Plug-ins were updated.

1. Akismet - up to version 0.5
2. HTMLPurifier - up to version 4.5.0
3. phpids - up to version 0.7

plugins/akismet/Akismet.class.php

@@ -7,7 +7,7 @@
  *
  * This service performs a number of checks on submitted data and returns whether or not the data is likely to be spam.
  *
- * Please note that in order to use this class, you must have a vaild {@link http://wordpress.com/api-keys/ WordPress API key}.  They are free for non/small-profit types and getting one will only take a couple of minutes.  
+ * Please note that in order to use this class, you must have a vaild {@link http://wordpress.com/api-keys/ WordPress API key}.  They are free for non/small-profit types and getting one will only take a couple of minutes.
  *
  * For commercial use, please {@link http://akismet.com/commercial/ visit the Akismet commercial licensing page}.
  *
@@ -17,111 +17,119 @@
  *
  * @package		akismet
  * @author		Alex Potsides, {@link http://www.achingbrain.net http://www.achingbrain.net}
- * @version		0.4
+ * @version		0.5
  * @copyright	Alex Potsides, {@link http://www.achingbrain.net http://www.achingbrain.net}
  * @license		http://www.opensource.org/licenses/bsd-license.php BSD License
  */
 
 /**
- *	The Akismet PHP5 Class
+ * The Akismet PHP5 Class
  *
- *  This class takes the functionality from the Akismet WordPress plugin written by {@link http://photomatt.net/ Matt Mullenweg} and allows it to be integrated into any PHP5 application or website.
+ * This class takes the functionality from the Akismet WordPress plugin written by {@link http://photomatt.net/ Matt Mullenweg} and allows it to be integrated into any PHP5 application or website.
  *
- *  The original plugin is {@link http://akismet.com/download/ available on the Akismet website}.
+ * The original plugin is {@link http://akismet.com/download/ available on the Akismet website}.
  *
- *  <b>Usage:</b>
- *  <code>
- *    $akismet = new Akismet('http://www.example.com/blog/', 'aoeu1aoue');
- *    $akismet->setCommentAuthor($name);
- *    $akismet->setCommentAuthorEmail($email);
- *    $akismet->setCommentAuthorURL($url);
- *    $akismet->setCommentContent($comment);
- *    $akismet->setPermalink('http://www.example.com/blog/alex/someurl/');
- *    if($akismet->isCommentSpam())
- *      // store the comment but mark it as spam (in case of a mis-diagnosis)
- *    else
- *      // store the comment normally
- *  </code>
+ * <code>
+ * $akismet = new Akismet('http://www.example.com/blog/', 'aoeu1aoue');
+ * $akismet->setCommentAuthor($name);
+ * $akismet->setCommentAuthorEmail($email);
+ * $akismet->setCommentAuthorURL($url);
+ * $akismet->setCommentContent($comment);
+ * $akismet->setPermalink('http://www.example.com/blog/alex/someurl/');
+ *
+ * if($akismet->isCommentSpam())
+ *   // store the comment but mark it as spam (in case of a mis-diagnosis)
+ * else
+ *   // store the comment normally
+ * </code>
+ *
+ * Optionally you may wish to check if your WordPress API key is valid as in the example below.
  *
- *  Optionally you may wish to check if your WordPress API key is valid as in the example below.
- * 
  * <code>
- *   $akismet = new Akismet('http://www.example.com/blog/', 'aoeu1aoue');
- *   
- *   if($akismet->isKeyValid()) {
- *     // api key is okay
- *   } else {
- *     // api key is invalid
- *   }
+ * $akismet = new Akismet('http://www.example.com/blog/', 'aoeu1aoue');
+ *
+ * if($akismet->isKeyValid()) {
+ *   // api key is okay
+ * } else {
+ *   // api key is invalid
+ * }
  * </code>
  *
- *	@package	akismet
- *	@name		Akismet
- *	@version	0.4
- *  @author		Alex Potsides
- *  @link		http://www.achingbrain.net/
+ * @package	akismet
+ * @name	Akismet
+ * @version	0.5
+ * @author	Alex Potsides
+ * @link	http://www.achingbrain.net/
  */
-class Akismet
-	{
-	private $version = '0.4';
+class Akismet {
+	private $version = '0.5';
 	private $wordPressAPIKey;
 	private $blogURL;
 	private $comment;
 	private $apiPort;
 	private $akismetServer;
 	private $akismetVersion;
-	
+	private $requestFactory;
+
 	// This prevents some potentially sensitive information from being sent accross the wire.
-	private $ignore = array('HTTP_COOKIE', 
-							'HTTP_X_FORWARDED_FOR', 
-							'HTTP_X_FORWARDED_HOST', 
-							'HTTP_MAX_FORWARDS', 
-							'HTTP_X_FORWARDED_SERVER', 
-							'REDIRECT_STATUS', 
-							'SERVER_PORT', 
+	private $ignore = array('HTTP_COOKIE',
+							'HTTP_X_FORWARDED_FOR',
+							'HTTP_X_FORWARDED_HOST',
+							'HTTP_MAX_FORWARDS',
+							'HTTP_X_FORWARDED_SERVER',
+							'REDIRECT_STATUS',
+							'SERVER_PORT',
 							'PATH',
 							'DOCUMENT_ROOT',
 							'SERVER_ADMIN',
 							'QUERY_STRING',
 							'PHP_SELF' );
-	
+
 	/**
-	 *	@param	string	$blogURL			The URL of your blog.
-	 *	@param	string	$wordPressAPIKey	WordPress API key.
+	 * @param	string	$blogURL			The URL of your blog.
+	 * @param	string	$wordPressAPIKey	WordPress API key.
 	 */
 	public function __construct($blogURL, $wordPressAPIKey) {
 		$this->blogURL = $blogURL;
 		$this->wordPressAPIKey = $wordPressAPIKey;
-		
+
 		// Set some default values
 		$this->apiPort = 80;
 		$this->akismetServer = 'rest.akismet.com';
 		$this->akismetVersion = '1.1';
-		
+		$this->requestFactory = new SocketWriteReadFactory();
+
 		// Start to populate the comment data
 		$this->comment['blog'] = $blogURL;
-		$this->comment['user_agent'] = $_SERVER['HTTP_USER_AGENT'];
-		
+
+		if(isset($_SERVER['HTTP_USER_AGENT'])) {
+			$this->comment['user_agent'] = $_SERVER['HTTP_USER_AGENT'];
+		}
+
 		if(isset($_SERVER['HTTP_REFERER'])) {
 			$this->comment['referrer'] = $_SERVER['HTTP_REFERER'];
 		}
-		
-		/* 
+
+		/*
 		 * This is necessary if the server PHP5 is running on has been set up to run PHP4 and
 		 * PHP5 concurently and is actually running through a separate proxy al a these instructions:
 		 * http://www.schlitt.info/applications/blog/archives/83_How_to_run_PHP4_and_PHP_5_parallel.html
 		 * and http://wiki.coggeshall.org/37.html
-		 * Otherwise the user_ip appears as the IP address of the PHP4 server passing the requests to the 
+		 * Otherwise the user_ip appears as the IP address of the PHP4 server passing the requests to the
 		 * PHP5 one...
 		 */
-		$this->comment['user_ip'] = $_SERVER['REMOTE_ADDR'] != getenv('SERVER_ADDR') ? $_SERVER['REMOTE_ADDR'] : getenv('HTTP_X_FORWARDED_FOR');
+		if(isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] != getenv('SERVER_ADDR')) {
+			$this->comment['user_ip'] = $_SERVER['REMOTE_ADDR'];
+		} else {
+			$this->comment['user_ip'] = getenv('HTTP_X_FORWARDED_FOR');
+		}
 	}
-	
+
 	/**
 	 * Makes a request to the Akismet service to see if the API key passed to the constructor is valid.
-	 * 
+	 *
 	 * Use this method if you suspect your API key is invalid.
-	 * 
+	 *
 	 * @return bool	True is if the key is valid, false if not.
 	 */
 	public function isKeyValid() {
@@ -129,7 +137,7 @@ class Akismet
 		$response = $this->sendRequest('key=' . $this->wordPressAPIKey . '&blog=' . $this->blogURL, $this->akismetServer, '/' . $this->akismetVersion . '/verify-key');
 		return $response[1] == 'valid';
 	}
-	
+
 	// makes a request to the Akismet service
 	private function sendRequest($request, $host, $path) {
 		$http_request  = "POST " . $path . " HTTP/1.0\r\n";
@@ -139,13 +147,13 @@ class Akismet
 		$http_request .= "User-Agent: Akismet PHP5 Class " . $this->version . " | Akismet/1.11\r\n";
 		$http_request .= "\r\n";
 		$http_request .= $request;
-		
-		$socketWriteRead = new SocketWriteRead($host, $this->apiPort, $http_request);
-		$socketWriteRead->send();
-		
-		return explode("\r\n\r\n", $socketWriteRead->getResponse(), 2);
+
+		$requestSender = $this->requestFactory->createRequestSender();
+		$response = $requestSender->send($host, $this->apiPort, $http_request);
+
+		return explode("\r\n\r\n", $response, 2);
 	}
-	
+
 	// Formats the data for transmission
 	private function getQueryString() {
 		foreach($_SERVER as $key => $value) {
@@ -159,234 +167,310 @@ class Akismet
 		}
 
 		$query_string = '';
-		
+
 		foreach($this->comment as $key => $data) {
 			if(!is_array($data)) {
 				$query_string .= $key . '=' . urlencode(stripslashes($data)) . '&';
 			}
 		}
-		
+
 		return $query_string;
 	}
-	
+
 	/**
-	 *	Tests for spam.
+	 * Tests for spam.
 	 *
-	 *	Uses the web service provided by {@link http://www.akismet.com Akismet} to see whether or not the submitted comment is spam.  Returns a boolean value.
+	 * Uses the web service provided by {@link http://www.akismet.com Akismet} to see whether or not the submitted comment is spam.  Returns a boolean value.
 	 *
-	 *	@return		bool	True if the comment is spam, false if not
-	 *  @throws		Will throw an exception if the API key passed to the constructor is invalid.
+	 * @return	bool	True if the comment is spam, false if not
+	 * @throws	Will throw an exception if the API key passed to the constructor is invalid.
 	 */
 	public function isCommentSpam() {
 		$response = $this->sendRequest($this->getQueryString(), $this->wordPressAPIKey . '.rest.akismet.com', '/' . $this->akismetVersion . '/comment-check');
-		
+
 		if($response[1] == 'invalid' && !$this->isKeyValid()) {
 			throw new exception('The Wordpress API key passed to the Akismet constructor is invalid.  Please obtain a valid one from http://wordpress.com/api-keys/');
 		}
-		
+
 		return ($response[1] == 'true');
 	}
 
 	/**
-	 *	Submit spam that is incorrectly tagged as ham.
+	 * Submit spam that is incorrectly tagged as ham.
 	 *
-	 *	Using this function will make you a good citizen as it helps Akismet to learn from its mistakes.  This will improve the service for everybody.
+	 * Using this function will make you a good citizen as it helps Akismet to learn from its mistakes.  This will improve the service for everybody.
 	 */
 	public function submitSpam() {
 		$this->sendRequest($this->getQueryString(), $this->wordPressAPIKey . '.' . $this->akismetServer, '/' . $this->akismetVersion . '/submit-spam');
 	}
-	
+
 	/**
-	 *	Submit ham that is incorrectly tagged as spam.
+	 * Submit ham that is incorrectly tagged as spam.
 	 *
-	 *	Using this function will make you a good citizen as it helps Akismet to learn from its mistakes.  This will improve the service for everybody.
+	 * Using this function will make you a good citizen as it helps Akismet to learn from its mistakes.  This will improve the service for everybody.
 	 */
 	public function submitHam() {
 		$this->sendRequest($this->getQueryString(), $this->wordPressAPIKey . '.' . $this->akismetServer, '/' . $this->akismetVersion . '/submit-ham');
 	}
-	
+
 	/**
-	 *	To override the user IP address when submitting spam/ham later on
+	 * To override the user IP address when submitting spam/ham later on
 	 *
-	 *	@param string $userip	An IP address.  Optional.
+	 * @param string $userip	An IP address.  Optional.
 	 */
 	public function setUserIP($userip) {
 		$this->comment['user_ip'] = $userip;
 	}
-	
+
 	/**
-	 *	To override the referring page when submitting spam/ham later on
+	 * To override the referring page when submitting spam/ham later on
 	 *
-	 *	@param string $referrer	The referring page.  Optional.
+	 * @param string $referrer	The referring page.  Optional.
 	 */
 	public function setReferrer($referrer) {
 		$this->comment['referrer'] = $referrer;
 	}
-	
+
 	/**
-	 *	A permanent URL referencing the blog post the comment was submitted to.
+	 * A permanent URL referencing the blog post the comment was submitted to.
 	 *
-	 *	@param string $permalink	The URL.  Optional.
+	 * @param string $permalink	The URL.  Optional.
 	 */
 	public function setPermalink($permalink) {
 		$this->comment['permalink'] = $permalink;
 	}
-	
+
 	/**
-	 *	The type of comment being submitted.  
+	 * The type of comment being submitted.
 	 *
-	 *	May be blank, comment, trackback, pingback, or a made up value like "registration" or "wiki".
+	 * May be blank, comment, trackback, pingback, or a made up value like "registration" or "wiki".
 	 */
 	public function setCommentType($commentType) {
 		$this->comment['comment_type'] = $commentType;
 	}
-	
+
 	/**
 	 *	The name that the author submitted with the comment.
 	 */
 	public function setCommentAuthor($commentAuthor) {
 		$this->comment['comment_author'] = $commentAuthor;
 	}
-	
+
 	/**
-	 *	The email address that the author submitted with the comment.
+	 * The email address that the author submitted with the comment.
 	 *
-	 *	The address is assumed to be valid.
+	 * The address is assumed to be valid.
 	 */
 	public function setCommentAuthorEmail($authorEmail) {
 		$this->comment['comment_author_email'] = $authorEmail;
 	}
-	
+
 	/**
-	 *	The URL that the author submitted with the comment.
-	 */	
+	 * The URL that the author submitted with the comment.
+	 */
 	public function setCommentAuthorURL($authorURL) {
 		$this->comment['comment_author_url'] = $authorURL;
 	}
-	
+
 	/**
-	 *	The comment's body text.
+	 * The comment's body text.
 	 */
 	public function setCommentContent($commentBody) {
 		$this->comment['comment_content'] = $commentBody;
 	}
-	
+
 	/**
-	 *	Defaults to 80
+	 * Lets you override the user agent used to submit the comment.
+	 * you may wish to do this when submitting ham/spam.
+	 * Defaults to $_SERVER['HTTP_USER_AGENT']
+	 */
+	public function setCommentUserAgent($userAgent) {
+		$this->comment['user_agent'] = $userAgent;
+	}
+
+	/**
+	 * Defaults to 80
 	 */
 	public function setAPIPort($apiPort) {
 		$this->apiPort = $apiPort;
 	}
-	
+
 	/**
-	 *	Defaults to rest.akismet.com
+	 * Defaults to rest.akismet.com
 	 */
 	public function setAkismetServer($akismetServer) {
 		$this->akismetServer = $akismetServer;
 	}
-	
+
 	/**
-	 *	Defaults to '1.1'
+	 * Defaults to '1.1'
+	 *
+	 * @param string $akismetVersion
 	 */
 	public function setAkismetVersion($akismetVersion) {
 		$this->akismetVersion = $akismetVersion;
 	}
+
+	/**
+	 * Used by unit tests to mock transport layer
+	 *
+	 * @param AkismetRequestFactory $requestFactory
+	 */
+	public function setRequestFactory($requestFactory) {
+		$this->requestFactory = $requestFactory;
+	}
 }
 
 /**
- *	Utility class used by Akismet
+ * Used internally by Akismet
  *
- *  This class is used by Akismet to do the actual sending and receiving of data.  It opens a connection to a remote host, sends some data and the reads the response and makes it available to the calling program.
+ * This class is used by Akismet to do the actual sending and receiving of data.  It opens a connection to a remote host, sends some data and the reads the response and makes it available to the calling program.
  *
- *  The code that makes up this class originates in the Akismet WordPress plugin, which is {@link http://akismet.com/download/ available on the Akismet website}.
+ * The code that makes up this class originates in the Akismet WordPress plugin, which is {@link http://akismet.com/download/ available on the Akismet website}.
  *
- *	N.B. It is not necessary to call this class directly to use the Akismet class.  This is included here mainly out of a sense of completeness.
+ * N.B. It is not necessary to call this class directly to use the Akismet class.
  *
- *	@package	akismet
- *	@name		SocketWriteRead
- *	@version	0.1
- *  @author		Alex Potsides
- *  @link		http://www.achingbrain.net/
+ * @package	akismet
+ * @name	SocketWriteRead
+ * @version	0.5
+ * @author	Alex Potsides
+ * @link	http://www.achingbrain.net/
  */
-class SocketWriteRead {
-	private $host;
-	private $port;
-	private $request;
+class SocketWriteRead implements AkismetRequestSender {
 	private $response;
-	private $responseLength;
 	private $errorNumber;
 	private $errorString;
-	
-	/**
-	 *	@param	string	$host			The host to send/receive data.
-	 *	@param	int		$port			The port on the remote host.
-	 *	@param	string	$request		The data to send.
-	 *	@param	int		$responseLength	The amount of data to read.  Defaults to 1160 bytes.
-	 */
-	public function __construct($host, $port, $request, $responseLength = 1160) {
-		$this->host = $host;
-		$this->port = $port;
-		$this->request = $request;
-		$this->responseLength = $responseLength;
+
+	public function __construct() {
 		$this->errorNumber = 0;
 		$this->errorString = '';
 	}
-	
+
 	/**
 	 *  Sends the data to the remote host.
 	 *
+	 * @param	string	$host			The host to send/receive data.
+	 * @param	int		$port			The port on the remote host.
+	 * @param	string	$request		The data to send.
+	 * @param	int		$responseLength	The amount of data to read.  Defaults to 1160 bytes.
 	 * @throws	An exception is thrown if a connection cannot be made to the remote host.
+	 * @returns	The server response
 	 */
-	public function send() {
-		$this->response = '';
-		
-		$fs = fsockopen($this->host, $this->port, $this->errorNumber, $this->errorString, 3);
-		
+	public function send($host, $port, $request, $responseLength = 1160) {
+		$response = '';
+
+		$fs = fsockopen($host, $port, $this->errorNumber, $this->errorString, 3);
+
 		if($this->errorNumber != 0) {
-			throw new Exception('Error connecting to host: ' . $this->host . ' Error number: ' . $this->errorNumber . ' Error message: ' . $this->errorString);
+			throw new Exception('Error connecting to host: ' . $host . ' Error number: ' . $this->errorNumber . ' Error message: ' . $this->errorString);
 		}
-		
+
 		if($fs !== false) {
-			@fwrite($fs, $this->request);
-			
+			@fwrite($fs, $request);
+
 			while(!feof($fs)) {
-				$this->response .= fgets($fs, $this->responseLength);
+				$response .= fgets($fs, $responseLength);
 			}
-			
+
 			fclose($fs);
 		}
+
+		return $response;
 	}
-	
+
 	/**
-	 *  Returns the server response text
+	 * Returns the server response text
 	 *
-	 *  @return	string
+	 * @return	string
 	 */
 	public function getResponse() {
 		return $this->response;
 	}
-	
+
 	/**
-	 *	Returns the error number
+	 * Returns the error number
 	 *
-	 *	If there was no error, 0 will be returned.
+	 * If there was no error, 0 will be returned.
 	 *
-	 *	@return int
+	 * @return int
 	 */
 	public function getErrorNumner() {
 		return $this->errorNumber;
 	}
-	
+
 	/**
-	 *	Returns the error string
+	 * Returns the error string
 	 *
-	 *	If there was no error, an empty string will be returned.
+	 * If there was no error, an empty string will be returned.
 	 *
-	 *	@return string
+	 * @return string
 	 */
 	public function getErrorString() {
 		return $this->errorString;
 	}
 }
 
-?>
+/**
+ * Used internally by the Akismet class and to mock the Akismet anti spam service in
+ * the unit tests.
+ *
+ * N.B. It is not necessary to call this class directly to use the Akismet class.
+ *
+ * @package	akismet
+ * @name	SocketWriteReadFactory
+ * @version	0.5
+ * @author	Alex Potsides
+ * @link	http://www.achingbrain.net/
+ */
+class SocketWriteReadFactory implements AkismetRequestFactory {
+
+	public function createRequestSender() {
+		return new SocketWriteRead();
+	}
+}
+
+/**
+ * Used internally by the Akismet class and to mock the Akismet anti spam service in
+ * the unit tests.
+ *
+ * N.B. It is not necessary to implement this class to use the Akismet class.
+ *
+ * @package	akismet
+ * @name	AkismetRequestSender
+ * @version	0.5
+ * @author	Alex Potsides
+ * @link	http://www.achingbrain.net/
+ */
+interface AkismetRequestSender {
+
+	/**
+	 *  Sends the data to the remote host.
+	 *
+	 * @param	string	$host			The host to send/receive data.
+	 * @param	int		$port			The port on the remote host.
+	 * @param	string	$request		The data to send.
+	 * @param	int		$responseLength	The amount of data to read.  Defaults to 1160 bytes.
+	 * @throws	An exception is thrown if a connection cannot be made to the remote host.
+	 * @returns	The server response
+	 */
+	public function send($host, $port, $request, $responseLength = 1160);
+}
+
+/**
+ * Used internally by the Akismet class and to mock the Akismet anti spam service in
+ * the unit tests.
+ *
+ * N.B. It is not necessary to implement this class to use the Akismet class.
+ *
+ * @package	akismet
+ * @name	AkismetRequestFactory
+ * @version	0.5
+ * @author	Alex Potsides
+ * @link	http://www.achingbrain.net/
+ */
+interface AkismetRequestFactory {
+
+	public function createRequestSender();
+}
+
+?>

plugins/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/CSS.AllowedFonts.txt

@@ -0,0 +1,12 @@
+CSS.AllowedFonts
+TYPE: lookup/null
+VERSION: 4.3.0
+DEFAULT: NULL
+--DESCRIPTION--
+<p>
+    Allows you to manually specify a set of allowed fonts.  If
+    <code>NULL</code>, all fonts are allowed.  This directive
+    affects generic names (serif, sans-serif, monospace, cursive,
+    fantasy) as well as specific font families.
+</p>
+--# vim: et sw=4 sts=4

plugins/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/CSS.Trusted.txt

@@ -0,0 +1,9 @@
+CSS.Trusted
+TYPE: bool
+VERSION: 4.2.1
+DEFAULT: false
+--DESCRIPTION--
+Indicates whether or not the user's CSS input is trusted or not. If the
+input is trusted, a more expansive set of allowed properties.  See
+also %HTML.Trusted.
+--# vim: et sw=4 sts=4

plugins/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/Cache.SerializerPermissions.txt

@@ -0,0 +1,11 @@
+Cache.SerializerPermissions
+TYPE: int
+VERSION: 4.3.0
+DEFAULT: 0755
+--DESCRIPTION--
+
+<p>
+    Directory permissions of the files and directories created inside
+    the DefinitionCache/Serializer or other custom serializer path.
+</p>
+--# vim: et sw=4 sts=4

plugins/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.ColorKeywords.txt

@@ -24,5 +24,6 @@ array (
 --DESCRIPTION--
 
 Lookup array of color names to six digit hexadecimal number corresponding
-to color, with preceding hash mark. Used when parsing colors.
+to color, with preceding hash mark. Used when parsing colors.  The lookup
+is done in a case-insensitive manner.
 --# vim: et sw=4 sts=4

plugins/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.DisableExcludes.txt

@@ -0,0 +1,14 @@
+Core.DisableExcludes
+TYPE: bool
+DEFAULT: false
+VERSION: 4.5.0
+--DESCRIPTION--
+<p>
+  This directive disables SGML-style exclusions, e.g. the exclusion of
+  <code>&lt;object&gt;</code> in any descendant of a
+  <code>&lt;pre&gt;</code> tag.  Disabling excludes will allow some
+  invalid documents to pass through HTML Purifier, but HTML Purifier
+  will also be less likely to accidentally remove large documents during
+  processing.
+</p>
+--# vim: et sw=4 sts=4

plugins/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/Core.EnableIDNA.txt

@@ -0,0 +1,9 @@
+Core.EnableIDNA
+TYPE: bool
+DEFAULT: false
+VERSION: 4.4.0
+--DESCRIPTION--
+Allows international domain names in URLs.  This configuration option
+requires the PEAR Net_IDNA2 module to be installed.  It operates by
+punycoding any internationalized host names for maximum portability.
+--# vim: et sw=4 sts=4

plugins/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.AllowedComments.txt

@@ -0,0 +1,10 @@
+HTML.AllowedComments
+TYPE: lookup
+VERSION: 4.4.0
+DEFAULT: array()
+--DESCRIPTION--
+A whitelist which indicates what explicit comment bodies should be
+allowed, modulo leading and trailing whitespace.  See also %HTML.AllowedCommentsRegexp
+(these directives are union'ed together, so a comment is considered
+valid if any directive deems it valid.)
+--# vim: et sw=4 sts=4

plugins/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.AllowedCommentsRegexp.txt

@@ -0,0 +1,15 @@
+HTML.AllowedCommentsRegexp
+TYPE: string/null
+VERSION: 4.4.0
+DEFAULT: NULL
+--DESCRIPTION--
+A regexp, which if it matches the body of a comment, indicates that
+it should be allowed. Trailing and leading spaces are removed prior
+to running this regular expression.
+<strong>Warning:</strong> Make sure you specify
+correct anchor metacharacters <code>^regex$</code>, otherwise you may accept
+comments that you did not mean to! In particular, the regex <code>/foo|bar/</code>
+is probably not sufficiently strict, since it also allows <code>foobar</code>.
+See also %HTML.AllowedComments (these directives are union'ed together,
+so a comment is considered valid if any directive deems it valid.)
+--# vim: et sw=4 sts=4

plugins/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.Nofollow.txt

@@ -0,0 +1,7 @@
+HTML.Nofollow
+TYPE: bool
+VERSION: 4.3.0
+DEFAULT: FALSE
+--DESCRIPTION--
+If enabled, nofollow rel attributes are added to all outgoing links.
+--# vim: et sw=4 sts=4

plugins/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.SafeIframe.txt

@@ -0,0 +1,13 @@
+HTML.SafeIframe
+TYPE: bool
+VERSION: 4.4.0
+DEFAULT: false
+--DESCRIPTION--
+<p>
+    Whether or not to permit iframe tags in untrusted documents.  This
+    directive must be accompanied by a whitelist of permitted iframes,
+    such as %URI.SafeIframeRegexp, otherwise it will fatally error.
+    This directive has no effect on strict doctypes, as iframes are not
+    valid.
+</p>
+--# vim: et sw=4 sts=4

plugins/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.SafeScripting.txt

@@ -0,0 +1,10 @@
+HTML.SafeScripting
+TYPE: lookup
+VERSION: 4.5.0
+DEFAULT: array()
+--DESCRIPTION--
+<p>
+    Whether or not to permit script tags to external scripts in documents.
+    Inline scripting is not allowed, and the script must match an explicit whitelist.
+</p>
+--# vim: et sw=4 sts=4

plugins/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.TargetBlank.txt

@@ -0,0 +1,8 @@
+HTML.TargetBlank
+TYPE: bool
+VERSION: 4.4.0
+DEFAULT: FALSE
+--DESCRIPTION--
+If enabled, <code>target=blank</code> attributes are added to all outgoing links.
+(This includes links from an HTTPS version of a page to an HTTP version.)
+--# vim: et sw=4 sts=4

plugins/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/HTML.Trusted.txt

@@ -5,4 +5,5 @@ DEFAULT: false
 --DESCRIPTION--
 Indicates whether or not the user input is trusted or not. If the input is
 trusted, a more expansive set of allowed tags and attributes will be used.
+See also %CSS.Trusted.
 --# vim: et sw=4 sts=4

plugins/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/Output.FixInnerHTML.txt

@@ -0,0 +1,15 @@
+Output.FixInnerHTML
+TYPE: bool
+VERSION: 4.3.0
+DEFAULT: true
+--DESCRIPTION--
+<p>
+  If true, HTML Purifier will protect against Internet Explorer's
+  mishandling of the <code>innerHTML</code> attribute by appending
+  a space to any attribute that does not contain angled brackets, spaces
+  or quotes, but contains a backtick.  This slightly changes the
+  semantics of any given attribute, so if this is unacceptable and
+  you do not use <code>innerHTML</code> on any of your pages, you can
+  turn this directive off.
+</p>
+--# vim: et sw=4 sts=4

plugins/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.SafeIframeRegexp.txt

@@ -0,0 +1,22 @@
+URI.SafeIframeRegexp
+TYPE: string/null
+VERSION: 4.4.0
+DEFAULT: NULL
+--DESCRIPTION--
+<p>
+    A PCRE regular expression that will be matched against an iframe URI.  This is
+    a relatively inflexible scheme, but works well enough for the most common
+    use-case of iframes: embedded video.  This directive only has an effect if
+    %HTML.SafeIframe is enabled.  Here are some example values:
+</p>
+<ul>
+    <li><code>%^http://www.youtube.com/embed/%</code> - Allow YouTube videos</li>
+    <li><code>%^http://player.vimeo.com/video/%</code> - Allow Vimeo videos</li>
+    <li><code>%^http://(www.youtube.com/embed/|player.vimeo.com/video/)%</code> - Allow both</li>
+</ul>
+<p>
+    Note that this directive does not give you enough granularity to, say, disable
+    all <code>autoplay</code> videos.  Pipe up on the HTML Purifier forums if this
+    is a capability you want.
+</p>
+--# vim: et sw=4 sts=4

plugins/htmlpurifier/standalone/HTMLPurifier/Filter/ExtractStyleBlocks.php

@@ -1,5 +1,11 @@
 <?php
 
+// why is this a top level function? Because PHP 5.2.0 doesn't seem to
+// understand how to interpret this filter if it's a static method.
+// It's all really silly, but if we go this route it might be reasonable
+// to coalesce all of these methods into one.
+function htmlpurifier_filter_extractstyleblocks_muteerrorhandler() {}
+
 /**
  * This filter extracts <style> blocks from input HTML, cleans them up
  * using CSSTidy, and then places them in $purifier->context->get('StyleBlocks')
@@ -21,8 +27,16 @@ class HTMLPurifier_Filter_ExtractStyleBlocks extends HTMLPurifier_Filter
     private $_styleMatches = array();
     private $_tidy;
 
+    private $_id_attrdef;
+    private $_class_attrdef;
+    private $_enum_attrdef;
+
     public function __construct() {
         $this->_tidy = new csstidy();
+        $this->_tidy->set_cfg('lowercase_s', false);
+        $this->_id_attrdef = new HTMLPurifier_AttrDef_HTML_ID(true);
+        $this->_class_attrdef = new HTMLPurifier_AttrDef_CSS_Ident();
+        $this->_enum_attrdef = new HTMLPurifier_AttrDef_Enum(array('first-child', 'link', 'visited', 'active', 'hover', 'focus'));
     }
 
     /**
@@ -77,27 +91,166 @@ class HTMLPurifier_Filter_ExtractStyleBlocks extends HTMLPurifier_Filter
             $css = substr($css, 0, -3);
         }
         $css = trim($css);
+        set_error_handler('htmlpurifier_filter_extractstyleblocks_muteerrorhandler');
         $this->_tidy->parse($css);
+        restore_error_handler();
         $css_definition = $config->getDefinition('CSS');
+        $html_definition = $config->getDefinition('HTML');
+        $new_css = array();
         foreach ($this->_tidy->css as $k => $decls) {
             // $decls are all CSS declarations inside an @ selector
             $new_decls = array();
             foreach ($decls as $selector => $style) {
                 $selector = trim($selector);
                 if ($selector === '') continue; // should not happen
-                if ($selector[0] === '+') {
-                    if ($selector !== '' && $selector[0] === '+') continue;
-                }
-                if (!empty($scopes)) {
-                    $new_selector = array(); // because multiple ones are possible
-                    $selectors = array_map('trim', explode(',', $selector));
-                    foreach ($scopes as $s1) {
-                        foreach ($selectors as $s2) {
-                            $new_selector[] = "$s1 $s2";
+                // Parse the selector
+                // Here is the relevant part of the CSS grammar:
+                //
+                // ruleset
+                //   : selector [ ',' S* selector ]* '{' ...
+                // selector
+                //   : simple_selector [ combinator selector | S+ [ combinator? selector ]? ]?
+                // combinator
+                //   : '+' S*
+                //   : '>' S*
+                // simple_selector
+                //   : element_name [ HASH | class | attrib | pseudo ]*
+                //   | [ HASH | class | attrib | pseudo ]+
+                // element_name
+                //   : IDENT | '*'
+                //   ;
+                // class
+                //   : '.' IDENT
+                //   ;
+                // attrib
+                //   : '[' S* IDENT S* [ [ '=' | INCLUDES | DASHMATCH ] S*
+                //     [ IDENT | STRING ] S* ]? ']'
+                //   ;
+                // pseudo
+                //   : ':' [ IDENT | FUNCTION S* [IDENT S*]? ')' ]
+                //   ;
+                //
+                // For reference, here are the relevant tokens:
+                //
+                // HASH         #{name}
+                // IDENT        {ident}
+                // INCLUDES     ==
+                // DASHMATCH    |=
+                // STRING       {string}
+                // FUNCTION     {ident}\(
+                //
+                // And the lexical scanner tokens
+                //
+                // name         {nmchar}+
+                // nmchar       [_a-z0-9-]|{nonascii}|{escape}
+                // nonascii     [\240-\377]
+                // escape       {unicode}|\\[^\r\n\f0-9a-f]
+                // unicode      \\{h}}{1,6}(\r\n|[ \t\r\n\f])?
+                // ident        -?{nmstart}{nmchar*}
+                // nmstart      [_a-z]|{nonascii}|{escape}
+                // string       {string1}|{string2}
+                // string1      \"([^\n\r\f\\"]|\\{nl}|{escape})*\"
+                // string2      \'([^\n\r\f\\"]|\\{nl}|{escape})*\'
+                //
+                // We'll implement a subset (in order to reduce attack
+                // surface); in particular:
+                //
+                //      - No Unicode support
+                //      - No escapes support
+                //      - No string support (by proxy no attrib support)
+                //      - element_name is matched against allowed
+                //        elements (some people might find this
+                //        annoying...)
+                //      - Pseudo-elements one of :first-child, :link,
+                //        :visited, :active, :hover, :focus
+
+                // handle ruleset
+                $selectors = array_map('trim', explode(',', $selector));
+                $new_selectors = array();
+                foreach ($selectors as $sel) {
+                    // split on +, > and spaces
+                    $basic_selectors = preg_split('/\s*([+> ])\s*/', $sel, -1, PREG_SPLIT_DELIM_CAPTURE);
+                    // even indices are chunks, odd indices are
+                    // delimiters
+                    $nsel = null;
+                    $delim = null; // guaranteed to be non-null after
+                                   // two loop iterations
+                    for ($i = 0, $c = count($basic_selectors); $i < $c; $i++) {
+                        $x = $basic_selectors[$i];
+                        if ($i % 2) {
+                            // delimiter
+                            if ($x === ' ') {
+                                $delim = ' ';
+                            } else {
+                                $delim = ' ' . $x . ' ';
+                            }
+                        } else {
+                            // simple selector
+                            $components = preg_split('/([#.:])/', $x, -1, PREG_SPLIT_DELIM_CAPTURE);
+                            $sdelim = null;
+                            $nx = null;
+                            for ($j = 0, $cc = count($components); $j < $cc; $j ++) {
+                                $y = $components[$j];
+                                if ($j === 0) {
+                                    if ($y === '*' || isset($html_definition->info[$y = strtolower($y)])) {
+                                        $nx = $y;
+                                    } else {
+                                        // $nx stays null; this matters
+                                        // if we don't manage to find
+                                        // any valid selector content,
+                                        // in which case we ignore the
+                                        // outer $delim
+                                    }
+                                } elseif ($j % 2) {
+                                    // set delimiter
+                                    $sdelim = $y;
+                                } else {
+                                    $attrdef = null;
+                                    if ($sdelim === '#') {
+                                        $attrdef = $this->_id_attrdef;
+                                    } elseif ($sdelim === '.') {
+                                        $attrdef = $this->_class_attrdef;
+                                    } elseif ($sdelim === ':') {
+                                        $attrdef = $this->_enum_attrdef;
+                                    } else {
+                                        throw new HTMLPurifier_Exception('broken invariant sdelim and preg_split');
+                                    }
+                                    $r = $attrdef->validate($y, $config, $context);
+                                    if ($r !== false) {
+                                        if ($r !== true) {
+                                            $y = $r;
+                                        }
+                                        if ($nx === null) {
+                                            $nx = '';
+                                        }
+                                        $nx .= $sdelim . $y;
+                                    }
+                                }
+                            }
+                            if ($nx !== null) {
+                                if ($nsel === null) {
+                                    $nsel = $nx;
+                                } else {
+                                    $nsel .= $delim . $nx;
+                                }
+                            } else {
+                                // delimiters to the left of invalid
+                                // basic selector ignored
+                            }
+                        }
+                    }
+                    if ($nsel !== null) {
+                        if (!empty($scopes)) {
+                            foreach ($scopes as $s) {
+                                $new_selectors[] = "$s $nsel";
+                            }
+                        } else {
+                            $new_selectors[] = $nsel;
                         }
                     }
-                    $selector = implode(', ', $new_selector); // now it's a string
                 }
+                if (empty($new_selectors)) continue;
+                $selector = implode(', ', $new_selectors);
                 foreach ($style as $name => $value) {
                     if (!isset($css_definition->info[$name])) {
                         unset($style[$name]);
@@ -110,10 +263,11 @@ class HTMLPurifier_Filter_ExtractStyleBlocks extends HTMLPurifier_Filter
                 }
                 $new_decls[$selector] = $style;
             }
-            $this->_tidy->css[$k] = $new_decls;
+            $new_css[$k] = $new_decls;
         }
         // remove stuff that shouldn't be used, could be reenabled
         // after security risks are analyzed
+        $this->_tidy->css = $new_css;
         $this->_tidy->import = array();
         $this->_tidy->charset = null;
         $this->_tidy->namespace = null;

plugins/htmlpurifier/standalone/HTMLPurifier/Filter/LocalMovie.php

@@ -1,36 +0,0 @@
-<?php
-
-class HTMLPurifier_Filter_LocalMovie extends HTMLPurifier_Filter
-{
-    public $name = 'LocalMovie';
-
-    public function preFilter($html, $config, $context) {
-        $localhost = BX_DOL_URL_ROOT . "flash/XML.php"; 
-        $pre_regex = '#<object[^>]+>.+?'.$localhost.'([A-Za-z0-9\-_;&=\.]+).+?</object>#s';
-        $pre_replace = '<span class="localmovie-embed">\1</span>';
-        return preg_replace($pre_regex, $pre_replace, $html);
-    }
-    
-    public function postFilter($html, $config, $context) {
-        $localhost = BX_DOL_URL_ROOT . "flash/XML.php";
-        $post_regex = '#<span class="localmovie-embed">([A-Za-z0-9\-_;&=\.]+)(module=)([A-Za-z0-9]+)([A-Za-z0-9\-_;&=\.]+)</span>#';
-        $post_replace = '<object style="display:block;" width="486" height="400" data="'.BX_DOL_URL_ROOT.'flash/modules/global/app/holder_as3.swf">'.
-            '<param name="movie" value="'.BX_DOL_URL_ROOT.'flash/modules/global/app/holder_as3.swf"></param>'.
-            '<param name="allowScriptAccess" value="always"></param>'.
-            '<param name="allowFullScreen" value="true"></param>'.
-            '<param name="base" value="'.BX_DOL_URL_ROOT.'flash/modules/\3/"></param>'.
-            '<param name="bgcolor" value="#FFFFFF"></param>'.
-            '<param name="wmode" value="opaque"></param>'.
-            '<param name="flashVars" value="url='.$localhost.'\1\2\3\4"></param>'.
-            '<embed src="'.BX_DOL_URL_ROOT.'flash/modules/global/app/holder_as3.swf"'.
-            ' type="application/x-shockwave-flash"'.
-            ' width="486" height="400"'.
-            ' allowScriptAccess="always" allowFullScreen="true"'.
-            ' base="'.BX_DOL_URL_ROOT.'flash/modules/\3/"'.
-            ' bgcolor="#FFFFFF" wmode="opaque"'.
-            ' flashVars="url='.$localhost.'\1\2\3\4"></embed>'.
-            '</object>';
-        return preg_replace($post_regex, $post_replace, $html);
-    }
-    
-}

plugins/htmlpurifier/standalone/HTMLPurifier/Filter/YouTube.php

@@ -0,0 +1,39 @@
+<?php
+
+class HTMLPurifier_Filter_YouTube extends HTMLPurifier_Filter
+{
+
+    public $name = 'YouTube';
+
+    public function preFilter($html, $config, $context) {
+        $pre_regex = '#<object[^>]+>.+?'.
+            'http://www.youtube.com/((?:v|cp)/[A-Za-z0-9\-_=]+).+?</object>#s';
+        $pre_replace = '<span class="youtube-embed">\1</span>';
+        return preg_replace($pre_regex, $pre_replace, $html);
+    }
+
+    public function postFilter($html, $config, $context) {
+        $post_regex = '#<span class="youtube-embed">((?:v|cp)/[A-Za-z0-9\-_=]+)</span>#';
+        return preg_replace_callback($post_regex, array($this, 'postFilterCallback'), $html);
+    }
+
+    protected function armorUrl($url) {
+        return str_replace('--', '-&#45;', $url);
+    }
+
+    protected function postFilterCallback($matches) {
+        $url = $this->armorUrl($matches[1]);
+        return '<object width="425" height="350" type="application/x-shockwave-flash" '.
+            'data="http://www.youtube.com/'.$url.'">'.
+            '<param name="movie" value="http://www.youtube.com/'.$url.'"></param>'.
+            '<!--[if IE]>'.
+            '<embed src="http://www.youtube.com/'.$url.'"'.
+            'type="application/x-shockwave-flash"'.
+            'wmode="transparent" width="425" height="350" />'.
+            '<![endif]-->'.
+            '</object>';
+
+    }
+}
+
+// vim: et sw=4 sts=4

plugins/htmlpurifier/standalone/HTMLPurifier/Lexer/PEARSax3.php

@@ -1,139 +0,0 @@
-<?php
-
-/**
- * Proof-of-concept lexer that uses the PEAR package XML_HTMLSax3 to parse HTML.
- *
- * PEAR, not suprisingly, also has a SAX parser for HTML.  I don't know
- * very much about implementation, but it's fairly well written.  However, that
- * abstraction comes at a price: performance. You need to have it installed,
- * and if the API changes, it might break our adapter. Not sure whether or not
- * it's UTF-8 aware, but it has some entity parsing trouble (in all areas,
- * text and attributes).
- *
- * Quite personally, I don't recommend using the PEAR class, and the defaults
- * don't use it. The unit tests do perform the tests on the SAX parser too, but
- * whatever it does for poorly formed HTML is up to it.
- *
- * @todo Generalize so that XML_HTMLSax is also supported.
- *
- * @warning Entity-resolution inside attributes is broken.
- */
-
-class HTMLPurifier_Lexer_PEARSax3 extends HTMLPurifier_Lexer
-{
-
-    /**
-     * Internal accumulator array for SAX parsers.
-     */
-    protected $tokens = array();
-    protected $last_token_was_empty;
-
-    private $parent_handler;
-    private $stack = array();
-
-    public function tokenizeHTML($string, $config, $context) {
-
-        $this->tokens = array();
-        $this->last_token_was_empty = false;
-
-        $string = $this->normalize($string, $config, $context);
-
-        $this->parent_handler = set_error_handler(array($this, 'muteStrictErrorHandler'));
-
-        $parser = new XML_HTMLSax3();
-        $parser->set_object($this);
-        $parser->set_element_handler('openHandler','closeHandler');
-        $parser->set_data_handler('dataHandler');
-        $parser->set_escape_handler('escapeHandler');
-
-        // doesn't seem to work correctly for attributes
-        $parser->set_option('XML_OPTION_ENTITIES_PARSED', 1);
-
-        $parser->parse($string);
-
-        restore_error_handler();
-
-        return $this->tokens;
-
-    }
-
-    /**
-     * Open tag event handler, interface is defined by PEAR package.
-     */
-    public function openHandler(&$parser, $name, $attrs, $closed) {
-        // entities are not resolved in attrs
-        foreach ($attrs as $key => $attr) {
-            $attrs[$key] = $this->parseData($attr);
-        }
-        if ($closed) {
-            $this->tokens[] = new HTMLPurifier_Token_Empty($name, $attrs);
-            $this->last_token_was_empty = true;
-        } else {
-            $this->tokens[] = new HTMLPurifier_Token_Start($name, $attrs);
-        }
-        $this->stack[] = $name;
-        return true;
-    }
-
-    /**
-     * Close tag event handler, interface is defined by PEAR package.
-     */
-    public function closeHandler(&$parser, $name) {
-        // HTMLSax3 seems to always send empty tags an extra close tag
-        // check and ignore if you see it:
-        // [TESTME] to make sure it doesn't overreach
-        if ($this->last_token_was_empty) {
-            $this->last_token_was_empty = false;
-            return true;
-        }
-        $this->tokens[] = new HTMLPurifier_Token_End($name);
-        if (!empty($this->stack)) array_pop($this->stack);
-        return true;
-    }
-
-    /**
-     * Data event handler, interface is defined by PEAR package.
-     */
-    public function dataHandler(&$parser, $data) {
-        $this->last_token_was_empty = false;
-        $this->tokens[] = new HTMLPurifier_Token_Text($data);
-        return true;
-    }
-
-    /**
-     * Escaped text handler, interface is defined by PEAR package.
-     */
-    public function escapeHandler(&$parser, $data) {
-        if (strpos($data, '--') === 0) {
-            // remove trailing and leading double-dashes
-            $data = substr($data, 2);
-            if (strlen($data) >= 2 && substr($data, -2) == "--") {
-                $data = substr($data, 0, -2);
-            }
-            if (isset($this->stack[sizeof($this->stack) - 1]) &&
-                $this->stack[sizeof($this->stack) - 1] == "style") {
-                $this->tokens[] = new HTMLPurifier_Token_Text($data);
-            } else {
-                $this->tokens[] = new HTMLPurifier_Token_Comment($data);
-            }
-            $this->last_token_was_empty = false;
-        }
-        // CDATA is handled elsewhere, but if it was handled here:
-        //if (strpos($data, '[CDATA[') === 0) {
-        //    $this->tokens[] = new HTMLPurifier_Token_Text(
-        //        substr($data, 7, strlen($data) - 9) );
-        //}
-        return true;
-    }
-
-    /**
-     * An error handler that mutes strict errors
-     */
-    public function muteStrictErrorHandler($errno, $errstr, $errfile=null, $errline=null, $errcontext=null) {
-        if ($errno == E_STRICT) return;
-        return call_user_func($this->parent_handler, $errno, $errstr, $errfile, $errline, $errcontext);
-    }
-
-}
-
-// vim: et sw=4 sts=4

plugins/phpids/IDS/.htaccess

@@ -0,0 +1,5 @@
+# in case PHPIDS is placed in the web-root
+deny from all
+
+# silence is golden
+php_flag display_errors off

plugins/phpids/IDS/Caching/Apc.php

@@ -4,7 +4,7 @@
  * 
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by

plugins/phpids/IDS/Caching/Database.php

@@ -5,7 +5,7 @@
  * 
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by

plugins/phpids/IDS/Caching/Factory.php

@@ -5,7 +5,7 @@
  * 
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by

plugins/phpids/IDS/Caching/File.php

@@ -5,7 +5,7 @@
  * 
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by

plugins/phpids/IDS/Caching/Interface.php

@@ -5,7 +5,7 @@
  * 
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by

plugins/phpids/IDS/Caching/Memcached.php

@@ -5,7 +5,7 @@
  * 
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by

plugins/phpids/IDS/Caching/Session.php

@@ -5,7 +5,7 @@
  * 
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by

plugins/phpids/IDS/Config/Config.ini.php

@@ -1,89 +1,89 @@
-; <?php die(); ?>
-
-; PHPIDS Config.ini
-
-; General configuration settings
-
-
-[General]
-
-    ; basic settings - customize to make the PHPIDS work at all
-    filter_type     = xml
-    
-    base_path       = /full/path/to/IDS/ 
-    use_base_path   = false
-    
-    filter_path     = default_filter.xml
-    tmp_path        = tmp
-    scan_keys       = false
-    
-    ; in case you want to use a different HTMLPurifier source, specify it here
-    ; By default, those files are used that are being shipped with PHPIDS
-    HTML_Purifier_Path	= vendors/htmlpurifier/HTMLPurifier.auto.php
-    HTML_Purifier_Cache = vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer
-    
-    ; define which fields contain html and need preparation before 
-    ; hitting the PHPIDS rules (new in PHPIDS 0.5)
-    html[]          = POST.__wysiwyg
-    
-    ; define which fields contain JSON data and should be treated as such 
-    ; for fewer false positives (new in PHPIDS 0.5.3)
-    json[]          = POST.__jsondata
-
-    ; define which fields shouldn't be monitored (a[b]=c should be referenced via a.b)
-    exceptions[]    = GET.__utmz
-    exceptions[]    = GET.__utmc
-
-    ; you can use regular expressions for wildcard exceptions - example: /.*foo/i
-
-    ; PHPIDS should run with PHP 5.1.2 but this is untested - set 
-    ; this value to force compatibilty with minor versions
-    min_php_version = 5.1.6
-
-; If you use the PHPIDS logger you can define specific configuration here
-
-[Logging]
-
-    ; file logging
-    path            = tmp/phpids_log.txt
-
-    ; email logging
-
-    ; note that enabling safemode you can prevent spam attempts,
-    ; see documentation
-    recipients[]    = test@test.com.invalid
-    subject         = "PHPIDS detected an intrusion attempt!"
-    header			= "From: <PHPIDS> info@php-ids.org"
-    envelope        = ""
-    safemode        = true
-    urlencode       = true
-    allowed_rate    = 15
-
-    ; database logging
-
-    wrapper         = "mysql:host=localhost;port=3306;dbname=phpids"
-    user            = phpids_user
-    password        = 123456
-    table           = intrusions
-
-; If you would like to use other methods than file caching you can configure them here
-
-[Caching]
-
-    ; caching:      session|file|database|memcached|none
-    caching         = file 
-    expiration_time = 600
-
-    ; file cache    
-    path            = tmp/default_filter.cache
-
-    ; database cache
-    wrapper         = "mysql:host=localhost;port=3306;dbname=phpids"   
-    user            = phpids_user
-    password        = 123456
-    table           = cache  
-
-    ; memcached     
-    ;host           = localhost
-    ;port           = 11211
-    ;key_prefix     = PHPIDS
+; <?php die(); ?>
+
+; PHPIDS Config.ini
+
+; General configuration settings
+
+
+[General]
+
+    ; basic settings - customize to make the PHPIDS work at all
+    filter_type     = xml
+    
+    base_path       = /full/path/to/IDS/ 
+    use_base_path   = false
+    
+    filter_path     = default_filter.xml
+    tmp_path        = tmp
+    scan_keys       = false
+    
+    ; in case you want to use a different HTMLPurifier source, specify it here
+    ; By default, those files are used that are being shipped with PHPIDS
+    HTML_Purifier_Path	= vendors/htmlpurifier/HTMLPurifier.auto.php
+    HTML_Purifier_Cache = vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer
+    
+    ; define which fields contain html and need preparation before 
+    ; hitting the PHPIDS rules (new in PHPIDS 0.5)
+    ;html[]          = POST.__wysiwyg
+    
+    ; define which fields contain JSON data and should be treated as such 
+    ; for fewer false positives (new in PHPIDS 0.5.3)
+    ;json[]          = POST.__jsondata
+
+    ; define which fields shouldn't be monitored (a[b]=c should be referenced via a.b)
+    exceptions[]    = GET.__utmz
+    exceptions[]    = GET.__utmc
+
+    ; you can use regular expressions for wildcard exceptions - example: /.*foo/i
+
+    ; PHPIDS should run with PHP 5.1.2 but this is untested - set 
+    ; this value to force compatibilty with minor versions
+    min_php_version = 5.1.6
+
+; If you use the PHPIDS logger you can define specific configuration here
+
+[Logging]
+
+    ; file logging
+    path            = tmp/phpids_log.txt
+
+    ; email logging
+
+    ; note that enabling safemode you can prevent spam attempts,
+    ; see documentation
+    recipients[]    = test@test.com.invalid
+    subject         = "PHPIDS detected an intrusion attempt!"
+    header			= "From: <PHPIDS> info@phpids.org"
+    envelope        = ""
+    safemode        = true
+    urlencode       = true
+    allowed_rate    = 15
+
+    ; database logging
+
+    wrapper         = "mysql:host=localhost;port=3306;dbname=phpids"
+    user            = phpids_user
+    password        = 123456
+    table           = intrusions
+
+; If you would like to use other methods than file caching you can configure them here
+
+[Caching]
+
+    ; caching:      session|file|database|memcached|none
+    caching         = file 
+    expiration_time = 600
+
+    ; file cache    
+    path            = tmp/default_filter.cache
+
+    ; database cache
+    wrapper         = "mysql:host=localhost;port=3306;dbname=phpids"   
+    user            = phpids_user
+    password        = 123456
+    table           = cache  
+
+    ; memcached     
+    ;host           = localhost
+    ;port           = 11211
+    ;key_prefix     = PHPIDS

plugins/phpids/IDS/Converter.php

@@ -5,7 +5,7 @@
  *
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by
@@ -75,26 +75,6 @@ class IDS_Converter
         return $value;
     }
 
-    /**
-     * Make sure the value to normalize and monitor doesn't contain 
-     * possibilities for a regex DoS.
-     * 
-     * @param string $value the value to pre-sanitize
-     *
-     * @static
-     * @return string
-     */
-    public static function convertFromRepetition($value) 
-    {
-        // remove obvios repetition patterns
-        $value = preg_replace(
-            '/(?:(.{2,})\1{32,})|(?:[+=|\-@\s]{128,})/', 
-            'x', 
-            $value
-        );
-        return $value;
-    }
-
     /**
      * Check for comments and erases them if available
      *
@@ -123,6 +103,8 @@ class IDS_Converter
         $value = preg_replace('/(<\w+)\/+(\w+=?)/m', '$1/$2', $value);
         $value = preg_replace('/[^\\\:]\/\/(.*)$/m', '/**/$1', $value);
         $value = preg_replace('/([^\-&])#.*[\r\n\v\f]/m', '$1', $value);
+        $value = preg_replace('/([^&\-])#.*\n/m', '$1 ', $value);
+        $value = preg_replace('/^#.*\n/m', ' ', $value);
 
         return $value;
     }
@@ -265,8 +247,8 @@ class IDS_Converter
         }
         // normalize obfuscated protocol handlers
         $value = preg_replace(
-            '/(?:j\s*a\s*v\s*a\s*s\s*c\s*r\s*i\s*p\s*t\s*)|(d\s*a\s*t\s*a\s*)/ms', 
-            'javascript', $value
+            '/(?:j\s*a\s*v\s*a\s*s\s*c\s*r\s*i\s*p\s*t\s*:)|(d\s*a\s*t\s*a\s*:)/ms', 
+            'javascript:', $value
         );
         
         return $value;
@@ -304,7 +286,7 @@ class IDS_Converter
     {
         $matches = array();
         if(preg_match_all('/(?:(?:\A|[^\d])0x[a-f\d]{3,}[a-f\d]*)+/im', $value, $matches)) {
-        	foreach($matches[0] as $match) {
+            foreach($matches[0] as $match) {
                 $converted = '';
                 foreach(str_split($match, 2) as $hex_index) {
                     if(preg_match('/[a-f\d]{2,3}/i', $hex_index)) {
@@ -334,20 +316,14 @@ class IDS_Converter
             '(?:(?:^|\W)in[+\s]*\([\s\d"]+[^()]*\))/ims');
         $value   = preg_replace($pattern, '"=0', $value);
         
-        $value   = preg_replace('/\W+\s*like\s*\W+/ims', '1" OR "1"', $value);
-        $value   = preg_replace('/null[,"\s]/ims', ',0', $value);
+        $value   = preg_replace('/[^\w\)]+\s*like\s*[^\w\s]+/ims', '1" OR "1"', $value);
+        $value   = preg_replace('/null([,"\s])/ims', '0$1', $value);
         $value   = preg_replace('/\d+\./ims', ' 1', $value);
         $value   = preg_replace('/,null/ims', ',0', $value);
-        $value   = preg_replace('/(?:between|mod)/ims', 'or', $value);
+        $value   = preg_replace('/(?:between)/ims', 'or', $value);
         $value   = preg_replace('/(?:and\s+\d+\.?\d*)/ims', '', $value);
         $value   = preg_replace('/(?:\s+and\s+)/ims', ' or ', $value);
 
-        $pattern = array('/[^\w,(]null|\\\n|true|false|utc_time|' .
-                         'localtime(?:stamp)?|current_\w+|binary|' .
-                         '(?:(?:ascii|soundex|find_in_set|' .
-                         'md5|r?like)[+\s]*\([^()]+\))|(?:-+\d)/ims');
-        $value   = preg_replace($pattern, 0, $value);
-
         $pattern = array('/(?:not\s+between)|(?:is\s+not)|(?:not\s+in)|' .
                          '(?:xor|<>|rlike(?:\s+binary)?)|' .
                          '(?:regexp\s+binary)|' .
@@ -375,7 +351,7 @@ class IDS_Converter
             chr(0), chr(1), chr(2), chr(3), chr(4), chr(5),
             chr(6), chr(7), chr(8), chr(11), chr(12), chr(14),
             chr(15), chr(16), chr(17), chr(18), chr(19), chr(24), 
-            chr(25), chr(192), chr(193), chr(238), chr(255)
+            chr(25), chr(192), chr(193), chr(238), chr(255), '\\0'
         );
         
         $value = str_replace($search, '%00', $value);
@@ -513,7 +489,7 @@ class IDS_Converter
      */
     public static function convertFromUTF7($value)
     {
-        if(preg_match('/\+A\w+-/m', $value)) {
+        if(preg_match('/\+A\w+-?/m', $value)) {
             if (function_exists('mb_convert_encoding')) {
                 if(version_compare(PHP_VERSION, '5.2.8', '<')) {
                     $tmp_chars = str_split($value);

plugins/phpids/IDS/Event.php

@@ -5,7 +5,7 @@
  * 
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by

plugins/phpids/IDS/Filter.php

@@ -5,7 +5,7 @@
  * 
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by

plugins/phpids/IDS/Filter/Storage.php

@@ -5,7 +5,7 @@
  * 
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by

plugins/phpids/IDS/Init.php

@@ -5,7 +5,7 @@
  * 
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by

plugins/phpids/IDS/Log/Composite.php

@@ -5,7 +5,7 @@
  * 
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by

plugins/phpids/IDS/Log/Database.php

@@ -5,7 +5,7 @@
  * 
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by
@@ -46,6 +46,7 @@ require_once 'IDS/Log/Interface.php';
       `page` varchar(255) NOT null,
       `tags` varchar(128) NOT null,
       `ip` varchar(15) NOT null,
+      `ip2` varchar(15) NOT null,
       `impact` int(11) unsigned NOT null,
       `origin` varchar(15) NOT null,
       `created` datetime NOT null,
@@ -161,12 +162,11 @@ class IDS_Log_Database implements IDS_Log_Interface
             $this->table    = $config['table'];
         }
 
-        // determine correct IP address
-        if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
-            $this->ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
-        } else {
-            $this->ip = $_SERVER['REMOTE_ADDR'];
-        }
+        // determine correct IP address and concat them if necessary
+        $this->ip  = $_SERVER['REMOTE_ADDR'];
+        $this->ip2 = isset($_SERVER['HTTP_X_FORWARDED_FOR']) 
+            ? $_SERVER['HTTP_X_FORWARDED_FOR'] 
+            : '';
 
         try {
             $this->handle = new PDO(
@@ -180,8 +180,9 @@ class IDS_Log_Database implements IDS_Log_Interface
                     name,
                     value,
                     page,
-					tags,
+                    tags,
                     ip,
+                    ip2,
                     impact,
                     origin,
                     created
@@ -190,8 +191,9 @@ class IDS_Log_Database implements IDS_Log_Interface
                     :name,
                     :value,
                     :page,
-					:tags,
+                    :tags,
                     :ip,
+                    :ip2,
                     :impact,
                     :origin,
                     now()
@@ -260,6 +262,7 @@ class IDS_Log_Database implements IDS_Log_Interface
         foreach ($data as $event) {
             $page = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '';
             $ip   = $this->ip;
+            $ip2  = $this->ip2;
             
             $name   = $event->getName();
             $value  = $event->getValue();
@@ -271,6 +274,7 @@ class IDS_Log_Database implements IDS_Log_Interface
             $this->statement->bindParam('page', $page);
             $this->statement->bindParam('tags', $tags);
             $this->statement->bindParam('ip', $ip);
+            $this->statement->bindParam('ip2', $ip2);
             $this->statement->bindParam('impact', $impact);
             $this->statement->bindParam('origin', $_SERVER['SERVER_ADDR']);
 

plugins/phpids/IDS/Log/Email.php

@@ -5,7 +5,7 @@
  *
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by
@@ -215,17 +215,15 @@ class IDS_Log_Email implements IDS_Log_Interface
         * loop through all files in the tmp directory and
         * delete garbage files
         */
-        $dir            = $this->tmp_path;
+        $dir = $this->tmp_path;
         $numPrefixChars = strlen($this->file_prefix);
-        $files          = scandir($dir);
+        $files = scandir($dir);
         foreach ($files as $file) {
-            if (is_file($dir . $file)) {
+            if (is_file($dir . DIRECTORY_SEPARATOR . $file)) {
                 if (substr($file, 0, $numPrefixChars) == $this->file_prefix) {
-                    $lastModified = filemtime($dir . $file);
-
-                    if ((
-                    time() - $lastModified) > 3600) {
-                        unlink($dir . $file);
+                    $lastModified = filemtime($dir . DIRECTORY_SEPARATOR . $file);
+                    if ((time() - $lastModified) > 3600) {
+                        unlink($dir . DIRECTORY_SEPARATOR . $file);
                     }
                 }
             }

plugins/phpids/IDS/Log/File.php

@@ -5,7 +5,7 @@
  * 
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by
@@ -86,12 +86,10 @@ class IDS_Log_File implements IDS_Log_Interface
     protected function __construct($logfile) 
     {
 
-        // determine correct IP address
-        if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
-            $this->ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
-        } else {
-            $this->ip = $_SERVER['REMOTE_ADDR'];
-        }
+        // determine correct IP address and concat them if necessary
+        $this->ip = $_SERVER['REMOTE_ADDR'] .
+            (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ?
+                ' (' . $_SERVER['HTTP_X_FORWARDED_FOR'] . ')' : '');
 
         $this->logfile = $logfile;
     }
@@ -156,13 +154,14 @@ class IDS_Log_File implements IDS_Log_Interface
         }
 
         $dataString = sprintf($format,
-                              $this->ip,
-                              date('c'),
-                              $data->getImpact(),
-                              join(' ', $data->getTags()),
-                              trim($attackedParameters),
-                              urlencode($_SERVER['REQUEST_URI']),
-                              $_SERVER['SERVER_ADDR']);
+            urlencode($this->ip),
+            date('c'),
+            $data->getImpact(),
+            join(' ', $data->getTags()),
+            urlencode(trim($attackedParameters)),
+            urlencode($_SERVER['REQUEST_URI']),
+            $_SERVER['SERVER_ADDR']
+        );
 
         return $dataString;
     }

plugins/phpids/IDS/Log/Interface.php

@@ -5,7 +5,7 @@
  * 
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by

plugins/phpids/IDS/Monitor.php

@@ -5,7 +5,7 @@
  *
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by
@@ -234,12 +234,13 @@ class IDS_Monitor
      */
     public function run()
     {
+        
         if (!empty($this->request)) {
             foreach ($this->request as $key => $value) {
                 $this->_iterate($key, $value);
             }
         }
-
+         
         return $this->getReport();
     }
 
@@ -286,9 +287,10 @@ class IDS_Monitor
      */
     private function _detect($key, $value)
     {
-        
+
         // define the pre-filter
-        $prefilter = '/[^\w\s\/@!?\.]+|(?:\.\/)|(?:@@\w+)/';
+        $prefilter = '/[^\w\s\/@!?\.]+|(?:\.\/)|(?:@@\w+)' 
+            . '|(?:\+ADw)|(?:union\s+select)/i';
         
         // to increase performance, only start detection if value
         // isn't alphanumeric
@@ -301,7 +303,7 @@ class IDS_Monitor
                 return false;
             }
         }
-
+        
         // check if this field is part of the exceptions
         if (is_array($this->exceptions)) {
             foreach($this->exceptions as $exception) {
@@ -323,6 +325,11 @@ class IDS_Monitor
             && get_magic_quotes_gpc()) {
             $value = stripslashes($value);
         }
+        if(function_exists('get_magic_quotes_gpc')
+            && !get_magic_quotes_gpc() 
+            && version_compare(PHP_VERSION, '5.3.0', '>=')) {
+            $value = preg_replace('/\\\(["\'\/])/im', '$1', $value);
+        }
 
         // if html monitoring is enabled for this field - then do it!
         if (is_array($this->html) && in_array($key, $this->html, true)) {
@@ -488,11 +495,13 @@ class IDS_Monitor
          */
         $purified = preg_replace('/\s+alt="[^"]*"/m', null, $purified);
         $purified = preg_replace('/=?\s*"\s*"/m', null, $purified);
-        
         $original = preg_replace('/\s+alt="[^"]*"/m', null, $original);
         $original = preg_replace('/=?\s*"\s*"/m', null, $original);
         $original = preg_replace('/style\s*=\s*([^"])/m', 'style = "$1', $original);
         
+        # deal with oversensitive CSS normalization
+        $original = preg_replace('/(?:([\w\-]+:)+\s*([^;]+;\s*))/m', '$1$2', $original);
+        
         # strip whitespace between tags
         $original = trim(preg_replace('/>\s*</m', '><', $original));
         $purified = trim(preg_replace('/>\s*</m', '><', $purified));
@@ -513,8 +522,8 @@ class IDS_Monitor
          * Calculate the difference between the original html input
          * and the purified string.
          */
-        $array_1 = str_split(html_entity_decode(urldecode($original)));
-        $array_2 = str_split($purified);
+        $array_1 = preg_split('/(?<!^)(?!$)/u', html_entity_decode(urldecode($original)));
+        $array_2 = preg_split('/(?<!^)(?!$)/u', $purified);
 
         // create an array containing the single character differences
         $differences = array();
@@ -528,7 +537,7 @@ class IDS_Monitor
         if(intval($length) <= 10) {
             $diff = trim(join('', $differences));
         } else {
-            $diff = substr(trim(join('', $differences)), 0, strlen($original));
+            $diff = mb_substr(trim(join('', $differences)), 0, strlen($original));
         }
 
         // clean up spaces between tag delimiters
@@ -538,7 +547,7 @@ class IDS_Monitor
         $diff = preg_replace('/[^<](iframe|script|embed|object' .
             '|applet|base|img|style)/m', '<$1', $diff);
 
-        if (strlen($diff) < 4) {
+        if (mb_strlen($diff) < 4) {
             return null;
         }
 

plugins/phpids/IDS/Report.php

@@ -5,7 +5,7 @@
  *
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by

plugins/phpids/IDS/Version.php

@@ -4,7 +4,7 @@
  *
  * Requirements: PHP5, SimpleXML
  *
- * Copyright (c) 2008 PHPIDS group (http://php-ids.org)
+ * Copyright (c) 2008 PHPIDS group (https://phpids.org)
  *
  * PHPIDS is free software; you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by
@@ -45,5 +45,5 @@
  */
 abstract class IDS_Version
 {
-    const VERSION = '0.5.6';
+    const VERSION = '@@phpIdsVersion@@';
 }

plugins/phpids/IDS/default_filter.xml

@@ -11,7 +11,7 @@
     </filter>
     <filter>
         <id>2</id>
-        <rule><![CDATA[(?:"+.*[<=]\s*"[^"]+")|(?:"\w+\s*=)|(?:>\w=\/)|(?:#.+\)["\s]*>)|(?:"\s*(?:src|style|on\w+)\s*=\s*")|(?:[^"]?"[,;\s]+\w*[\[\(])]]></rule>
+        <rule><![CDATA[(?:"+.*[<=]\s*"[^"]+")|(?:"\s*\w+\s*=)|(?:>\w=\/)|(?:#.+\)["\s]*>)|(?:"\s*(?:src|style|on\w+)\s*=\s*")|(?:[^"]?"[,;\s]+\w*[\[\(])]]></rule>
         <description>finds attribute breaking injections including whitespace attacks</description>
         <tags>
             <tag>xss</tag>
@@ -71,7 +71,7 @@
     </filter>
     <filter>
         <id>8</id>
-        <rule><![CDATA[(?:\/\w*\s*\)\s*\()|(?:\(.*\/.+\/\w*\s*\))|(?:\([\w\s]+\([\w\s]+\)[\w\s]+\))|(?:(?<!(?:mozilla\/\d\.\d\s))\([^)[]+\[[^\]]+\][^)]*\))|(?:[^\s!][{([][^({[]+[{([][^}\])]+[}\])][\s+",\d]*[}\])])|(?:"\)?\]\W*\[)|(?:=\s*[^\s:;]+\s*[{([][^}\])]+[}\])];)]]></rule>
+        <rule><![CDATA[(?:\/\w*\s*\)\s*\()|(?:\([\w\s]+\([\w\s]+\)[\w\s]+\))|(?:(?<!(?:mozilla\/\d\.\d\s))\([^)[]+\[[^\]]+\][^)]*\))|(?:[^\s!][{([][^({[]+[{([][^}\])]+[}\])][\s+",\d]*[}\])])|(?:"\)?\]\W*\[)|(?:=\s*[^\s:;]+\s*[{([][^}\])]+[}\])];)]]></rule>
         <description>Detects self-executing JavaScript functions</description>
         <tags>
             <tag>xss</tag>
@@ -146,7 +146,7 @@
     </filter>
     <filter>
         <id>15</id>
-        <rule><![CDATA[([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z\/_@>\-\|])(\s*return\s*)?(?:create(?:element|attribute|textnode)|[a-z]+events?|setattribute|getelement\w+|appendchild|createrange|createcontextualfragment|removenode|parentnode|decodeuricomponent|\wettimeout|option|useragent)(?(1)[^\w%"]|(?:\s*[^@\s\w%",.+\-]))]]></rule>
+        <rule><![CDATA[([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z\/_@\-\|])(\s*return\s*)?(?:create(?:element|attribute|textnode)|[a-z]+events?|setattribute|getelement\w+|appendchild|createrange|createcontextualfragment|removenode|parentnode|decodeuricomponent|\wettimeout|(?:ms)?setimmediate|option|useragent)(?(1)[^\w%"]|(?:\s*[^@\s\w%",.+\-]))]]></rule>
         <description>Detects JavaScript DOM/miscellaneous properties and methods</description>
         <tags>
             <tag>xss</tag>
@@ -158,7 +158,7 @@
     </filter>
     <filter>
         <id>16</id>
-        <rule><![CDATA[([^*\s\w,.\/?+-]\s*)?(?<![a-mo-z]\s)(?<![a-z\/_@>])(\s*return\s*)?(?:alert|inputbox|showmodaldialog|infinity|isnan|isnull|iterator|msgbox|expression|prompt|write(?:ln)?|confirm|dialog|urn|(?:un)?eval|exec|execscript|tostring|status|execute|window|unescape|navigate|jquery|getscript|extend|prototype)(?(1)[^\w%"]|(?:\s*[^@\s\w%",.:\/+\-]))]]></rule>
+        <rule><![CDATA[([^*\s\w,.\/?+-]\s*)?(?<![a-mo-z]\s)(?<![a-z\/_@])(\s*return\s*)?(?:alert|inputbox|showmod(?:al|eless)dialog|showhelp|infinity|isnan|isnull|iterator|msgbox|executeglobal|expression|prompt|write(?:ln)?|confirm|dialog|urn|(?:un)?eval|exec|execscript|tostring|status|execute|window|unescape|navigate|jquery|getscript|extend|prototype)(?(1)[^\w%"]|(?:\s*[^@\s\w%",.:\/+\-]))]]></rule>
         <description>Detects possible includes and typical script methods</description>
         <tags>
             <tag>xss</tag>
@@ -170,7 +170,7 @@
     </filter>
     <filter>
         <id>17</id>
-        <rule><![CDATA[([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z\/_@>])(\s*return\s*)?(?:hash|name|href|navigateandfind|source|pathname|close|constructor|port|protocol|assign|replace|back|forward|document|ownerdocument|window|top|this|self|parent|frames|_?content|date|cookie|innerhtml|innertext|csstext+?|outerhtml|print|moveby|resizeto|createstylesheet|stylesheets)(?(1)[^\w%"]|(?:\s*[^@\/\s\w%.+\-]))]]></rule>
+        <rule><![CDATA[([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z\/_@])(\s*return\s*)?(?:hash|name|href|navigateandfind|source|pathname|close|constructor|port|protocol|assign|replace|back|forward|document|ownerdocument|window|top|this|self|parent|frames|_?content|date|cookie|innerhtml|innertext|csstext+?|outerhtml|print|moveby|resizeto|createstylesheet|stylesheets)(?(1)[^\w%"]|(?:\s*[^@\/\s\w%.+\-]))]]></rule>
         <description>Detects JavaScript object properties and methods</description>
         <tags>
             <tag>xss</tag>
@@ -182,7 +182,7 @@
     </filter>
     <filter>
         <id>18</id>
-        <rule><![CDATA[([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z\/_@>\-\|])(\s*return\s*)?(?:join|pop|push|reverse|reduce|concat|map|shift|sp?lice|sort|unshift)(?(1)[^\w%"]|(?:\s*[^@\s\w%,.+\-]))]]></rule>
+        <rule><![CDATA[([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z\/_@\-\|])(\s*return\s*)?(?:join|pop|push|reverse|reduce|concat|map|shift|sp?lice|sort|unshift)(?(1)[^\w%"]|(?:\s*[^@\s\w%,.+\-]))]]></rule>
         <description>Detects JavaScript array properties and methods</description>
         <tags>
             <tag>xss</tag>
@@ -194,7 +194,7 @@
     </filter>
     <filter>
         <id>19</id>
-        <rule><![CDATA[([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z\/_@>\-\|])(\s*return\s*)?(?:set|atob|btoa|charat|charcodeat|charset|concat|crypto|frames|fromcharcode|indexof|lastindexof|match|navigator|toolbar|menubar|replace|regexp|slice|split|substr|substring|escape|\w+codeuri\w*)(?(1)[^\w%"]|(?:\s*[^@\s\w%,.+\-]))]]></rule>
+        <rule><![CDATA[([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z\/_@\-\|])(\s*return\s*)?(?:set|atob|btoa|charat|charcodeat|charset|concat|crypto|frames|fromcharcode|indexof|lastindexof|match|navigator|toolbar|menubar|replace|regexp|slice|split|substr|substring|escape|\w+codeuri\w*)(?(1)[^\w%"]|(?:\s*[^@\s\w%,.+\-]))]]></rule>
         <description>Detects JavaScript string properties and methods</description>
         <tags>
             <tag>xss</tag>
@@ -206,7 +206,7 @@
     </filter>
     <filter>
         <id>20</id>
-        <rule><![CDATA[(?:\)\s*\[)|(?:\/\w*\s*\)\s*\W)|([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z_@>\|])(\s*return\s*)?(?:globalstorage|sessionstorage|postmessage|callee|constructor|content|domain|prototype|try|catch|top|call|apply|url|function|object|array|string|math|if|for\s*(?:each)?|elseif|case|switch|regex|boolean|location|settimeout|setinterval|void|setexpression|namespace|while)(?(1)[^\w%"]|(?:\s*[^@\s\w%".+\-]))]]></rule>
+        <rule><![CDATA[(?:\)\s*\[)|([^*":\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z_@\|])(\s*return\s*)?(?:globalstorage|sessionstorage|postmessage|callee|constructor|content|domain|prototype|try|catch|top|call|apply|url|function|object|array|string|math|if|for\s*(?:each)?|elseif|case|switch|regex|boolean|location|(?:ms)?setimmediate|settimeout|setinterval|void|setexpression|namespace|while)(?(1)[^\w%"]|(?:\s*[^@\s\w%".+\-\/]))]]></rule>
         <description>Detects JavaScript language constructs</description>
         <tags>
             <tag>xss</tag>
@@ -218,7 +218,7 @@
     </filter>
     <filter>
         <id>21</id>
-        <rule><![CDATA[(?:,\s*(?:alert|showmodaldialog|eval)\s*,)|(?::\s*eval\s*[^\s])|([^:\s\w,.\/?+-]\s*)?(?<![a-z\/_@])(\s*return\s*)?(?:(?:document\s*\.)?(?:.+\/)?(?:alert|eval|msgbox|showmodaldialog|prompt|write(?:ln)?|confirm|dialog|open))\s*(?:[^a-z\s\-]|(?:\s*[^\s\w,.@\/+-]))|(?:java[\s\/]*\.[\s\/]*lang)|(?:\w\s*=\s*new\s+\w+)|(?:&\s*\w+\s*\)[^,])|(?:\+[\W\d]*new\s+\w+[\W\d]*\+)|(?:document\.\w)]]></rule>
+        <rule><![CDATA[(?:,\s*(?:alert|showmodaldialog|eval)\s*,)|(?::\s*eval\s*[^\s])|([^:\s\w,.\/?+-]\s*)?(?<![a-z\/_@])(\s*return\s*)?(?:(?:document\s*\.)?(?:.+\/)?(?:alert|eval|msgbox|showmod(?:al|eless)dialog|showhelp|prompt|write(?:ln)?|confirm|dialog|open))\s*(?:[^.a-z\s\-]|(?:\s*[^\s\w,.@\/+-]))|(?:java[\s\/]*\.[\s\/]*lang)|(?:\w\s*=\s*new\s+\w+)|(?:&\s*\w+\s*\)[^,])|(?:\+[\W\d]*new\s+\w+[\W\d]*\+)|(?:document\.\w)]]></rule>
         <description>Detects very basic XSS probings</description>
         <tags>
             <tag>xss</tag>
@@ -230,7 +230,7 @@
     </filter>
     <filter>
         <id>22</id>
-        <rule><![CDATA[(?:=\s*(?:top|this|window|content|self|frames|_content))|(?:\/\s*\w*\s*[)}])|(?:[^\s]\s*=\s*script)|(?:\.\s*constructor)|(?:default\s+xml\s+namespace\s*=)|(?:\/\s*\+[^+]+\s*\+\s*\/)]]></rule>
+        <rule><![CDATA[(?:=\s*(?:top|this|window|content|self|frames|_content))|(?:\/\s*[gimx]*\s*[)}])|(?:[^\s]\s*=\s*script)|(?:\.\s*constructor)|(?:default\s+xml\s+namespace\s*=)|(?:\/\s*\+[^+]+\s*\+\s*\/)]]></rule>
         <description>Detects advanced XSS probings via Script(), RexExp, constructors and XML namespaces</description>
         <tags>
             <tag>xss</tag>
@@ -282,7 +282,7 @@
     </filter>
     <filter>
         <id>27</id>
-        <rule><![CDATA[(?:data:.*,)|(?:\w+\s*=\W*(?!https?)\w+:)|(jar:\w+:)|(=\s*"?\s*vbs(?:ript)?:)|(language\s*=\s?"?\s*vbs(?:ript)?)|on\w+\s*=\*\w+\-"?]]></rule>
+        <rule><![CDATA[(?:(?:vbs|vbscript|data):.*[,+])|(?:\w+\s*=\W*(?!https?)\w+:)|(jar:\w+:)|(=\s*"?\s*vbs(?:ript)?:)|(language\s*=\s?"?\s*vbs(?:ript)?)|on\w+\s*=\*\w+\-"?]]></rule>
         <description>Detects data: URL injections, VBS injections and common URI schemes</description>
         <tags>
             <tag>xss</tag>
@@ -436,7 +436,7 @@
     </filter>   
     <filter>
         <id>42</id>
-        <rule><![CDATA[(?:"\s*or\s*\d)|(?:\\x(?:23|27|3d))|(?:^.?"$)|(?:^.*\\".+(?<!\\)")|(?:(?:^["\\]*(?:[\d"]+|[^"]+"))+\s*(?:n?and|x?or|not|\|\||\&\&)\s*[\w"[+&!@(),.-])|(?:[^\w\s]\w+\s*[|-]\s*"\s*\w)|(?:@\w+\s+(and|or)\s*["\d]+)|(?:@[\w-]+\s(and|or)\s*[^\w\s])|(?:[^\w\s:]\s*\d\W+[^\w\s]\s*".)]]></rule>
+        <rule><![CDATA[(?:"\s*or\s*"?\d)|(?:\\x(?:23|27|3d))|(?:^.?"$)|(?:(?:^["\\]*(?:[\d"]+|[^"]+"))+\s*(?:n?and|x?or|not|\|\||\&\&)\s*[\w"[+&!@(),.-])|(?:[^\w\s]\w+\s*[|-]\s*"\s*\w)|(?:@\w+\s+(and|or)\s*["\d]+)|(?:@[\w-]+\s(and|or)\s*[^\w\s])|(?:[^\w\s:]\s*\d\W+[^\w\s]\s*".)|(?:\Winformation_schema|table_name\W)]]></rule>
         <description>Detects classic SQL injection probings 1/2</description>
         <tags>
             <tag>sqli</tag>
@@ -447,7 +447,7 @@
     </filter>  
     <filter>
         <id>43</id>
-        <rule><![CDATA[(?:"\s*\*.+(?:or|id)\W*"\d)|(?:\^")|(?:^[\w\s"-]+(?<=and\s)(?<=or\s)(?<=xor\s)(?<=nand\s)(?<=not\s)(?<=\|\|)(?<=\&\&)\w+\()|(?:"[\s\d]*[^\w\s]+\W*\d\W*.*["\d])|(?:"\s*[^\w\s?]+\s*[^\w\s]+\s*")|(?:"\s*[^\w\s]+\s*[\W\d].*(?:#|--))|(?:".*\*\s*\d)|(?:"\s*or\s[\w-]+.*\d)|(?:[()*<>%+-][\w-]+[^\w\s]+"[^,])]]></rule>
+        <rule><![CDATA[(?:"\s*\*.+(?:or|id)\W*"\d)|(?:\^")|(?:^[\w\s"-]+(?<=and\s)(?<=or\s)(?<=xor\s)(?<=nand\s)(?<=not\s)(?<=\|\|)(?<=\&\&)\w+\()|(?:"[\s\d]*[^\w\s]+\W*\d\W*.*["\d])|(?:"\s*[^\w\s?]+\s*[^\w\s]+\s*")|(?:"\s*[^\w\s]+\s*[\W\d].*(?:#|--))|(?:".*\*\s*\d)|(?:"\s*or\s[^\d]+[\w-]+.*\d)|(?:[()*<>%+-][\w-]+[^\w\s]+"[^,])]]></rule>
         <description>Detects classic SQL injection probings 2/2</description>
         <tags>
             <tag>sqli</tag>
@@ -469,7 +469,7 @@
     </filter> 
     <filter>
         <id>45</id>
-        <rule><![CDATA[(?:union\s*(?:all|distinct|[(!@]*)?\s*[([]*\s*select)|(?:\w+\s+like\s+\")|(?:like\s*"\%)|(?:"\s*like\W*["\d])|(?:"\s*(?:n?and|x?or|not |\|\||\&\&)\s+[\s\w]+=\s*\w+\s*having)|(?:"\s*\*\s*\w+\W+")|(?:"\s*[^?\w\s=.,;)(]+\s*[(@"]*\s*\w+\W+\w)|(?:select\s*[\[\]()\s\w\.,-]+from)]]></rule>
+        <rule><![CDATA[(?:union\s*(?:all|distinct|[(!@]*)?\s*[([]*\s*select)|(?:\w+\s+like\s+\")|(?:like\s*"\%)|(?:"\s*like\W*["\d])|(?:"\s*(?:n?and|x?or|not |\|\||\&\&)\s+[\s\w]+=\s*\w+\s*having)|(?:"\s*\*\s*\w+\W+")|(?:"\s*[^?\w\s=.,;)(]+\s*[(@"]*\s*\w+\W+\w)|(?:select\s*[\[\]()\s\w\.,"-]+from)|(?:find_in_set\s*\()]]></rule>
         <description>Detects basic SQL authentication bypass attempts 2/3</description>
         <tags>
             <tag>sqli</tag>
@@ -491,7 +491,7 @@
     </filter> 
     <filter>
         <id>47</id>
-        <rule><![CDATA[(?:[\d\W]\s+as\s*["\w]+\s*from)|(?:^[\W\d]+\s*(?:union|select|create|rename|truncate|load|alter|delete|update|insert|desc))|(?:(?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\s+(?:concat|char|load_file)\s?\(?)|(?:end\s*\);)|("\s+regexp\W)|(?:[\s(]load_file\s*\()]]></rule>
+        <rule><![CDATA[(?:[\d\W]\s+as\s*["\w]+\s*from)|(?:^[\W\d]+\s*(?:union|select|create|rename|truncate|load|alter|delete|update|insert|desc))|(?:(?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\s+(?:(?:group_)concat|char|load_file)\s?\(?)|(?:end\s*\);)|("\s+regexp\W)|(?:[\s(]load_file\s*\()]]></rule>
         <description>Detects concatenated basic SQL injection and SQLLFI attempts</description>
         <tags>
             <tag>sqli</tag>
@@ -502,7 +502,7 @@
     </filter>
     <filter>
         <id>48</id>
-        <rule><![CDATA[(?:\d+\s*or\s*\d+\s*[\-+])|(?:\/\w+;?\s+(?:having|and|or|select))|(?:\d\s+group\s+by.+\()|(?:(?:;|#|--)\s*(?:drop|alter))|(?:(?:;|#|--)\s*(?:update|insert)\s*\w{2,})|(?:[^\w]SET\s*@\w+)|(?:(?:n?and|x?or|not |\|\||\&\&)[\s(]+\w+[\s)]*[!=+]+[\s\d]*["=()])]]></rule>
+        <rule><![CDATA[(?:@.+=\s*\(\s*select)|(?:\d+\s*or\s*\d+\s*[\-+])|(?:\/\w+;?\s+(?:having|and|or|select)\W)|(?:\d\s+group\s+by.+\()|(?:(?:;|#|--)\s*(?:drop|alter))|(?:(?:;|#|--)\s*(?:update|insert)\s*\w{2,})|(?:[^\w]SET\s*@\w+)|(?:(?:n?and|x?or|not |\|\||\&\&)[\s(]+\w+[\s)]*[!=+]+[\s\d]*["=()])]]></rule>
         <description>Detects chained SQL injection attempts 1/2</description>
         <tags>
             <tag>sqli</tag>
@@ -572,7 +572,7 @@
     </filter>
     <filter>
         <id>55</id>
-        <rule><![CDATA[(?:\sexec\s+xp_cmdshell)|(?:"\s*!\s*["\w])|(?:from\s+information_schema\W)|(?:(?:(?:current_)?user|database|schema|connection_id)\s*\([^\)]*)|(?:";?\s*(?:select|union|having)\s*[^\s])|(?:\wiif\s*\()|(?:exec\s+master\.)|(?:union select @)|(?:union[\w(\s]*select)|(?:select.*\w?user\()|(?:into[\s+]+(?:dump|out)file\s*")]]></rule>
+        <rule><![CDATA[(?:\sexec\s+xp_cmdshell)|(?:"\s*!\s*["\w])|(?:from\W+information_schema\W)|(?:(?:(?:current_)?user|database|schema|connection_id)\s*\([^\)]*)|(?:";?\s*(?:select|union|having)\s*[^\s])|(?:\wiif\s*\()|(?:exec\s+master\.)|(?:union select @)|(?:union[\w(\s]*select)|(?:select.*\w?user\()|(?:into[\s+]+(?:dump|out)file\s*")]]></rule>
         <description>Detects MSSQL code execution and information gathering attempts</description>
         <tags>
             <tag>sqli</tag>
@@ -582,7 +582,7 @@
     </filter>
     <filter>
         <id>56</id>
-        <rule><![CDATA[(?:merge.*using\s*\()|(execute\s*immediate\s*")|(?:\W+\d*\s*having\s*[^\s])|(?:match\s*[\w(),+-]+\s*against\s*\()]]></rule>
+        <rule><![CDATA[(?:merge.*using\s*\()|(execute\s*immediate\s*")|(?:\W+\d*\s*having\s*[^\s\-])|(?:match\s*[\w(),+-]+\s*against\s*\()]]></rule>
         <description>Detects MATCH AGAINST, MERGE, EXECUTE IMMEDIATE and HAVING injections</description>
         <tags>
             <tag>sqli</tag>
@@ -592,7 +592,7 @@
     </filter>
     <filter>
         <id>57</id>
-        <rule><![CDATA[(?:,.*[)\da-f"]"(?:".*"|\Z|[^"]+))|(?:select\s*\*\s*from)|((?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\s*\(\s*space\s*\()]]></rule>
+        <rule><![CDATA[(?:,.*[)\da-f"]"(?:".*"|\Z|[^"]+))|(?:\Wselect.+\W*from)|((?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\s*\(\s*space\s*\()]]></rule>
         <description>Detects MySQL comment-/space-obfuscated injections and backtick termination</description>
         <tags>
             <tag>sqli</tag>
@@ -701,7 +701,7 @@
     <filter>
         <id>68</id>
         <rule><![CDATA[(?:[\s\/"]+[-\w\/\\\*]+\s*=.+(?:\/\s*>))]]></rule>
-        <description>finds attribute breaking injections including obfuscated attributes</description>
+        <description>Finds attribute breaking injections including obfuscated attributes</description>
         <tags>
             <tag>xss</tag>
             <tag>csrf</tag>
@@ -711,7 +711,7 @@
     <filter>
         <id>69</id>
         <rule><![CDATA[(?:(?:msgbox|eval)\s*\+|(?:language\s*=\*vbscript))]]></rule>
-        <description>finds basic VBScript injection attempts</description>
+        <description>Finds basic VBScript injection attempts</description>
         <tags>
             <tag>xss</tag>
             <tag>csrf</tag>
@@ -721,7 +721,7 @@
     <filter>
         <id>70</id>
         <rule><![CDATA[(?:\[\$(?:ne|eq|lte?|gte?|n?in|mod|all|size|exists|type|slice|or)\])]]></rule>
-        <description>finds basic MongoDB SQL injection attempts</description>
+        <description>Finds basic MongoDB SQL injection attempts</description>
         <tags>
             <tag>sqli</tag>
         </tags>
@@ -729,12 +729,71 @@
     </filter>
     <filter>
         <id>71</id>
-        <rule><![CDATA[(?:[\s\d\/"]+(?:on\w+|style|poster|background)=[$"\w])]]></rule>
-        <description>finds malicious attribute injection attempts</description>
+        <rule><![CDATA[(?:[\s\d\/"]+(?:on\w+|style|poster|background)=[$"\w])|(?:-type\s*:\s*multipart)]]></rule>
+        <description>finds malicious attribute injection attempts and MHTML attacks</description>
         <tags>
             <tag>xss</tag>
             <tag>csrf</tag>
         </tags>
         <impact>6</impact>
+    </filter>
+  <filter>
+        <id>72</id>
+        <rule><![CDATA[(?:(sleep\((\s*)(\d*)(\s*)\)|benchmark\((.*)\,(.*)\)))]]></rule>
+        <description>Detects blind sqli tests using sleep() or benchmark().</description>
+        <tags>
+            <tag>sqli</tag>
+            <tag>id</tag>
+        </tags>
+        <impact>4</impact>
+    </filter>
+    <filter>
+        <id>73</id>
+        <rule><![CDATA[(?i:(\%SYSTEMROOT\%))]]></rule>
+        <description>An attacker is trying to locate a file to read or write.</description>
+        <tags>
+            <tag>files</tag>
+            <tag>id</tag>
+        </tags>
+        <impact>4</impact>
     </filter>   
+    <filter>
+        <id>74</id>
+        <rule><![CDATA[(?i:(ping(.*)[\-(.*)\w|\w(.*)\-]))]]></rule>
+        <description>Detects remote code exectuion tests. Will match "ping -n 3 localhost" and "ping localhost -n 3" </description>
+        <tags>
+            <tag>Command Execution</tag>
+            <tag>id</tag>
+        </tags>
+        <impact>5</impact>
+    </filter>       
+    <filter>
+        <id>75</id>
+        <rule><![CDATA[(?:(((.*)\%[c|d|i|e|f|g|o|s|u|x|p|n]){8}))]]></rule>
+        <description>Looking for a format string attack</description>
+        <tags>
+            <tag>format string</tag>
+        </tags>
+        <impact>4</impact>
+    </filter> 
+    <filter>
+        <id>76</id>
+        <rule><![CDATA[(?:(union(.*)select(.*)from))]]></rule>
+        <description>Looking for basic sql injection. Common attack string for mysql, oracle and others.</description>
+        <tags>
+            <tag>sqli</tag>
+            <tag>id</tag>
+        </tags>
+        <impact>3</impact>
+    </filter>
+    <filter>
+        <id>77</id>
+        <rule><![CDATA[(?:^(-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|2.2250738585072007e-308|1e309)$)]]></rule>
+        <description>Looking for intiger overflow attacks, these are taken from skipfish, except 2.2250738585072007e-308 is the "magic number" crash</description>
+        <tags>
+            <tag>sqli</tag>
+            <tag>id</tag>
+        </tags>
+        <impact>3</impact>
+    </filter>        
 </filters>