@@ -26,17 +26,17 @@ discard block |
||
| 26 | 26 | |
| 27 | 27 | /* Conf */ |
| 28 | 28 | if (!isset($_GET['conf'])) { |
| 29 | - syslog(LOG_ALERT, |
|
| 30 | - sprintf('%s: you must insert the config file name as a GET parameter, such as %s?conf=listEmail.conf', |
|
| 31 | - $user, $_SERVER['SCRIPT_NAME']) ); |
|
| 32 | - exit(254); |
|
| 29 | + syslog(LOG_ALERT, |
|
| 30 | + sprintf('%s: you must insert the config file name as a GET parameter, such as %s?conf=listEmail.conf', |
|
| 31 | + $user, $_SERVER['SCRIPT_NAME']) ); |
|
| 32 | + exit(254); |
|
| 33 | 33 | } |
| 34 | 34 | $fileconf = $_GET['conf']; |
| 35 | 35 | if ( !file_exists(dirname(__FILE__) . '/../' . $fileconf) ) { |
| 36 | - syslog(LOG_ALERT, |
|
| 37 | - sprintf('%s: the configuration file <%s> doesn\'t exist.', |
|
| 38 | - $user, $fileconf )); |
|
| 39 | - exit(254); |
|
| 36 | + syslog(LOG_ALERT, |
|
| 37 | + sprintf('%s: the configuration file <%s> doesn\'t exist.', |
|
| 38 | + $user, $fileconf )); |
|
| 39 | + exit(254); |
|
| 40 | 40 | } |
| 41 | 41 | |
| 42 | 42 | closelog(); |
@@ -64,8 +64,8 @@ discard block |
||
| 64 | 64 | |
| 65 | 65 | /* check you select a blocklist */ |
| 66 | 66 | if ( !$tables["$typedesc"]['bl'] ) { |
| 67 | - syslog(LOG_EMERG,"$user: <$typedesc> is not a blocklist. Are you stupid? Do you want to whitelist a spammer? I refuse to continue."); |
|
| 68 | - exit (254); |
|
| 67 | + syslog(LOG_EMERG,"$user: <$typedesc> is not a blocklist. Are you stupid? Do you want to whitelist a spammer? I refuse to continue."); |
|
| 68 | + exit (254); |
|
| 69 | 69 | } |
| 70 | 70 | |
| 71 | 71 | |
@@ -95,15 +95,15 @@ discard block |
||
| 95 | 95 | if (preg_match_all('/^https?\:\/\/(?<splunkhost>[\w\.\-]+)\:8000(?:\/[\w\-\_\d]+)*\/app\/(?<splunkapp>[\w\.\-\_\d]+)\/\@go\?sid=(?<job>[\w\.\-\d]+)$/', |
| 96 | 96 | $webhook['results_link'], $out, PREG_PATTERN_ORDER) === FALSE) { |
| 97 | 97 | syslog(LOG_ALERT, |
| 98 | - sprintf('%s: unexpected error: can\'t parse the results link returned by webhook (<%s>).', |
|
| 98 | + sprintf('%s: unexpected error: can\'t parse the results link returned by webhook (<%s>).', |
|
| 99 | 99 | $user, $webhook['results_link']) ); |
| 100 | 100 | return 255; |
| 101 | 101 | } |
| 102 | 102 | |
| 103 | 103 | if ( $webhook['app'] != $out['splunkapp'][0] ) { |
| 104 | 104 | syslog(LOG_ALERT, |
| 105 | - sprintf('%s: unexpected error: the APP returned by webhook (<%s>) doesn\'t match the app (<%s>) in result link.', |
|
| 106 | - $user, $webhook['app'], $out['splunkapp'][0] ) ); |
|
| 105 | + sprintf('%s: unexpected error: the APP returned by webhook (<%s>) doesn\'t match the app (<%s>) in result link.', |
|
| 106 | + $user, $webhook['app'], $out['splunkapp'][0] ) ); |
|
| 107 | 107 | return 255; |
| 108 | 108 | } |
| 109 | 109 | |
@@ -137,14 +137,14 @@ discard block |
||
| 137 | 137 | |
| 138 | 138 | $nr = count ($results); |
| 139 | 139 | for ($i=1; $i<$nr; $i++) { /* We skip first header line (i=0) */ |
| 140 | - $data = str_getcsv($results[$i], ','); |
|
| 141 | - $thisVal = $data[1]; |
|
| 142 | - unset($data[1]); |
|
| 143 | - $data = array_values($data); |
|
| 144 | - if ( !in_array($thisVal,array_keys($tolist)) ) |
|
| 145 | - $tolist["$thisVal"] = $data; |
|
| 146 | - else if ($data[3]>$tolist[$thisVal][3]) |
|
| 147 | - $tolist["$thisVal"] = $data; |
|
| 140 | + $data = str_getcsv($results[$i], ','); |
|
| 141 | + $thisVal = $data[1]; |
|
| 142 | + unset($data[1]); |
|
| 143 | + $data = array_values($data); |
|
| 144 | + if ( !in_array($thisVal,array_keys($tolist)) ) |
|
| 145 | + $tolist["$thisVal"] = $data; |
|
| 146 | + else if ($data[3]>$tolist[$thisVal][3]) |
|
| 147 | + $tolist["$thisVal"] = $data; |
|
| 148 | 148 | } |
| 149 | 149 | |
| 150 | 150 | /* Make MYSQL connection */ |
@@ -154,34 +154,34 @@ discard block |
||
| 154 | 154 | exit (254); |
| 155 | 155 | |
| 156 | 156 | foreach ( array_keys($tolist) as $value) { |
| 157 | - $quantity = $conf['quantity']; |
|
| 158 | - $reason = 'On ['.$tolist["$value"][0]."] <$value> sent ".$tolist["$value"][1].' messages to '.$tolist["$value"][2].' recipients.'; |
|
| 159 | - if ( $tolist["$value"][3] >= $threshold ) { |
|
| 160 | - if ( searchAndList ($mysqli,$user,$tables,$typedesc,$value,$unit,$quantity,$reason) ) { |
|
| 161 | - syslog (LOG_INFO, "$user: ".'Listing reason: '.$reason); |
|
| 162 | - /* Send a email to domain admin if you list an email */ |
|
| 163 | - if ( ( $tables["$typedesc"]['field'] == 'email' ) OR ( $tables["$typedesc"]['field'] == 'username' ) ) { |
|
| 164 | - /* Sometime uid are in the form of <user>@<domain> ... */ |
|
| 165 | - if ( strpos($value, '@') !== FALSE ) { |
|
| 166 | - $domain = substr(strrchr($value, '@'), 1); |
|
| 167 | - if ( strpos($domain, '@') === FALSE ) { |
|
| 168 | - $recip = emailToNotify($domainNotify_file,$domain); |
|
| 169 | - $subject = sprintf('%s <%s> is now blocked because exceedes limits on outgoing emails', |
|
| 170 | - $tables["$typedesc"]['field'], $value); |
|
| 171 | - if (!empty($recip)) |
|
| 172 | - if ( sendEmailWarn($tplfile,'[email protected]',$recip, |
|
| 173 | - $subject,$value,"$quantity $unit",$reason) ) |
|
| 174 | - syslog(LOG_INFO, "$user: \"$recip\" was notified about the \"$value\" abuse."); |
|
| 175 | - } |
|
| 176 | - else syslog(LOG_ERR,"$user: <$domain> contains the '@' char. Notification cannot be sent."); |
|
| 177 | - } |
|
| 178 | - } |
|
| 179 | - } |
|
| 180 | - } |
|
| 181 | - else { |
|
| 182 | - $reason .= " But it has NOT been listed because it doesn't apply to the trigger condition."; |
|
| 183 | - syslog (LOG_INFO, "$user: ".$reason); |
|
| 184 | - } |
|
| 157 | + $quantity = $conf['quantity']; |
|
| 158 | + $reason = 'On ['.$tolist["$value"][0]."] <$value> sent ".$tolist["$value"][1].' messages to '.$tolist["$value"][2].' recipients.'; |
|
| 159 | + if ( $tolist["$value"][3] >= $threshold ) { |
|
| 160 | + if ( searchAndList ($mysqli,$user,$tables,$typedesc,$value,$unit,$quantity,$reason) ) { |
|
| 161 | + syslog (LOG_INFO, "$user: ".'Listing reason: '.$reason); |
|
| 162 | + /* Send a email to domain admin if you list an email */ |
|
| 163 | + if ( ( $tables["$typedesc"]['field'] == 'email' ) OR ( $tables["$typedesc"]['field'] == 'username' ) ) { |
|
| 164 | + /* Sometime uid are in the form of <user>@<domain> ... */ |
|
| 165 | + if ( strpos($value, '@') !== FALSE ) { |
|
| 166 | + $domain = substr(strrchr($value, '@'), 1); |
|
| 167 | + if ( strpos($domain, '@') === FALSE ) { |
|
| 168 | + $recip = emailToNotify($domainNotify_file,$domain); |
|
| 169 | + $subject = sprintf('%s <%s> is now blocked because exceedes limits on outgoing emails', |
|
| 170 | + $tables["$typedesc"]['field'], $value); |
|
| 171 | + if (!empty($recip)) |
|
| 172 | + if ( sendEmailWarn($tplfile,'[email protected]',$recip, |
|
| 173 | + $subject,$value,"$quantity $unit",$reason) ) |
|
| 174 | + syslog(LOG_INFO, "$user: \"$recip\" was notified about the \"$value\" abuse."); |
|
| 175 | + } |
|
| 176 | + else syslog(LOG_ERR,"$user: <$domain> contains the '@' char. Notification cannot be sent."); |
|
| 177 | + } |
|
| 178 | + } |
|
| 179 | + } |
|
| 180 | + } |
|
| 181 | + else { |
|
| 182 | + $reason .= " But it has NOT been listed because it doesn't apply to the trigger condition."; |
|
| 183 | + syslog (LOG_INFO, "$user: ".$reason); |
|
| 184 | + } |
|
| 185 | 185 | } |
| 186 | 186 | |
| 187 | 187 | /* Close connection */ |