Also block request methods such as CONNECT as they can be used for proxying

[ctracker.git] / libs / lib_general.php

diff --git a/libs/lib_general.php b/libs/lib_general.php
index 8d5dd1e93ae268deb63ba850cc1d3d0b5cc8f519..f4b956ef385fed6d09cdd4030f86ce9402c47fdc 100644 (file)
--- a/libs/lib_general.php
+++ b/libs/lib_general.php
@@ -143,14 +143,20 @@ function isCrackerTrackerProxyUsed () {
 }
 
 // Detects the user-agent string
-function crackerTrackerUserAgent () {
+function crackerTrackerUserAgent ($sanitize = FALSE) {
        // Default is 'unknown'
        $ua = 'unknown';
 
        // Is the entry there?
        if (isset($_SERVER['HTTP_USER_AGENT'])) {
                // Then use it securely
-               $ua = crackerTrackerSecureString($_SERVER['HTTP_USER_AGENT']);
+               $ua = crackerTrackerSecureString(urldecode($_SERVER['HTTP_USER_AGENT']));
+       } // END - if
+
+       // Sanitize it?
+       if ($sanitize === TRUE) {
+               // Sanitize ...
+               $ua = crackerTrackerSanitize($ua);
        } // END - if
 
        // Return it
@@ -158,56 +164,104 @@ function crackerTrackerUserAgent () {
 }
 
 // Detects the script name
-function crackerTrackerScriptName () {
+function crackerTrackerScriptName ($sanitize = FALSE) {
+       // Default is NULL
+       $scriptName = NULL;
+
        // Is it there?
-       if (!isset($_SERVER['SCRIPT_NAME'])) {
+       if (!empty($_SERVER['SCRIPT_NAME'])) {
                // Return NULL
-               return NULL;
+               $scriptName = crackerTrackerSecureString($_SERVER['SCRIPT_NAME']);
        } // END - if
 
-       // Should always be there!
-       return crackerTrackerSecureString($_SERVER['SCRIPT_NAME']);
+       // Sanitize it?
+       if ($sanitize === TRUE) {
+               // Sanitize ...
+               $scriptName = crackerTrackerSanitize($scriptName);
+       } // END - if
+
+       // Return
+       return $scriptName;
 }
 
 // Detects the query string
-function crackerTrackerQueryString () {
+function crackerTrackerQueryString ($sanitize = FALSE) {
+       // Default is NULL
+       $query = NULL;
+
        // Is it there?
-       if (!isset($_SERVER['QUERY_STRING'])) {
+       if (!empty($_SERVER['QUERY_STRING'])) {
                // Return NULL
-               return NULL;
+               $query = crackerTrackerEscapeString(urldecode($_SERVER['QUERY_STRING']));
        } // END - if
 
-       // Should always be there!
-       return crackerTrackerEscapeString(urldecode($_SERVER['QUERY_STRING']));
+       // Sanitize it?
+       if ($sanitize === TRUE) {
+               // Sanitize ...
+               $query = crackerTrackerSanitize($query);
+       } // END - if
+
+       // Return it
+       return $query;
 }
 
 // Detects the server's name
-function crackerTrackerServerName () {
+function crackerTrackerServerName ($sanitize = FALSE) {
+       // Default is NULL
+       $serverName = NULL;
+
        // Is it there?
-       if (!isset($_SERVER['SERVER_NAME'])) {
+       if (!empty($_SERVER['SERVER_NAME'])) {
                // Return NULL
-               return NULL;
+               $serverName = crackerTrackerSecureString($_SERVER['SERVER_NAME']);
        } // END - if
 
-       // Should always be there!
-       return crackerTrackerSecureString($_SERVER['SERVER_NAME']);
+       // Sanitize it?
+       if ($sanitize === TRUE) {
+               // Sanitize ...
+               $serverName = crackerTrackerSanitize($serverName);
+       } // END - if
+
+       // Return it
+       return $serverName;
 }
 
 // Detects the referer
-function crackerTrackerReferer () {
+function crackerTrackerReferer ($sanitize = FALSE) {
        // Default is a dash
        $referer = '-';
 
        // Is it there?
-       if (isset($_SERVER['HTTP_REFERER'])) {
+       if (!empty($_SERVER['HTTP_REFERER'])) {
                // Then use it securely
                $referer = crackerTrackerSecureString(urldecode($_SERVER['HTTP_REFERER']));
        } // END - if
 
+       // Sanitize it?
+       if ($sanitize === TRUE) {
+               // Sanitize ...
+               $referer = crackerTrackerSanitize($referer);
+       } // END - if
+
        // Return it
        return $referer;
 }
 
+// Detects request method
+function crackerTrackerRequestMethod () {
+       // Default is NULL
+       $method = NULL;
+
+       // Is it set?
+       if (!empty($_SERVER['REQUEST_METHOD'])) {
+               // Then use it
+               $method = $_SERVER['REQUEST_METHOD'];
+       } // END - if
+
+       // Return it
+       return $method;
+}
+
 // Detects the scripts path
 function crackerTrackerScriptPath () {
        // Should always be there!
@@ -514,8 +568,9 @@ function unsetCtrackerData () {
                        'ctracker_post_blacklist',
                        'ctracker_header',
                        'ctracker_post_track',
-                       'ctracker_checkworm',
-                       'ctracker_check_post',
+                       'ctracker_checked_get',
+                       'ctracker_checked_post',
+                       'ctracker_checked_ua',
                        'ctracker_last_sql',
                        'ctracker_last_result',
                        'ctracker_config',
@@ -523,11 +578,14 @@ function unsetCtrackerData () {
                        'ctracker_language',
                        'ctracker_localized',
                        'ctracker_link',
+                       'ctracker_blocked_requests',
                ) as $key) {
                        // Unset it
                        unset($GLOBALS[$key]);
        } // END - foreach
 }
 
-// [EOF]
-?>
+// Sanitizes string
+function crackerTrackerSanitize ($str) {
+       return str_replace(array('//', '/./'), array('/', '/'), $str);
+}