0.2.1/inc/libs/security_functions.php

   1 <?php\r
   2 /************************************************************************\r
   3  * MXChange v0.2.1                                    Start: 09/20/2005 *\r
   4  * ===============                              Last change: 09/20/2005 *\r
   5  *                                                                      *\r
   6  * -------------------------------------------------------------------- *\r
   7  * File              : security_functions.php                           *\r
   8  * -------------------------------------------------------------------- *\r
   9  * Short description : Secure all GET, POST and COOKIE data             *\r
  10  * -------------------------------------------------------------------- *\r
  11  * Kurzbeschreibung  : Alle GET, POST und COOKIE-Daten sichern          *\r
  12  * -------------------------------------------------------------------- *\r
  13  *                                                                      *\r
  14  * -------------------------------------------------------------------- *\r
  15  * Copyright (c) 2003 - 2008 by Roland Haeder                           *\r
  16  * For more information visit: http://www.mxchange.org                  *\r
  17  *                                                                      *\r
  18  * This program is free software; you can redistribute it and/or modify *\r
  19  * it under the terms of the GNU General Public License as published by *\r
  20  * the Free Software Foundation; either version 2 of the License, or    *\r
  21  * (at your option) any later version.                                  *\r
  22  *                                                                      *\r
  23  * This program is distributed in the hope that it will be useful,      *\r
  24  * but WITHOUT ANY WARRANTY; without even the implied warranty of       *\r
  25  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the        *\r
  26  * GNU General Public License for more details.                         *\r
  27  *                                                                      *\r
  28  * You should have received a copy of the GNU General Public License    *\r
  29  * along with this program; if not, write to the Free Software          *\r
  30  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,               *\r
  31  * MA  02110-1301  USA                                                  *\r
  32  ************************************************************************/\r
  33 \r
  34 // Some security stuff...\r
  35 if (ereg(basename(__FILE__), $_SERVER['PHP_SELF']))\r
  36 {\r
  37         $INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4) . "/security.php";\r
  38         require($INC);\r
  39 }\r
  40
  41 /**
  42  * Function to secure input strings
  43  *
  44  * @param       $str    The unsecured string
  45  * @return      $str    A (hopefully) secured string against HTML and other things
  46  */
  47 function secureString ($str) {
  48         $str = trim(strip_tags($str));
  49         $str = htmlentities($str, ENT_QUOTES);
  50         return $str;
  51 }
  52 \r
  53 // Run only once this security check/exchange\r
  54 if (defined('__SECURITY')) return;\r
  55 \r
  56 // Fatal messages goes here\r
  57 global $FATAL;\r
  58 $FATAL = array();\r
  59 \r
  60 // Runtime quoting is off now...\r
  61 set_magic_quotes_runtime(false);\r
  62 \r
  63 // Unregister all global variables because of vultures and surpress failed attemps\r
  64 @import_request_variables('');\r
  65 \r
  66 // Error reporting level\r
  67 @error_reporting(E_ALL | E_STRICT);\r
  68 \r
  69 // Check if important arrays are found and define them if missing\r
  70 if (!isset($_SERVER))\r
  71 {\r
  72         global $_SERVER;\r
  73         $_SERVER = $GLOBALS['_SERVER'];\r
  74 }\r
  75 if (!isset($_GET))\r
  76 {\r
  77         global $_GET;\r
  78         $_GET = $GLOBALS['_GET'];\r
  79 }\r
  80 if (!isset($_POST))\r
  81 {\r
  82         global $_POST;\r
  83         $_POST = $GLOBALS['_POST'];\r
  84 }\r
  85 if (!isset($_COOKIE))\r
  86 {\r
  87         global $_COOKIE;\r
  88         $_COOKIE = $GLOBALS['_COOKIE'];\r
  89 }\r
  90 \r
  91 // Include IP-Filter here\r
  92 //require("/usr/share/php/ipfilter.php");\r
  93 \r
  94 // Generate arrays which holds the relevante chars to replace\r
  95 global $SEC_CHARS, $URL_CHARS;\r
  96 $SEC_CHARS = array(\r
  97         // The chars we are looking for...\r
  98         'from' => array("{", "}", "/", ".", "'", "$", "(", ")", "{--", "--}", "%", ";", "[", "]", ":", "--"),\r
  99         // ... and we will replace to.\r
 100         'to'   => array(\r
 101                 "{OPEN_ANCHOR2}",\r
 102                 "{CLOSE_ANCHOR2}",\r
 103                 "{SLASH}",\r
 104                 "{DOT}",\r
 105                 "{QUOT}",\r
 106                 "{DOLLAR}",\r
 107                 "{OPEN_ANCHOR}",\r
 108                 "{CLOSE_ANCHOR}",\r
 109                 "{OPEN_TEMPLATE}",\r
 110                 "{CLOSE_TEMPLATE}",\r
 111                 "{PER}",\r
 112                 "{SEMI}",\r
 113                 "{OPEN_INDEX}",\r
 114                 "{CLOSE_INDEX}",\r
 115                 "{DBL_DOT}",\r
 116                 "{COMMENT}"\r
 117         ),\r
 118 );\r
 119 \r
 120 // Characters allowed in URLs\r
 121 //\r
 122 // Note: Do not replace 'to' with 'from' and vise-versa! When you do this all booked URLs will be\r
 123 //       rejected because of the {SLASH}, {DOT} and all below listed items inside the URL.\r
 124 $URL_CHARS = array(\r
 125         // Search for these secured characters\r
 126         'to'   => array("{SLASH}", "{DOT}", "{PER}", "{DBL_DOT}", "{COMMENT}"),\r
 127         // Replace with these characters\r
 128         'from' => array("/", ".", "%", ":", "--")\r
 129 );\r
 130 \r
 131 // Overworked security part:\r
 132 if (is_array($_GET)) {\r
 133         foreach ($_GET as $seckey=>$secvalue)\r
 134         {\r
 135                 if (is_array($secvalue))\r
 136                 {\r
 137                         // Throw arrays away...\r
 138                         unset($_GET[$seckey]);\r
 139                 }\r
 140                  else\r
 141                 {\r
 142                         // Only variables are allowed (non-array) but we secure them all!\r
 143                         foreach ($SEC_CHARS['from'] as $key=>$char)\r
 144                         {\r
 145                                 // Pass all through\r
 146                                 $_GET[$seckey] = str_replace($char  , $SEC_CHARS['to'][$key], $_GET[$seckey]);\r
 147                         }\r
 148 \r
 149                         // Strip all other out\r
 150                         $_GET[$seckey] = strip_tags($_GET[$seckey]);\r
 151                 }\r
 152         }\r
 153 }\r
 154 \r
 155 if (basename($_SERVER['PHP_SELF']) != "install.php")\r
 156 {\r
 157         // And POST data\r
 158         foreach ($_POST as $seckey=>$secvalue)\r
 159         {\r
 160                 if (!is_array($secvalue))\r
 161                 {\r
 162                         // Only variables are allowed (non-array) to be secured...\r
 163                         foreach ($SEC_CHARS['from'] as $key=>$char)\r
 164                         {\r
 165                                 // Pass all through\r
 166                                 $_POST[$seckey] = str_replace($char  , $SEC_CHARS['to'][$key], $_POST[$seckey]);\r
 167                         }\r
 168 \r
 169                         // Strip all other out\r
 170                         $_POST[$seckey] = strip_tags($_POST[$seckey]);\r
 171                 }\r
 172         }\r
 173 \r
 174         // ... and finally cookies\r
 175         foreach ($_COOKIE as $seckey=>$secvalue)\r
 176         {\r
 177                 if (is_array($secvalue))\r
 178                 {\r
 179                         // Throw arrays away...\r
 180                         unset($_COOKIE[$seckey]);\r
 181                 }\r
 182                  else\r
 183                 {\r
 184                         // Only variables are allowed (non-array) but we secure them all!\r
 185                         foreach ($SEC_CHARS['from'] as $key=>$char)\r
 186                         {\r
 187                                 // Pass all through\r
 188                                 $_COOKIE[$seckey] = str_replace($char  , $SEC_CHARS['to'][$key], $_COOKIE[$seckey]);\r
 189                         }\r
 190 \r
 191                         // Strip all other out\r
 192                         $_COOKIE[$seckey] = strip_tags($_COOKIE[$seckey]);\r
 193                 }\r
 194         }\r
 195 }\r
 196 \r
 197 // Activate caching or transparent compressing when it is not already done\r
 198 if (!defined('_OB_CACHING'))\r
 199 {\r
 200         if (phpversion() >= '4.0.4pl1' && (strstr(getenv('HTTP_USER_AGENT'),'compatible') || (strstr(getenv('HTTP_USER_AGENT'), "Mozilla"))))\r
 201         {\r
 202                 if ((extension_loaded('zlib')) && (function_exists('ob_start')))\r
 203                 {\r
 204                         // Start caching\r
 205                         define('_OB_CACHING', "on");\r
 206                         ob_start();\r
 207                 }\r
 208                  else\r
 209                 {\r
 210                         // Extension not loaded or required function is missing\r
 211                         define('_OB_CACHING', "404");\r
 212                 }\r
 213         }\r
 214          else\r
 215         {\r
 216                 // Old PHP version\r
 217                 define('_OB_CACHING', "old");\r
 218         }\r
 219 }\r
 220 \r
 221 // At last secure the $_SERVER['PHP_SELF'] element\r
 222 $_SERVER['PHP_SELF'] = secureString($_SERVER['PHP_SELF']);\r
 223 \r
 224 // Split it up into path and filename\r
 225 $SELF_DIR  = dirname($_SERVER['PHP_SELF']);\r
 226 $SELF_FILE = basename($_SERVER['PHP_SELF']);\r
 227 \r
 228 // Check for a .php inside the $SELF_DIR...\r
 229 while (ereg(".php", $SELF_DIR))\r
 230 {\r
 231         // Correct the dirname\r
 232         $SELF_DIR = substr($SELF_DIR, 0, (strpos($SELF_DIR, ".php") + 4));\r
 233         // Rewrite filename...\r
 234         $SELF_FILE = basename($SELF_DIR);\r
 235         // ... and dirname\r
 236         $SELF_DIR = dirname($SELF_DIR);\r
 237 }\r
 238 \r
 239 // Put both together again and let's pray it is secured now...\r
 240 $_SERVER['PHP_SELF'] = $SELF_DIR."/".$SELF_FILE;\r
 241 \r
 242 // Remove uneccessary variables\r
 243 unset($SELF_DIR);\r
 244 unset($SELF_FILE);\r
 245 \r
 246 // Security system loaded...\r
 247 define('__SECURITY', "1");\r
 248 \r
 249 //\r
 250 ?>\r