bulletproof-security / 400.php

400.php in BulletProof Security trunk, at 400.php

141 lines 5.3 KB

Raw Download Zip

1	<?php ob_start(); ?>
2	<?php session_cache_limiter('nocache'); ?>
3	<?php session_start(); ?>
4	<?php error_reporting(0); ?>
5	<?php session_destroy(); ?>
6	<?php
7	# BEGIN HEADERS
8	header($_SERVER['SERVER_PROTOCOL'].' 400 Bad Request', true, 400);
9	header('Status: 400 Bad Request');
10	header('Content-type: text/html; charset=UTF-8');
11	header('Cache-Control: no-store, no-cache, must-revalidate' );
12	header('Expires: Sat, 26 Jul 1997 05:00:00 GMT');
13	header('Pragma: no-cache' );
14	# END HEADERS
15	?>
16
17	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
18	<html xmlns="http://www.w3.org/1999/xhtml">
19	<head>
20	<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
21	<title>400 Bad Request</title>
22
23	<style type="text/css">
24	<!--
25	body {
26	background-color:#fff;
27	line-height:normal;
28	/* If you want to add a background image uncomment the CSS properties below */
29	/* background-image:url(http://www.example.com/path-to-some-image-file/example-image-file.jpg); /*
30	/* background-repeat:repeat; */
31	}
32
33	#bpsMessage {
34	text-align:center;
35	background-color:#fff;
36	padding:0px;
37	}
38
39	p {
40	font-family:Verdana, Arial, Helvetica, Tahoma, sans-serif;
41	line-height:21px;
42	font-size:14px;
43	font-weight:normal;
44	}
45	-->
46	</style>
47
48	</head>
49
50	<body>
51
52	<div id="bpsMessage">
53	<!-- This code needs to be standard php code (not WP code) in case wp-load.php is not loaded -->
54	<?php
55	$http_status_code = '<p style="font-size:21px;font-weight:600">400 Bad Request Error</p>';
56	$message = '<p>If you arrived here due to a search or clicking on a link click your <br>Browser\'s back button to return to the previous page. Thank you.</p>';
57	$bps_hostname = '<p>Website: ' . htmlspecialchars( $_SERVER['SERVER_NAME'], ENT_QUOTES ) . '</p>';
58	$ip_address = '<p>Your IP Address: ' . htmlspecialchars( $_SERVER['REMOTE_ADDR'], ENT_QUOTES ) . '</p>';
59	$bps_plugin_footer = '<p>BPS Plugin 400 Error Page</p>';
60
61	echo $http_status_code . $message . $bps_hostname . $ip_address . $bps_plugin_footer;
62	?>
63
64	</div>
65
66	<?php
67
68	if ( file_exists( dirname(dirname(dirname(dirname(__FILE__)))) . '/wp-load.php' ) ) {
69	require_once '../../../wp-load.php';
70	} else {
71	ob_end_flush();
72	return;
73	}
74
75	$bpsPro_http_referer = false;
76
77	if ( array_key_exists('HTTP_REFERER', $_SERVER) ) {
78	$bpsPro_http_referer = $_SERVER['HTTP_REFERER'];
79	}
80
81	$bpsPro_http_user_agent = false;
82
83	if ( array_key_exists('HTTP_USER_AGENT', $_SERVER) ) {
84	$bpsPro_http_user_agent = $_SERVER['HTTP_USER_AGENT'];
85	}
86
87	$bpsProLog = WP_CONTENT_DIR . '/bps-backup/logs/http_error_log.txt';
88	$hostname = gethostbyaddr($_SERVER['REMOTE_ADDR']);
89	$timeNow = time();
90	$gmt_offset = get_option( 'gmt_offset' ) * 3600;
91
92	$query_string = parse_url($_SERVER['REQUEST_URI'], PHP_URL_QUERY);
93
94	if ( ! get_option( 'gmt_offset' ) ) {
95	$timestamp = date("F j, Y g:i a", time() );
96	} else {
97	$timestamp = date_i18n(get_option('date_format'), strtotime("11/15-1976")) . ' - ' . date_i18n(get_option('time_format'), $timeNow + $gmt_offset);
98	}
99
100	$event = 'The request could not be understood by the server due to malformed syntax.';
101	$solution = 'N/A - Malformed Request - Not an Attack';
102
103	if ( $_SERVER['REQUEST_METHOD'] == 'POST' ) {
104
105	$log_contents = "\r\n" . '[400 POST Bad Request: ' . $timestamp . ']' . "\r\n" . 'BPS: ' . $bps_version . "\r\n" . 'WP: ' . $wp_version . "\r\n" . 'Event Code: ' . $event . "\r\n" . 'Solution: ' . $solution . "\r\n" . 'REMOTE_ADDR: '.$bpsPro_remote_addr . "\r\n" . 'Host Name: ' . $hostname . "\r\n" . 'SERVER_PROTOCOL: ' . $_SERVER['SERVER_PROTOCOL'] . "\r\n" . 'HTTP_CLIENT_IP: ' . $bpsPro_http_client_ip . "\r\n" . 'HTTP_FORWARDED: ' . $bpsPro_http_forwarded . "\r\n" . 'HTTP_X_FORWARDED_FOR: ' . $bpsPro_http_x_forwarded_for . "\r\n" . 'HTTP_X_CLUSTER_CLIENT_IP: ' . $bpsPro_http_x_cluster_client_ip."\r\n" . 'REQUEST_METHOD: '.$_SERVER['REQUEST_METHOD']."\r\n" . 'HTTP_REFERER: '.$bpsPro_http_referer."\r\n" . 'REQUEST_URI: '.$_SERVER['REQUEST_URI']."\r\n" . 'QUERY_STRING: '.$query_string."\r\n" . 'HTTP_USER_AGENT: '.$bpsPro_http_user_agent."\r\n";
106
107	if ( is_writable( $bpsProLog ) ) {
108
109	if ( !$handle = fopen( $bpsProLog, 'a' ) ) {
110	exit;
111	}
112
113	if ( fwrite( $handle, $log_contents) === false ) {
114	exit;
115	}
116
117	fclose($handle);
118	}
119	}
120
121	if ( $_SERVER['REQUEST_METHOD'] != 'POST' ) {
122
123	$log_contents = "\r\n" . '[400 GET Bad Request: ' . $timestamp . ']' . "\r\n" . 'BPS: ' . $bps_version . "\r\n" . 'WP: ' . $wp_version . "\r\n" . 'Event Code: ' . $event . "\r\n" . 'Solution: ' . $solution . "\r\n" . 'REMOTE_ADDR: '.$bpsPro_remote_addr . "\r\n" . 'Host Name: ' . $hostname . "\r\n" . 'SERVER_PROTOCOL: ' . $_SERVER['SERVER_PROTOCOL'] . "\r\n" . 'HTTP_CLIENT_IP: ' . $bpsPro_http_client_ip . "\r\n" . 'HTTP_FORWARDED: ' . $bpsPro_http_forwarded . "\r\n" . 'HTTP_X_FORWARDED_FOR: ' . $bpsPro_http_x_forwarded_for . "\r\n" . 'HTTP_X_CLUSTER_CLIENT_IP: ' . $bpsPro_http_x_cluster_client_ip."\r\n" . 'REQUEST_METHOD: '.$_SERVER['REQUEST_METHOD']."\r\n" . 'HTTP_REFERER: '.$bpsPro_http_referer."\r\n" . 'REQUEST_URI: '.$_SERVER['REQUEST_URI']."\r\n" . 'QUERY_STRING: '.$query_string."\r\n" . 'HTTP_USER_AGENT: '.$bpsPro_http_user_agent."\r\n";
124
125	if ( is_writable( $bpsProLog ) ) {
126
127	if ( !$handle = fopen( $bpsProLog, 'a' ) ) {
128	exit;
129	}
130
131	if ( fwrite( $handle, $log_contents) === false ) {
132	exit;
133	}
134
135	fclose($handle);
136	}
137	}
138	?>
139	</body>
140	</html>
141	<?php ob_end_flush(); ?>