From 2f1c4e0042685c5678f8719ac199d4661d7a12f1 Mon Sep 17 00:00:00 2001 From: unknown Date: Tue, 30 Jul 2024 23:01:07 +0700 Subject: [PATCH 1/3] Upd. WAR. Analysis php://input --- lib/CleantalkSP/SpbctWP/Firewall/WAF.php | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/lib/CleantalkSP/SpbctWP/Firewall/WAF.php b/lib/CleantalkSP/SpbctWP/Firewall/WAF.php index b3bcf3713..ac46f6370 100644 --- a/lib/CleantalkSP/SpbctWP/Firewall/WAF.php +++ b/lib/CleantalkSP/SpbctWP/Firewall/WAF.php @@ -74,12 +74,25 @@ public function check() } } + if ( $_POST || $_GET || $_COOKIE ) { + $data_array = array($_POST, $_GET, $_COOKIE); + } else { + $data_flow_row['data_flow_row'] = file_get_contents('php://input'); + $data_array = array($data_flow_row); + } + $results[] = $this->waf__suspicious_check - ? $this->wafSuspiciousCheck(array($_POST, $_GET, $_COOKIE)) + ? $this->wafSuspiciousCheck($data_array) + : false; + $results[] = $this->waf__xss_check + ? $this->wafXssCheck($data_array) + : false; + $results[] = $this->waf__sql_check + ? $this->wafSqlCheck($data_array) + : false; + $results[] = $this->waf__exploit_check + ? $this->wafExploitCheck(urldecode(Server::get('QUERY_STRING'))) : false; - $results[] = $this->waf__xss_check ? $this->wafXssCheck(array($_POST, $_GET, $_COOKIE)) : false; - $results[] = $this->waf__sql_check ? $this->wafSqlCheck(array($_POST, $_GET)) : false; - $results[] = $this->waf__exploit_check ? $this->wafExploitCheck(urldecode(Server::get('QUERY_STRING'))) : false; // Adding common parameters to results foreach ( $results as $key => &$result ) { From 521ce8a5c70a8998d3fa43bc364bd4816131100a Mon Sep 17 00:00:00 2001 From: unknown Date: Mon, 5 Aug 2024 13:23:10 +0700 Subject: [PATCH 2/3] Upd. WAF. Exploit check from php://input --- lib/CleantalkSP/SpbctWP/Firewall/WAF.php | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/lib/CleantalkSP/SpbctWP/Firewall/WAF.php b/lib/CleantalkSP/SpbctWP/Firewall/WAF.php index ac46f6370..f9321254b 100644 --- a/lib/CleantalkSP/SpbctWP/Firewall/WAF.php +++ b/lib/CleantalkSP/SpbctWP/Firewall/WAF.php @@ -74,9 +74,18 @@ public function check() } } + $data_array = array(); + $query_str = ''; + + if (Server::get('QUERY_STRING')) { + $query_str = urldecode(Server::get('QUERY_STRING')); + } else if (file_get_contents('php://input')) { + $query_str = file_get_contents('php://input'); + } + if ( $_POST || $_GET || $_COOKIE ) { $data_array = array($_POST, $_GET, $_COOKIE); - } else { + } else if (file_get_contents('php://input')) { $data_flow_row['data_flow_row'] = file_get_contents('php://input'); $data_array = array($data_flow_row); } @@ -91,7 +100,7 @@ public function check() ? $this->wafSqlCheck($data_array) : false; $results[] = $this->waf__exploit_check - ? $this->wafExploitCheck(urldecode(Server::get('QUERY_STRING'))) + ? $this->wafExploitCheck($query_str) : false; // Adding common parameters to results From 57f628f2b2d32b78c23f9c01ef9ae2bb93feba4e Mon Sep 17 00:00:00 2001 From: unknown Date: Tue, 6 Aug 2024 16:47:58 +0700 Subject: [PATCH 3/3] Upd. WAF. Error Control Operators --- lib/CleantalkSP/SpbctWP/Firewall/WAF.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/CleantalkSP/SpbctWP/Firewall/WAF.php b/lib/CleantalkSP/SpbctWP/Firewall/WAF.php index f9321254b..43ad57e47 100644 --- a/lib/CleantalkSP/SpbctWP/Firewall/WAF.php +++ b/lib/CleantalkSP/SpbctWP/Firewall/WAF.php @@ -79,13 +79,13 @@ public function check() if (Server::get('QUERY_STRING')) { $query_str = urldecode(Server::get('QUERY_STRING')); - } else if (file_get_contents('php://input')) { + } else if (@file_get_contents('php://input')) { $query_str = file_get_contents('php://input'); } if ( $_POST || $_GET || $_COOKIE ) { $data_array = array($_POST, $_GET, $_COOKIE); - } else if (file_get_contents('php://input')) { + } else if (@file_get_contents('php://input')) { $data_flow_row['data_flow_row'] = file_get_contents('php://input'); $data_array = array($data_flow_row); }