@@ -10,11 +10,11 @@ |
||
10 | 10 | |
11 | 11 | namespace Shieldon\Security; |
12 | 12 | |
13 | - /** |
|
14 | - * WWW-Authenticate |
|
15 | - * |
|
16 | - * @since 3.0.0 |
|
17 | - */ |
|
13 | + /** |
|
14 | + * WWW-Authenticate |
|
15 | + * |
|
16 | + * @since 3.0.0 |
|
17 | + */ |
|
18 | 18 | class httpAuthentication |
19 | 19 | { |
20 | 20 | /** |
@@ -36,9 +36,9 @@ discard block |
||
36 | 36 | use function time; |
37 | 37 | use function version_compare; |
38 | 38 | |
39 | - /** |
|
40 | - * Cross-Site Scripting protection. |
|
41 | - */ |
|
39 | + /** |
|
40 | + * Cross-Site Scripting protection. |
|
41 | + */ |
|
42 | 42 | class Xss |
43 | 43 | { |
44 | 44 | /** |
@@ -285,7 +285,7 @@ discard block |
||
285 | 285 | unset($original); |
286 | 286 | |
287 | 287 | // Remove evil attributes such as style, onclick and xmlns |
288 | - $str = $this->removeEvilAttributes($str, $isImage); |
|
288 | + $str = $this->removeEvilAttributes($str, $isImage); |
|
289 | 289 | |
290 | 290 | /* |
291 | 291 | * Sanitize naughty HTML elements |
@@ -449,62 +449,62 @@ discard block |
||
449 | 449 | * @param boolean $is_image TRUE if this is an image |
450 | 450 | * @return string The string with the evil attributes removed |
451 | 451 | */ |
452 | - protected function removeEvilAttributes($str, $is_image) |
|
453 | - { |
|
454 | - // All javascript event handlers (e.g. onload, onclick, onmouseover), style, and xmlns |
|
455 | - $evilAttributes = array('on\w*', 'style', 'xmlns', 'formaction', 'form', 'xlink:href'); |
|
452 | + protected function removeEvilAttributes($str, $is_image) |
|
453 | + { |
|
454 | + // All javascript event handlers (e.g. onload, onclick, onmouseover), style, and xmlns |
|
455 | + $evilAttributes = array('on\w*', 'style', 'xmlns', 'formaction', 'form', 'xlink:href'); |
|
456 | 456 | |
457 | - if ($is_image) { |
|
458 | - /* |
|
457 | + if ($is_image) { |
|
458 | + /* |
|
459 | 459 | * Adobe Photoshop puts XML metadata into JFIF images, |
460 | 460 | * including namespacing, so we have to allow this for images. |
461 | 461 | */ |
462 | - unset($evilAttributes[array_search('xmlns', $evilAttributes)]); |
|
463 | - } |
|
462 | + unset($evilAttributes[array_search('xmlns', $evilAttributes)]); |
|
463 | + } |
|
464 | 464 | |
465 | - do { |
|
466 | - $count = 0; |
|
467 | - $attribs = array(); |
|
465 | + do { |
|
466 | + $count = 0; |
|
467 | + $attribs = array(); |
|
468 | 468 | |
469 | - // find occurrences of illegal attribute strings with quotes (042 and 047 are octal quotes) |
|
470 | - preg_match_all( |
|
469 | + // find occurrences of illegal attribute strings with quotes (042 and 047 are octal quotes) |
|
470 | + preg_match_all( |
|
471 | 471 | '/(?<!\w)(' . implode('|', $evilAttributes) . ')\s*=\s*(\042|\047)([^\\2]*?)(\\2)/is', |
472 | 472 | $str, |
473 | 473 | $matches, |
474 | 474 | PREG_SET_ORDER |
475 | 475 | ); |
476 | 476 | |
477 | - foreach ($matches as $attr) { |
|
478 | - $attribs[] = preg_quote($attr[0], '/'); |
|
479 | - } |
|
477 | + foreach ($matches as $attr) { |
|
478 | + $attribs[] = preg_quote($attr[0], '/'); |
|
479 | + } |
|
480 | 480 | |
481 | - // find occurrences of illegal attribute strings without quotes |
|
482 | - preg_match_all( |
|
481 | + // find occurrences of illegal attribute strings without quotes |
|
482 | + preg_match_all( |
|
483 | 483 | '/(?<!\w)(' . implode('|', $evilAttributes) . ')\s*=\s*([^\s>]*)/is', |
484 | 484 | $str, |
485 | 485 | $matches, |
486 | 486 | PREG_SET_ORDER |
487 | 487 | ); |
488 | 488 | |
489 | - foreach ($matches as $attr) { |
|
490 | - $attribs[] = preg_quote($attr[0], '/'); |
|
491 | - } |
|
489 | + foreach ($matches as $attr) { |
|
490 | + $attribs[] = preg_quote($attr[0], '/'); |
|
491 | + } |
|
492 | 492 | |
493 | - // replace illegal attribute strings that are inside an html tag |
|
494 | - if (count($attribs) > 0) { |
|
495 | - $str = preg_replace( |
|
493 | + // replace illegal attribute strings that are inside an html tag |
|
494 | + if (count($attribs) > 0) { |
|
495 | + $str = preg_replace( |
|
496 | 496 | '/(<?)(\/?[^><]+?)([^A-Za-z<>\-])(.*?)(' . implode('|', $attribs) . ')(.*?)([\s><]?)([><]*)/i', |
497 | 497 | '$1$2 $4$6$7$8', |
498 | 498 | $str, |
499 | 499 | -1, |
500 | 500 | $count |
501 | 501 | ); |
502 | - } |
|
502 | + } |
|
503 | 503 | |
504 | - } while ($count); |
|
504 | + } while ($count); |
|
505 | 505 | |
506 | - return $str; |
|
507 | - } |
|
506 | + return $str; |
|
507 | + } |
|
508 | 508 | |
509 | 509 | /** |
510 | 510 | * Random Hash for protecting URLs |
@@ -895,16 +895,16 @@ discard block |
||
895 | 895 | * @return bool |
896 | 896 | */ |
897 | 897 | protected function isPHP($version): bool |
898 | - { |
|
898 | + { |
|
899 | 899 | static $_isPHP; |
900 | 900 | |
901 | - $version = (string) $version; |
|
901 | + $version = (string) $version; |
|
902 | 902 | |
903 | - if (! isset($_isPHP[$version])) { |
|
904 | - $_isPHP[$version] = version_compare(PHP_VERSION, $version, '>='); |
|
905 | - } |
|
903 | + if (! isset($_isPHP[$version])) { |
|
904 | + $_isPHP[$version] = version_compare(PHP_VERSION, $version, '>='); |
|
905 | + } |
|
906 | 906 | |
907 | - return $_isPHP[$version]; |
|
908 | - } |
|
907 | + return $_isPHP[$version]; |
|
908 | + } |
|
909 | 909 | } |
910 | 910 |
@@ -19,9 +19,9 @@ |
||
19 | 19 | use function time; |
20 | 20 | use function uniqid; |
21 | 21 | |
22 | - /** |
|
23 | - * Cross Site Request Forgery protection. |
|
24 | - */ |
|
22 | + /** |
|
23 | + * Cross Site Request Forgery protection. |
|
24 | + */ |
|
25 | 25 | class Csrf |
26 | 26 | { |
27 | 27 | /** |
@@ -146,7 +146,7 @@ |
||
146 | 146 | return $results; |
147 | 147 | } |
148 | 148 | |
149 | - /** |
|
149 | + /** |
|
150 | 150 | * {@inheritDoc} |
151 | 151 | */ |
152 | 152 | protected function doFetchAll(string $type = 'filter_log'): array |
@@ -27,11 +27,11 @@ |
||
27 | 27 | parent::__construct($pdo, $debug); |
28 | 28 | } |
29 | 29 | |
30 | - /** |
|
31 | - * Create SQL tables that Shieldon needs. |
|
32 | - * |
|
33 | - * @return bool |
|
34 | - */ |
|
30 | + /** |
|
31 | + * Create SQL tables that Shieldon needs. |
|
32 | + * |
|
33 | + * @return bool |
|
34 | + */ |
|
35 | 35 | protected function installSql(): bool |
36 | 36 | { |
37 | 37 | try { |
@@ -192,7 +192,7 @@ discard block |
||
192 | 192 | } |
193 | 193 | } |
194 | 194 | |
195 | - // @codeCoverageIgnoreStart |
|
195 | + // @codeCoverageIgnoreStart |
|
196 | 196 | |
197 | 197 | /** |
198 | 198 | * Display pages. |
@@ -1308,7 +1308,7 @@ discard block |
||
1308 | 1308 | $iptablesQueueFile = $iptablesWatchingFolder . '/iptables_queue.log'; |
1309 | 1309 | |
1310 | 1310 | if ( |
1311 | - (isset($_POST['ip']) && (filter_var(explode('/', $_POST['ip'])[0], FILTER_VALIDATE_IP))) |
|
1311 | + (isset($_POST['ip']) && (filter_var(explode('/', $_POST['ip'])[0], FILTER_VALIDATE_IP))) |
|
1312 | 1312 | && (isset($_POST['port']) && (is_numeric($_POST['port']) || ($_POST['port'] === 'all') || ($_POST['port'] === 'custom'))) |
1313 | 1313 | && (isset($_POST['subnet']) && (is_numeric($_POST['subnet']) || ($_POST['subnet'] === 'null'))) |
1314 | 1314 | && (isset($_POST['protocol']) && (in_array($_POST['protocol'], ['tcp', 'udp', 'all']))) |
@@ -2252,7 +2252,7 @@ discard block |
||
2252 | 2252 | $channel = $_GET['channel'] ?? ''; |
2253 | 2253 | |
2254 | 2254 | if ( |
2255 | - ! empty($serverUrl) |
|
2255 | + ! empty($serverUrl) |
|
2256 | 2256 | && ! empty($userId) |
2257 | 2257 | && ! empty($accessToken) |
2258 | 2258 | && ! empty($channel) |
@@ -257,7 +257,7 @@ discard block |
||
257 | 257 | $ip = $ipData[0]; |
258 | 258 | $cidr = (int) $ipData[1] ?? 32; |
259 | 259 | |
260 | - $result[0] = long2ip((ip2long($ip)) & ((-1 << (32 - $cidr)))); |
|
260 | + $result[0] = long2ip((ip2long($ip)) & ((-1 << (32 - $cidr)))); |
|
261 | 261 | $result[1] = long2ip((ip2long($ip)) + pow(2, (32 - $cidr)) - 1); |
262 | 262 | |
263 | 263 | if ($isDecimal) { |
@@ -265,7 +265,7 @@ discard block |
||
265 | 265 | $result[1] = ip2long($result[1]); |
266 | 266 | } |
267 | 267 | |
268 | - return $result; |
|
268 | + return $result; |
|
269 | 269 | } |
270 | 270 | |
271 | 271 | /** |
@@ -43,41 +43,41 @@ |
||
43 | 43 | } |
44 | 44 | } |
45 | 45 | |
46 | - /** |
|
46 | + /** |
|
47 | 47 | * Shieldon middleware invokable class. |
48 | 48 | * |
49 | - * @param Request $request |
|
50 | - * |
|
51 | - * @return mixed |
|
52 | - */ |
|
53 | - public function before(Request $request) |
|
54 | - { |
|
55 | - if ($request->isCLI()) { |
|
56 | - return; |
|
57 | - } |
|
49 | + * @param Request $request |
|
50 | + * |
|
51 | + * @return mixed |
|
52 | + */ |
|
53 | + public function before(Request $request) |
|
54 | + { |
|
55 | + if ($request->isCLI()) { |
|
56 | + return; |
|
57 | + } |
|
58 | 58 | |
59 | 59 | $firewall = new Firewall($this->storage); |
60 | 60 | |
61 | 61 | // Pass CodeIgniter CSRF Token to Captcha form. |
62 | 62 | $firewall->getShieldon()->setCaptcha(new \Shieldon\Captcha\Csrf([ |
63 | - 'name' => csrf_token(), |
|
64 | - 'value' => csrf_hash(), |
|
63 | + 'name' => csrf_token(), |
|
64 | + 'value' => csrf_hash(), |
|
65 | 65 | ])); |
66 | 66 | |
67 | 67 | $firewall->restful(); |
68 | 68 | $firewall->run(); |
69 | - } |
|
69 | + } |
|
70 | 70 | |
71 | - /** |
|
72 | - * We don't have anything to do here. |
|
73 | - * |
|
74 | - * @param Response $request |
|
75 | - * @param Response $response |
|
76 | - * |
|
77 | - * @return mixed |
|
78 | - */ |
|
79 | - public function after(Request $request, Response $response) |
|
80 | - { |
|
71 | + /** |
|
72 | + * We don't have anything to do here. |
|
73 | + * |
|
74 | + * @param Response $request |
|
75 | + * @param Response $response |
|
76 | + * |
|
77 | + * @return mixed |
|
78 | + */ |
|
79 | + public function after(Request $request, Response $response) |
|
80 | + { |
|
81 | 81 | |
82 | 82 | } |
83 | 83 | } |
84 | 84 | \ No newline at end of file |