Added 'safe_mode' (php.ini setting).

[ctracker.git] / libs / lib_detector.php

diff --git a/libs/lib_detector.php b/libs/lib_detector.php
index e08a49744de036b9a36348032552d5d41d26a102..7da613b15874f4da3e24de79affe9367f3e11516 100644 (file)
--- a/libs/lib_detector.php
+++ b/libs/lib_detector.php
@@ -89,6 +89,9 @@ function initCrackerTrackerArrays () {
                'bin/./tclsh', 'bin/nasm', 'bin/./nasm', '/perl', 'perl ', 'cmd.exe',
                'nc.exe', 'ftp.exe',
 
+               // php.ini settings
+               'allow_url_fopen', 'allow_url_include', 'auto_prepend_file', 'disable_functions', 'safe_mode',
+
                // PHP commands/scripts
                'fopen', 'fwrite', 'phpinfo()', '\<?', '?\>',
 
@@ -123,6 +126,9 @@ function initCrackerTrackerArrays () {
                // Windows XP (?) hacks
                'xp_enumdsn', 'xp_availablemedia', 'xp_filelist', 'xp_cmdshell',
 
+               // Attempts to insert links into a badly secured URL
+               '%3E%3C',
+
                // @TODO Misc/unsorted
                'cgi-', '.eml', '$_request', '$_get', '$request', '$get', '.system',
                '&aim', 'new_password', '&icq', '.conf', 'motd ', 'HTTP/1.',
@@ -130,7 +136,7 @@ function initCrackerTrackerArrays () {
                'wwwacl', '.js', '.jsp', 'server-info', 'server-status',
                'secure_site, ok', 'chunked', 'org.apache', '/servlet/con',
                '<script', 'mod_gzip_status', '.system', 'http_',
-               'uol.com', ',0x', '(0x',
+               'uol.com', ',0x', '(0x'
        );
 
        // Block these words found in POST requests
@@ -218,6 +224,7 @@ function crackerTrackerSendMail ($mail, $recipient = NULL, $subject = NULL) {
        // Construct dummy array
        $rowData = array(
                'remote_addr' => determineCrackerTrackerRealRemoteAddress(),
+               'proxy_addr'  => getenv('REMOTE_ADDR'),
                'check_worm'  => $GLOBALS['ctracker_checkworm'],
                'server_name' => crackerTrackerServerName()
        );
@@ -318,6 +325,7 @@ function crackerTrackerLogAttack () {
        // Prepare array for database insert
        $rowData = array(
                'remote_addr'   => determineCrackerTrackerRealRemoteAddress(),
+               'proxy_addr'    => getenv('REMOTE_ADDR'),
                'user_agent'    => crackerTrackerUserAgent(),
                'get_data'      => crackerTrackerQueryString(),
                'post_data'     => $GLOBALS['ctracker_post_track'],
@@ -340,20 +348,8 @@ function crackerTrackerAlertCurrentUser () {
        if (isset($GLOBALS['ctracker_last_suspicious_entry'])) {
                // Does the user have a ticket?
                if (ifCrackerTrackerIpHasTicket()) {
-                       // Should we continue?
-                       if (isset($_POST['ctracker_continue'])) {
-                               // Set cookie
-                               sendCrackerTrackerCookie();
-
-                               // And redirect to same URL
-                               crackerTrackerRedirectSameUrl();
-                       } elseif (ifCrackerTrackerCookieIsSet()) {
-                               // Return here to normal program
-                               return;
-                       } else {
-                               // Load "Thank you" template
-                               crackerTrackerLoadTemplate('add_ticket_thanks');
-                       }
+                       // Load "Thank you" template
+                       crackerTrackerLoadTemplate('add_ticket_thanks');
                } elseif ((isset($_POST['ctracker_add_ticket'])) && (!empty($_POST['name'])) && (!empty($_POST['email']))) {
                        // Add the ticket
                        addCrackerTrackerTicket($_POST);