Experimental commit:

[ctracker.git] / libs / lib_detector.php

diff --git a/libs/lib_detector.php b/libs/lib_detector.php
index 4d71463d8d079e4324515baefbc6c6728d6fc251..3fa9b4da9ea0fb83545fba330c6698fd5d655520 100644 (file)
--- a/libs/lib_detector.php
+++ b/libs/lib_detector.php
@@ -35,9 +35,10 @@ function initCrackerTrackerArrays () {
 
        // Whitelist some absolute query strings (see below)
        $GLOBALS['ctracker_whitelist'] = array(
-               'cmd=new',   // LinPHA
-               'cmd=edit',  // LinPHA
-               'cmd=lostpw' // LinPHA
+               'cmd=new',          // LinPHA
+               'cmd=edit',         // LinPHA
+               'cmd=lostpw',       // LinPHA
+               'secure_session=1', // Mantis Bug Tracker
        );
 
        // Attacks we should detect and block
@@ -57,7 +58,7 @@ function initCrackerTrackerArrays () {
                'HTTP_USER_AGENT', 'HTTP_HOST', 'wget%20', 'uname\x20-', 'uname%20-', 'bin/id', '/bin/', '/chgrp',
                '/chown', '/usr/bin', 'g\+\+', 'bin/python', 'bin/tclsh', 'bin/nasm', 'perl%20', 'traceroute%20',
                'ping%20', 'bin/xterm', 'lsof%20', '.conf', 'motd%20', 'HTTP/1.', '.inc.php', '.lib.php', '.class.php',
-               'config.php', 'file\://', 'window.open', '<SCRIPT>', 'javascript\://', 'img src', 'img%20src', '.jsp',
+               'config.php', 'file\://', 'window.open', 'javascript\://', 'img src', 'img%20src', '.jsp',
                'ftp.exe', 'xp_enumdsn', 'xp_availablemedia', 'xp_filelist', 'xp_cmdshell', 'nc.exe', '.htpasswd',
                'servlet', '/etc/passwd', 'wwwacl', '~root', '~ftp', '.js', '.jsp', '.history', 'bash_history',
                '.bash_history', '~nobody', 'server-info', 'server-status', 'reboot%20', 'halt%20',
@@ -77,10 +78,9 @@ function initCrackerTrackerArrays () {
        // Block these words found in POST requests
        $GLOBALS['ctracker_post_blacklist'] = array(
                // This line is for detecting hidden link spam in wikis, forums, guestbooks, etc.
-               'div style=', 'overflow:auto', 'height:1px', 'width:1px', 'display:hidden',
-               // "Common" login name from VHCS exploiters ;-)
-               'starhack', 'DeLiMehmet', 'hisset', 'Hisset', 'delimert', 'MecTruy',
-               'busca'
+               'div style=', 'overflow:auto', 'height:1px', 'width:1px', 'display:hidden', 'style.display',
+               // "Common" login names from VHCS exploiters ;-)
+               'starhack', 'DeLiMehmet', 'hisset', 'Hisset', 'delimert', 'MecTruy'
        );
 
        // Load email header
@@ -95,7 +95,7 @@ function initCrackerTrackerArrays () {
 // Checks for worms
 function isCrackerTrackerWormDetected () {
        // Check against the whole list
-       $GLOBALS['ctracker_checkworm'] = str_replace($GLOBALS['ctracker_get_blacklist'], '*', crackerTrackerQueryString());
+       $GLOBALS['ctracker_checkworm'] = str_ireplace($GLOBALS['ctracker_get_blacklist'], '*', urldecode(crackerTrackerQueryString()));
 
        // If it differs to original and the *whole* request string is not in whitelist
        // then blog the attempt
@@ -108,7 +108,7 @@ function isCrackerTrackerPostAttackDetected () {
        $GLOBALS['ctracker_post_track'] = implode_r('', $_POST);
 
        // Check for suspicious POST data
-       $GLOBALS['ctracker_check_post'] = str_replace($GLOBALS['ctracker_post_blacklist'], '*', $GLOBALS['ctracker_post_track']);
+       $GLOBALS['ctracker_check_post'] = str_ireplace($GLOBALS['ctracker_post_blacklist'], '*', $GLOBALS['ctracker_post_track']);
 
        // Is it detected?
        return ((isCrackerTrackerWormDetected()) || ($GLOBALS['ctracker_check_post'] != $GLOBALS['ctracker_post_track']));
@@ -151,7 +151,7 @@ function sendCrackerTrackerTicketMails () {
        $mail = crackerTrackerLoadEmailTemplate('webmaster_add_ticket', $GLOBALS['ctracker_last_ticket'], getCrackerTrackerConfig('ctracker_language'));
 
        // Send email to the user
-       crackerTrackerSendMail($mail, null, getCrackerTrackerLocalized('webmaster_add_ticket_subject'));
+       crackerTrackerSendMail($mail, NULL, getCrackerTrackerLocalized('webmaster_add_ticket_subject'));
 }
 
 // Sends a mail out