Also block request methods such as CONNECT as they can be used for proxying

[ctracker.git] / libs / lib_general.php

diff --git a/libs/lib_general.php b/libs/lib_general.php
index 4180c9d75a52685a05f610847b968d47d6b6dfe4..f4b956ef385fed6d09cdd4030f86ce9402c47fdc 100644 (file)
--- a/libs/lib_general.php
+++ b/libs/lib_general.php
@@ -143,7 +143,7 @@ function isCrackerTrackerProxyUsed () {
 }
 
 // Detects the user-agent string
-function crackerTrackerUserAgent () {
+function crackerTrackerUserAgent ($sanitize = FALSE) {
        // Default is 'unknown'
        $ua = 'unknown';
 
@@ -153,48 +153,81 @@ function crackerTrackerUserAgent () {
                $ua = crackerTrackerSecureString(urldecode($_SERVER['HTTP_USER_AGENT']));
        } // END - if
 
+       // Sanitize it?
+       if ($sanitize === TRUE) {
+               // Sanitize ...
+               $ua = crackerTrackerSanitize($ua);
+       } // END - if
+
        // Return it
        return $ua;
 }
 
 // Detects the script name
-function crackerTrackerScriptName () {
+function crackerTrackerScriptName ($sanitize = FALSE) {
+       // Default is NULL
+       $scriptName = NULL;
+
        // Is it there?
-       if (!isset($_SERVER['SCRIPT_NAME'])) {
+       if (!empty($_SERVER['SCRIPT_NAME'])) {
                // Return NULL
-               return NULL;
+               $scriptName = crackerTrackerSecureString($_SERVER['SCRIPT_NAME']);
        } // END - if
 
-       // Should always be there!
-       return crackerTrackerSecureString($_SERVER['SCRIPT_NAME']);
+       // Sanitize it?
+       if ($sanitize === TRUE) {
+               // Sanitize ...
+               $scriptName = crackerTrackerSanitize($scriptName);
+       } // END - if
+
+       // Return
+       return $scriptName;
 }
 
 // Detects the query string
-function crackerTrackerQueryString () {
+function crackerTrackerQueryString ($sanitize = FALSE) {
+       // Default is NULL
+       $query = NULL;
+
        // Is it there?
-       if (!isset($_SERVER['QUERY_STRING'])) {
+       if (!empty($_SERVER['QUERY_STRING'])) {
                // Return NULL
-               return NULL;
+               $query = crackerTrackerEscapeString(urldecode($_SERVER['QUERY_STRING']));
        } // END - if
 
-       // Should always be there!
-       return crackerTrackerEscapeString(urldecode($_SERVER['QUERY_STRING']));
+       // Sanitize it?
+       if ($sanitize === TRUE) {
+               // Sanitize ...
+               $query = crackerTrackerSanitize($query);
+       } // END - if
+
+       // Return it
+       return $query;
 }
 
 // Detects the server's name
-function crackerTrackerServerName () {
+function crackerTrackerServerName ($sanitize = FALSE) {
+       // Default is NULL
+       $serverName = NULL;
+
        // Is it there?
-       if (!isset($_SERVER['SERVER_NAME'])) {
+       if (!empty($_SERVER['SERVER_NAME'])) {
                // Return NULL
-               return NULL;
+               $serverName = crackerTrackerSecureString($_SERVER['SERVER_NAME']);
        } // END - if
 
-       // Should always be there!
-       return crackerTrackerSecureString($_SERVER['SERVER_NAME']);
+       // Sanitize it?
+       if ($sanitize === TRUE) {
+               // Sanitize ...
+               $serverName = crackerTrackerSanitize($serverName);
+       } // END - if
+
+       // Return it
+       return $serverName;
 }
 
 // Detects the referer
-function crackerTrackerReferer () {
+function crackerTrackerReferer ($sanitize = FALSE) {
        // Default is a dash
        $referer = '-';
 
@@ -204,6 +237,12 @@ function crackerTrackerReferer () {
                $referer = crackerTrackerSecureString(urldecode($_SERVER['HTTP_REFERER']));
        } // END - if
 
+       // Sanitize it?
+       if ($sanitize === TRUE) {
+               // Sanitize ...
+               $referer = crackerTrackerSanitize($referer);
+       } // END - if
+
        // Return it
        return $referer;
 }
@@ -539,11 +578,14 @@ function unsetCtrackerData () {
                        'ctracker_language',
                        'ctracker_localized',
                        'ctracker_link',
+                       'ctracker_blocked_requests',
                ) as $key) {
                        // Unset it
                        unset($GLOBALS[$key]);
        } // END - foreach
 }
 
-// [EOF]
-?>
+// Sanitizes string
+function crackerTrackerSanitize ($str) {
+       return str_replace(array('//', '/./'), array('/', '/'), $str);
+}