Click here if this is spam.
";
}
function add_to_blacklist($ip)
{
if(!preg_match("/^166.66/", $ip)) {
$filename = "/var/www/html/blacklist.txt";
$data = file($filename);
$newIP = true;
# Search to see if IP is alerady in blacklist
foreach($data as $line)
{
# Is the IP Address already in the file?
if(preg_match("/" . $ip . "/mis", $line))
{
# It is!
$IP_record = explode(", ", $line); # split line
$IP_record[1] = trim($IP_record[1]); # clean count
$IP_record[1]++; # increase count
# add newly updated record back to blacklist
$blacklist[] = implode(", ", $IP_record) . "\r\n";
$newIP = false;
}
else
{
# This isnt the same IP, so add it back to file string
$blacklist[] = $line; # add the line back on
}
}
# It is a new IP, add it to the black list
if($newIP)
{
$blacklist[] = $ip . ", 1\r\n";
}
# Write data to the blacklist
file_put_contents($filename, $blacklist);
}
}
###########################################################
# FUNCTION recurse_input
# Recurse through array and clean up.
# -------------------------------------
function recurse_input($arr='')
{
if (is_array($arr))
{
$new = array();
foreach($arr as $k => $v) {
if (is_array($v))
{
$new[$k] = recurse_input($v);
}
else
{
$new[$k] = clean_value($v);
}
}
return $new;
}
else
{
return clean_value($arr);
}
} ### recurse_input ###
###########################################################
# FUNCTION recurse_output
# Recurse through array and clean up.
# -------------------------------------
function recurse_output($arr='')
{
if (is_array($arr))
{
$new = array();
foreach($arr as $k => $v) {
if (is_array($v))
{
$new[$k] = recurse_output($v);
}
else
{
$new[$k] = htmlentities($v);
}
}
return $new;
}
else
{
return htmlentities($arr);
}
} ### recurse_output ###
###########################################################
# FUNCTION clean_value
# Check the value and clean it.
# -------------------------------
function clean_value($val)
{
if (preg_match("/(%0A|%0D|\n+|\r+)(content-type:|to:|cc:|bcc:)/i", $val))
{
logAttack("Header Injection Found"); # store attempt for further analysis
header("HTTP/1.0 403 Forbidden");
die("Error with form information.");
}
if(strip_tags($val) != $val)
{
logAttack("Form filled in with HTML and/or PHP");
add_to_blacklist($_SERVER['REMOTE_ADDR']);
header("HTTP/1.0 403 Forbidden");
die("Error with form. HTML and/or PHP is not allowed in form submission. Please go
back and submit again without HTML and/or PHP
");
}
return htmlentities(stripslashes(trim($val)), ENT_QUOTES);
} ### recurse_input ###
function logAttack($reason)
{
$msg= "
| Reason | " . $reason . "
|
| Form | " . $_SERVER['HTTP_REFERER'] . " |
| Date | " . date("Y-m-d h:i:s") . " |
| IP | " . $_SERVER['REMOTE_ADDR'] . " |
REQUEST
";
foreach($_REQUEST as $k => $v)
$msg .= "| $k | " . recurse_output($v) . " |
\r\n";
$msg .= "
SERVER
";
foreach($_SERVER as $k => $v)
$msg .= "| $k | $v |
\r\n";
$msg .= "| " .
is_spam_msg($_SERVER['REMOTE_ADDR']) .
" |
" .
"
";
$header = "From: Form Spam Check\r\n";
$header.= "Content-type: text/html\r\n";
mail("david.fitzgerald@millersville.edu", "Logged Attack: " . $_SERVER['HTTP_REFERER'], $msg, $header );
//mail("eric.horst@millersville.edu", "Logged Attack: " . $_SERVER['HTTP_REFERER'], $msg, $header );
}
############################################################
# 1.) Define White and Black lists - Block Words
# White List = allowed hosts that can submit to forms
# Black List = hosts/IPs that are banned from submitting
# Block Words = words contained in spam messages
#white list
$goodHosts = array(
"muweb.millersville.edu",
"mustang.millersville.edu",
"www.millersville.edu",
"snowball.millersville.edu",
"snowball.esci.millersville.edu");
#black list
$badHosts = array("");
$from = parse_url(strtolower($_SERVER['HTTP_REFERER']));
#block words
$blockWords = array("sveta@cepk.info",
"yandex.com");
############################################################
# 2.) Deny access from anything but a browser
if (!isset($_SERVER['HTTP_USER_AGENT']))
{
logAttack("Accessed from something other than a browser");
die("Forbidden - You are not authorized to view this page");
}
############################################################
# 3.) Form must use POST
if (!$_SERVER['REQUEST_METHOD'] == "POST")
{
logAttack("Form not using POST");
die("Forbidden - You are not authorized to view this page");
}
############################################################
# 4.) Make sure the form was posted from an approved host name.
if (!in_array($from['host'] , $goodHosts))
{
logAttack("Form accessed from a bad host");
header("HTTP/1.0 403 Forbidden");
die("Error with form host.");
}
############################################################
# 5.) Make sure the form isn't being submitted by a blacklisted IP
#$filename = "/var/apache2/htdocs/lib/inc/blacklist.txt";
$filename = "/var/www/html/blacklist.txt";
$data = file($filename);
$match = "/" . $_SERVER['REMOTE_ADDR'] . "/mis";
foreach($data as $line)
{
if(preg_match($match, $line))
{
die("Your IP address has been blocked from submitting forms,".
" please contact webmaster@millersville.edu if you feel this was done in error.");
}
}
############################################################
# 6.) Loop thru every field and perform multiple checks on
# each field.
foreach ($_POST as $k => $userInput)
{
$_POST[$k] = recurse_input($userInput);
}
foreach ($_POST as $k => $userInput)
{
############################################################
# 7.) Check for header code in all post fields.
if (preg_match("/(%0A|%0D|\n+|\r+)(content-type:|to:|cc:|bcc:)/i", $userInput))
{
logAttack("Header Injection Found"); # store attempt for further analysis
header("HTTP/1.0 403 Forbidden");
die("Error with form information.");
}
############################################################
# 8.) Remove any special HTML entities to prevent certain XSS attacks
if(strip_tags($userInput) != $userInput)
{
logAttack("Form filled in with HTML and/or PHP");
header("HTTP/1.0 403 Forbidden");
die("Error with form. HTML and/or PHP is not allowed in form submission. Please go
back and submit again with HTML and/or PHP
");
}
############################################################
# 9.) Checked for banned words.
foreach($blockWords as $word)
{
if(strstr($userInput, $word))
{
logAttack("Message contains banned words");
header("HTTP/1.0 403 Forbidden");
die('Your message contained words marked as spam. If you feel you got this in error, please remove "'.$word.'" from your message and resubmit it.');
}
}
############################################################
#10.) Remove any special HTML entities to prevent certain XSS attacks
$_POST[$k] = htmlentities($userInput, ENT_QUOTES);
}
############################################################
# 10.) Free memory and continue with script.
unset($k, $v, $v2, $badStrings, $goodHosts, $from);
#eof########################################################
?>
WIC - Contact Info
