Checking against GET parameters is for the user-agent string not possible as

ordinary UAs may get blocked.

Signed-off-by: Roland Häder <rhaeder@cho-time.de>

diff --git a/libs/lib_detector.php b/libs/lib_detector.php
index eab50bbf04c6e7829f6addbc82c5c2d5256b9b53..44de983b657237397d022031939fc15b550896aa 100644 (file)
--- a/libs/lib_detector.php
+++ b/libs/lib_detector.php
@@ -185,6 +185,34 @@ function initCrackerTrackerArrays () {
                'proc/self/environ',
        ];
 
+       // BLock these words found in User-Agent
+       $GLOBALS['ctracker_ua_blacklist'] = array(
+               // Compiler/interpreter
+               'bin/g++ ', 'bin/c++ ', 'cc ', 'bin/python', 'bin/python', 'bin/tclsh',
+               'bin/tclsh', 'bin/nasm', '/perl', 'cmd.exe',
+               'nc.exe', 'ftp.exe', 'wget ', 'system(', 'curl ',
+
+               // php.ini settings
+               'allow_url_fopen', 'allow_url_include', 'auto_prepend_file', 'disable_functions', 'safe_mode',
+
+               // PHP commands/scripts
+               'fopen', 'fwrite', 'phpinfo()', '\<?', '?\>', 'base64_decode', 'file_put_contents',
+               'set_magic_quotes_runtime', 'set_magic_quotes_runtime', 'display_errors', 'passthru',
+
+               // Typical PHP script remote-inclusions and typical include file names
+               '.inc.php', '.lib.php', '.class.php', 'config.php', '.inc', '_php',
+               'php_', 'class_', '_class.php', 'db_mysql.inc',
+
+               // PHP arrays
+               '_PHPLIB',
+
+               // Request header being inserted
+               'content-type',
+
+               // /proc/ and other forbidden paths
+               'proc/self/environ',
+       );
+
        // Block these words found in POST requests
        $GLOBALS['ctracker_post_blacklist'] = [
                // This line is for detecting hidden link spam in wikis, forums, guestbooks, etc.