@@ -15,11 +15,11 @@ |
||
| 15 | 15 | */ |
| 16 | 16 | class ApiException extends Exception |
| 17 | 17 | { |
| 18 | - /** |
|
| 19 | - * @param string $message |
|
| 20 | - */ |
|
| 21 | - public function __construct($message) |
|
| 22 | - { |
|
| 23 | - $this->message = $message; |
|
| 24 | - } |
|
| 18 | + /** |
|
| 19 | + * @param string $message |
|
| 20 | + */ |
|
| 21 | + public function __construct($message) |
|
| 22 | + { |
|
| 23 | + $this->message = $message; |
|
| 24 | + } |
|
| 25 | 25 | } |
@@ -10,96 +10,96 @@ |
||
| 10 | 10 | |
| 11 | 11 | class AuthUtility |
| 12 | 12 | { |
| 13 | - /** |
|
| 14 | - * Test the specified data against the specified credentials |
|
| 15 | - * |
|
| 16 | - * @param string $password |
|
| 17 | - * @param string $credentials |
|
| 18 | - * |
|
| 19 | - * @return bool |
|
| 20 | - */ |
|
| 21 | - public static function testCredentials($password, $credentials) |
|
| 22 | - { |
|
| 23 | - global $minimumPasswordVersion; |
|
| 13 | + /** |
|
| 14 | + * Test the specified data against the specified credentials |
|
| 15 | + * |
|
| 16 | + * @param string $password |
|
| 17 | + * @param string $credentials |
|
| 18 | + * |
|
| 19 | + * @return bool |
|
| 20 | + */ |
|
| 21 | + public static function testCredentials($password, $credentials) |
|
| 22 | + { |
|
| 23 | + global $minimumPasswordVersion; |
|
| 24 | 24 | |
| 25 | - if (substr($credentials, 0, 1) != ":") { |
|
| 26 | - return false; |
|
| 27 | - } |
|
| 25 | + if (substr($credentials, 0, 1) != ":") { |
|
| 26 | + return false; |
|
| 27 | + } |
|
| 28 | 28 | |
| 29 | - // determine password version |
|
| 30 | - $data = explode(':', substr($credentials, 1)); |
|
| 29 | + // determine password version |
|
| 30 | + $data = explode(':', substr($credentials, 1)); |
|
| 31 | 31 | |
| 32 | - // call the encryptVersion function for the version that this password actually is. |
|
| 33 | - // syntax: :1:SALT:HASH |
|
| 34 | - // syntax: :2:x:HASH |
|
| 32 | + // call the encryptVersion function for the version that this password actually is. |
|
| 33 | + // syntax: :1:SALT:HASH |
|
| 34 | + // syntax: :2:x:HASH |
|
| 35 | 35 | |
| 36 | - // check the version is one of the allowed ones: |
|
| 37 | - if ($minimumPasswordVersion > $data[0]) { |
|
| 38 | - return false; |
|
| 39 | - } |
|
| 36 | + // check the version is one of the allowed ones: |
|
| 37 | + if ($minimumPasswordVersion > $data[0]) { |
|
| 38 | + return false; |
|
| 39 | + } |
|
| 40 | 40 | |
| 41 | - if ($data[0] == 1) { |
|
| 42 | - return $credentials == self::encryptVersion1($password, $data[1]); |
|
| 43 | - } |
|
| 41 | + if ($data[0] == 1) { |
|
| 42 | + return $credentials == self::encryptVersion1($password, $data[1]); |
|
| 43 | + } |
|
| 44 | 44 | |
| 45 | - if ($data[0] == 2) { |
|
| 46 | - return self::verifyVersion2($password, $data[2]); |
|
| 47 | - } |
|
| 45 | + if ($data[0] == 2) { |
|
| 46 | + return self::verifyVersion2($password, $data[2]); |
|
| 47 | + } |
|
| 48 | 48 | |
| 49 | - return false; |
|
| 50 | - } |
|
| 49 | + return false; |
|
| 50 | + } |
|
| 51 | 51 | |
| 52 | - /** |
|
| 53 | - * @param string $credentials |
|
| 54 | - * |
|
| 55 | - * @return bool |
|
| 56 | - */ |
|
| 57 | - public static function isCredentialVersionLatest($credentials) |
|
| 58 | - { |
|
| 59 | - return substr($credentials, 0, 3) === ":2:"; |
|
| 60 | - } |
|
| 52 | + /** |
|
| 53 | + * @param string $credentials |
|
| 54 | + * |
|
| 55 | + * @return bool |
|
| 56 | + */ |
|
| 57 | + public static function isCredentialVersionLatest($credentials) |
|
| 58 | + { |
|
| 59 | + return substr($credentials, 0, 3) === ":2:"; |
|
| 60 | + } |
|
| 61 | 61 | |
| 62 | - /** |
|
| 63 | - * Encrypts a user's password with the latest version of the hash algorithm |
|
| 64 | - * |
|
| 65 | - * @param string $password |
|
| 66 | - * |
|
| 67 | - * @return string |
|
| 68 | - */ |
|
| 69 | - public static function encryptPassword($password) |
|
| 70 | - { |
|
| 71 | - return self::encryptVersion2($password); |
|
| 72 | - } |
|
| 62 | + /** |
|
| 63 | + * Encrypts a user's password with the latest version of the hash algorithm |
|
| 64 | + * |
|
| 65 | + * @param string $password |
|
| 66 | + * |
|
| 67 | + * @return string |
|
| 68 | + */ |
|
| 69 | + public static function encryptPassword($password) |
|
| 70 | + { |
|
| 71 | + return self::encryptVersion2($password); |
|
| 72 | + } |
|
| 73 | 73 | |
| 74 | - /** |
|
| 75 | - * @param string $password |
|
| 76 | - * @param string $salt |
|
| 77 | - * |
|
| 78 | - * @return string |
|
| 79 | - */ |
|
| 80 | - private static function encryptVersion1($password, $salt) |
|
| 81 | - { |
|
| 82 | - return ':1:' . $salt . ':' . md5($salt . '-' . md5($password)); |
|
| 83 | - } |
|
| 74 | + /** |
|
| 75 | + * @param string $password |
|
| 76 | + * @param string $salt |
|
| 77 | + * |
|
| 78 | + * @return string |
|
| 79 | + */ |
|
| 80 | + private static function encryptVersion1($password, $salt) |
|
| 81 | + { |
|
| 82 | + return ':1:' . $salt . ':' . md5($salt . '-' . md5($password)); |
|
| 83 | + } |
|
| 84 | 84 | |
| 85 | - /** |
|
| 86 | - * @param string $password |
|
| 87 | - * |
|
| 88 | - * @return string |
|
| 89 | - */ |
|
| 90 | - private static function encryptVersion2($password) |
|
| 91 | - { |
|
| 92 | - return ':2:x:' . password_hash($password, PASSWORD_BCRYPT); |
|
| 93 | - } |
|
| 85 | + /** |
|
| 86 | + * @param string $password |
|
| 87 | + * |
|
| 88 | + * @return string |
|
| 89 | + */ |
|
| 90 | + private static function encryptVersion2($password) |
|
| 91 | + { |
|
| 92 | + return ':2:x:' . password_hash($password, PASSWORD_BCRYPT); |
|
| 93 | + } |
|
| 94 | 94 | |
| 95 | - /** |
|
| 96 | - * @param string $password |
|
| 97 | - * @param string $hash |
|
| 98 | - * |
|
| 99 | - * @return bool |
|
| 100 | - */ |
|
| 101 | - private static function verifyVersion2($password, $hash) |
|
| 102 | - { |
|
| 103 | - return password_verify($password, $hash); |
|
| 104 | - } |
|
| 95 | + /** |
|
| 96 | + * @param string $password |
|
| 97 | + * @param string $hash |
|
| 98 | + * |
|
| 99 | + * @return bool |
|
| 100 | + */ |
|
| 101 | + private static function verifyVersion2($password, $hash) |
|
| 102 | + { |
|
| 103 | + return password_verify($password, $hash); |
|
| 104 | + } |
|
| 105 | 105 | } |
@@ -79,7 +79,7 @@ discard block |
||
| 79 | 79 | */ |
| 80 | 80 | private static function encryptVersion1($password, $salt) |
| 81 | 81 | { |
| 82 | - return ':1:' . $salt . ':' . md5($salt . '-' . md5($password)); |
|
| 82 | + return ':1:'.$salt.':'.md5($salt.'-'.md5($password)); |
|
| 83 | 83 | } |
| 84 | 84 | |
| 85 | 85 | /** |
@@ -89,7 +89,7 @@ discard block |
||
| 89 | 89 | */ |
| 90 | 90 | private static function encryptVersion2($password) |
| 91 | 91 | { |
| 92 | - return ':2:x:' . password_hash($password, PASSWORD_BCRYPT); |
|
| 92 | + return ':2:x:'.password_hash($password, PASSWORD_BCRYPT); |
|
| 93 | 93 | } |
| 94 | 94 | |
| 95 | 95 | /** |
@@ -22,77 +22,77 @@ |
||
| 22 | 22 | */ |
| 23 | 23 | class CachedApiAntispoofProvider implements IAntiSpoofProvider |
| 24 | 24 | { |
| 25 | - /** |
|
| 26 | - * @var PdoDatabase |
|
| 27 | - */ |
|
| 28 | - private $database; |
|
| 29 | - /** |
|
| 30 | - * @var string |
|
| 31 | - */ |
|
| 32 | - private $mediawikiWebServiceEndpoint; |
|
| 33 | - /** |
|
| 34 | - * @var HttpHelper |
|
| 35 | - */ |
|
| 36 | - private $httpHelper; |
|
| 25 | + /** |
|
| 26 | + * @var PdoDatabase |
|
| 27 | + */ |
|
| 28 | + private $database; |
|
| 29 | + /** |
|
| 30 | + * @var string |
|
| 31 | + */ |
|
| 32 | + private $mediawikiWebServiceEndpoint; |
|
| 33 | + /** |
|
| 34 | + * @var HttpHelper |
|
| 35 | + */ |
|
| 36 | + private $httpHelper; |
|
| 37 | 37 | |
| 38 | - public function __construct(PdoDatabase $database, $mediawikiWebServiceEndpoint, HttpHelper $httpHelper) |
|
| 39 | - { |
|
| 40 | - $this->database = $database; |
|
| 41 | - $this->mediawikiWebServiceEndpoint = $mediawikiWebServiceEndpoint; |
|
| 42 | - $this->httpHelper = $httpHelper; |
|
| 43 | - } |
|
| 38 | + public function __construct(PdoDatabase $database, $mediawikiWebServiceEndpoint, HttpHelper $httpHelper) |
|
| 39 | + { |
|
| 40 | + $this->database = $database; |
|
| 41 | + $this->mediawikiWebServiceEndpoint = $mediawikiWebServiceEndpoint; |
|
| 42 | + $this->httpHelper = $httpHelper; |
|
| 43 | + } |
|
| 44 | 44 | |
| 45 | - public function getSpoofs($username) |
|
| 46 | - { |
|
| 47 | - /** @var AntiSpoofCache $cacheResult */ |
|
| 48 | - $cacheResult = AntiSpoofCache::getByUsername($username, $this->database); |
|
| 49 | - if ($cacheResult == false) { |
|
| 50 | - // get the data from the API |
|
| 51 | - $data = $this->httpHelper->get($this->mediawikiWebServiceEndpoint, array( |
|
| 52 | - 'action' => 'antispoof', |
|
| 53 | - 'format' => 'php', |
|
| 54 | - 'username' => $username, |
|
| 55 | - )); |
|
| 45 | + public function getSpoofs($username) |
|
| 46 | + { |
|
| 47 | + /** @var AntiSpoofCache $cacheResult */ |
|
| 48 | + $cacheResult = AntiSpoofCache::getByUsername($username, $this->database); |
|
| 49 | + if ($cacheResult == false) { |
|
| 50 | + // get the data from the API |
|
| 51 | + $data = $this->httpHelper->get($this->mediawikiWebServiceEndpoint, array( |
|
| 52 | + 'action' => 'antispoof', |
|
| 53 | + 'format' => 'php', |
|
| 54 | + 'username' => $username, |
|
| 55 | + )); |
|
| 56 | 56 | |
| 57 | - $cacheEntry = new AntiSpoofCache(); |
|
| 58 | - $cacheEntry->setDatabase($this->database); |
|
| 59 | - $cacheEntry->setUsername($username); |
|
| 60 | - $cacheEntry->setData($data); |
|
| 61 | - $cacheEntry->save(); |
|
| 57 | + $cacheEntry = new AntiSpoofCache(); |
|
| 58 | + $cacheEntry->setDatabase($this->database); |
|
| 59 | + $cacheEntry->setUsername($username); |
|
| 60 | + $cacheEntry->setData($data); |
|
| 61 | + $cacheEntry->save(); |
|
| 62 | 62 | |
| 63 | - $cacheResult = $cacheEntry; |
|
| 64 | - } |
|
| 65 | - else { |
|
| 66 | - $data = $cacheResult->getData(); |
|
| 67 | - } |
|
| 63 | + $cacheResult = $cacheEntry; |
|
| 64 | + } |
|
| 65 | + else { |
|
| 66 | + $data = $cacheResult->getData(); |
|
| 67 | + } |
|
| 68 | 68 | |
| 69 | - $result = unserialize($data); |
|
| 69 | + $result = unserialize($data); |
|
| 70 | 70 | |
| 71 | - if (!isset($result['antispoof']) || !isset($result['antispoof']['result'])) { |
|
| 72 | - $cacheResult->delete(); |
|
| 71 | + if (!isset($result['antispoof']) || !isset($result['antispoof']['result'])) { |
|
| 72 | + $cacheResult->delete(); |
|
| 73 | 73 | |
| 74 | - if (isset($result['error']['info'])) { |
|
| 75 | - throw new Exception("Unrecognised API response to query: " . $result['error']['info']); |
|
| 76 | - } |
|
| 74 | + if (isset($result['error']['info'])) { |
|
| 75 | + throw new Exception("Unrecognised API response to query: " . $result['error']['info']); |
|
| 76 | + } |
|
| 77 | 77 | |
| 78 | - throw new Exception("Unrecognised API response to query."); |
|
| 79 | - } |
|
| 78 | + throw new Exception("Unrecognised API response to query."); |
|
| 79 | + } |
|
| 80 | 80 | |
| 81 | - if ($result['antispoof']['result'] == "pass") { |
|
| 82 | - // All good here! |
|
| 83 | - return array(); |
|
| 84 | - } |
|
| 81 | + if ($result['antispoof']['result'] == "pass") { |
|
| 82 | + // All good here! |
|
| 83 | + return array(); |
|
| 84 | + } |
|
| 85 | 85 | |
| 86 | - if ($result['antispoof']['result'] == "conflict") { |
|
| 87 | - // we've got conflicts, let's do something with them. |
|
| 88 | - return $result['antispoof']['users']; |
|
| 89 | - } |
|
| 86 | + if ($result['antispoof']['result'] == "conflict") { |
|
| 87 | + // we've got conflicts, let's do something with them. |
|
| 88 | + return $result['antispoof']['users']; |
|
| 89 | + } |
|
| 90 | 90 | |
| 91 | - if ($result['antispoof']['result'] == "error") { |
|
| 92 | - // we've got conflicts, let's do something with them. |
|
| 93 | - throw new Exception("Encountered error while getting result: " . $result['antispoof']['error']); |
|
| 94 | - } |
|
| 91 | + if ($result['antispoof']['result'] == "error") { |
|
| 92 | + // we've got conflicts, let's do something with them. |
|
| 93 | + throw new Exception("Encountered error while getting result: " . $result['antispoof']['error']); |
|
| 94 | + } |
|
| 95 | 95 | |
| 96 | - throw new Exception("Unrecognised API response to query."); |
|
| 97 | - } |
|
| 96 | + throw new Exception("Unrecognised API response to query."); |
|
| 97 | + } |
|
| 98 | 98 | } |
@@ -72,7 +72,7 @@ discard block |
||
| 72 | 72 | $cacheResult->delete(); |
| 73 | 73 | |
| 74 | 74 | if (isset($result['error']['info'])) { |
| 75 | - throw new Exception("Unrecognised API response to query: " . $result['error']['info']); |
|
| 75 | + throw new Exception("Unrecognised API response to query: ".$result['error']['info']); |
|
| 76 | 76 | } |
| 77 | 77 | |
| 78 | 78 | throw new Exception("Unrecognised API response to query."); |
@@ -90,7 +90,7 @@ discard block |
||
| 90 | 90 | |
| 91 | 91 | if ($result['antispoof']['result'] == "error") { |
| 92 | 92 | // we've got conflicts, let's do something with them. |
| 93 | - throw new Exception("Encountered error while getting result: " . $result['antispoof']['error']); |
|
| 93 | + throw new Exception("Encountered error while getting result: ".$result['antispoof']['error']); |
|
| 94 | 94 | } |
| 95 | 95 | |
| 96 | 96 | throw new Exception("Unrecognised API response to query."); |
@@ -22,156 +22,156 @@ |
||
| 22 | 22 | */ |
| 23 | 23 | class XffTrustProvider implements IXffTrustProvider |
| 24 | 24 | { |
| 25 | - /** |
|
| 26 | - * Array of IP addresses which are TRUSTED proxies |
|
| 27 | - * @var string[] |
|
| 28 | - */ |
|
| 29 | - private $trustedCache = array(); |
|
| 30 | - /** |
|
| 31 | - * Array of IP addresses which are UNTRUSTED proxies |
|
| 32 | - * @var string[] |
|
| 33 | - */ |
|
| 34 | - private $untrustedCache = array(); |
|
| 35 | - /** @var PDOStatement */ |
|
| 36 | - private $trustedQuery; |
|
| 37 | - /** |
|
| 38 | - * @var PdoDatabase |
|
| 39 | - */ |
|
| 40 | - private $database; |
|
| 41 | - |
|
| 42 | - /** |
|
| 43 | - * Creates a new instance of the trust provider |
|
| 44 | - * |
|
| 45 | - * @param string[] $squidIpList List of IP addresses to pre-approve |
|
| 46 | - * @param PdoDatabase $database |
|
| 47 | - */ |
|
| 48 | - public function __construct($squidIpList, PdoDatabase $database) |
|
| 49 | - { |
|
| 50 | - $this->trustedCache = $squidIpList; |
|
| 51 | - $this->database = $database; |
|
| 52 | - } |
|
| 53 | - |
|
| 54 | - /** |
|
| 55 | - * Returns a value if the IP address is a trusted proxy |
|
| 56 | - * |
|
| 57 | - * @param string $ip |
|
| 58 | - * |
|
| 59 | - * @return bool |
|
| 60 | - */ |
|
| 61 | - public function isTrusted($ip) |
|
| 62 | - { |
|
| 63 | - if (in_array($ip, $this->trustedCache)) { |
|
| 64 | - return true; |
|
| 65 | - } |
|
| 66 | - |
|
| 67 | - if (in_array($ip, $this->untrustedCache)) { |
|
| 68 | - return false; |
|
| 69 | - } |
|
| 70 | - |
|
| 71 | - if ($this->trustedQuery === null) { |
|
| 72 | - $query = "SELECT COUNT(id) FROM xfftrustcache WHERE ip = :ip;"; |
|
| 73 | - $this->trustedQuery = $this->database->prepare($query); |
|
| 74 | - } |
|
| 75 | - |
|
| 76 | - $this->trustedQuery->execute(array(":ip" => $ip)); |
|
| 77 | - $result = $this->trustedQuery->fetchColumn(); |
|
| 78 | - $this->trustedQuery->closeCursor(); |
|
| 79 | - |
|
| 80 | - if ($result == 0) { |
|
| 81 | - $this->untrustedCache[] = $ip; |
|
| 82 | - |
|
| 83 | - return false; |
|
| 84 | - } |
|
| 85 | - |
|
| 86 | - if ($result >= 1) { |
|
| 87 | - $this->trustedCache[] = $ip; |
|
| 88 | - |
|
| 89 | - return true; |
|
| 90 | - } |
|
| 91 | - |
|
| 92 | - // something weird has happened if we've got here. |
|
| 93 | - // default to untrusted. |
|
| 94 | - return false; |
|
| 95 | - } |
|
| 96 | - |
|
| 97 | - /** |
|
| 98 | - * Gets the last trusted IP in the proxy chain. |
|
| 99 | - * |
|
| 100 | - * @param string $ip The IP address from REMOTE_ADDR |
|
| 101 | - * @param string $proxyIp The contents of the XFF header. |
|
| 102 | - * |
|
| 103 | - * @return string Trusted source IP address |
|
| 104 | - */ |
|
| 105 | - public function getTrustedClientIp($ip, $proxyIp) |
|
| 106 | - { |
|
| 107 | - $clientIpAddress = $ip; |
|
| 108 | - if ($proxyIp) { |
|
| 109 | - $ipList = explode(",", $proxyIp); |
|
| 110 | - $ipList[] = $clientIpAddress; |
|
| 111 | - $ipList = array_reverse($ipList); |
|
| 112 | - |
|
| 113 | - foreach ($ipList as $ipNumber => $ipAddress) { |
|
| 114 | - if ($this->isTrusted(trim($ipAddress)) && $ipNumber < (count($ipList) - 1)) { |
|
| 115 | - continue; |
|
| 116 | - } |
|
| 117 | - |
|
| 118 | - $clientIpAddress = $ipAddress; |
|
| 119 | - break; |
|
| 120 | - } |
|
| 121 | - } |
|
| 122 | - |
|
| 123 | - return $clientIpAddress; |
|
| 124 | - } |
|
| 125 | - |
|
| 126 | - /** |
|
| 127 | - * Takes an array( "low" => "high" ) values, and returns true if $needle is in at least one of them. |
|
| 128 | - * |
|
| 129 | - * @param array $haystack |
|
| 130 | - * @param string $ip |
|
| 131 | - * |
|
| 132 | - * @return bool |
|
| 133 | - */ |
|
| 134 | - public function ipInRange($haystack, $ip) |
|
| 135 | - { |
|
| 136 | - $needle = ip2long($ip); |
|
| 137 | - |
|
| 138 | - foreach ($haystack as $low => $high) { |
|
| 139 | - if (ip2long($low) <= $needle && ip2long($high) >= $needle) { |
|
| 140 | - return true; |
|
| 141 | - } |
|
| 142 | - } |
|
| 143 | - |
|
| 144 | - return false; |
|
| 145 | - } |
|
| 146 | - |
|
| 147 | - /** |
|
| 148 | - * Explodes a CIDR range into an array of addresses |
|
| 149 | - * |
|
| 150 | - * @param string $range A CIDR-format range |
|
| 151 | - * |
|
| 152 | - * @return array An array containing every IP address in the range |
|
| 153 | - */ |
|
| 154 | - public function explodeCidr($range) |
|
| 155 | - { |
|
| 156 | - $cidrData = explode('/', $range); |
|
| 157 | - |
|
| 158 | - if (!isset($cidrData[1])) { |
|
| 159 | - return array($range); |
|
| 160 | - } |
|
| 161 | - |
|
| 162 | - $blow = ( |
|
| 163 | - str_pad(decbin(ip2long($cidrData[0])), 32, "0", STR_PAD_LEFT) & |
|
| 164 | - str_pad(str_pad("", $cidrData[1], "1"), 32, "0") |
|
| 165 | - ); |
|
| 166 | - $bhigh = ($blow | str_pad(str_pad("", $cidrData[1], "0"), 32, "1")); |
|
| 167 | - |
|
| 168 | - $list = array(); |
|
| 169 | - |
|
| 170 | - $bindecBHigh = bindec($bhigh); |
|
| 171 | - for ($x = bindec($blow); $x <= $bindecBHigh; $x++) { |
|
| 172 | - $list[] = long2ip($x); |
|
| 173 | - } |
|
| 174 | - |
|
| 175 | - return $list; |
|
| 176 | - } |
|
| 25 | + /** |
|
| 26 | + * Array of IP addresses which are TRUSTED proxies |
|
| 27 | + * @var string[] |
|
| 28 | + */ |
|
| 29 | + private $trustedCache = array(); |
|
| 30 | + /** |
|
| 31 | + * Array of IP addresses which are UNTRUSTED proxies |
|
| 32 | + * @var string[] |
|
| 33 | + */ |
|
| 34 | + private $untrustedCache = array(); |
|
| 35 | + /** @var PDOStatement */ |
|
| 36 | + private $trustedQuery; |
|
| 37 | + /** |
|
| 38 | + * @var PdoDatabase |
|
| 39 | + */ |
|
| 40 | + private $database; |
|
| 41 | + |
|
| 42 | + /** |
|
| 43 | + * Creates a new instance of the trust provider |
|
| 44 | + * |
|
| 45 | + * @param string[] $squidIpList List of IP addresses to pre-approve |
|
| 46 | + * @param PdoDatabase $database |
|
| 47 | + */ |
|
| 48 | + public function __construct($squidIpList, PdoDatabase $database) |
|
| 49 | + { |
|
| 50 | + $this->trustedCache = $squidIpList; |
|
| 51 | + $this->database = $database; |
|
| 52 | + } |
|
| 53 | + |
|
| 54 | + /** |
|
| 55 | + * Returns a value if the IP address is a trusted proxy |
|
| 56 | + * |
|
| 57 | + * @param string $ip |
|
| 58 | + * |
|
| 59 | + * @return bool |
|
| 60 | + */ |
|
| 61 | + public function isTrusted($ip) |
|
| 62 | + { |
|
| 63 | + if (in_array($ip, $this->trustedCache)) { |
|
| 64 | + return true; |
|
| 65 | + } |
|
| 66 | + |
|
| 67 | + if (in_array($ip, $this->untrustedCache)) { |
|
| 68 | + return false; |
|
| 69 | + } |
|
| 70 | + |
|
| 71 | + if ($this->trustedQuery === null) { |
|
| 72 | + $query = "SELECT COUNT(id) FROM xfftrustcache WHERE ip = :ip;"; |
|
| 73 | + $this->trustedQuery = $this->database->prepare($query); |
|
| 74 | + } |
|
| 75 | + |
|
| 76 | + $this->trustedQuery->execute(array(":ip" => $ip)); |
|
| 77 | + $result = $this->trustedQuery->fetchColumn(); |
|
| 78 | + $this->trustedQuery->closeCursor(); |
|
| 79 | + |
|
| 80 | + if ($result == 0) { |
|
| 81 | + $this->untrustedCache[] = $ip; |
|
| 82 | + |
|
| 83 | + return false; |
|
| 84 | + } |
|
| 85 | + |
|
| 86 | + if ($result >= 1) { |
|
| 87 | + $this->trustedCache[] = $ip; |
|
| 88 | + |
|
| 89 | + return true; |
|
| 90 | + } |
|
| 91 | + |
|
| 92 | + // something weird has happened if we've got here. |
|
| 93 | + // default to untrusted. |
|
| 94 | + return false; |
|
| 95 | + } |
|
| 96 | + |
|
| 97 | + /** |
|
| 98 | + * Gets the last trusted IP in the proxy chain. |
|
| 99 | + * |
|
| 100 | + * @param string $ip The IP address from REMOTE_ADDR |
|
| 101 | + * @param string $proxyIp The contents of the XFF header. |
|
| 102 | + * |
|
| 103 | + * @return string Trusted source IP address |
|
| 104 | + */ |
|
| 105 | + public function getTrustedClientIp($ip, $proxyIp) |
|
| 106 | + { |
|
| 107 | + $clientIpAddress = $ip; |
|
| 108 | + if ($proxyIp) { |
|
| 109 | + $ipList = explode(",", $proxyIp); |
|
| 110 | + $ipList[] = $clientIpAddress; |
|
| 111 | + $ipList = array_reverse($ipList); |
|
| 112 | + |
|
| 113 | + foreach ($ipList as $ipNumber => $ipAddress) { |
|
| 114 | + if ($this->isTrusted(trim($ipAddress)) && $ipNumber < (count($ipList) - 1)) { |
|
| 115 | + continue; |
|
| 116 | + } |
|
| 117 | + |
|
| 118 | + $clientIpAddress = $ipAddress; |
|
| 119 | + break; |
|
| 120 | + } |
|
| 121 | + } |
|
| 122 | + |
|
| 123 | + return $clientIpAddress; |
|
| 124 | + } |
|
| 125 | + |
|
| 126 | + /** |
|
| 127 | + * Takes an array( "low" => "high" ) values, and returns true if $needle is in at least one of them. |
|
| 128 | + * |
|
| 129 | + * @param array $haystack |
|
| 130 | + * @param string $ip |
|
| 131 | + * |
|
| 132 | + * @return bool |
|
| 133 | + */ |
|
| 134 | + public function ipInRange($haystack, $ip) |
|
| 135 | + { |
|
| 136 | + $needle = ip2long($ip); |
|
| 137 | + |
|
| 138 | + foreach ($haystack as $low => $high) { |
|
| 139 | + if (ip2long($low) <= $needle && ip2long($high) >= $needle) { |
|
| 140 | + return true; |
|
| 141 | + } |
|
| 142 | + } |
|
| 143 | + |
|
| 144 | + return false; |
|
| 145 | + } |
|
| 146 | + |
|
| 147 | + /** |
|
| 148 | + * Explodes a CIDR range into an array of addresses |
|
| 149 | + * |
|
| 150 | + * @param string $range A CIDR-format range |
|
| 151 | + * |
|
| 152 | + * @return array An array containing every IP address in the range |
|
| 153 | + */ |
|
| 154 | + public function explodeCidr($range) |
|
| 155 | + { |
|
| 156 | + $cidrData = explode('/', $range); |
|
| 157 | + |
|
| 158 | + if (!isset($cidrData[1])) { |
|
| 159 | + return array($range); |
|
| 160 | + } |
|
| 161 | + |
|
| 162 | + $blow = ( |
|
| 163 | + str_pad(decbin(ip2long($cidrData[0])), 32, "0", STR_PAD_LEFT) & |
|
| 164 | + str_pad(str_pad("", $cidrData[1], "1"), 32, "0") |
|
| 165 | + ); |
|
| 166 | + $bhigh = ($blow | str_pad(str_pad("", $cidrData[1], "0"), 32, "1")); |
|
| 167 | + |
|
| 168 | + $list = array(); |
|
| 169 | + |
|
| 170 | + $bindecBHigh = bindec($bhigh); |
|
| 171 | + for ($x = bindec($blow); $x <= $bindecBHigh; $x++) { |
|
| 172 | + $list[] = long2ip($x); |
|
| 173 | + } |
|
| 174 | + |
|
| 175 | + return $list; |
|
| 176 | + } |
|
| 177 | 177 | } |
@@ -20,40 +20,40 @@ |
||
| 20 | 20 | */ |
| 21 | 21 | class CachedRDnsLookupProvider implements IRDnsProvider |
| 22 | 22 | { |
| 23 | - private $database; |
|
| 23 | + private $database; |
|
| 24 | 24 | |
| 25 | - public function __construct(PdoDatabase $database) |
|
| 26 | - { |
|
| 27 | - $this->database = $database; |
|
| 28 | - } |
|
| 25 | + public function __construct(PdoDatabase $database) |
|
| 26 | + { |
|
| 27 | + $this->database = $database; |
|
| 28 | + } |
|
| 29 | 29 | |
| 30 | - public function getReverseDNS($address) |
|
| 31 | - { |
|
| 32 | - $address = trim($address); |
|
| 30 | + public function getReverseDNS($address) |
|
| 31 | + { |
|
| 32 | + $address = trim($address); |
|
| 33 | 33 | |
| 34 | - // lets look in our cache database first. |
|
| 35 | - $rDns = RDnsCache::getByAddress($address, $this->database); |
|
| 34 | + // lets look in our cache database first. |
|
| 35 | + $rDns = RDnsCache::getByAddress($address, $this->database); |
|
| 36 | 36 | |
| 37 | - if ($rDns instanceof RDnsCache) { |
|
| 38 | - // touch cache timer |
|
| 39 | - $rDns->save(); |
|
| 37 | + if ($rDns instanceof RDnsCache) { |
|
| 38 | + // touch cache timer |
|
| 39 | + $rDns->save(); |
|
| 40 | 40 | |
| 41 | - return $rDns->getData(); |
|
| 42 | - } |
|
| 41 | + return $rDns->getData(); |
|
| 42 | + } |
|
| 43 | 43 | |
| 44 | - // OK, it's not there, let's do an rDNS lookup. |
|
| 45 | - $result = @ gethostbyaddr($address); |
|
| 44 | + // OK, it's not there, let's do an rDNS lookup. |
|
| 45 | + $result = @ gethostbyaddr($address); |
|
| 46 | 46 | |
| 47 | - if ($result !== false) { |
|
| 48 | - $rDns = new RDnsCache(); |
|
| 49 | - $rDns->setDatabase($this->database); |
|
| 50 | - $rDns->setAddress($address); |
|
| 51 | - $rDns->setData($result); |
|
| 52 | - $rDns->save(); |
|
| 47 | + if ($result !== false) { |
|
| 48 | + $rDns = new RDnsCache(); |
|
| 49 | + $rDns->setDatabase($this->database); |
|
| 50 | + $rDns->setAddress($address); |
|
| 51 | + $rDns->setData($result); |
|
| 52 | + $rDns->save(); |
|
| 53 | 53 | |
| 54 | - return $result; |
|
| 55 | - } |
|
| 54 | + return $result; |
|
| 55 | + } |
|
| 56 | 56 | |
| 57 | - return null; |
|
| 58 | - } |
|
| 57 | + return null; |
|
| 58 | + } |
|
| 59 | 59 | } |
@@ -18,35 +18,35 @@ |
||
| 18 | 18 | */ |
| 19 | 19 | class GlobalStateProvider implements IGlobalStateProvider |
| 20 | 20 | { |
| 21 | - /** |
|
| 22 | - * @return array |
|
| 23 | - */ |
|
| 24 | - public function &getServerSuperGlobal() |
|
| 25 | - { |
|
| 26 | - return $_SERVER; |
|
| 27 | - } |
|
| 21 | + /** |
|
| 22 | + * @return array |
|
| 23 | + */ |
|
| 24 | + public function &getServerSuperGlobal() |
|
| 25 | + { |
|
| 26 | + return $_SERVER; |
|
| 27 | + } |
|
| 28 | 28 | |
| 29 | - /** |
|
| 30 | - * @return array |
|
| 31 | - */ |
|
| 32 | - public function &getGetSuperGlobal() |
|
| 33 | - { |
|
| 34 | - return $_GET; |
|
| 35 | - } |
|
| 29 | + /** |
|
| 30 | + * @return array |
|
| 31 | + */ |
|
| 32 | + public function &getGetSuperGlobal() |
|
| 33 | + { |
|
| 34 | + return $_GET; |
|
| 35 | + } |
|
| 36 | 36 | |
| 37 | - /** |
|
| 38 | - * @return array |
|
| 39 | - */ |
|
| 40 | - public function &getPostSuperGlobal() |
|
| 41 | - { |
|
| 42 | - return $_POST; |
|
| 43 | - } |
|
| 37 | + /** |
|
| 38 | + * @return array |
|
| 39 | + */ |
|
| 40 | + public function &getPostSuperGlobal() |
|
| 41 | + { |
|
| 42 | + return $_POST; |
|
| 43 | + } |
|
| 44 | 44 | |
| 45 | - /** |
|
| 46 | - * @return array |
|
| 47 | - */ |
|
| 48 | - public function &getSessionSuperGlobal() |
|
| 49 | - { |
|
| 50 | - return $_SESSION; |
|
| 51 | - } |
|
| 45 | + /** |
|
| 46 | + * @return array |
|
| 47 | + */ |
|
| 48 | + public function &getSessionSuperGlobal() |
|
| 49 | + { |
|
| 50 | + return $_SESSION; |
|
| 51 | + } |
|
| 52 | 52 | } |
| 53 | 53 | \ No newline at end of file |
@@ -14,23 +14,23 @@ |
||
| 14 | 14 | */ |
| 15 | 15 | interface IGlobalStateProvider |
| 16 | 16 | { |
| 17 | - /** |
|
| 18 | - * @return array |
|
| 19 | - */ |
|
| 20 | - public function getServerSuperGlobal(); |
|
| 17 | + /** |
|
| 18 | + * @return array |
|
| 19 | + */ |
|
| 20 | + public function getServerSuperGlobal(); |
|
| 21 | 21 | |
| 22 | - /** |
|
| 23 | - * @return array |
|
| 24 | - */ |
|
| 25 | - public function getGetSuperGlobal(); |
|
| 22 | + /** |
|
| 23 | + * @return array |
|
| 24 | + */ |
|
| 25 | + public function getGetSuperGlobal(); |
|
| 26 | 26 | |
| 27 | - /** |
|
| 28 | - * @return array |
|
| 29 | - */ |
|
| 30 | - public function getPostSuperGlobal(); |
|
| 27 | + /** |
|
| 28 | + * @return array |
|
| 29 | + */ |
|
| 30 | + public function getPostSuperGlobal(); |
|
| 31 | 31 | |
| 32 | - /** |
|
| 33 | - * @return array |
|
| 34 | - */ |
|
| 35 | - public function getSessionSuperGlobal(); |
|
| 32 | + /** |
|
| 33 | + * @return array |
|
| 34 | + */ |
|
| 35 | + public function getSessionSuperGlobal(); |
|
| 36 | 36 | } |
| 37 | 37 | \ No newline at end of file |
@@ -18,28 +18,28 @@ |
||
| 18 | 18 | */ |
| 19 | 19 | class FakeGlobalStateProvider extends GlobalStateProvider implements IGlobalStateProvider |
| 20 | 20 | { |
| 21 | - var $server = array(); |
|
| 22 | - var $get = array(); |
|
| 23 | - var $post = array(); |
|
| 24 | - var $session = array(); |
|
| 21 | + var $server = array(); |
|
| 22 | + var $get = array(); |
|
| 23 | + var $post = array(); |
|
| 24 | + var $session = array(); |
|
| 25 | 25 | |
| 26 | - public function &getServerSuperGlobal() |
|
| 27 | - { |
|
| 28 | - return $this->server; |
|
| 29 | - } |
|
| 26 | + public function &getServerSuperGlobal() |
|
| 27 | + { |
|
| 28 | + return $this->server; |
|
| 29 | + } |
|
| 30 | 30 | |
| 31 | - public function &getGetSuperGlobal() |
|
| 32 | - { |
|
| 33 | - return $this->get; |
|
| 34 | - } |
|
| 31 | + public function &getGetSuperGlobal() |
|
| 32 | + { |
|
| 33 | + return $this->get; |
|
| 34 | + } |
|
| 35 | 35 | |
| 36 | - public function &getPostSuperGlobal() |
|
| 37 | - { |
|
| 38 | - return $this->post; |
|
| 39 | - } |
|
| 36 | + public function &getPostSuperGlobal() |
|
| 37 | + { |
|
| 38 | + return $this->post; |
|
| 39 | + } |
|
| 40 | 40 | |
| 41 | - public function &getSessionSuperGlobal() |
|
| 42 | - { |
|
| 43 | - return $this->session; |
|
| 44 | - } |
|
| 41 | + public function &getSessionSuperGlobal() |
|
| 42 | + { |
|
| 43 | + return $this->session; |
|
| 44 | + } |
|
| 45 | 45 | } |
| 46 | 46 | \ No newline at end of file |
@@ -13,96 +13,96 @@ |
||
| 13 | 13 | |
| 14 | 14 | class TorExitProvider |
| 15 | 15 | { |
| 16 | - /** @var PdoDatabase */ |
|
| 17 | - private $database; |
|
| 18 | - |
|
| 19 | - /** |
|
| 20 | - * TorExitProvider constructor. |
|
| 21 | - * |
|
| 22 | - * @param PdoDatabase $database |
|
| 23 | - */ |
|
| 24 | - public function __construct(PdoDatabase $database) |
|
| 25 | - { |
|
| 26 | - $this->database = $database; |
|
| 27 | - } |
|
| 28 | - |
|
| 29 | - /** |
|
| 30 | - * Checks whether an IP address is a Tor exit node for one of the pre-cached IP addresses. |
|
| 31 | - * |
|
| 32 | - * @param string $ip IP Address |
|
| 33 | - * |
|
| 34 | - * @return bool |
|
| 35 | - */ |
|
| 36 | - public function isTorExit($ip) |
|
| 37 | - { |
|
| 38 | - $statement = $this->database->prepare('SELECT COUNT(1) FROM tornodecache WHERE ipaddr = :ip'); |
|
| 39 | - |
|
| 40 | - $statement->execute(array(':ip' => $ip)); |
|
| 41 | - |
|
| 42 | - $count = $statement->fetchColumn(); |
|
| 43 | - $statement->closeCursor(); |
|
| 44 | - |
|
| 45 | - if ($count > 0) { |
|
| 46 | - return true; |
|
| 47 | - } |
|
| 48 | - else { |
|
| 49 | - return false; |
|
| 50 | - } |
|
| 51 | - } |
|
| 52 | - |
|
| 53 | - public static function regenerate(PdoDatabase $database, HttpHelper $httpHelper, $destinationIps) |
|
| 54 | - { |
|
| 55 | - $query = <<<SQL |
|
| 16 | + /** @var PdoDatabase */ |
|
| 17 | + private $database; |
|
| 18 | + |
|
| 19 | + /** |
|
| 20 | + * TorExitProvider constructor. |
|
| 21 | + * |
|
| 22 | + * @param PdoDatabase $database |
|
| 23 | + */ |
|
| 24 | + public function __construct(PdoDatabase $database) |
|
| 25 | + { |
|
| 26 | + $this->database = $database; |
|
| 27 | + } |
|
| 28 | + |
|
| 29 | + /** |
|
| 30 | + * Checks whether an IP address is a Tor exit node for one of the pre-cached IP addresses. |
|
| 31 | + * |
|
| 32 | + * @param string $ip IP Address |
|
| 33 | + * |
|
| 34 | + * @return bool |
|
| 35 | + */ |
|
| 36 | + public function isTorExit($ip) |
|
| 37 | + { |
|
| 38 | + $statement = $this->database->prepare('SELECT COUNT(1) FROM tornodecache WHERE ipaddr = :ip'); |
|
| 39 | + |
|
| 40 | + $statement->execute(array(':ip' => $ip)); |
|
| 41 | + |
|
| 42 | + $count = $statement->fetchColumn(); |
|
| 43 | + $statement->closeCursor(); |
|
| 44 | + |
|
| 45 | + if ($count > 0) { |
|
| 46 | + return true; |
|
| 47 | + } |
|
| 48 | + else { |
|
| 49 | + return false; |
|
| 50 | + } |
|
| 51 | + } |
|
| 52 | + |
|
| 53 | + public static function regenerate(PdoDatabase $database, HttpHelper $httpHelper, $destinationIps) |
|
| 54 | + { |
|
| 55 | + $query = <<<SQL |
|
| 56 | 56 | INSERT INTO tornodecache (ipaddr, exitaddr, exitport) |
| 57 | 57 | VALUES (:ipaddr, :exitaddr, :exitport) |
| 58 | 58 | ON DUPLICATE KEY |
| 59 | 59 | UPDATE touched = CURRENT_TIMESTAMP, updateversion = updateversion + 1 |
| 60 | 60 | SQL; |
| 61 | 61 | |
| 62 | - $statement = $database->prepare($query); |
|
| 62 | + $statement = $database->prepare($query); |
|
| 63 | 63 | |
| 64 | - foreach ($destinationIps as $ip) { |
|
| 65 | - echo 'Fetching data for ' . $ip . PHP_EOL; |
|
| 64 | + foreach ($destinationIps as $ip) { |
|
| 65 | + echo 'Fetching data for ' . $ip . PHP_EOL; |
|
| 66 | 66 | |
| 67 | - $statement->bindValue(':exitaddr', $ip); |
|
| 67 | + $statement->bindValue(':exitaddr', $ip); |
|
| 68 | 68 | |
| 69 | - $http = $httpHelper->get( |
|
| 70 | - 'https://check.torproject.org/cgi-bin/TorBulkExitList.py', |
|
| 71 | - array( |
|
| 72 | - 'ip' => $ip, |
|
| 73 | - 'port' => 80, |
|
| 74 | - )); |
|
| 69 | + $http = $httpHelper->get( |
|
| 70 | + 'https://check.torproject.org/cgi-bin/TorBulkExitList.py', |
|
| 71 | + array( |
|
| 72 | + 'ip' => $ip, |
|
| 73 | + 'port' => 80, |
|
| 74 | + )); |
|
| 75 | 75 | |
| 76 | - $https = $httpHelper->get( |
|
| 77 | - 'https://check.torproject.org/cgi-bin/TorBulkExitList.py', |
|
| 78 | - array( |
|
| 79 | - 'ip' => $ip, |
|
| 80 | - 'port' => 443, |
|
| 81 | - )); |
|
| 76 | + $https = $httpHelper->get( |
|
| 77 | + 'https://check.torproject.org/cgi-bin/TorBulkExitList.py', |
|
| 78 | + array( |
|
| 79 | + 'ip' => $ip, |
|
| 80 | + 'port' => 443, |
|
| 81 | + )); |
|
| 82 | 82 | |
| 83 | - foreach (array(80 => $http, 443 => $https) as $port => $response) { |
|
| 84 | - echo ' Running for port ' . $ip . ':' . $port . PHP_EOL; |
|
| 83 | + foreach (array(80 => $http, 443 => $https) as $port => $response) { |
|
| 84 | + echo ' Running for port ' . $ip . ':' . $port . PHP_EOL; |
|
| 85 | 85 | |
| 86 | - $statement->bindValue(':exitport', $port); |
|
| 86 | + $statement->bindValue(':exitport', $port); |
|
| 87 | 87 | |
| 88 | - $lines = explode("\n", $response); |
|
| 88 | + $lines = explode("\n", $response); |
|
| 89 | 89 | |
| 90 | - foreach ($lines as $line) { |
|
| 91 | - // line contains a comment char, just skip the line. |
|
| 92 | - // This is OK as of 2016-04-06 --stw |
|
| 93 | - if (strpos($line, '#') !== false) { |
|
| 94 | - continue; |
|
| 95 | - } |
|
| 90 | + foreach ($lines as $line) { |
|
| 91 | + // line contains a comment char, just skip the line. |
|
| 92 | + // This is OK as of 2016-04-06 --stw |
|
| 93 | + if (strpos($line, '#') !== false) { |
|
| 94 | + continue; |
|
| 95 | + } |
|
| 96 | 96 | |
| 97 | - $statement->bindValue(':ipaddr', $line); |
|
| 98 | - $statement->execute(); |
|
| 99 | - } |
|
| 100 | - } |
|
| 97 | + $statement->bindValue(':ipaddr', $line); |
|
| 98 | + $statement->execute(); |
|
| 99 | + } |
|
| 100 | + } |
|
| 101 | 101 | |
| 102 | - echo 'Done for ' . $ip . PHP_EOL; |
|
| 103 | - } |
|
| 102 | + echo 'Done for ' . $ip . PHP_EOL; |
|
| 103 | + } |
|
| 104 | 104 | |
| 105 | - // kill old cached entries |
|
| 106 | - $database->exec('DELETE FROM tornodecache WHERE touched < DATE_SUB(CURRENT_TIMESTAMP, INTERVAL 1 DAY)'); |
|
| 107 | - } |
|
| 105 | + // kill old cached entries |
|
| 106 | + $database->exec('DELETE FROM tornodecache WHERE touched < DATE_SUB(CURRENT_TIMESTAMP, INTERVAL 1 DAY)'); |
|
| 107 | + } |
|
| 108 | 108 | } |
| 109 | 109 | \ No newline at end of file |
@@ -62,7 +62,7 @@ discard block |
||
| 62 | 62 | $statement = $database->prepare($query); |
| 63 | 63 | |
| 64 | 64 | foreach ($destinationIps as $ip) { |
| 65 | - echo 'Fetching data for ' . $ip . PHP_EOL; |
|
| 65 | + echo 'Fetching data for '.$ip.PHP_EOL; |
|
| 66 | 66 | |
| 67 | 67 | $statement->bindValue(':exitaddr', $ip); |
| 68 | 68 | |
@@ -81,7 +81,7 @@ discard block |
||
| 81 | 81 | )); |
| 82 | 82 | |
| 83 | 83 | foreach (array(80 => $http, 443 => $https) as $port => $response) { |
| 84 | - echo ' Running for port ' . $ip . ':' . $port . PHP_EOL; |
|
| 84 | + echo ' Running for port '.$ip.':'.$port.PHP_EOL; |
|
| 85 | 85 | |
| 86 | 86 | $statement->bindValue(':exitport', $port); |
| 87 | 87 | |
@@ -99,7 +99,7 @@ discard block |
||
| 99 | 99 | } |
| 100 | 100 | } |
| 101 | 101 | |
| 102 | - echo 'Done for ' . $ip . PHP_EOL; |
|
| 102 | + echo 'Done for '.$ip.PHP_EOL; |
|
| 103 | 103 | } |
| 104 | 104 | |
| 105 | 105 | // kill old cached entries |