perdedora/leftypol
1
0
Fork 0
forked from leftypol/leftypol
Code Pull requests Activity

implement a protection against transparent proxies

Browse source
This commit is contained in:
czaks 2015-03-24 05:19:25 +01:00
parent 9fa320838b
commit 10f93d0d43
3 changed files with 34 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

6
inc/config.php
View file

@ -290,6 +290,12 @@
// Ability to lock a board for normal users and still allow mods to post. Could also be useful for making an archive board
$config['board_locked'] = false;
// If poster's proxy supplies X-Forwarded-For header, check if poster's real IP is banned.
$config['proxy_check'] = false;
// If poster's proxy supplies X-Forwarded-For header, save it for further inspection and/or filtering.
$config['proxy_save'] = false;
/*
* Custom filters detect certain posts and reject/ban accordingly. They are made up of a condition and an
* action (for when ALL conditions are met). As every single post has to be put through each filter,

34
inc/functions.php
View file

@ -810,12 +810,29 @@ function checkBan($board = false) {
if (event('check-ban', $board))
return true;
$bans = Bans::find($_SERVER['REMOTE_ADDR'], $board, $config['show_modname']);
$ips = array();
$ips[] = $_SERVER['REMOTE_ADDR'];
if ($config['proxy_check'] && isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$ips = array_merge($ips, explode(", ", $_SERVER['HTTP_X_FORWARDED_FOR']));
}
foreach ($ips as $ip) {
$bans = Bans::find($_SERVER['REMOTE_ADDR'], $board, $config['show_modname']);
foreach ($bans as &$ban) {
if ($ban['expires'] && $ban['expires'] < time()) {
Bans::delete($ban['id']);
if ($config['require_ban_view'] && !$ban['seen']) {
foreach ($bans as &$ban) {
if ($ban['expires'] && $ban['expires'] < time()) {
Bans::delete($ban['id']);
if ($config['require_ban_view'] && !$ban['seen']) {
if (!isset($_POST['json_response'])) {
displayBan($ban);
} else {
header('Content-Type: text/json');
die(json_encode(array('error' => true, 'banned' => true)));
}
}
} else {
if (!isset($_POST['json_response'])) {
displayBan($ban);
} else {
@ -823,13 +840,6 @@ function checkBan($board = false) {
die(json_encode(array('error' => true, 'banned' => true)));
}
}
} else {
if (!isset($_POST['json_response'])) {
displayBan($ban);
} else {
header('Content-Type: text/json');
die(json_encode(array('error' => true, 'banned' => true)));
}
}
}