Changeset 13259

Timestamp:

11/18/09 00:00:14 (3 years ago)

Author:

Alexander Trofimov

Message:

Ticket #1467

Location:

trunk

Files:

• inc/classes/BxDolInstallerUtils.php (modified) (3 diffs)
• inc/security.inc.php (modified) (4 diffs)
• install/sql/v70.sql (modified) (1 diff)
• modules/boonex/open_social/integration/html/index.php (modified) (1 diff)
• modules/boonex/open_social/shindig/php/index.php (modified) (1 diff)

trunk/inc/classes/BxDolInstallerUtils.php

@@ -83 +83 @@
         $s = getParam('sys_exceptions_fields');
         if (!$s) {
-            return;
-        } 
-        $a = unserialize($s);
-        unset($a['system_email_templates']);
+            $a = array ();
+        } else {
+            $a = unserialize($s);
+            unset($a['system_email_templates']);
+        }
         $a['system_email_templates'] = $this->_getEmailTemplatesHtmlFields();
         $s = serialize ($a);
@@ -98 +99 @@
         $s = getParam('sys_html_fields');
         if (!$s) {
-            return;
-        } 
-        $a = unserialize($s);
-        unset($a['system_profile_html']);
+            $a = array ();
+        } else {
+            $a = unserialize($s);
+            unset($a['system_profile_html']);            
+        }
         $a['system_profile_html'] = $this->_getSystemProfileHtmlFields();
         $s = serialize ($a);
@@ -116 +118 @@
         $a = $GLOBALS['MySQL']->getAll ("SELECT `Name` FROM `sys_email_templates`");
         foreach ($a as $r) {
-            $aRet[] = 'POST.'.$r['Name'];
-            $aRet[] = 'REQUEST.'.$r['Name'];
+            $aRet[] = 'POST.' . $r['Name'] . '_Body';
+            $aRet[] = 'REQUEST.' . $r['Name'] . '_Body';
+            $aRet[] = 'POST.' . $r['Name'] . '_Subject';
+            $aRet[] = 'REQUEST.' . $r['Name'] . '_Subject';
         }
         return $aRet;

trunk/inc/security.inc.php

@@ -46 +46 @@
 
         $ids = new IDS_Monitor($request, $init);
-        $result = $ids->run();
+        $result = $ids->run();        
 
-        if (!$result->isEmpty()) {
+        list ($iImpactLog, $iImpactBlock) = bx_sys_security_get_impact_threshold ();        
+
+        if (!$result->isEmpty() && $result->getImpact() >= $iImpactLog) {
+            
             require_once( BX_DIRECTORY_PATH_CLASSES . "BxDolService.php" );
             require_once( BX_DIRECTORY_PATH_INC . 'design.inc.php' );
@@ -57 +60 @@
             $s .=  "\nHTTP_X_FORWARDED_FOR: " . $_SERVER['HTTP_X_FORWARDED_FOR'];
             $s .=  "\nHTTP_CLIENT_IP: " . $_SERVER['HTTP_CLIENT_IP'];
-            sendMail($GLOBALS['site']['bugReportMail'], $GLOBALS['site']['url'] . ' -  possible attack!', $s, 0, array(), 'text');
-            echo 'Possible attack!!! All data has been collected and sent to the site owner for analysis.';
-            exit;
+            $s .=  "\nSCRIPT_FILENAME: " . $_SERVER['SCRIPT_FILENAME'];
+            $s .=  "\nQUERY_STRING: " . $_SERVER['QUERY_STRING'];
+            $s .=  "\nREQUEST_URI: " . $_SERVER['REQUEST_URI'];
+            $s .=  "\nQUERY_STRING: " . $_SERVER['QUERY_STRING'];
+            $s .=  "\nSCRIPT_NAME: " . $_SERVER['SCRIPT_NAME'];
+            $s .=  "\nPHP_SELF: " . $_SERVER['PHP_SELF'];            
+            if ($result->getImpact() >= $iImpactBlock) {
+                sendMail($GLOBALS['site']['bugReportMail'], $GLOBALS['site']['url'] . ' -  security attack was stopped!', $s, 0, array(), 'text');
+                echo 'Possible security attack!!! All data has been collected and sent to the site owner for analysis.';
+                exit;
+            } else {
+                sendMail($GLOBALS['site']['bugReportMail'], $GLOBALS['site']['url'] . ' -  possible security attack!', $s, 0, array(), 'text');
+            }
         }
     } else {
@@ -79 +92 @@
         if (!file_exists($sCacheFile)) {
             require_once( BX_DIRECTORY_PATH_INC . 'db.inc.php' );
-            $mixedVar = $GLOBALS['MySQL']->fromCache ("sys_{$sType}_fields", 'getOne', "SELECT `VALUE` FROM `sys_options` WHERE `Name` = 'sys_html_fields' LIMIT 1");
+            $mixedVar = $GLOBALS['MySQL']->fromCache ("sys_{$sType}_fields", 'getOne', "SELECT `VALUE` FROM `sys_options` WHERE `Name` = 'sys_{$sType}_fields' LIMIT 1");
         } else {
             include $sCacheFile;
@@ -92 +105 @@
     }
 
+    function bx_sys_security_get_impact_threshold () {
+        $sCacheFile = BX_DIRECTORY_PATH_CACHE . "sys_options.php";
+        if (!file_exists($sCacheFile)) {
+            require_once( BX_DIRECTORY_PATH_INC . 'db.inc.php' );
+            return array (getParam('sys_security_impact_threshold_log'), getParam('sys_security_impact_threshold_block'));
+        } else {
+            include $sCacheFile;
+        }
+        return array ($mixedData['sys_security_impact_threshold_log'], $mixedData['sys_security_impact_threshold_block']);
+    }
+
 ?>

trunk/install/sql/v70.sql

@@ -1156 +1156 @@
 INSERT INTO `sys_options` VALUES('categ_show_limit', '50', 27, 'Number of categories to show limit', 'digit', '', '', 2, '');
 INSERT INTO `sys_options` VALUES('categ_show_columns', '5', 27, 'Number of columns to show categories', 'digit', '', '', 3, '');
+INSERT INTO `sys_options` VALUES('sys_security_impact_threshold_log', '9', 3, 'Total security impact threshold to send report', 'digit', '', '', 0, '');
+INSERT INTO `sys_options` VALUES('sys_security_impact_threshold_block', '27', 3, 'Total security impact threshold to send report and block aggressor', 'digit', '', '', 0, '');
 
 -- --------------------------------------------------------

trunk/modules/boonex/open_social/integration/html/index.php

@@ -18 +18 @@
  *
  */
+
+define('BX_SECURITY_EXCEPTIONS', true);
+$aBxSecurityExceptions = array(
+    'POST.request',
+    'GET.request',
+    'REQUEST.request',
+);
+
 $aPathInfo = pathinfo(__FILE__);
 require_once ($aPathInfo['dirname'] . '/../../../../../inc/header.inc.php');

trunk/modules/boonex/open_social/shindig/php/index.php

@@ -18 +18 @@
  * under the License.
  */
+
+define('BX_SECURITY_EXCEPTIONS', true);
+$aBxSecurityExceptions = array(
+    'POST.request',
+    'GET.request',
+    'REQUEST.request',
+);
 
 // 'A' configuration