Rev 6 | Rev 10 | Go to most recent revision | Details | Compare with Previous | Last modification | View Log | RSS feed
| Rev | Author | Line No. | Line |
|---|---|---|---|
| 3 | daniel-mar | 1 | <?php |
| 2 | |||
| 3 | // ATTENTION: This is a very simple XSS "Firewall". There ARE many other ways to do an XSS attack, so please don't rely on this script! |
||
| 4 | |||
| 9 | daniel-mar | 5 | $xxx_vts_prepend_config = array(); |
| 6 | if (file_exists($xxx_vts_prepend_config_file = __DIR__.'/config.local.php')) include $xxx_vts_prepend_config_file; |
||
| 7 | unset($xxx_vts_prepend_config_file); |
||
| 8 | $xxx_directories_need_anti_xss = $xxx_vts_prepend_config['directories_need_anti_xss']; |
||
| 9 | unset($xxx_vts_prepend_config); |
||
| 3 | daniel-mar | 10 | |
| 11 | function ___check_xss___($str) { |
||
| 6 | daniel-mar | 12 | $ary = is_array($str) ? $str : array($str); |
| 13 | foreach ($ary as $str) { |
||
| 14 | if ((stripos($str, '<svg') !== false) || (stripos($str, '<script') !== false)) { |
||
| 9 | daniel-mar | 15 | #@header($_SERVER['SERVER_PROTOCOL'] . ' 500 Internal Server Error', true, 500); |
| 16 | @header($_SERVER['SERVER_PROTOCOL'] . ' 400 Bad Request', true, 400); |
||
| 6 | daniel-mar | 17 | die('There is a problem with the data you have entered. Please write us an email if you think you received this message in error. info at viathinksoft.de'); |
| 18 | } |
||
| 3 | daniel-mar | 19 | } |
| 20 | } |
||
| 21 | |||
| 22 | // --- |
||
| 23 | |||
| 24 | $xxx_go = false; |
||
| 25 | foreach ($xxx_directories_need_anti_xss as $xxx_directory_need_anti_xss) { |
||
| 9 | daniel-mar | 26 | if ($xxx_negate = (substr($xxx_directory_need_anti_xss,0,1) === '!')) { |
| 27 | $xxx_directory_need_anti_xss = substr($xxx_directory_need_anti_xss,1); |
||
| 28 | } |
||
| 3 | daniel-mar | 29 | if (strpos($_SERVER['SCRIPT_FILENAME'], $xxx_directory_need_anti_xss) === 0) { |
| 9 | daniel-mar | 30 | $xxx_go = !$xxx_negate; |
| 3 | daniel-mar | 31 | } |
| 32 | } |
||
| 33 | unset($xxx_directories_need_anti_xss); |
||
| 34 | unset($xxx_directory_need_anti_xss); |
||
| 9 | daniel-mar | 35 | |
| 3 | daniel-mar | 36 | if ($xxx_go) { |
| 37 | if (isset($_SERVER['REQUEST_URI'])) ___check_xss___($_SERVER['REQUEST_URI']); |
||
| 38 | if (isset($_SERVER['QUERY_STRING'])) ___check_xss___($_SERVER['QUERY_STRING']); |
||
| 39 | if (isset($_SERVER['SCRIPT_URI'])) ___check_xss___($_SERVER['SCRIPT_URI']); |
||
| 40 | if (isset($_SERVER['SCRIPT_URL'])) ___check_xss___($_SERVER['SCRIPT_URL']); |
||
| 41 | if (isset($_SERVER['PHP_SELF'])) ___check_xss___($_SERVER['PHP_SELF']); |
||
| 42 | |||
| 9 | daniel-mar | 43 | # Warum so viele ___ ? Damit man auf keinen Fall ein GET/POST Argument mit diesen Variablen überschreibt! |
| 3 | daniel-mar | 44 | foreach ($_REQUEST as $___key___ => $___val___) { |
| 45 | ___check_xss___($___val___); |
||
| 46 | } |
||
| 47 | unset($___key___); |
||
| 48 | unset($___val___); |
||
| 49 | } |
||
| 50 | unset($xxx_go); |