elkarte /
Elkarte
| Conditions | 38 |
| Paths | 142 |
| Total Lines | 116 |
| Code Lines | 42 |
| Lines | 0 |
| Ratio | 0 % |
| Changes | 0 | ||
Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.
For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.
Commonly applied refactorings include:
If many parameters/temporary variables are present:
| 1 | <?php if (!defined('BB2_CORE')) die('I said no cheating!'); |
||
| 36 | function bb2_misc_headers($settings, $package) |
||
| 37 | { |
||
| 38 | @$ua = $package['headers_mixed']['User-Agent']; |
||
| 39 | |||
| 40 | if (!strcmp($package['request_method'], "POST") && empty($ua)) { |
||
| 41 | return "f9f2b8b9"; |
||
| 42 | } |
||
| 43 | |||
| 44 | // Broken spambots send URLs with various invalid characters |
||
| 45 | // Some broken browsers send the #vector in the referer field :( |
||
| 46 | // Worse yet, some Javascript client-side apps do the same in |
||
| 47 | // blatant violation of the protocol and good sense. |
||
| 48 | // if (strpos($package['request_uri'], "#") !== FALSE || strpos($package['headers_mixed']['Referer'], "#") !== FALSE) { |
||
| 49 | if ($settings['strict'] && strpos($package['request_uri'], "#") !== FALSE) { |
||
| 50 | return "dfd9b1ad"; |
||
| 51 | } |
||
| 52 | // A pretty nasty SQL injection attack on IIS servers |
||
| 53 | if (strpos($package['request_uri'], ";DECLARE%20@") !== FALSE) { |
||
| 54 | return "dfd9b1ad"; |
||
| 55 | } |
||
| 56 | |||
| 57 | // Range: field exists and begins with 0 |
||
| 58 | // Real user-agents do not start ranges at 0 |
||
| 59 | // NOTE: this blocks the whois.sc bot. No big loss. |
||
| 60 | // Exceptions: MT (not fixable); LJ (refuses to fix; may be |
||
| 61 | // blocked again in the future); Facebook |
||
| 62 | if ($settings['strict'] && array_key_exists('Range', $package['headers_mixed']) && strpos($package['headers_mixed']['Range'], "=0-") !== FALSE) { |
||
| 63 | if (strncmp($ua, "MovableType", 11) && strncmp($ua, "URI::Fetch", 10) && strncmp($ua, "php-openid/", 11) && strncmp($ua, "facebookexternalhit", 19)) { |
||
| 64 | return "7ad04a8a"; |
||
| 65 | } |
||
| 66 | } |
||
| 67 | |||
| 68 | // Content-Range is a response header, not a request header |
||
| 69 | if (array_key_exists('Content-Range', $package['headers_mixed'])) { |
||
| 70 | return '7d12528e'; |
||
| 71 | } |
||
| 72 | |||
| 73 | // Lowercase via is used by open proxies/referrer spammers |
||
| 74 | // Exceptions: Clearswift uses lowercase via (refuses to fix; |
||
| 75 | // may be blocked again in the future) |
||
| 76 | if ($settings['strict'] && |
||
| 77 | array_key_exists('via', $package['headers']) && |
||
| 78 | strpos($package['headers']['via'],'Clearswift') === FALSE && |
||
| 79 | strpos($ua,'CoralWebPrx') === FALSE) { |
||
| 80 | return "9c9e4979"; |
||
| 81 | } |
||
| 82 | |||
| 83 | // pinappleproxy is used by referrer spammers |
||
| 84 | if (array_key_exists('Via', $package['headers_mixed'])) { |
||
| 85 | if (stripos($package['headers_mixed']['Via'], "pinappleproxy") !== FALSE || stripos($package['headers_mixed']['Via'], "PCNETSERVER") !== FALSE || stripos($package['headers_mixed']['Via'], "Invisiware") !== FALSE) { |
||
| 86 | return "939a6fbb"; |
||
| 87 | } |
||
| 88 | } |
||
| 89 | |||
| 90 | // TE: if present must have Connection: TE |
||
| 91 | // RFC 2616 14.39 |
||
| 92 | // Blocks Microsoft ISA Server 2004 in strict mode. Contact Microsoft |
||
| 93 | // to obtain a hotfix. |
||
| 94 | if ($settings['strict'] && array_key_exists('Te', $package['headers_mixed'])) { |
||
| 95 | if (!preg_match('/\bTE\b/', $package['headers_mixed']['Connection'])) { |
||
| 96 | return "582ec5e4"; |
||
| 97 | } |
||
| 98 | } |
||
| 99 | |||
| 100 | if (array_key_exists('Connection', $package['headers_mixed'])) { |
||
| 101 | // Connection: keep-alive and close are mutually exclusive |
||
| 102 | if (preg_match('/\bKeep-Alive\b/i', $package['headers_mixed']['Connection']) && preg_match('/\bClose\b/i', $package['headers_mixed']['Connection'])) { |
||
| 103 | return "a52f0448"; |
||
| 104 | } |
||
| 105 | // Close shouldn't appear twice |
||
| 106 | if (preg_match('/\bclose,\s?close\b/i', $package['headers_mixed']['Connection'])) { |
||
| 107 | return "a52f0448"; |
||
| 108 | } |
||
| 109 | // Keey-Alive shouldn't appear twice either |
||
| 110 | if (preg_match('/\bkeep-alive,\s?keep-alive\b/i', $package['headers_mixed']['Connection'])) { |
||
| 111 | return "a52f0448"; |
||
| 112 | } |
||
| 113 | // Keep-Alive format in RFC 2068; some bots mangle these headers |
||
| 114 | if (stripos($package['headers_mixed']['Connection'], "Keep-Alive: ") !== FALSE) { |
||
| 115 | return "b0924802"; |
||
| 116 | } |
||
| 117 | } |
||
| 118 | |||
| 119 | |||
| 120 | // Headers which are not seen from normal user agents; only malicious bots |
||
| 121 | if (array_key_exists('X-Aaaaaaaaaaaa', $package['headers_mixed']) || array_key_exists('X-Aaaaaaaaaa', $package['headers_mixed'])) { |
||
| 122 | return "b9cc1d86"; |
||
| 123 | } |
||
| 124 | // Proxy-Connection does not exist and should never be seen in the wild |
||
| 125 | // http://lists.w3.org/Archives/Public/ietf-http-wg-old/1999JanApr/0032.html |
||
| 126 | // http://lists.w3.org/Archives/Public/ietf-http-wg-old/1999JanApr/0040.html |
||
| 127 | if ($settings['strict'] && array_key_exists('Proxy-Connection', $package['headers_mixed'])) { |
||
| 128 | return "b7830251"; |
||
| 129 | } |
||
| 130 | |||
| 131 | if (array_key_exists('Referer', $package['headers_mixed'])) { |
||
| 132 | // Referer, if it exists, must not be blank |
||
| 133 | if (empty($package['headers_mixed']['Referer'])) { |
||
| 134 | return "69920ee5"; |
||
| 135 | } |
||
| 136 | |||
| 137 | // Referer, if it exists, must contain a : |
||
| 138 | // While a relative URL is technically valid in Referer, all known |
||
| 139 | // legitimate user-agents send an absolute URL |
||
| 140 | if (strpos($package['headers_mixed']['Referer'], ":") === FALSE) { |
||
| 141 | return "45b35e30"; |
||
| 142 | } |
||
| 143 | } |
||
| 144 | |||
| 145 | // "uk" is not a language (ISO 639) nor a country (ISO 3166) |
||
| 146 | // oops, yes it is :( Please shoot any Ukrainian spammers you see. |
||
| 147 | # if (preg_match('/\buk\b/', $package['headers_mixed']['Accept-Language'])) { |
||
| 148 | # return "35ea7ffa"; |
||
| 149 | # } |
||
| 150 | |||
| 151 | return false; |
||
| 152 | } |
||
| 153 |
This check looks for parameters that have been defined for a function or method, but which are not used in the method body.