bulletproof-security / 403.php

403.php in BulletProof Security trunk, at 403.php

188 lines 7.4 KB

Raw Download Zip

1	<?php ob_start(); ?>
2	<?php session_cache_limiter('nocache'); ?>
3	<?php session_start(); ?>
4	<?php error_reporting(0); ?>
5	<?php session_destroy(); ?>
6	<?php
7	# BEGIN HEADERS
8	header($_SERVER['SERVER_PROTOCOL'].' 403 Forbidden', true, 403);
9	header('Status: 403 Forbidden');
10	header('Content-type: text/html; charset=UTF-8');
11	header('Cache-Control: no-store, no-cache, must-revalidate' );
12	header('Expires: Sat, 26 Jul 1997 05:00:00 GMT');
13	header('Pragma: no-cache' );
14	# END HEADERS
15	?>
16
17	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
18	<html xmlns="http://www.w3.org/1999/xhtml">
19	<head>
20	<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
21	<title>403 Forbidden</title>
22
23	<style type="text/css">
24	<!--
25	body {
26	background-color:#fff;
27	line-height:normal;
28	/* If you want to add a background image uncomment the CSS properties below */
29	/* background-image:url(http://www.example.com/path-to-some-image-file/example-image-file.jpg); /*
30	/* background-repeat:repeat; */
31	}
32
33	#bpsMessage {
34	text-align:center;
35	background-color:#fff;
36	padding:0px;
37	}
38
39	p {
40	font-family:Verdana, Arial, Helvetica, Tahoma, sans-serif;
41	line-height:21px;
42	font-size:14px;
43	font-weight:normal;
44	}
45	-->
46	</style>
47
48	</head>
49
50	<body>
51
52	<div id="bpsMessage">
53	<!-- This code needs to be standard php code (not WP code) in case wp-load.php is not loaded -->
54	<?php
55	$http_status_code = '<p style="font-size:21px;font-weight:600">403 Forbidden Error</p>';
56	$message = '<p>If you arrived here due to a search or clicking on a link click your <br>Browser\'s back button to return to the previous page. Thank you.</p>';
57	$bps_hostname = '<p>Website: ' . htmlspecialchars( $_SERVER['SERVER_NAME'], ENT_QUOTES ) . '</p>';
58	$ip_address = '<p>Your IP Address: ' . htmlspecialchars( $_SERVER['REMOTE_ADDR'], ENT_QUOTES ) . '</p>';
59	$bps_plugin_footer = '<p>BPS Plugin 403 Error Page</p>';
60
61	echo $http_status_code . $message . $bps_hostname . $ip_address . $bps_plugin_footer;
62	?>
63	</div>
64
65	<?php
66
67	if ( file_exists( dirname(dirname(dirname(dirname(__FILE__)))) . '/wp-load.php' ) ) {
68	require_once '../../../wp-load.php';
69	} else {
70	ob_end_flush();
71	return;
72	}
73
74	$bpsPro_http_referer = false;
75
76	if ( array_key_exists('HTTP_REFERER', $_SERVER) ) {
77	$bpsPro_http_referer = $_SERVER['HTTP_REFERER'];
78	}
79
80	$bpsPro_http_user_agent = false;
81
82	if ( array_key_exists('HTTP_USER_AGENT', $_SERVER) ) {
83	$bpsPro_http_user_agent = $_SERVER['HTTP_USER_AGENT'];
84	}
85
86	# BEGIN USERAGENT FILTER
87	if ( !preg_match('/BPSUserAgentPlaceHolder/', $bpsPro_http_user_agent) ) {
88	# END USERAGENT FILTER
89
90	$bpsProLog = WP_CONTENT_DIR . '/bps-backup/logs/http_error_log.txt';
91	$hostname = gethostbyaddr($_SERVER['REMOTE_ADDR']);
92	$timeNow = time();
93	$gmt_offset = get_option( 'gmt_offset' ) * 3600;
94
95	$post_limit = get_option('bulletproof_security_options_sec_log_post_limit');
96	$query_string = parse_url($_SERVER['REQUEST_URI'], PHP_URL_QUERY);
97
98	if ( isset($post_limit['bps_security_log_post_none']) && $post_limit['bps_security_log_post_none'] == '1' ) {
99	$request_body = file_get_contents( 'php://input', false, NULL, 0, 5 );
100
101	} else {
102
103	if ( isset($post_limit['bps_security_log_post_none']) && $post_limit['bps_security_log_post_limit'] == '1' ) {
104	$request_body = file_get_contents( 'php://input', false, NULL, 0, 500 );
105	} else {
106	$request_body = file_get_contents( 'php://input', false, NULL, 0, 250000 ); // roughly 250KB Max Limit
107	}
108	}
109
110	if ( ! get_option( 'gmt_offset' ) ) {
111	$timestamp = date("F j, Y g:i a", time() );
112	} else {
113	$timestamp = date_i18n(get_option('date_format'), strtotime("11/15-1976")) . ' - ' . date_i18n(get_option('time_format'), $timeNow + $gmt_offset);
114	}
115
116	if ( ! preg_match('/wp-content\/plugins\/bulletproof-security\/admin\/mod-test/', $_SERVER['REQUEST_URI'] ) ) {
117
118	if ( ! empty($request_body) ) {
119
120	if ( $post_limit['bps_security_log_post_none'] == '1' ) {
121	$request_body = 'BPS Security Log option set to: Do Not Log POST Request Body Data';
122	}
123
124	if ( preg_match_all('/(.)\/plugins\/(.)\.[a-zA-Z0-9]/', $_SERVER['REQUEST_URI'], $matches ) ) {
125	$event = 'PSBR-HPRA';
126	$solution = 'https://forum.ait-pro.com/forums/topic/security-log-event-codes/';
127
128	} elseif ( preg_match('/(.)\/wp-admin\/(.)\.[a-zA-Z0-9]/', $_SERVER['REQUEST_URI'], $matches ) \|\| preg_match('/(.)\/wp-admin\/(.)\.[a-zA-Z0-9]/', $bpsPro_http_referer, $matches ) ) {
129	$event = 'WPADMIN-SBR';
130	$solution = 'https://forum.ait-pro.com/forums/topic/security-log-event-codes/';
131
132	} else {
133	$event = 'BFHS - Blocked/Forbidden Hacker or Spammer';
134	$solution = 'N/A - Hacker/Spammer Blocked/Forbidden';
135	}
136
137	$log_contents = "\r\n" . '[403 POST Request: ' . $timestamp . ']' . "\r\n" . 'BPS: ' . $bps_version . "\r\n" . 'WP: ' . $wp_version . "\r\n" . 'Event Code: ' . $event . "\r\n" . 'Solution: ' . $solution . "\r\n" . 'REMOTE_ADDR: '.$bpsPro_remote_addr . "\r\n" . 'Host Name: ' . $hostname . "\r\n" . 'SERVER_PROTOCOL: ' . $_SERVER['SERVER_PROTOCOL'] . "\r\n" . 'HTTP_CLIENT_IP: ' . $bpsPro_http_client_ip . "\r\n" . 'HTTP_FORWARDED: ' . $bpsPro_http_forwarded . "\r\n" . 'HTTP_X_FORWARDED_FOR: ' . $bpsPro_http_x_forwarded_for . "\r\n" . 'HTTP_X_CLUSTER_CLIENT_IP: ' . $bpsPro_http_x_cluster_client_ip."\r\n" . 'REQUEST_METHOD: '.$_SERVER['REQUEST_METHOD']."\r\n" . 'HTTP_REFERER: '.$bpsPro_http_referer."\r\n" . 'REQUEST_URI: '.$_SERVER['REQUEST_URI']."\r\n" . 'QUERY_STRING: '.$query_string."\r\n" . 'HTTP_USER_AGENT: '.$bpsPro_http_user_agent . "\r\n" . 'REQUEST BODY: ' . $request_body . "\r\n";
138
139	if ( is_writable( $bpsProLog ) ) {
140
141	if ( ! $handle = fopen( $bpsProLog, 'a' ) ) {
142	exit;
143	}
144
145	if ( fwrite( $handle, $log_contents) === false ) {
146	exit;
147	}
148
149	fclose($handle);
150	}
151	}
152
153	if ( empty($request_body) ) {
154
155	if ( preg_match_all('/(.)\/plugins\/(.)\.[a-zA-Z0-9]/', $_SERVER['REQUEST_URI'], $matches ) ) {
156	$event = 'PSBR-HPRA';
157	$solution = 'https://forum.ait-pro.com/forums/topic/security-log-event-codes/';
158
159	} elseif ( preg_match('/(.)\/wp-admin\/(.)\.[a-zA-Z0-9]/', $_SERVER['REQUEST_URI'], $matches ) \|\| preg_match('/(.)\/wp-admin\/(.)\.[a-zA-Z0-9]/', $bpsPro_http_referer, $matches ) ) {
160	$event = 'WPADMIN-SBR';
161	$solution = 'https://forum.ait-pro.com/forums/topic/security-log-event-codes/';
162
163	} else {
164	$event = 'BFHS - Blocked/Forbidden Hacker or Spammer';
165	$solution = 'N/A - Hacker/Spammer Blocked/Forbidden';
166	}
167
168	$log_contents = "\r\n" . '[403 GET Request: ' . $timestamp . ']' . "\r\n" . 'BPS: ' . $bps_version . "\r\n" . 'WP: ' . $wp_version . "\r\n" . 'Event Code: ' . $event . "\r\n" . 'Solution: ' . $solution . "\r\n" . 'REMOTE_ADDR: '.$bpsPro_remote_addr . "\r\n" . 'Host Name: ' . $hostname . "\r\n" . 'SERVER_PROTOCOL: ' . $_SERVER['SERVER_PROTOCOL'] . "\r\n" . 'HTTP_CLIENT_IP: ' . $bpsPro_http_client_ip . "\r\n" . 'HTTP_FORWARDED: ' . $bpsPro_http_forwarded . "\r\n" . 'HTTP_X_FORWARDED_FOR: ' . $bpsPro_http_x_forwarded_for . "\r\n" . 'HTTP_X_CLUSTER_CLIENT_IP: ' . $bpsPro_http_x_cluster_client_ip."\r\n" . 'REQUEST_METHOD: '.$_SERVER['REQUEST_METHOD']."\r\n" . 'HTTP_REFERER: '.$bpsPro_http_referer."\r\n" . 'REQUEST_URI: '.$_SERVER['REQUEST_URI']."\r\n" . 'QUERY_STRING: '.$query_string."\r\n" . 'HTTP_USER_AGENT: '.$bpsPro_http_user_agent."\r\n";
169
170	if ( is_writable( $bpsProLog ) ) {
171
172	if ( ! $handle = fopen( $bpsProLog, 'a' ) ) {
173	exit;
174	}
175
176	if ( fwrite( $handle, $log_contents) === false ) {
177	exit;
178	}
179
180	fclose($handle);
181	}
182	}
183	}
184	}
185	?>
186	</body>
187	</html>
188	<?php ob_end_flush(); ?>