTTP_CLIENT_IP |
| $client_ip = get_client_ip(); ## HTTP_CLIENT_IP |
| $x_forwarded = &get_x_forwarded; ## HTTP_X_FORWARDED_FOR |
| $x_forwarded = get_x_forwarded(); ## HTTP_X_FORWARDED_FOR |
| $x_ip_client = &get_x_ip_client; ## X_IP_CLIENT |
| $x_ip_client = get_x_ip_client(); ## X_IP_CLIENT |
| $http_via = &get_http_via; ## HTTP_VIA |
| $http_via = get_http_via(); ## HTTP_VIA |
| $remote_addr = &get_remote_addr; ## REMOTE_ADDR |
| $remote_addr = get_remote_addr(); ## REMOTE_ADDR |
| if ($client_ip && $client_ip !~ m/empty/ && $client_ip !~ m/unknown/) { |
| if ( $client_ip |
| return $client_ip; |
| && $client_ip !~ m/empty/sm |
| } elsif ($x_forwarded && $x_forwarded !~ m/empty/ && $x_forwarded !~ m/unknown/) { |
| && $client_ip !~ m/unknown/sm ) |
| return $x_forwarded; |
| { |
| } elsif ($x_ip_client && $x_ip_client !~ m/empty/ && $x_ip_client !~ m/unknown/) { |
| return $client_ip; |
| return $x_ip_client; |
| } |
| } elsif ($http_via && $http_via !~ m/empty/ && $http_via !~ m/unknown/) { |
| elsif ($x_forwarded |
| return $http_via; |
| && $x_forwarded !~ m/empty/sm |
| } elsif ($remote_addr && $remote_addr !~ m/empty/ && $remote_addr !~ m/unknown/) { |
| && $x_forwarded !~ m/unknown/sm ) |
| return $remote_addr; |
| { |
| } else { |
| return $x_forwarded; |
| return "empty"; |
| } |
| } |
| elsif ($x_ip_client |
| |
| && $x_ip_client !~ m/empty/sm |
| |
| && $x_ip_client !~ m/unknown/sm ) |
| |
| { |
| |
| return $x_ip_client; |
| |
| } |
| |
| elsif ($http_via |
| |
| && $http_via !~ m/empty/sm |
| |
| && $http_via !~ m/unknown/sm ) |
| |
| { |
| |
| return $http_via; |
| |
| } |
| |
| elsif ($remote_addr |
| |
| && $remote_addr !~ m/empty/sm |
| |
| && $remote_addr !~ m/unknown/sm ) |
| |
| { |
| |
| return $remote_addr; |
| |
| } |
| |
| else { |
| |
| return 'empty'; |
| |
| } |
| } |
| } |
| |
| |
| sub get_client_ip { |
| sub get_client_ip { |
| if ($ENV{'HTTP_CLIENT_IP'} && $ENV{'HTTP_CLIENT_IP'} ne "127.0.0.1") { |
| if ( $ENV{'HTTP_CLIENT_IP'} && $ENV{'HTTP_CLIENT_IP'} ne '127.0.0.1' ) { |
| return $ENV{'HTTP_CLIENT_IP'}; |
| return $ENV{'HTTP_CLIENT_IP'}; |
| } else { |
| } |
| return "empty"; |
| else { |
| } |
| return 'empty'; |
| |
| } |
| } |
| } |
| |
| |
| sub get_x_ip_client { |
| sub get_x_ip_client { |
| if ($ENV{'X_CLIENT_IP'} && $ENV{'X_CLIENT_IP'} ne "127.0.0.1") { |
| if ( $ENV{'X_CLIENT_IP'} && $ENV{'X_CLIENT_IP'} ne '127.0.0.1' ) { |
| return $ENV{'X_CLIENT_IP'}; |
| return $ENV{'X_CLIENT_IP'}; |
| } else { |
| } |
| return "empty"; |
| else { |
| } |
| return 'empty'; |
| |
| } |
| } |
| } |
| |
| |
| sub get_http_via { |
| sub get_http_via { |
| if ($ENV{'HTTP_VIA'} && $ENV{'HTTP_VIA'} ne "127.0.0.1") { |
| if ( $ENV{'HTTP_VIA'} && $ENV{'HTTP_VIA'} ne '127.0.0.1' ) { |
| return $ENV{'HTTP_VIA'}; |
| return $ENV{'HTTP_VIA'}; |
| } else { |
| } |
| return "empty"; |
| else { |
| } |
| return 'empty'; |
| |
| } |
| } |
| } |
| |
| |
| sub get_x_forwarded { |
| sub get_x_forwarded { |
| if ($ENV{'HTTP_X_FORWARDED_FOR'} && $ENV{'HTTP_X_FORWARDED_FOR'} ne "127.0.0.1") { |
| if ( $ENV{'HTTP_X_FORWARDED_FOR'} |
| return $ENV{'HTTP_X_FORWARDED_FOR'}; |
| && $ENV{'HTTP_X_FORWARDED_FOR'} ne '127.0.0.1' ) |
| } else { |
| { |
| return "empty"; |
| return $ENV{'HTTP_X_FORWARDED_FOR'}; |
| } |
| } |
| |
| else { |
| |
| return 'empty'; |
| |
| } |
| } |
| } |
| |
| |
| sub get_remote_addr { |
| sub get_remote_addr { |
| if ($ENV{'REMOTE_ADDR'}) { |
| if ( $ENV{'REMOTE_ADDR'} ) { |
| return $ENV{'REMOTE_ADDR'}; |
| return $ENV{'REMOTE_ADDR'}; |
| } else { |
| } |
| return "empty"; |
| else { |
| } |
| return 'empty'; |
| |
| } |
| } |
| } |
| |
| |
| sub str_replace { |
| sub str_replace { |
| my ($org, $repl, $target) = @_; |
| my ( $org, $repl, $target ) = @_; |
| $target =~ s~$org~$repl~ig; |
| $target =~ s/$org/$repl/igxsm; |
| return $target; |
| return $target; |
| } |
| } |
| |
| |
| sub update_htaccess { |
| sub update_htaccess { |
| my ($action, $value) = @_; |
| my ( $action, $value ) = @_; |
| my ($htheader, $htfooter, @denies, @htout); |
| my ( $htheader, $htfooter, @denies, @htout ); |
| if (!$action) { return 0; } |
| if ( !$action ) { return 0; } |
| fopen(HTA, ".htaccess"); |
| fopen( HTA, '.htaccess' ); |
| my @htlines = <HTA>; |
| my @htlines = <HTA>; |
| fclose(HTA); |
| fclose(HTA); |
| |
| |
| # header to determine only who has access to the main script, not the admin script |
| # header to determine only who has access to the main script, not the admin script |
| $htheader = qq~<Files YaBB*>~; |
| $htheader = q~<Files YaBB*>~; |
| $htfooter = qq~</Files>~; |
| $htfooter = q~</Files>~; |
| $start = 0; |
| $start = 0; |
| foreach (@htlines) { |
| foreach (@htlines) { |
| chomp $_; |
| chomp $_; |
| if ($_ eq $htheader) { $start = 1; } |
| if ( $_ eq $htheader ) { $start = 1; } |
| if ($start == 0 && $_ !~ m/#/ && $_ ne "") { push(@htout, "$_\n"); } |
| if ( $start == 0 && $_ !~ m/\x23/xsm && $_ ne q{} ) { |
| if ($_ eq $htfooter) { $start = 0; } |
| push @htout, "$_\n"; |
| if ($start == 1 && $_ =~ s/Deny from //g) { |
| } |
| push(@denies, $_); |
| if ( $_ eq $htfooter ) { $start = 0; } |
| } |
| if ( $start == 1 && $_ =~ s/Deny from //gsm ) { |
| } |
| push @denies, $_; |
| if ($use_htaccess && ($action eq "add" || $action eq "remove")) { |
| } |
| fopen(HTA, ">.htaccess"); |
| } |
| print HTA "# Last modified by The Guardian: " . &timeformat($date, 1) . " #\n\n"; |
| if ( $use_htaccess && $action eq 'add' ) { |
| print HTA @htout; |
| fopen( HTA, '>.htaccess' ); |
| if ($value) { |
| print {HTA} '# Last modified by The Guardian: ' |
| print HTA "\n$htheader\n"; |
| . ctbtime( $date, 1 ) |
| foreach (@denies) { |
| . " #\n\n" |
| if ($_ ne $value) { print HTA "Deny from $_\n"; } |
| or croak "$croak{'print'} HTA"; |
| } |
| print {HTA} @htout or croak "$croak{'print'} HTA"; |
| if ($action eq "add") { print HTA "Deny from $value\n"; } |
| if ($value) { |
| print HTA "$htfooter\n"; |
| print {HTA} "\n$htheader\n" or croak "$croak{'print'} HTA"; |
| } |
| push @denies, $value; |
| fclose(HTA); |
| foreach (@denies) { |
| } |
| print {HTA} "Deny from $_\n" |
| |
| or croak "$croak{'print'} HTA"; |
| |
| } |
| |
| print {HTA} "$htfooter\n" or croak "$croak{'print'} HTA"; |
| |
| } |
| |
| fclose(HTA); |
| |
| } |
| |
| return; |
| } |
| } |
| |
| |
| 1; |
| 1; |
| |
| |