Skip to content

Commit 33ad99a

Browse files
dave83649dave83649
committed
Added: capture post data for logging purposes.
Removed: Patchstack plugin specific legacy code and move to own branch.
1 parent 2363cb9 commit 33ad99a

3 files changed

Lines changed: 18 additions & 399 deletions

File tree

‎src/Extensions/WordPress/Extension.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -74,10 +74,10 @@ public function logRequest($ruleId, $request, $logType = 'BLOCK')
7474
}
7575

7676
// Determine where to get the POST payload from.
77-
if (!isset($request['rulesRawPost']) || empty($request['rulesRawPost'])) {
78-
$postData = count($_POST) == 0 ? null : json_encode($_POST);
77+
if (!isset($request['raw']) || empty($request['raw'])) {
78+
$postData = count($request['post']) == 0 ? null : json_encode($request['post']);
7979
} else {
80-
$postData = $request['rulesRawPost'];
80+
$postData = is_array($request['raw']) ? json_encode($request['raw'][0]) : $request['raw'];
8181
}
8282

8383
// Insert into the logs.

‎src/Processor.php‎

Lines changed: 9 additions & 166 deletions
Original file line numberDiff line numberDiff line change
@@ -15,27 +15,13 @@ class Processor
1515
*/
1616
private $firewallRules = [];
1717

18-
/**
19-
* The legacy firewall rules to process.
20-
*
21-
* @var array
22-
*/
23-
private $firewallRulesLegacy = [];
24-
2518
/**
2619
* The whitelist rules to process.
2720
*
2821
* @var array
2922
*/
3023
private $whitelistRules = [];
3124

32-
/**
33-
* The legacy whitelist rules to process.
34-
*
35-
* @var array
36-
*/
37-
private $whitelistRulesLegacy = [];
38-
3925
/**
4026
* The options of the engine.
4127
*
@@ -77,24 +63,18 @@ class Processor
7763
* @param array $firewallRules
7864
* @param array $whitelistRules
7965
* @param array $options
80-
* @param array $firewallRulesLegacy
81-
* @param array $whitelistRulesLegacy
8266
* @return void
8367
*/
8468
public function __construct(
8569
ExtensionInterface $extension,
8670
$firewallRules = [],
8771
$whitelistRules = [],
88-
$options = [],
89-
$firewallRulesLegacy = [],
90-
$whitelistRulesLegacy = []
72+
$options = []
9173
) {
9274
$this->extension = $extension;
9375
$this->firewallRules = $firewallRules;
9476
$this->whitelistRules = $whitelistRules;
9577
$this->options = array_merge($this->options, $options);
96-
$this->firewallRulesLegacy = $firewallRulesLegacy;
97-
$this->whitelistRulesLegacy = $whitelistRulesLegacy;
9878

9979
$this->request = new Request($this->options, $this->extension);
10080
$this->response = new Response($this->options);
@@ -131,12 +111,6 @@ public function launch($mustExit = true)
131111
$this->extension->forceExit(22);
132112
}
133113

134-
// Check for whitelist based on the legacy whitelist rules.
135-
$request = $this->request->capture();
136-
if (!$this->mustUsePluginCall && $this->extension->isWhitelisted($this->whitelistRulesLegacy, $request)) {
137-
return true;
138-
}
139-
140114
// Determine if the firewall and whitelist rules were parsed properly.
141115
if (!is_array($this->firewallRules) || !is_array($this->whitelistRules)) {
142116
return true;
@@ -180,9 +154,14 @@ public function launch($mustExit = true)
180154
continue;
181155
}
182156

157+
// Capture the POST data for logging purposes.
158+
if ($rule['type'] != 'WHITELIST') {
159+
$postData = $this->request->getParameterValues('log');
160+
}
161+
183162
// Determine what action to perform.
184163
if ($rule['type'] == 'BLOCK') {
185-
$this->extension->logRequest($rule['id'], $request, 'BLOCK');
164+
$this->extension->logRequest($rule['id'], $postData, 'BLOCK');
186165

187166
// Do we have to exit the page or simply return false?
188167
if ($mustExit) {
@@ -191,20 +170,15 @@ public function launch($mustExit = true)
191170
return false;
192171
}
193172
} elseif ($rule['type'] == 'LOG') {
194-
$this->extension->logRequest($rule['id'], $request, 'LOG');
173+
$this->extension->logRequest($rule['id'], $postData, 'LOG');
195174
} elseif ($rule['type'] == 'REDIRECT') {
196-
$this->extension->logRequest($rule['id'], $request, 'REDIRECT');
175+
$this->extension->logRequest($rule['id'], $postData, 'REDIRECT');
197176
$this->response->redirect($rule['type_params'], $mustExit);
198177
} elseif ($rule['type'] == 'WHITELIST') {
199178
return $mustExit;
200179
}
201180
}
202181

203-
// Run the legacy firewall rules processor for backwards compatibility.
204-
if (count($this->firewallRulesLegacy) > 0 && !$this->mustUsePluginCall) {
205-
$this->launchLegacy(true, $request, $this->extension->getIpAddress());
206-
}
207-
208182
return true;
209183
}
210184

@@ -491,135 +465,4 @@ private function hasWpAction($rules)
491465

492466
return false;
493467
}
494-
495-
/**
496-
* The legacy firewall processor will only iterate over the general legacy firewall rules.
497-
* Will return true if $mustExit is false and all of the rules were processed without a positive detection.
498-
*
499-
* @param boolean $mustExit
500-
* @param array $request
501-
* @param string $ip
502-
* @return boolean
503-
*/
504-
public function launchLegacy($mustExit = true, $request = [], $ip = '')
505-
{
506-
// Obtain the IP address and request data if it has not been supplied yet.
507-
$client_ip = $ip == '' ? $this->extension->getIpAddress() : $ip;
508-
$requests = count($request) == 0 ? $this->request->capture() : $request;
509-
510-
// The request parameter values exploded into pairs.
511-
$requestParams = [
512-
'method' => 'method',
513-
'rulesFile' => 'rules->file',
514-
'rulesRawPost' => 'rules->raw->post',
515-
'rulesUri' => 'rules->uri',
516-
'rulesHeadersAll' => 'rules->headers->all',
517-
'rulesHeadersKeys' => 'rules->headers->keys',
518-
'rulesHeadersValues' => 'rules->headers->values',
519-
'rulesHeadersCombinations' => 'rules->headers->combinations',
520-
'rulesBodyAll' => 'rules->body->all',
521-
'rulesBodyKeys' => 'rules->body->keys',
522-
'rulesBodyValues' => 'rules->body->values',
523-
'rulesBodyCombinations' => 'rules->body->combinations',
524-
'rulesParamsAll' => 'rules->params->all',
525-
'rulesParamsKeys' => 'rules->params->keys',
526-
'rulesParamsValues' => 'rules->params->values',
527-
'rulesParamsCombinations' => 'rules->params->combinations'
528-
];
529-
530-
// Iterate through all root objects.
531-
foreach ($this->firewallRulesLegacy as $firewall_rule) {
532-
$rule_terms = json_decode($firewall_rule['rule']);
533-
534-
// Determine if we should match the IP address.
535-
$ip = isset($rule_terms->rules->ip_address) ? $rule_terms->rules->ip_address : null;
536-
if (!is_null($ip)) {
537-
$matched_ip = false;
538-
if (strpos($ip, '*') !== false) {
539-
$matched_ip = $this->plugin->ban->check_wildcard_rule($client_ip, $ip);
540-
} elseif (strpos($ip, '-') !== false) {
541-
$matched_ip = $this->plugin->ban->check_range_rule($client_ip, $ip);
542-
} elseif (strpos($ip, '/') !== false) {
543-
$matched_ip = $this->plugin->ban->check_subnet_mask_rule($client_ip, $ip);
544-
} elseif ($client_ip == $ip) {
545-
$matched_ip = true;
546-
}
547-
548-
if (!$matched_ip) {
549-
continue;
550-
}
551-
}
552-
553-
// Loop through all request data that we captured.
554-
foreach ($requests as $key => $request) {
555-
// Treat the raw POST data string as the body contents of all values combined.
556-
if ($key == 'rulesRawPost') {
557-
$key = 'rulesBodyAll';
558-
}
559-
560-
// Determine if the requesting method matches.
561-
if ($rule_terms->method == $requests['method'] || $rule_terms->method == 'ALL' || $rule_terms->method == 'GET' || ($rule_terms->method == 'FILES' && $this->extension->isFileUploadRequest())) {
562-
if (!isset($requestParams[$key])) {
563-
continue;
564-
}
565-
$exp = explode('->', $requestParams[$key]);
566-
567-
// Determine if a rule exists for this request.
568-
$rule = $rule_terms;
569-
foreach ($exp as $var) {
570-
if (!isset($rule->$var)) {
571-
$rule = null;
572-
continue;
573-
}
574-
$rule = $rule->$var;
575-
}
576-
577-
// Determine if the rule matches the request.
578-
if (!is_null($rule) && substr($key, 0, 4) == 'rule' && $this->isLegacyRuleMatch($rule, $request)) {
579-
if ($rule_terms->type == 'BLOCK') {
580-
$this->extension->logRequest($firewall_rule['id'], $request, 'BLOCK');
581-
582-
// Do we have to exit the page or simply return false?
583-
if ($mustExit) {
584-
$this->extension->forceExit($firewall_rule['id']);
585-
} else {
586-
return false;
587-
}
588-
} elseif ($rule_terms->type == 'LOG') {
589-
$this->extension->logRequest($firewall_rule['id'], $request, 'LOG');
590-
} elseif ($rule_terms->type == 'REDIRECT') {
591-
$this->extension->logRequest($firewall_rule['id'], $request, 'REDIRECT');
592-
$this->response->redirect($rule_terms->type_params, $mustExit);
593-
}
594-
}
595-
}
596-
}
597-
}
598-
599-
return true;
600-
}
601-
602-
/**
603-
* Determine if the request matches the given firewall or whitelist rule.
604-
*
605-
* @param string $rule
606-
* @param string|array $request
607-
* @return bool
608-
*/
609-
private function isLegacyRuleMatch($rule, $request)
610-
{
611-
$is_matched = false;
612-
if (is_array($request)) {
613-
foreach ($request as $value) {
614-
$is_matched = $this->isLegacyRuleMatch($rule, $value);
615-
if ($is_matched) {
616-
return $is_matched;
617-
}
618-
}
619-
} else {
620-
return preg_match($rule, urldecode($request));
621-
}
622-
623-
return $is_matched;
624-
}
625468
}

0 commit comments

Comments
 (0)