| 1 |
<?php |
| 2 |
|
| 3 |
class Meow_MWAI_Modules_Security { |
| 4 |
public $core = null; |
| 5 |
public $banned_ips = []; |
| 6 |
public $banned_words = []; |
| 7 |
|
| 8 |
public function __construct( $core ) { |
| 9 |
$this->core = $core; |
| 10 |
$this->banned_ips = $this->core->get_option( 'banned_ips' ); |
| 11 |
$this->banned_words = $this->core->get_option( 'banned_words' ); |
| 12 |
|
| 13 |
if ( !empty( $this->banned_ips ) ) { |
| 14 |
add_filter( 'mwai_ai_allowed', [ $this, 'check_banned_ips' ], 5, 3 ); |
| 15 |
} |
| 16 |
if ( !empty( $this->banned_words ) ) { |
| 17 |
add_filter( 'mwai_ai_allowed', [ $this, 'check_banned_words' ], 5, 3 ); |
| 18 |
} |
| 19 |
} |
| 20 |
|
| 21 |
function check_banned_ips( $ok, $query, $limits ) { |
| 22 |
if ( $ok !== true || empty( $this->banned_ips ) ) { |
| 23 |
return $ok; |
| 24 |
} |
| 25 |
if ( is_a( $query, 'Meow_MWAI_Query_Embed' ) ) { |
| 26 |
if ( $this->core->can_access_settings() ) { |
| 27 |
return $ok; |
| 28 |
} |
| 29 |
} |
| 30 |
$ip = $this->core->get_ip_address(); |
| 31 |
if ( $this->is_blocked_ip( $ip, $this->banned_ips ) ) { |
| 32 |
error_log( "AI Engine blocked IP: $ip" ); |
| 33 |
throw new Exception( "Your query has been rejected." ); |
| 34 |
} |
| 35 |
return $ok; |
| 36 |
} |
| 37 |
|
| 38 |
function check_banned_words( $ok, $query, $limits ) { |
| 39 |
if ( $ok !== true || empty( $this->banned_words ) ) { |
| 40 |
return $ok; |
| 41 |
} |
| 42 |
if ( is_a( $query, 'Meow_MWAI_Query_Embed' ) ) { |
| 43 |
if ( $this->core->can_access_settings() ) { |
| 44 |
return $ok; |
| 45 |
} |
| 46 |
} |
| 47 |
$text = $query->getLastPrompt(); |
| 48 |
foreach ( $this->banned_words as $word ) { |
| 49 |
if ( stripos( $text, $word ) !== false ) { |
| 50 |
error_log( "AI Engine blocked word: $word" ); |
| 51 |
throw new Exception( "Your query has been rejected." ); |
| 52 |
} |
| 53 |
} |
| 54 |
return $ok; |
| 55 |
} |
| 56 |
|
| 57 |
function ip_in_range($ip, $range) |
| 58 |
{ |
| 59 |
if (strpos($range, '/') === false) { |
| 60 |
$range .= '/32'; // Convert single IP to CIDR notation |
| 61 |
} |
| 62 |
|
| 63 |
list($range_ip, $subnet) = explode('/', $range, 2); |
| 64 |
if (filter_var($range_ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) { |
| 65 |
$ip_bin = ip2long($ip); |
| 66 |
$range_ip_bin = ip2long($range_ip); |
| 67 |
$subnet_mask = 0xFFFFFFFF << (32 - $subnet); |
| 68 |
|
| 69 |
return ($ip_bin & $subnet_mask) == ($range_ip_bin & $subnet_mask); |
| 70 |
} elseif (filter_var($range_ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) { |
| 71 |
$ip_bin = inet_pton($ip); |
| 72 |
$range_ip_bin = inet_pton($range_ip); |
| 73 |
$subnet_mask = str_repeat("\xFF", $subnet >> 3) . str_repeat("\x00", 16 - ($subnet >> 3)); |
| 74 |
$subnet_mask[($subnet >> 3)] = chr(0xFF << (8 - ($subnet & 7))); |
| 75 |
|
| 76 |
return ($ip_bin & $subnet_mask) == ($range_ip_bin & $subnet_mask); |
| 77 |
} |
| 78 |
|
| 79 |
return false; |
| 80 |
} |
| 81 |
|
| 82 |
function is_blocked_ip($ip, $blocked_ips) |
| 83 |
{ |
| 84 |
foreach ($blocked_ips as $range) { |
| 85 |
if ($this->ip_in_range($ip, $range)) { |
| 86 |
return true; |
| 87 |
} |
| 88 |
} |
| 89 |
|
| 90 |
return false; |
| 91 |
} |
| 92 |
} |
