PHP Classes

File: htdocs/xoops_lib/modules/protector/MEMO_ja

Recommend this page to a friend!
  Classes of Michael Beck   Xoops 2.5   htdocs/xoops_lib/modules/protector/MEMO_ja   Download  
File: htdocs/xoops_lib/modules/protector/MEMO_ja
Role: Auxiliary data
Content type: text/plain
Description: Auxiliary data
Class: Xoops 2.5
Modular content management publication system
Author: By
Last change:
Date: 7 years ago
Size: 8,535 bytes
 

Contents

Class file image Download 
??????????????????????????????


???????

-(front-end).php
 --mainfile.php
   ---modules/protector/include/precheck.inc.php
   ---include/common.php  (?????????????????????
   ---modules/protector/include/postcheck.inc.php
 --header.php
   x ---modules/protector/blocks/protector_block.php (deleted)
...

mainfile.php ????????



?Anti-DoS??????

?precheck.inc.php

?????????????

?postcheck.inc.php

$protector->check_dos_attack() ?????

???
  protector_access ?????????
  ??IP????URI????????????? (F5 Attack)
   > protector_access ???????????? (DELAYED INSERT)
   > protector_access ????IP?????????5?????????????????????????????????????????
   > preferences ????????????false???
   > banIP ????bad_ips?????
   > exit ????exit; ?????????
  USER_AGENT ????
   > ?????USER_AGENT???????????OK???
   > USER_AGENT?????????bot??????????
  ??IP?????URI????????????? ???????????
  protector_access ???????????? (DELAYED INSERT)
   > preferences ????????????false???
   > banIP ????bad_ips?????
   > exit ????exit; ?????????
  ????????????OK?

????false???????
?????purge() ????????


?preferences ????????

none   ????????????????????
sleep  5????sleep()???Apache?MySQL???????????????????
exit   ???exit??
banip  xoopsConfig ? bad_ips ???
htaccess .htaccess?DENY FROM????????uploads/.htaccess.bak????????????????????????.htaccess????????????.htaccess?????????????????????????????????uploads/??????????????????.htaccess?????????????????????



???????????????

precheck ??????

??????ON?

$_FILES ?????
/(\.php|\.phtml|\.phtm|\.php3|\.php4|\.cgi|\.pl|\.asp)$/i
??????????????????????????purge()

B-Wiki??????????????php???????????????????OFF??????????

????????mainfile.php ?????? PROTECTOR_SKIP_FILESCHECKER ?????????????????????????B-Wiki???????????????



???????????

precheck ??????

????????????????exit?

$_POST, $_GET, $_COOKIE ???????????

'GLOBALS'
'_SESSION'
'HTTP_SESSION_VARS'
'_GET'
'HTTP_GET_VARS'
'_COOKIE'
'HTTP_COOKIE_VARS'
'_REQUEST'
'_SERVER'
'_ENV'
'_FILES'
'xoopsDB'
'xoopsUser'
'xoopsUserId'
'xoopsUserGroups'
'xoopsUserIsAdmin'
'xoopsConfig'
'xoopsOption'
'xoopsModule'
'xoopsModuleConfig'

????????????????

??????????????????

precheck ??????????ban_ip ??????????GET?POST???????bad_ip?????postcheck???????????????ban?

???????????????????exit ?????????



???????ID? XSS , SQL Injection ??

precheck ???

$_POST, $_GET, $_COOKIE ???????????? 'id' ???????????????????????intval() ????

???????OFF?



?SQL Injection????????

postcheck ???common.php ????????????????????

$_POST, $_GET, $_COOKIE ?????????????UNION ??????? /* ???????????

?????/* ??????? */ ??? /* ????SQL Injection?????????????

????????????????????????

??????

?bit0 ???? ???????
  UNION ???UNI-ON ?????
  /* ?????? */ ?????

?bit1 ??
  ???? /* ????????????????????????????????????????????????????????????????????

?bit2 bad_ip ??
  ????????????????????????????



??????????????

precheck ??????

??????GET?????????????????????????????????????

????????????????????????????????????????????????????

????????????????????../ ????????../../ ????????????????????????????????????

????????????????

??????ON?

2.3x ????POST????????????POST?????????????????2.0.9.2???????????????????????



????????

????????????????precheck?

????????? \0 ????????????????????
?????\0 ?????????????????????????????
???????????????????

??????ON?



??????????????

postcheck ???

??????IP???????????????IP???????????
????????

???????????????????????????????????
??????IP???????????????????????????
?????????

??????????IP???????????????????????
??????????????????????



?XOOPS??????????????

??????2.0.9.2 ?????????Protector??????????
???2.4??????????off??????



???IP????????????????

XOOPS_URL/modules/protector/admin/rescue.php
??????????????????????????IP???????????

?????????????????????????????
???????????????????????????????

precheck ?????????md5??????????????md5???????????????????????????????'*=*'????????????????????????????????????????? :-)

??????????????




??????????

??????
--------------------------------
1:   ???????????????
     CONTAMI, UPLOAD
     BruteForce, xmlrpc, CRITERIA,
     misc debug, misc smilies, edituser avatar choose, findusersh
     DBLayerTrap???SQL Injection??
-------------------------------- Quiet
16:  DoS, CRAWLER
32:  NullByte, ISOCOM, UNION
-------------------------------- quiet
64:  ../ ????
128: SPAM
-------------------------------- full