| @@ -145,13 +145,23 @@ | ||
| 145 | 145 | $whitelisted_ip = true; |
| 146 | 146 | } |
| 147 | 147 | |
| 148 | 148 | foreach ( $requests as $key => $request ) { |
| 149 | + | |
| 150 | + // Treat the raw POST data string as the body contents of all values combined. | |
| 151 | + if ( $key == 'rulesRawPost' ) { | |
| 152 | + $key = 'rulesBodyAll'; | |
| 153 | + } | |
| 154 | + | |
| 149 | 155 | if ( $whitelist_rule->method == $requests['method'] || $whitelist_rule->method == 'ALL' ) { |
| 150 | 156 | $test = strtolower( preg_replace( '/(?!^)[A-Z]{2,}(?=[A-Z][a-z])|[A-Z][a-z]/', '->$0', $key ) ); |
| 151 | 157 | $rule = array_reduce( |
| 152 | 158 | explode( '->', $test ), |
| 153 | 159 | function ( $o, $p ) { |
| 160 | + if ( ! isset( $o->$p ) ) { | |
| 161 | + return null; | |
| 162 | + } | |
| 163 | + | |
| 154 | 164 | return $o->$p; |
| 155 | 165 | }, |
| 156 | 166 | $whitelist_rule |
| 157 | 167 | ); |
| @@ -528,8 +538,12 @@ | ||
| 528 | 538 | // Determine if a rule exists for this request. |
| 529 | 539 | $rule = array_reduce( |
| 530 | 540 | $exp, |
| 531 | 541 | function ( $o, $p ) { |
| 542 | + if ( ! isset( $o->$p ) ) { | |
| 543 | + return null; | |
| 544 | + } | |
| 545 | + | |
| 532 | 546 | return $o->$p; |
| 533 | 547 | }, |
| 534 | 548 | $rule_terms |
| 535 | 549 | ); |
| @@ -645,10 +659,15 @@ | ||
| 645 | 659 | if ( $bypass || ! is_user_logged_in() ) { |
| 646 | 660 | return false; |
| 647 | 661 | } |
| 648 | 662 | |
| 663 | + // Get the whitelisted roles. | |
| 664 | + $roles = $this->get_option( 'patchstack_basic_firewall_roles', array( 'administrator', 'editor', 'author' ) ); | |
| 665 | + if ( ! is_array ( $roles ) ) { | |
| 666 | + return false; | |
| 667 | + } | |
| 668 | + | |
| 649 | 669 | // Special scenario for super admins on a multisite environment. |
| 650 | - $roles = $this->get_option( 'patchstack_basic_firewall_roles', array( 'administrator', 'editor', 'author' ) ); | |
| 651 | 670 | if ( in_array( 'administrator', $roles ) && is_multisite() && is_super_admin() ) { |
| 652 | 671 | return true; |
| 653 | 672 | } |
| 654 | 673 | |
| @@ -673,9 +692,9 @@ | ||
| 673 | 692 | * @return void |
| 674 | 693 | */ |
| 675 | 694 | private function log_hacker( $fid = 1, $post_data = '', $block_type = 'BLOCK' ) { |
| 676 | 695 | global $wpdb; |
| 677 | - if ( ! $wpdb || $fid == 22 ) { | |
| 696 | + if ( ! $wpdb || $fid == 22 || $fid == 23 ) { | |
| 678 | 697 | return; |
| 679 | 698 | } |
| 680 | 699 | |
| 681 | 700 | // Insert into the logs. |
| @@ -713,9 +732,9 @@ | ||
| 713 | 732 | * @param integer $fid |
| 714 | 733 | * @return void |
| 715 | 734 | */ |
| 716 | 735 | public function display_error_page( $fid = 1 ) { |
| 717 | - if ( $fid != 22 ) { | |
| 736 | + if ( $fid != 22 && $fid != 23 && $fid != 'login' ) { | |
| 718 | 737 | $this->log_hacker( $fid ); |
| 719 | 738 | } |
| 720 | 739 | |
| 721 | 740 | header( 'Cache-Control: no-store' ); |
| @@ -720,8 +739,14 @@ | ||
| 720 | 739 | |
| 721 | 740 | header( 'Cache-Control: no-store' ); |
| 722 | 741 | header( 'Pragma: no-cache' ); |
| 723 | 742 | http_response_code( 403 ); |
| 724 | - require_once dirname( __FILE__ ) . '/views/access-denied.php'; | |
| 743 | + | |
| 744 | + if ($fid == 'login' ) { | |
| 745 | + require_once dirname( __FILE__ ) . '/views/access-denied-login.php'; | |
| 746 | + } else { | |
| 747 | + require_once dirname( __FILE__ ) . '/views/access-denied.php'; | |
| 748 | + } | |
| 749 | + | |
| 725 | 750 | exit; |
| 726 | 751 | } |
| 727 | 752 | } |
