From: Michael Vogel Date: Wed, 20 Apr 2016 20:10:05 +0000 (+0200) Subject: Improved DDoS detection X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=f7010edeb0f855dd8a6015e1636f83aa67539c56;p=friendica.git Improved DDoS detection --- diff --git a/index.php b/index.php index fcd2bfec3e..c2f469b5a8 100644 --- a/index.php +++ b/index.php @@ -118,14 +118,20 @@ if((x($_SESSION,'language')) && ($_SESSION['language'] !== $lang)) { if((x($_GET,'zrl')) && (!$install && !$maintenance)) { // Only continue when the given profile link seems valid - // Valid profile links contain a path and no query parameters + // Valid profile links contain a path with "/profile/" and no query parameters if ((parse_url($_GET['zrl'], PHP_URL_QUERY) == "") AND - (parse_url($_GET['zrl'], PHP_URL_PATH) != "")) { + strstr(parse_url($_GET['zrl'], PHP_URL_PATH), "/profile/")) { $_SESSION['my_url'] = $_GET['zrl']; $a->query_string = preg_replace('/[\?&]zrl=(.*?)([\?&]|$)/is','',$a->query_string); zrl_init($a); - } else + } else { + // Someone came with an invalid parameter, maybe as a DDoS attempt + // We simply stop processing here logger("Invalid ZRL parameter ".$_GET['zrl'], LOGGER_DEBUG); + header('HTTP/1.1 403 Forbidden'); + echo "

403 Forbidden

"; + killme(); + } } /**