Passed
Push — master ( d9e5dd...36764d )
by Spuds
01:07 queued 26s
created

bb2_screen()   D

Complexity

Conditions 47
Paths 109

Size

Total Lines 109
Code Lines 76

Duplication

Lines 0
Ratio 0 %

Importance

Changes 0
Metric Value
cc 47
eloc 76
dl 0
loc 109
rs 4.0916
c 0
b 0
f 0
nc 109
nop 2

How to fix   Long Method    Complexity   

Long Method

Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.

For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.

Commonly applied refactorings include:

1
<?php if (!defined('BB2_CWD')) die("I said no cheating!");
2
define('BB2_VERSION', "2.2.22");
3
4
// Bad Behavior entry point is bb2_start()
5
// If you're reading this, you are probably lost.
6
// Go read the bad-behavior-generic.php file.
7
8
define('BB2_CORE', dirname(__FILE__));
9
10
require_once(BB2_CORE . "/functions.inc.php");
11
12
// Kill 'em all!
13
function bb2_banned($settings, $package, $key, $previous_key=false)
14
{
15
	// Some spambots hit too hard. Slow them down a bit.
16
	sleep(2);
17
18
	require_once(BB2_CORE . "/banned.inc.php");
19
	bb2_display_denial($settings, $package, $key, $previous_key);
20
	bb2_log_denial($settings, $package, $key, $previous_key);
21
	if (is_callable('bb2_banned_callback')) {
22
		bb2_banned_callback($settings, $package, $key);
0 ignored issues
show
Bug introduced by
The function bb2_banned_callback was not found. Maybe you did not declare it correctly or list all dependencies? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

22
		/** @scrutinizer ignore-call */ 
23
  bb2_banned_callback($settings, $package, $key);
Loading history...
23
	}
24
	// Penalize the spammers some more
25
	bb2_housekeeping($settings, $package);
26
	die();
0 ignored issues
show
Best Practice introduced by
Using exit here is not recommended.

In general, usage of exit should be done with care and only when running in a scripting context like a CLI script.

Loading history...
27
}
28
29
function bb2_approved($settings, $package)
30
{
31
	// Dirk wanted this
32
	if (is_callable('bb2_approved_callback')) {
33
		bb2_approved_callback($settings, $package);
0 ignored issues
show
Bug introduced by
The function bb2_approved_callback was not found. Maybe you did not declare it correctly or list all dependencies? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

33
		/** @scrutinizer ignore-call */ 
34
  bb2_approved_callback($settings, $package);
Loading history...
34
	}
35
36
	// Decide what to log on approved requests.
37
	if (($settings['verbose'] && $settings['logging']) || empty($package['user_agent'])) {
38
		bb2_db_query(bb2_insert($settings, $package, "00000000"));
39
	}
40
}
41
42
# If this is reverse-proxied or load balanced, obtain the actual client IP
43
function bb2_reverse_proxy($settings, $headers_mixed)
44
{
45
	# Detect if option is on when it should be off
46
	$header = uc_all($settings['reverse_proxy_header']);
47
	if (!array_key_exists($header, $headers_mixed)) {
48
		return false;
49
	}
50
	
51
	$addrs = @array_reverse(preg_split("/[\s,]+/", $headers_mixed[$header]));
52
	# Skip our known reverse proxies and private addresses
53
	if (!empty($settings['reverse_proxy_addresses'])) {
54
		foreach ($addrs as $addr) {
55
			if (!match_cidr($addr, $settings['reverse_proxy_addresses']) && !is_rfc1918($addr)) {
56
				return $addr;
57
			}
58
		}
59
	} else {
60
		foreach ($addrs as $addr) {
61
			if (!is_rfc1918($addr)) {
62
				return $addr;
63
			}
64
		}
65
	}
66
	# If we got here, someone is playing a trick on us.
67
	return false;
68
}
69
70
# FIXME: Bug #12. But this code doesn't currently work.
71
function bb2_unpack_php_post_array($key, $value)
72
{
73
	$unpacked = array();
74
	foreach ($value as $k => $v) {
75
		$i = $key. '[' . $k . ']';
76
		if (is_array($v))
77
			$v = bb2_unpack_php_post_array($i, $v);
78
		$unpacked[$i] = $v;
79
	}
80
	return $unpacked;
81
}
82
83
// Let God sort 'em out!
84
function bb2_start($settings)
85
{
86
	// Gather up all the information we need, first of all.
87
	$headers = bb2_load_headers();
88
	// Postprocess the headers to mixed-case
89
	// TODO: get the world to stop using PHP as CGI
90
	$headers_mixed = array();
91
	foreach ($headers as $h => $v) {
92
		$headers_mixed[uc_all($h)] = $v;
93
	}
94
95
	// IPv6 - IPv4 compatibility mode hack
96
	$_SERVER['REMOTE_ADDR'] = preg_replace("/^::ffff:/", "", $_SERVER['REMOTE_ADDR']);
97
98
	// Reconstruct the HTTP entity, if present.
99
	$request_entity = array();
100
	if (isset($_SERVER['REQUEST_METHOD']) && (!strcasecmp($_SERVER['REQUEST_METHOD'], "POST") || !strcasecmp($_SERVER['REQUEST_METHOD'], "PUT"))) {
101
		foreach ($_POST as $h => $v) {
102
			if (is_array($v)) {
103
				# Workaround, see Bug #12
104
				$v = "Array";
105
			}
106
			$request_entity[$h] = $v;
107
		}
108
	}
109
110
	$request_uri = $_SERVER["REQUEST_URI"];
111
	if (!$request_uri) $request_uri = $_SERVER['SCRIPT_NAME'];	# IIS
112
113
	if ($settings['reverse_proxy'] && $ip = bb2_reverse_proxy($settings, $headers_mixed)) {
114
		$headers['X-Bad-Behavior-Remote-Address'] = $_SERVER['REMOTE_ADDR'];
115
		$headers_mixed['X-Bad-Behavior-Remote-Address'] = $_SERVER['REMOTE_ADDR'];
116
	} else {
117
		$ip = $_SERVER['REMOTE_ADDR'];
118
	}
119
120
	@$package = array('ip' => $ip, 'headers' => $headers, 'headers_mixed' => $headers_mixed, 'request_method' => $_SERVER['REQUEST_METHOD'], 'request_uri' => $request_uri, 'server_protocol' => $_SERVER['SERVER_PROTOCOL'], 'request_entity' => $request_entity, 'user_agent' => $_SERVER['HTTP_USER_AGENT'], 'is_browser' => false,);
121
122
	$result = bb2_screen($settings, $package);
123
	if ($result && !defined('BB2_TEST')) bb2_banned($settings, $package, $result);
124
	return $result;
125
}
126
127
function bb2_screen($settings, $package)
128
{
129
	// Please proceed to the security checkpoint, have your identification
130
	// and boarding pass ready, and prepare to be nakedized or fondled.
131
132
	// CloudFlare-specific checks not handled by reverse proxy code
133
	// Thanks to butchs at Simple Machines
134
	if (array_key_exists('Cf-Connecting-Ip', $package['headers_mixed'])) {
135
		require_once(BB2_CORE . "/cloudflare.inc.php");
136
		$r = bb2_cloudflare($package);
137
		if ($r !== false && $r != $package['ip']) return $r;
0 ignored issues
show
introduced by
The condition $r !== false is always false.
Loading history...
138
	}
139
140
	// First check the whitelist
141
	require_once(BB2_CORE . "/whitelist.inc.php");
142
	if (!bb2_run_whitelist($package)) {
143
		// Now check the blacklist
144
		require_once(BB2_CORE . "/blacklist.inc.php");
145
		if ($r = bb2_blacklist($package)) return $r;
146
147
		// Check the http:BL
148
		require_once(BB2_CORE . "/blackhole.inc.php");
149
		if ($r = bb2_httpbl($settings, $package)) {
150
			if ($r == 1) return false;	# whitelisted
151
			return $r;
152
		}
153
154
		// Check for common stuff
155
		require_once(BB2_CORE . "/common_tests.inc.php");
156
		if ($r = bb2_protocol($settings, $package)) return $r;
157
		if ($r = bb2_cookies($settings, $package)) return $r;
158
		if ($r = bb2_misc_headers($settings, $package)) return $r;
159
160
		// Specific checks
161
		@$ua = $package['user_agent'];
162
		// Search engine checks come first
163
		if (stripos($ua, "bingbot") !== FALSE || stripos($ua, "msnbot") !== FALSE || stripos($ua, "MS Search") !== FALSE) {
164
			require_once(BB2_CORE . "/searchengine.inc.php");
165
			if ($r = bb2_msnbot($package)) {
166
				if ($r == 1) return false;	# whitelisted
167
				return $r;
168
			}
169
			return false;
170
		} elseif (stripos($ua, "Googlebot") !== FALSE || stripos($ua, "Mediapartners-Google") !== FALSE || stripos($ua, "Google Web Preview") !== FALSE) {
171
			require_once(BB2_CORE . "/searchengine.inc.php");
172
			if ($r = bb2_google($package)) {
173
				if ($r == 1) return false;	# whitelisted
174
				return $r;
175
			}
176
			return false;
177
		} elseif (stripos($ua, "Yahoo! Slurp") !== FALSE || stripos($ua, "Yahoo! SearchMonkey") !== FALSE) {
178
			require_once(BB2_CORE . "/searchengine.inc.php");
179
			if ($r = bb2_yahoo($package)) {
180
				if ($r == 1) return false;	# whitelisted
181
				return $r;
182
			}
183
			return false;
184
		} elseif (stripos($ua, "Baidu") !== FALSE) {
185
			require_once(BB2_CORE . "/searchengine.inc.php");
186
			if ($r = bb2_baidu($package)) {
187
				if ($r == 1) return false;	# whitelisted
188
				return $r;
189
			}
190
			return false;
191
		}
192
		// MSIE checks
193
		if (stripos($ua, "; MSIE") !== FALSE) {
194
			$package['is_browser'] = true;
195
			require_once(BB2_CORE . "/browser.inc.php");
196
			if (stripos($ua, "Opera") !== FALSE) {
197
				if ($r = bb2_opera($package)) return $r;
198
			} else {
199
				if ($r = bb2_msie($package)) return $r;
200
			}
201
		} elseif (stripos($ua, "Konqueror") !== FALSE) {
202
			$package['is_browser'] = true;
203
			require_once(BB2_CORE . "/browser.inc.php");
204
			if ($r = bb2_konqueror($package)) return $r;
205
		} elseif (stripos($ua, "Opera") !== FALSE) {
206
			$package['is_browser'] = true;
207
			require_once(BB2_CORE . "/browser.inc.php");
208
			if ($r = bb2_opera($package)) return $r;
209
		} elseif (stripos($ua, "Safari") !== FALSE) {
210
			$package['is_browser'] = true;
211
			require_once(BB2_CORE . "/browser.inc.php");
212
			if ($r = bb2_safari($package)) return $r;
213
		} elseif (stripos($ua, "Lynx") !== FALSE) {
214
			$package['is_browser'] = true;
215
			require_once(BB2_CORE . "/browser.inc.php");
216
			if ($r = bb2_lynx($package)) return $r;
217
		} elseif (stripos($ua, "MovableType") !== FALSE) {
218
			require_once(BB2_CORE . "/movabletype.inc.php");
219
			if ($r = bb2_movabletype($package)) return $r;
220
		} elseif (stripos($ua, "Mozilla") !== FALSE && stripos($ua, "Mozilla") == 0) {
221
			$package['is_browser'] = true;
222
			require_once(BB2_CORE . "/browser.inc.php");
223
			if ($r = bb2_mozilla($package)) return $r;
224
		}
225
226
		// More intensive screening applies to POST requests
227
		if (!strcasecmp('POST', $package['request_method'])) {
228
			require_once(BB2_CORE . "/post.inc.php");
229
			if ($r = bb2_post($settings, $package)) return $r;
230
		}
231
	}
232
233
	// And that's about it.
234
	bb2_approved($settings, $package);
235
	return false;
236
}
237