bulletproof-security / 405.php

405.php in BulletProof Security 7.2, at 405.php

181 lines 7.2 KB

Raw Download Zip

1	<?php ob_start(); ?>
2	<?php session_cache_limiter('nocache'); ?>
3	<?php session_start(); ?>
4	<?php error_reporting(0); ?>
5	<?php session_destroy(); ?>
6	<?php
7	# BEGIN HEADERS
8	header($_SERVER['SERVER_PROTOCOL'].' 405 Method Not Allowed', true, 405);
9	header('Status: 405 Method Not Allowed');
10	header('Allow: GET, POST, PUT');
11	header('Content-type: text/html; charset=UTF-8');
12	header('Cache-Control: no-store, no-cache, must-revalidate');
13	header('Expires: Sat, 26 Jul 1997 05:00:00 GMT');
14	header('Pragma: no-cache');
15	# END HEADERS
16	?>
17
18	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
19	<html xmlns="http://www.w3.org/1999/xhtml">
20	<head>
21	<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
22	<title>405 Method Not Allowed</title>
23
24	<style type="text/css">
25	<!--
26	body {
27	background-color:#fff;
28	line-height:normal;
29	/* If you want to add a background image uncomment the CSS properties below */
30	/* background-image:url(http://www.example.com/path-to-some-image-file/example-image-file.jpg); /*
31	/* background-repeat:repeat; */
32	}
33
34	#bpsMessage {
35	text-align:center;
36	background-color:#fff;
37	padding:0px;
38	}
39
40	p {
41	font-family:Verdana, Arial, Helvetica, Tahoma, sans-serif;
42	line-height:21px;
43	font-size:14px;
44	font-weight:normal;
45	}
46	-->
47	</style>
48
49	</head>
50
51	<body>
52
53	<div id="bpsMessage">
54	<!-- This code needs to be standard php code (not WP code) in case wp-load.php is not loaded -->
55	<?php
56	$http_status_code = '<p style="font-size:21px;font-weight:600">405 Method Not Allowed Error</p>';
57	$message = '<p>If you arrived here due to a search or clicking on a link click your <br>Browser\'s back button to return to the previous page. Thank you.</p>';
58	$bps_hostname = '<p>Website: ' . htmlspecialchars( $_SERVER['SERVER_NAME'], ENT_QUOTES ) . '</p>';
59	$ip_address = '<p>Your IP Address: ' . htmlspecialchars( $_SERVER['REMOTE_ADDR'], ENT_QUOTES ) . '</p>';
60	$bps_plugin_footer = '<p>BPS Plugin 405 Error Page</p>';
61
62	echo $http_status_code . $message . $bps_hostname . $ip_address . $bps_plugin_footer;
63	?>
64	</div>
65
66	<?php
67
68	if ( file_exists( dirname(dirname(dirname(dirname(__FILE__)))) . '/wp-load.php' ) ) {
69	require_once '../../../wp-load.php';
70	} else {
71	ob_end_flush();
72	return;
73	}
74
75	$bpsPro_http_referer = false;
76
77	if ( array_key_exists('HTTP_REFERER', $_SERVER) ) {
78	$bpsPro_http_referer = $_SERVER['HTTP_REFERER'];
79	}
80
81	$bpsPro_http_user_agent = false;
82
83	if ( array_key_exists('HTTP_USER_AGENT', $_SERVER) ) {
84	$bpsPro_http_user_agent = $_SERVER['HTTP_USER_AGENT'];
85	}
86
87	$bpsProLog = WP_CONTENT_DIR . '/bps-backup/logs/http_error_log.txt';
88	$hostname = gethostbyaddr($_SERVER['REMOTE_ADDR']);
89	$timeNow = time();
90	$gmt_offset = get_option( 'gmt_offset' ) * 3600;
91
92	$post_limit = get_option('bulletproof_security_options_sec_log_post_limit');
93	$query_string = parse_url($_SERVER['REQUEST_URI'], PHP_URL_QUERY);
94
95	if ( $post_limit['bps_security_log_post_none'] == '1' ) {
96	$request_body = file_get_contents( 'php://input', false, NULL, 0, 5 );
97
98	} else {
99
100	if ( $post_limit['bps_security_log_post_limit'] == '1' ) {
101	$request_body = file_get_contents( 'php://input', false, NULL, 0, 500 );
102	} else {
103	$request_body = file_get_contents( 'php://input', false, NULL, 0, 250000 ); // roughly 250KB Max Limit
104	}
105	}
106
107	if ( ! get_option( 'gmt_offset' ) ) {
108	$timestamp = date("F j, Y g:i a", time() );
109	} else {
110	$timestamp = date_i18n(get_option('date_format'), strtotime("11/15-1976")) . ' - ' . date_i18n(get_option('time_format'), $timeNow + $gmt_offset);
111	}
112
113	if ( ! empty($request_body) ) {
114
115	if ( $post_limit['bps_security_log_post_none'] == '1' ) {
116	$request_body = 'BPS Security Log option set to: Do Not Log POST Request Body Data';
117	}
118
119	if ( preg_match_all('/(.)\/plugins\/(.)\.[a-zA-Z0-9]/', $_SERVER['REQUEST_URI'], $matches ) ) {
120	$event = 'PSBR-HPRA-HEAD';
121	$solution = 'https://forum.ait-pro.com/forums/topic/security-log-event-codes/';
122	}
123	elseif ( preg_match('/(.)\/wp-admin\/(.)\.[a-zA-Z0-9]/', $_SERVER['REQUEST_URI'], $matches ) \|\| preg_match('/(.)\/wp-admin\/(.)\.[a-zA-Z0-9]/', $bpsPro_http_referer, $matches ) ) {
124	$event = 'WPADMIN-SBR-HEAD';
125	$solution = 'https://forum.ait-pro.com/forums/topic/security-log-event-codes/';
126
127	} else {
128	$event = 'BFHS-HEAD - HEAD Request Blocked';
129	$solution = 'https://forum.ait-pro.com/forums/topic/security-log-event-codes/';
130	}
131
132	$log_contents = "\r\n" . '[405 HEAD Request: ' . $timestamp . ']' . "\r\n" . 'BPS: ' . $bps_version . "\r\n" . 'WP: ' . $wp_version . "\r\n" . 'Event Code: ' . $event . "\r\n" . 'Solution: ' . $solution . "\r\n" . 'REMOTE_ADDR: ' . $bpsPro_remote_addr . "\r\n" . 'Host Name: ' . $hostname . "\r\n" . 'SERVER_PROTOCOL: ' . $_SERVER['SERVER_PROTOCOL'] . "\r\n" . 'HTTP_CLIENT_IP: ' . $bpsPro_http_client_ip . "\r\n" . 'HTTP_FORWARDED: ' . $bpsPro_http_forwarded . "\r\n" . 'HTTP_X_FORWARDED_FOR: ' . $bpsPro_http_x_forwarded_for . "\r\n" . 'HTTP_X_CLUSTER_CLIENT_IP: ' . $bpsPro_http_x_cluster_client_ip . "\r\n" . 'REQUEST_METHOD: HEAD' . "\r\n" . 'HTTP_REFERER: ' . $bpsPro_http_referer . "\r\n" . 'REQUEST_URI: ' . $_SERVER['REQUEST_URI'] . "\r\n" . 'QUERY_STRING: ' . $query_string . "\r\n" . 'HTTP_USER_AGENT: '. $bpsPro_http_user_agent . "\r\n" . 'REQUEST BODY: ' . $request_body . "\r\n";
133
134	if ( is_writable( $bpsProLog ) ) {
135
136	if ( ! $handle = fopen( $bpsProLog, 'a' ) ) {
137	exit;
138	}
139
140	if ( fwrite( $handle, $log_contents) === false ) {
141	exit;
142	}
143
144	fclose($handle);
145	}
146	}
147
148	if ( empty($request_body) ) {
149
150	if ( preg_match_all('/(.)\/plugins\/(.)\.[a-zA-Z0-9]/', $_SERVER['REQUEST_URI'], $matches ) ) {
151	$event = 'PSBR-HPRA-HEAD';
152	$solution = 'https://forum.ait-pro.com/forums/topic/security-log-event-codes/';
153	}
154	elseif ( preg_match('/(.)\/wp-admin\/(.)\.[a-zA-Z0-9]/', $_SERVER['REQUEST_URI'], $matches ) \|\| preg_match('/(.)\/wp-admin\/(.)\.[a-zA-Z0-9]/', $bpsPro_http_referer, $matches ) ) {
155	$event = 'WPADMIN-SBR-HEAD';
156	$solution = 'https://forum.ait-pro.com/forums/topic/security-log-event-codes/';
157
158	} else {
159	$event = 'BFHS-HEAD - HEAD Request Blocked';
160	$solution = 'https://forum.ait-pro.com/forums/topic/security-log-event-codes/';
161	}
162
163	$log_contents = "\r\n" . '[405 HEAD Request: ' . $timestamp . ']' . "\r\n" . 'BPS: ' . $bps_version . "\r\n" . 'WP: ' . $wp_version . "\r\n" . 'Event Code: ' . $event . "\r\n" . 'Solution: ' . $solution . "\r\n" . 'REMOTE_ADDR: ' . $bpsPro_remote_addr . "\r\n" . 'Host Name: ' . $hostname . "\r\n" . 'SERVER_PROTOCOL: ' . $_SERVER['SERVER_PROTOCOL'] . "\r\n" . 'HTTP_CLIENT_IP: ' . $bpsPro_http_client_ip . "\r\n" . 'HTTP_FORWARDED: ' . $bpsPro_http_forwarded . "\r\n" . 'HTTP_X_FORWARDED_FOR: ' . $bpsPro_http_x_forwarded_for . "\r\n" . 'HTTP_X_CLUSTER_CLIENT_IP: ' . $bpsPro_http_x_cluster_client_ip . "\r\n" . 'REQUEST_METHOD: HEAD' . "\r\n" . 'HTTP_REFERER: ' . $bpsPro_http_referer . "\r\n" . 'REQUEST_URI: ' . $_SERVER['REQUEST_URI'] . "\r\n" . 'QUERY_STRING: ' . $query_string . "\r\n" . 'HTTP_USER_AGENT: ' . $bpsPro_http_user_agent . "\r\n";
164
165	if ( is_writable( $bpsProLog ) ) {
166
167	if ( ! $handle = fopen( $bpsProLog, 'a' ) ) {
168	exit;
169	}
170
171	if ( fwrite( $handle, $log_contents) === false ) {
172	exit;
173	}
174
175	fclose($handle);
176	}
177	}
178	?>
179	</body>
180	</html>
181	<?php ob_end_flush(); ?>