#53 - get rid of phpids

inc/classes/BxDolInstallerUtils.php

@@ -101,162 +101,6 @@ class BxDolInstallerUtils extends BxDolIO
             sendMail (getParam('site_email'), $aMessage['Subject'], $aMessage['Body'], 0, array(), BX_EMAIL_SYSTEM);
         }
     }
-
-    function addHtmlFields ($a)
-    {
-        $this->_addFields ('html', $a);
-    }
-
-    function removeHtmlFields ()
-    {
-        $this->_removeFields('html');
-    }
-
-    function addJsonFields ($a)
-    {
-        $this->_addFields ('json', $a);
-    }
-
-    function removeJsonFields ()
-    {
-        $this->_removeFields('json');
-    }
-
-    function addExceptionsFields ($a)
-    {
-        $this->_addFields ('exceptions', $a);
-    }
-
-    function removeExceptionsFields ()
-    {
-        $this->_removeFields('exceptions');
-    }
-
-    function updateSystemExceptions ()
-    {
-        $s = getParam('sys_exceptions_fields');
-        if (!$s) {
-            $a = array ();
-        } else {
-            $a = unserialize($s);
-            unset($a['system']);
-        }
-        $a['system'] = array(
-            'COOKIE.memberSession',
-        );
-        $s = serialize ($a);
-        setParam ('sys_exceptions_fields', $s);
-        // recreate cache
-        $GLOBALS['MySQL']->cleanCache ('sys_exceptions_fields');
-        $GLOBALS['MySQL']->fromCache ('sys_exceptions_fields', 'getOne', "SELECT `VALUE` FROM `sys_options` WHERE `Name` = 'sys_exceptions_fields' LIMIT 1");
-    }
-
-    function updateEmailTemplatesExceptions ()
-    {
-        $s = getParam('sys_exceptions_fields');
-        if (!$s) {
-            $a = array ();
-        } else {
-            $a = unserialize($s);
-            unset($a['system_email_templates']);
-        }
-        $a['system_email_templates'] = $this->_getEmailTemplatesHtmlFields();
-        $s = serialize ($a);
-        setParam ('sys_exceptions_fields', $s);
-        // recreate cache
-        $oDb = BxDolDb::getInstance();
-        $oDb->cleanCache ('sys_exceptions_fields');
-        $oDb->fromCache ('sys_exceptions_fields', 'getOne', "SELECT `VALUE` FROM `sys_options` WHERE `Name` = 'sys_exceptions_fields' LIMIT 1");
-    }
-
-    function updateProfileFieldsHtml ()
-    {
-        $s = getParam('sys_html_fields');
-        if (!$s) {
-            $a = array ();
-        } else {
-            $a = unserialize($s);
-            unset($a['system_profile_html']);
-        }
-        $a['system_profile_html'] = $this->_getSystemProfileHtmlFields();
-        $s = serialize ($a);
-        setParam ('sys_html_fields', $s);
-        // recreate cache
-        $oDb = BxDolDb::getInstance();
-        $oDb->cleanCache ('sys_html_fields');
-        $oDb->fromCache ('sys_html_fields', 'getOne', "SELECT `VALUE` FROM `sys_options` WHERE `Name` = 'sys_html_fields' LIMIT 1");
-    }
-
-    //--- Protected methods ---//
-
-    function _getEmailTemplatesHtmlFields ()
-    {
-        $oDb = BxDolDb::getInstance();
-        $aRet = array ();
-        $a = $oDb->getAll ("SELECT `Name` FROM `sys_email_templates`");
-        foreach ($a as $r) {
-            $aRet[] = 'POST.' . $r['Name'] . '_Body';
-            $aRet[] = 'REQUEST.' . $r['Name'] . '_Body';
-            $aRet[] = 'POST.' . $r['Name'] . '_Subject';
-            $aRet[] = 'REQUEST.' . $r['Name'] . '_Subject';
-        }
-        return $aRet;
-    }
-
-    function _getSystemProfileHtmlFields ()
-    {
-        $oDb = BxDolDb::getInstance();
-        $aRet = array ();
-        $a = $oDb->getAll ("SELECT `Name` FROM `sys_profile_fields` WHERE `Type` = 'html_area'");
-        foreach ($a as $r) {
-            $aRet[] = 'POST.' . $r['Name'];
-            $aRet[] = 'REQUEST.' . $r['Name'];
-        }
-        return $aRet;
-    }
-
-    function _addFields ($sType, $a)
-    {
-        switch ($sType) {
-        case 'html':
-        case 'json':
-        case 'exceptions':
-            break;
-        default:
-            return array();
-        }
-
-        $s = getParam("sys_{$sType}_fields");
-        if (!$s) {
-            $a = array ($this->_aConfig['home_uri'] => $a);
-        } else {
-            $a = array_merge (unserialize($s), array ($this->_aConfig['home_uri'] => $a));
-        }
-        $s = serialize ($a);
-        setParam ("sys_{$sType}_fields", $s);
-    }
-
-    function _removeFields ($sType)
-    {
-        switch ($sType) {
-        case 'html':
-        case 'json':
-        case 'exceptions':
-            break;
-        default:
-            return array();
-        }
-
-        $s = getParam("sys_{$sType}_fields");
-        if (!$s) {
-            return;
-        }
-        $a = unserialize($s);
-        unset ($a[$this->_aConfig['home_uri']]);
-        $s = serialize ($a);
-        setParam ("sys_{$sType}_fields", $s);
-    }
-
 }
 
 /** @} */

inc/security.inc.php

@@ -1,138 +0,0 @@
-<?php
-/**
- * @package     Dolphin Core
- * @copyright   Copyright (c) BoonEx Pty Limited - http://www.boonex.com/
- * @license     CC-BY - http://creativecommons.org/licenses/by/3.0/
- */
-defined('BX_DOL') or die('hack attempt');
-
-// TODO: move it to bx_process_input
-
-list ($iImpactLog, $iImpactBlock) = bx_sys_security_get_impact_threshold ();
-
-if ((-1 != $iImpactLog || -1 != $iImpactBlock) && !defined('BX_DOL_CRON_EXECUTE')) {
-
-    if (version_compare(phpversion(), '5.1.6', '>=')) {
-
-        set_include_path (
-            get_include_path()
-            . PATH_SEPARATOR
-            . BX_DIRECTORY_PATH_PLUGINS . 'phpids/'
-        );
-
-        require_once 'IDS/Init.php';
-        $request = array(
-            'GET' => $_GET,
-            'POST' => $_POST,
-            'COOKIE' => $_COOKIE,
-            'PHP_SELF' => $_SERVER['PHP_SELF'],
-        );
-        $init = IDS_Init::init(BX_DIRECTORY_PATH_PLUGINS . 'phpids/IDS/Config/Config.ini');
-        $init->config['General']['base_path'] = BX_DIRECTORY_PATH_PLUGINS . 'phpids/IDS/';
-        $init->config['General']['use_base_path'] = true;
-        $init->config['General']['tmp_path'] = '../../../tmp/';
-        $init->config['Caching']['path'] = '../../../tmp/default_filter.cache';
-
-
-        if (defined('BX_SECURITY_JSON') && is_array($aBxSecurityJSON)) {
-            $init->config['General']['json'] = array_merge ($init->config['General']['json'], $aBxSecurityJSON);
-        }
-        $init->config['General']['json'] = array_merge($init->config['General']['json'], bx_sys_security_get_fields ('json'));
-
-
-        if (defined('BX_SECURITY_HTML') && is_array($aBxSecurityHTML)) {
-            $init->config['General']['html'] = array_merge ($init->config['General']['html'], $aBxSecurityHTML);
-        }
-        $init->config['General']['html'] = array_merge($init->config['General']['html'], bx_sys_security_get_fields ('html'));
-
-
-        if (defined('BX_SECURITY_EXCEPTIONS') && is_array($aBxSecurityExceptions)) {
-            $init->config['General']['exceptions'] = array_merge ($init->config['General']['exceptions'], $aBxSecurityExceptions);
-        }
-        $init->config['General']['exceptions'] = array_merge($init->config['General']['exceptions'], bx_sys_security_get_fields ('exceptions'));
-
-
-        $init->config['General']['HTML_Purifier_Path'] = BX_DIRECTORY_PATH_PLUGINS . 'htmlpurifier/HTMLPurifier.standalone.php';
-        $init->config['General']['HTML_Purifier_Cache'] = rtrim(BX_DIRECTORY_PATH_CACHE, '/');
-
-        $ids = new IDS_Monitor($request, $init);
-        $result = $ids->run();
-
-
-        if (!$result->isEmpty() && $result->getImpact() >= $iImpactLog) {
-
-            require_once(BX_DIRECTORY_PATH_INC . 'utils.inc.php');
-            require_once(BX_DIRECTORY_PATH_INC . 'db.inc.php');
-            bx_import('BxDolService');
-
-            $s = (string)$result;
-            $s .=  "\nREMOTE_ADDR: " . $_SERVER['REMOTE_ADDR'];
-            $s .=  "\nHTTP_X_FORWARDED_FOR: " . $_SERVER['HTTP_X_FORWARDED_FOR'];
-            $s .=  "\nHTTP_CLIENT_IP: " . $_SERVER['HTTP_CLIENT_IP'];
-            $s .=  "\nSCRIPT_FILENAME: " . $_SERVER['SCRIPT_FILENAME'];
-            $s .=  "\nQUERY_STRING: " . $_SERVER['QUERY_STRING'];
-            $s .=  "\nREQUEST_URI: " . $_SERVER['REQUEST_URI'];
-            $s .=  "\nQUERY_STRING: " . $_SERVER['QUERY_STRING'];
-            $s .=  "\nSCRIPT_NAME: " . $_SERVER['SCRIPT_NAME'];
-            $s .=  "\nPHP_SELF: " . $_SERVER['PHP_SELF'];
-            if ($result->getImpact() >= $iImpactBlock) {
-                sendMail(getParam('site_email_bug_report'), BX_DOL_URL_ROOT . ' -  security attack was stopped!', $s, 0, array(), BX_EMAIL_NOTIFY, 'text'); // TODO: email template
-                echo 'Possible security attack!!! All data has been collected and sent to the site owner for analysis.';
-                exit;
-            } else {
-                sendMail(getParam('site_email_bug_report'), BX_DOL_URL_ROOT . ' -  possible security attack!', $s, 0, array(), BX_EMAIL_NOTIFY, 'text'); // TODO: email template
-            }
-        }
-    } else {
-        echo 'Site security module is disabled, please upgrade to php 5.1.6 or higher to make your site secure.';
-    }
-}
-
-function bx_sys_security_get_fields ($sType) {
-
-    switch ($sType) {
-    case 'html':
-    case 'json':
-    case 'exceptions':
-        break;
-    default:
-        return array();
-    }
-
-    $sCacheFile = BX_DIRECTORY_PATH_CACHE . 'sys_options_' . bx_site_hash() . '.php';
-    if (!file_exists($sCacheFile)) {
-        require_once( BX_DIRECTORY_PATH_INC . 'utils.inc.php' );
-        require_once( BX_DIRECTORY_PATH_INC . 'db.inc.php' );
-        $mixedVar = getParam("sys_{$sType}_fields");
-    } else {
-        include $sCacheFile;
-        $mixedVar = $mixedData["sys_{$sType}_fields"];
-        $mixedData = null;
-    }
-
-    $mixedVar = unserialize ($mixedVar);
-    if (!$mixedVar || !is_array($mixedVar))
-        return array ();
-    $a = array ();
-    foreach ($mixedVar as $r)
-        $a = array_merge ($a, $r);
-
-    return $a;
-}
-
-function bx_sys_security_get_impact_threshold () {
-    // TODO: remake security to check in bx_process_input function only
-    $sCacheFile = BX_DIRECTORY_PATH_CACHE . 'sys_options_' . bx_site_hash('', true) . '.php';
-    if (!file_exists($sCacheFile)) {
-        require_once( BX_DIRECTORY_PATH_INC . 'utils.inc.php' );
-        require_once( BX_DIRECTORY_PATH_INC . 'db.inc.php' );
-        return array (getParam('sys_security_impact_threshold_log'), getParam('sys_security_impact_threshold_block'));
-    } else {
-        include $sCacheFile;
-        $iThresholdLog = $mixedData['sys_security_impact_threshold_log'];
-        $iThresholdBlock = $mixedData['sys_security_impact_threshold_block'];
-        $mixedData = null;
-        return array ($iThresholdLog, $iThresholdBlock);
-    }
-}
-

install/sql/system.sql

@@ -220,10 +220,6 @@ INSERT INTO `sys_options`(`category_id`, `name`, `caption`, `value`, `type`, `ex
 (@iCategoryId, 'sys_version', '', @sSysVersion, 'digit', '', '', '', 2),
 (@iCategoryId, 'sys_install_time', '', '0', 'digit', '', '', '', 3),
 
-(@iCategoryId, 'sys_html_fields', '', 'a:1:{s:6:"system";a:4:{i:0;s:12:"POST.message";i:1;s:15:"REQUEST.message";i:2;s:12:"POST.CmtText";i:3;s:15:"REQUEST.CmtText";}}', 'text', '', '', '', 10),
-(@iCategoryId, 'sys_json_fields', '', '', 'text', '', '', '', 11),
-(@iCategoryId, 'sys_exceptions_fields', '', '', 'text', '', '', '', 12),
-
 (@iCategoryId, 'sys_site_logo', '', '0', 'digit', '', '', '', 20),
 (@iCategoryId, 'sys_site_logo_alt', '_adm_dsg_txt_alt_text', '0', 'text', '', '', '', 21),
 (@iCategoryId, 'sys_site_icon', '', '0', 'digit', '', '', '', 22),
@@ -367,8 +363,6 @@ INSERT INTO `sys_options_categories`(`type_id`, `name`, `caption`, `hidden`, `or
 SET @iCategoryId = LAST_INSERT_ID();
 
 INSERT INTO `sys_options`(`category_id`, `name`, `caption`, `value`, `type`, `extra`, `check`, `check_error`, `order`) VALUES
-(@iCategoryId, 'sys_security_impact_threshold_log', '_adm_stg_cpt_option_sys_security_impact_threshold_log', '-1', 'digit', '', '', '', 4),
-(@iCategoryId, 'sys_security_impact_threshold_block', '_adm_stg_cpt_option_sys_security_impact_threshold_block', '-1', 'digit', '', '', '', 5),
 (@iCategoryId, 'sys_security_form_token_enable', '_adm_stg_cpt_option_sys_security_form_token_enable', 'on', 'checkbox', '', '', '', 6),
 (@iCategoryId, 'sys_security_form_token_lifetime', '_adm_stg_cpt_option_sys_security_form_token_lifetime', '86400', 'digit', '', '', '', 7),
 (@iCategoryId, 'sys_recaptcha_key_public', '_adm_stg_cpt_option_sys_recaptcha_key_public', '', 'digit', '', '', '', 14),

modules/boonex/profiler/install/installer.php

@@ -3,7 +3,7 @@
  * Copyright (c) BoonEx Pty Limited - http://www.boonex.com/
  * CC-BY License - http://creativecommons.org/licenses/by/3.0/
  * 
- * @defgroup    Persons Persons
+ * @defgroup    Profiler Profiler
  * @ingroup     DolphinModules
  *
  * @{
@@ -11,27 +11,12 @@
 
 bx_import('BxDolStudioInstaller');
 
-class BxProfilerInstaller extends BxDolStudioInstaller {
-
-    function __construct($aConfig) {
+class BxProfilerInstaller extends BxDolStudioInstaller 
+{
+    function __construct($aConfig) 
+    {
         parent::__construct($aConfig);
     }
-
-    function install($aParams, $bEnable = false) {
-
-        $aResult = parent::install($aParams, $bEnable);
-/*
-        $this->updateEmailTemplatesExceptions ();
-        $this->updateProfileFieldsHtml ();
-        $this->updateSystemExceptions ();
-*/
-        return $aResult;
-    }
-
-    function uninstall($aParams, $bDisable = false) {
-
-        return parent::uninstall($aParams, $bDisable);
-    }
 }
 
 /** @} */

plugins/phpids/IDS/.htaccess

@@ -1,5 +0,0 @@
-# in case PHPIDS is placed in the web-root
-deny from all
-
-# silence is golden
-php_flag display_errors off

plugins/phpids/IDS/Caching/Apc.php

@@ -1,151 +0,0 @@
-<?php
-/**
- * PHPIDS
- * 
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. 
- *
- * PHP version 5.1.6+
- * 
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
- 
-require_once 'IDS/Caching/Interface.php';
-
-/**
- * APC caching wrapper
- *
- * This class inhabits functionality to get and set cache via memcached.
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Yves Berkholz <godzilla80@gmx.net>
- * @copyright 2007-2009 The PHPIDS Groupoup
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @version   Release: $Id$
- * @link      http://php-ids.org/
- * @since     Version 0.6.5
- */
-class IDS_Caching_Apc implements IDS_Caching_Interface
-{
-
-    /**
-     * Caching type
-     *
-     * @var string
-     */
-    private $type = null;
-
-    /**
-     * Cache configuration
-     *
-     * @var array
-     */
-    private $config = null;
-
-    /**
-     * Flag if the filter storage has been found in memcached 
-     * 
-     * @var boolean 
-     */ 
-    private $isCached = false; 
-    
-    /**
-     * Holds an instance of this class
-     *
-     * @var object
-     */
-    private static $cachingInstance = null;
-
-
-    /**
-     * Constructor
-     *
-     * @param  string $type caching type
-     * @param  array  $init the IDS_Init object
-     * 
-     * @return void
-     */
-    public function __construct($type, $init) 
-    {
-
-        $this->type   = $type;
-        $this->config = $init->config['Caching'];
-    }
-
-    /**
-     * Returns an instance of this class
-     *
-     * @param  string $type caching type
-     * @param  object $init the IDS_Init object
-     * 
-     * @return object $this
-     */
-    public static function getInstance($type, $init) 
-    {
-
-        if (!self::$cachingInstance) {
-            self::$cachingInstance = new IDS_Caching_Apc($type, $init);
-        }
-
-        return self::$cachingInstance;
-    }
-
-    /**
-     * Writes cache data
-     *
-     * @param  array $data the caching data
-     * 
-     * @return object $this
-     */
-    public function setCache(array $data) 
-    {
-        if(!$this->isCached)
-            apc_store($this->config['key_prefix'] . '.storage', 
-            	$data, $this->config['expiration_time']);
-        return $this;
-    }
-
-    /**
-     * Returns the cached data
-     *
-     * Note that this method returns false if either type or file cache is 
-     * not set
-     *
-     * @return mixed cache data or false
-     */
-    public function getCache() 
-    {
-       $data = apc_fetch($this->config['key_prefix'] . '.storage');
-       $this->isCached = !empty($data); 
-       return $data;
-    }
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Caching/Database.php

@@ -1,291 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- * 
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. 
- *
- * PHP version 5.1.6+
- * 
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-require_once 'IDS/Caching/Interface.php';
-
-/**
- * Needed SQL:
- *
-
-    #create the database
-
-    CREATE DATABASE IF NOT EXISTS `phpids` DEFAULT CHARACTER 
-        SET utf8 COLLATE utf8_general_ci;
-    DROP TABLE IF EXISTS `cache`;
-
-    #now select the created datbase and create the table
-
-    CREATE TABLE `cache` (
-        `type` VARCHAR( 32 ) NOT null ,
-        `data` TEXT NOT null ,
-        `created` DATETIME NOT null ,
-        `modified` DATETIME NOT null
-    ) ENGINE = MYISAM ;
- */
-
-/**
- * Database caching wrapper
- *
- * This class inhabits functionality to get and set cache via a database.
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Groupup
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @version   Release: $Id:Database.php 517 2007-09-15 15:04:13Z mario $
- * @link      http://php-ids.org/
- * @since     Version 0.4
- */
-class IDS_Caching_Database implements IDS_Caching_Interface
-{
-
-    /**
-     * Caching type
-     *
-     * @var string
-     */
-    private $type = null;
-
-    /**
-     * Cache configuration
-     *
-     * @var array
-     */
-    private $config = null;
-
-    /**
-     * DBH
-     *
-     * @var object
-     */
-    private $handle = null;
-
-    /**
-     * Holds an instance of this class
-     *
-     * @var object
-     */
-    private static $cachingInstance = null;
-
-    /**
-     * Constructor
-     *
-     * Connects to database.
-     *
-     * @param string $type caching type
-     * @param object $init the IDS_Init object
-     * 
-     * @return void
-     */
-    public function __construct($type, $init) 
-    {
-    
-        $this->type   = $type;
-        $this->config = $init->config['Caching'];
-        $this->handle = $this->_connect();
-    }
-
-    /**
-     * Returns an instance of this class
-     *
-     * @static
-     * @param  string $type caching type
-     * @param  object $init the IDS_Init object
-     * 
-     * @return object $this
-     */
-    public static function getInstance($type, $init)
-    {
-
-        if (!self::$cachingInstance) {
-            self::$cachingInstance = new IDS_Caching_Database($type, $init);
-        }
-        return self::$cachingInstance;
-    }
-
-    /**
-     * Writes cache data into the database
-     *
-     * @param array $data the caching data
-     * 
-     * @throws PDOException if a db error occurred
-     * @return object $this
-     */
-    public function setCache(array $data) 
-    {
-
-        $handle = $this->handle;
-        
-        $rows = $handle->query('SELECT created FROM `' . 
-            $this->config['table'].'`');
-            
-        if (!$rows || $rows->rowCount() === 0) {
-        
-            $this->_write($handle, $data);             
-        } else {
-
-            foreach ($rows as $row) {
-                
-                if ((time()-strtotime($row['created'])) > 
-                  $this->config['expiration_time']) {
-                  
-                    $this->_write($handle, $data);  
-                }
-            }        
-        }
-
-        return $this;
-    }
-
-    /**
-     * Returns the cached data
-     *
-     * Note that this method returns false if either type or file cache is 
-     * not set
-     *
-     * @throws PDOException if a db error occurred
-     * @return mixed cache data or false
-     */
-    public function getCache() 
-    {
-
-        try{
-            $handle = $this->handle;
-            $result = $handle->prepare('SELECT * FROM `' . 
-                $this->config['table'] . 
-                '` where type=?');
-            $result->execute(array($this->type));
-
-            foreach ($result as $row) {
-                return unserialize($row['data']);
-            }
-
-        } catch (PDOException $e) {
-            throw new PDOException('PDOException: ' . $e->getMessage());
-        }
-        return false;
-    }
-
-    /**
-     * Connect to database and return a handle
-     *
-     * @return object PDO
-     * @throws Exception if connection parameters are faulty
-     * @throws PDOException if a db error occurred
-     */
-    private function _connect() 
-    {
-
-        // validate connection parameters
-        if (!$this->config['wrapper']
-            || !$this->config['user']
-                || !$this->config['password']
-                    || !$this->config['table']) {
-
-            throw new Exception('
-                Insufficient connection parameters'
-            );
-        }
-
-        // try to connect
-        try {
-            $handle = new PDO(
-                $this->config['wrapper'],
-                $this->config['user'],
-                $this->config['password']
-            );
-            $handle->setAttribute(
-                PDO::MYSQL_ATTR_USE_BUFFERED_QUERY, true
-            );
-
-        } catch (PDOException $e) {
-            throw new PDOException('PDOException: ' . $e->getMessage());
-        }
-        return $handle;
-    }
-    
-    /**
-     * Write the cache data to the table
-     * 
-     * @param object $handle the database handle
-     * @param array  $data   the caching data
-     * 
-     * @return object PDO
-     * @throws PDOException if a db error occurred
-     */    
-    private function _write($handle, $data) 
-    {
-        
-        try {
-            $handle->query('TRUNCATE ' . 
-                $this->config['table'].'');
-            $statement = $handle->prepare('
-                INSERT INTO `' . 
-                $this->config['table'].'` (
-                    type,
-                    data,
-                    created,
-                    modified
-                )
-                VALUES (
-                    :type,
-                    :data,
-                    now(),
-                    now()
-                )
-            ');
-    
-            $statement->bindParam('type', 
-                $handle->quote($this->type));
-            $statement->bindParam('data', serialize($data));
-    
-            if (!$statement->execute()) {
-                throw new PDOException($statement->errorCode());
-            }
-    
-        } catch (PDOException $e) {
-            throw new PDOException('PDOException: ' . $e->getMessage());
-        }    
-    }
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Caching/Factory.php

@@ -1,94 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- * 
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. 
- *
- * PHP version 5.1.6+
- * 
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-/**
- * Caching factory
- *
- * This class is used as a factory to load the correct concrete caching
- * implementation.
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Group
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @version   Release: $Id:Factory.php 517 2007-09-15 15:04:13Z mario $
- * @link      http://php-ids.org/
- * @since     Version 0.4
- */
-class IDS_Caching
-{
-
-    /**
-     * Factory method
-     *
-     * @param  object $init the IDS_Init object
-     * @param  string $type the caching type
-     * 
-     * @return object the caching facility
-     */
-    public static function factory($init, $type) 
-    {
-        
-    	$object  = false;
-        $wrapper = preg_replace(
-			'/\W+/m', 
-			null, 
-			ucfirst($init->config['Caching']['caching'])
-		);
-        $class   = 'IDS_Caching_' . $wrapper;
-        $path    = dirname(__FILE__) . DIRECTORY_SEPARATOR . 
-            $wrapper . '.php';
-
-        if (file_exists($path)) {
-            include_once $path;
-
-            if (class_exists($class)) {
-                $object = call_user_func(array($class, 'getInstance'), 
-                    $type, $init);
-            }
-        }
-
-        return $object;
-    }
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Caching/File.php

@@ -1,187 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- * 
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. 
- *
- * PHP version 5.1.6+
- * 
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-require_once 'IDS/Caching/Interface.php';
-
-/**
- * File caching wrapper
- *
- * This class inhabits functionality to get and set cache via a static flatfile.
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Group
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @version   Release: $Id:File.php 517 2007-09-15 15:04:13Z mario $
- * @link      http://php-ids.org/
- * @since     Version 0.4
- */
-class IDS_Caching_File implements IDS_Caching_Interface
-{
-
-    /**
-     * Caching type
-     *
-     * @var string
-     */
-    private $type = null;
-
-    /**
-     * Cache configuration
-     *
-     * @var array
-     */
-    private $config = null;
-
-    /**
-     * Path to cache file
-     *
-     * @var string
-     */
-    private $path = null;
-
-    /**
-     * Holds an instance of this class
-     *
-     * @var object
-     */
-    private static $cachingInstance = null;
-
-    /**
-     * Constructor
-     *
-     * @param  string $type caching type
-     * @param  object $init the IDS_Init object
-     * 
-     * @return void
-     */
-    public function __construct($type, $init)
-    {
-    	
-        $this->type   = $type;
-        $this->config = $init->config['Caching'];
-        $this->path   = $init->getBasePath() . $this->config['path'];
-
-        if (file_exists($this->path) && !is_writable($this->path)) {
-            throw new Exception('Make sure all files in ' . 
-            htmlspecialchars($this->path, ENT_QUOTES, 'UTF-8') . 
-                'are writeable!');
-        }
-    }
-
-    /**
-     * Returns an instance of this class
-     *
-     * @param  string $type caching type
-     * @param  object $init the IDS_Init object
-     * 
-     * @return object $this
-     */
-    public static function getInstance($type, $init)
-    {
-        if (!self::$cachingInstance) {
-            self::$cachingInstance = new IDS_Caching_File($type, $init);
-        }
-
-        return self::$cachingInstance;
-    }
-
-    /**
-     * Writes cache data into the file
-     *
-     * @param array $data the cache data
-     * 
-     * @throws Exception if cache file couldn't be created
-     * @return object $this
-     */
-    public function setCache(array $data) 
-    {
-
-        if (!is_writable(preg_replace('/[\/][^\/]+\.[^\/]++$/', null, 
-            $this->path))) {
-            throw new Exception('Temp directory ' . 
-            htmlspecialchars($this->path, ENT_QUOTES, 'UTF-8') . 
-            ' seems not writable');
-        }    	
-        
-        if ((!file_exists($this->path) || (time()-filectime($this->path)) > 
-            $this->config['expiration_time'])) {
-            $handle = @fopen($this->path, 'w+');
-            $serialized = @serialize($data);
-            
-            if (!$handle) {
-                throw new Exception("Cache file couldn't be created");
-            }
-			if (!$serialized) {
-                throw new Exception("Cache data couldn't be serialized");
-            }            
-
-            fwrite($handle, $serialized);
-            fclose($handle);
-        }
-
-        return $this;
-    }
-
-    /**
-     * Returns the cached data
-     *
-     * Note that this method returns false if either type or file cache is 
-     * not set
-     * 
-     * @return mixed cache data or false
-     */
-    public function getCache() 
-    {
-
-        // make sure filters are parsed again if cache expired
-        if (file_exists($this->path) && (time()-filectime($this->path)) < 
-            $this->config['expiration_time']) {
-            $data = unserialize(file_get_contents($this->path));
-              return $data;
-        }
-
-        return false;
-    }
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Caching/Interface.php

@@ -1,73 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- * 
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. 
- *
- * PHP version 5.1.6+
- * 
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-/**
- * Caching wrapper interface
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Group
- * @version   SVN: $Id:Interface.php 517 2007-09-15 15:04:13Z mario $
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @since     Version 0.4
- * @link      http://php-ids.org/
- */
-interface IDS_Caching_Interface
-{
-    /**
-     * Interface method
-     *
-     * @param array $data the cache data
-     * 
-     * @return void
-     */
-    public function setCache(array $data);
-    
-    /**
-     * Interface method
-     *
-     * @return void
-     */
-    public function getCache();
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Caching/Memcached.php

@@ -1,195 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- * 
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. 
- *
- * PHP version 5.1.6+
- * 
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-require_once 'IDS/Caching/Interface.php';
-
-/**
- * File caching wrapper
- *
- * This class inhabits functionality to get and set cache via memcached.
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Groupoup
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @version   Release: $Id:Memcached.php 517 2007-09-15 15:04:13Z mario $
- * @link      http://php-ids.org/
- * @since     Version 0.4
- */
-class IDS_Caching_Memcached implements IDS_Caching_Interface
-{
-
-    /**
-     * Caching type
-     *
-     * @var string
-     */
-    private $type = null;
-
-    /**
-     * Cache configuration
-     *
-     * @var array
-     */
-    private $config = null;
-
-    /**
-     * Flag if the filter storage has been found in memcached 
-     * 
-     * @var boolean 
-     */ 
-    private $isCached = false; 
-    
-    /**
-     * Memcache object
-     *
-     * @var object
-     */
-    private $memcache = null;
-
-    /**
-     * Holds an instance of this class
-     *
-     * @var object
-     */
-    private static $cachingInstance = null;
-
-
-    /**
-     * Constructor
-     *
-     * @param  string $type caching type
-     * @param  array  $init the IDS_Init object
-     * 
-     * @return void
-     */
-    public function __construct($type, $init) 
-    {
-
-        $this->type   = $type;
-        $this->config = $init->config['Caching'];
-        
-        $this->_connect();
-    }
-
-    /**
-     * Returns an instance of this class
-     *
-     * @param  string $type caching type
-     * @param  object $init the IDS_Init object
-     * 
-     * @return object $this
-     */
-    public static function getInstance($type, $init) 
-    {
-
-        if (!self::$cachingInstance) {
-            self::$cachingInstance = new IDS_Caching_Memcached($type, $init);
-        }
-
-        return self::$cachingInstance;
-    }
-
-    /**
-     * Writes cache data
-     *
-     * @param  array $data the caching data
-     * 
-     * @return object $this
-     */
-    public function setCache(array $data) 
-    {
-
-        if(!$this->isCached) { 
-            $this->memcache->set(
-                $this->config['key_prefix'] . '.storage',
-                $data, false, $this->config['expiration_time']
-            ); 
-        }
-
-        return $this;
-    }
-
-    /**
-     * Returns the cached data
-     *
-     * Note that this method returns false if either type or file cache is 
-     * not set
-     *
-     * @return mixed cache data or false
-     */
-    public function getCache() 
-    {
-        
-        $data = $this->memcache->get(
-            $this->config['key_prefix'] .  
-            '.storage'
-        ); 
-        $this->isCached = !empty($data); 
-        
-        return $data;
-    }
-
-    /**
-     * Connect to the memcached server
-     *
-     * @throws Exception if connection parameters are insufficient
-     * @return void
-     */
-    private function _connect() 
-    {
-
-        if ($this->config['host'] && $this->config['port']) {
-            // establish the memcache connection
-            $this->memcache = new Memcache;
-            $this->memcache->pconnect(
-            	$this->config['host'], 
-                $this->config['port']
-            );
-
-        } else {
-            throw new Exception('Insufficient connection parameters');
-        }
-    }
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Caching/Session.php

@@ -1,146 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- * 
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.  
- *
- * PHP version 5.1.6+
- * 
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-require_once 'IDS/Caching/Interface.php';
-
-/**
- * File caching wrapper
- *
- * This class inhabits functionality to get and set cache via session.
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Group
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @version   Release: $Id:Session.php 517 2007-09-15 15:04:13Z mario $
- * @link      http://php-ids.org/
- * @since     Version 0.4
- */
-class IDS_Caching_Session implements IDS_Caching_Interface
-{
-
-    /**
-     * Caching type
-     *
-     * @var string
-     */
-    private $type = null;
-
-    /**
-     * Cache configuration
-     *
-     * @var array
-     */
-    private $config = null;
-
-    /**
-     * Holds an instance of this class
-     *
-     * @var object
-     */
-    private static $cachingInstance = null;
-
-    /**
-     * Constructor
-     *
-     * @param  string $type caching type
-     * @param  object $init the IDS_Init object
-     * 
-     * @return void
-     */
-    public function __construct($type, $init) 
-    {
-        $this->type   = $type;
-        $this->config = $init->config['Caching'];
-    }
-
-    /**
-     * Returns an instance of this class
-     *
-     * @param  string $type   caching type
-     * @param  object $init the IDS_Init object
-     * 
-     * @return object $this
-     */
-    public static function getInstance($type, $init) 
-    {
-
-        if (!self::$cachingInstance) {
-            self::$cachingInstance = new IDS_Caching_Session($type, $init);
-        }
-
-        return self::$cachingInstance;
-    }
-
-    /**
-     * Writes cache data into the session
-     *
-     * @param array $data the caching data
-     * 
-     * @return object $this
-     */
-    public function setCache(array $data) 
-    {
-
-        $_SESSION['PHPIDS'][$this->type] = $data;
-        return $this;
-    }
-
-    /**
-     * Returns the cached data
-     *
-     * Note that this method returns false if either type or file cache is not set
-     *
-     * @return mixed cache data or false
-     */
-    public function getCache() 
-    {
-
-        if ($this->type && $_SESSION['PHPIDS'][$this->type]) {
-            return $_SESSION['PHPIDS'][$this->type];
-        }
-
-        return false;
-    }
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Config/Config.ini

@@ -1,94 +0,0 @@
-; PHPIDS Config.ini
-
-; General configuration settings
-
-; !!!DO NOT PLACE THIS FILE INSIDE THE WEB-ROOT IF DATABASE CONNECTION DATA WAS ADDED!!!
-
-[General]
-
-    ; basic settings - customize to make the PHPIDS work at all
-    filter_type     = xml
-    
-    base_path       = /full/path/to/IDS/ 
-    use_base_path   = false
-    
-    filter_path     = default_filter.xml
-    tmp_path        = tmp
-    scan_keys       = false
-    
-    ; in case you want to use a different HTMLPurifier source, specify it here
-    ; By default, those files are used that are being shipped with PHPIDS
-    HTML_Purifier_Path	= vendors/htmlpurifier/HTMLPurifier.auto.php
-    HTML_Purifier_Cache = vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer
-    
-    ; define which fields contain html and need preparation before 
-    ; hitting the PHPIDS rules (new in PHPIDS 0.5)
-    html[]          = POST.__wysiwyg
-    
-    ; define which fields contain JSON data and should be treated as such 
-    ; for fewer false positives (new in PHPIDS 0.5.3)
-    json[]          = POST.__jsondata
-
-    ; define which fields shouldn't be monitored (a[b]=c should be referenced via a.b)
-    exceptions[]    = GET.__utmz
-    exceptions[]    = GET.__utmc
-    exceptions[]    = REQUEST.__utmz
-    exceptions[]    = REQUEST.__utmc
-    exceptions[]    = REQUEST.__gads
-    exceptions[]    = COOKIE.__utmz
-    exceptions[]    = COOKIE.__utmc    
-    exceptions[]    = COOKIE.__gads
-    exceptions[]    = REQUEST.ZP_CAL
-    exceptions[]    = COOKIE.ZP_CAL
-
-    ; PHPIDS should run with PHP 5.1.2 but this is untested - set 
-    ; this value to force compatibilty with minor versions
-    min_php_version = 5.1.6
-
-; If you use the PHPIDS logger you can define specific configuration here
-
-[Logging]
-
-    ; file logging
-    path            = tmp/phpids_log.txt
-
-    ; email logging
-
-    ; note that enabling safemode you can prevent spam attempts,
-    ; see documentation
-    recipients[]    = test@test.com.invalid
-    subject         = "PHPIDS detected an intrusion attempt!"
-    header			= "From: <PHPIDS> info@php-ids.org"
-    envelope        = ""
-    safemode        = true
-    urlencode       = true
-    allowed_rate    = 15
-
-    ; database logging
-
-    wrapper         = "mysql:host=localhost;port=3306;dbname=phpids"
-    user            = phpids_user
-    password        = 123456
-    table           = intrusions
-
-; If you would like to use other methods than file caching you can configure them here
-
-[Caching]
-
-    ; caching:      session|file|database|memcached|none
-    caching         = file 
-    expiration_time = 600
-
-    ; file cache    
-    path            = tmp/default_filter.cache
-
-    ; database cache
-    wrapper         = "mysql:host=localhost;port=3306;dbname=phpids"   
-    user            = phpids_user
-    password        = 123456
-    table           = cache  
-
-    ; memcached     
-    ;host           = localhost
-    ;port           = 11211
-    ;key_prefix     = PHPIDS

plugins/phpids/IDS/Config/Config.ini.php

@@ -1,89 +0,0 @@
-; <?php die(); ?>
-
-; PHPIDS Config.ini
-
-; General configuration settings
-
-
-[General]
-
-    ; basic settings - customize to make the PHPIDS work at all
-    filter_type     = xml
-    
-    base_path       = /full/path/to/IDS/ 
-    use_base_path   = false
-    
-    filter_path     = default_filter.xml
-    tmp_path        = tmp
-    scan_keys       = false
-    
-    ; in case you want to use a different HTMLPurifier source, specify it here
-    ; By default, those files are used that are being shipped with PHPIDS
-    HTML_Purifier_Path	= vendors/htmlpurifier/HTMLPurifier.auto.php
-    HTML_Purifier_Cache = vendors/htmlpurifier/HTMLPurifier/DefinitionCache/Serializer
-    
-    ; define which fields contain html and need preparation before 
-    ; hitting the PHPIDS rules (new in PHPIDS 0.5)
-    ;html[]          = POST.__wysiwyg
-    
-    ; define which fields contain JSON data and should be treated as such 
-    ; for fewer false positives (new in PHPIDS 0.5.3)
-    ;json[]          = POST.__jsondata
-
-    ; define which fields shouldn't be monitored (a[b]=c should be referenced via a.b)
-    exceptions[]    = GET.__utmz
-    exceptions[]    = GET.__utmc
-
-    ; you can use regular expressions for wildcard exceptions - example: /.*foo/i
-
-    ; PHPIDS should run with PHP 5.1.2 but this is untested - set 
-    ; this value to force compatibilty with minor versions
-    min_php_version = 5.1.6
-
-; If you use the PHPIDS logger you can define specific configuration here
-
-[Logging]
-
-    ; file logging
-    path            = tmp/phpids_log.txt
-
-    ; email logging
-
-    ; note that enabling safemode you can prevent spam attempts,
-    ; see documentation
-    recipients[]    = test@test.com.invalid
-    subject         = "PHPIDS detected an intrusion attempt!"
-    header			= "From: <PHPIDS> info@phpids.org"
-    envelope        = ""
-    safemode        = true
-    urlencode       = true
-    allowed_rate    = 15
-
-    ; database logging
-
-    wrapper         = "mysql:host=localhost;port=3306;dbname=phpids"
-    user            = phpids_user
-    password        = 123456
-    table           = intrusions
-
-; If you would like to use other methods than file caching you can configure them here
-
-[Caching]
-
-    ; caching:      session|file|database|memcached|none
-    caching         = file 
-    expiration_time = 600
-
-    ; file cache    
-    path            = tmp/default_filter.cache
-
-    ; database cache
-    wrapper         = "mysql:host=localhost;port=3306;dbname=phpids"   
-    user            = phpids_user
-    password        = 123456
-    table           = cache  
-
-    ; memcached     
-    ;host           = localhost
-    ;port           = 11211
-    ;key_prefix     = PHPIDS

plugins/phpids/IDS/Converter.php

@@ -1,750 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- *
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. 
- *
- * PHP version 5.1.6+
- *
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-/**
- * PHPIDS specific utility class to convert charsets manually
- *
- * Note that if you make use of IDS_Converter::runAll(), existing class
- * methods will be executed in the same order as they are implemented in the
- * class tree!
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Group
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @version   Release: $Id:Converter.php 517 2007-09-15 15:04:13Z mario $
- * @link      http://php-ids.org/
- */
-class IDS_Converter
-{
-    /**
-     * Runs all converter functions
-     *
-     * Note that if you make use of IDS_Converter::runAll(), existing class
-     * methods will be executed in the same order as they are implemented in the
-     * class tree!
-     *
-     * @param string $value the value to convert
-     *
-     * @static
-     * @return string
-     */
-    public static function runAll($value)
-    {
-        foreach (get_class_methods(__CLASS__) as $method) {
-
-            if (strpos($method, 'run') === 0) {
-                continue;
-            }
-            $value = self::$method($value);
-        }
-
-        return $value;
-    }
-
-    /**
-     * Check for comments and erases them if available
-     *
-     * @param string $value the value to convert
-     *
-     * @static
-     * @return string
-     */
-    public static function convertFromCommented($value)
-    {
-        // check for existing comments
-        if (preg_match('/(?:\<!-|-->|\/\*|\*\/|\/\/\W*\w+\s*$)|' .
-            '(?:--[^-]*-)/ms', $value)) {
-
-            $pattern = array(
-                '/(?:(?:<!)(?:(?:--(?:[^-]*(?:-[^-]+)*)--\s*)*)(?:>))/ms',
-                '/(?:(?:\/\*\/*[^\/\*]*)+\*\/)/ms',
-                '/(?:--[^-]*-)/ms'
-            );
-
-            $converted = preg_replace($pattern, ';', $value);
-            $value    .= "\n" . $converted;
-        }
-        
-        //make sure inline comments are detected and converted correctly
-        $value = preg_replace('/(<\w+)\/+(\w+=?)/m', '$1/$2', $value);
-        $value = preg_replace('/[^\\\:]\/\/(.*)$/m', '/**/$1', $value);
-        $value = preg_replace('/([^\-&])#.*[\r\n\v\f]/m', '$1', $value);
-        $value = preg_replace('/([^&\-])#.*\n/m', '$1 ', $value);
-        $value = preg_replace('/^#.*\n/m', ' ', $value);
-
-        return $value;
-    }
-
-    /**
-     * Strip newlines
-     *
-     * @param string $value the value to convert
-     *
-     * @static
-     * @return string
-     */
-    public static function convertFromWhiteSpace($value)
-    {
-        //check for inline linebreaks
-        $search = array('\r', '\n', '\f', '\t', '\v');
-        $value  = str_replace($search, ';', $value);
-
-        // replace replacement characters regular spaces
-        $value = str_replace('�', ' ', $value);
-
-        //convert real linebreaks
-        return preg_replace('/(?:\n|\r|\v)/m', '  ', $value);
-    }
-
-    /**
-     * Checks for common charcode pattern and decodes them
-     *
-     * @param string $value the value to convert
-     *
-     * @static
-     * @return string
-     */
-    public static function convertFromJSCharcode($value)
-    {
-        $matches = array();
-
-        // check if value matches typical charCode pattern
-        if (preg_match_all('/(?:[\d+-=\/\* ]+(?:\s?,\s?[\d+-=\/\* ]+)){4,}/ms',
-            $value, $matches)) {
-
-            $converted = '';
-            $string    = implode(',', $matches[0]);
-            $string    = preg_replace('/\s/', '', $string);
-            $string    = preg_replace('/\w+=/', '', $string);
-            $charcode  = explode(',', $string);
-
-            foreach ($charcode as $char) {
-                $char = preg_replace('/\W0/s', '', $char);
-
-                if (preg_match_all('/\d*[+-\/\* ]\d+/', $char, $matches)) {
-                    $match = preg_split('/(\W?\d+)/',
-                                        (implode('', $matches[0])),
-                                        null,
-                                        PREG_SPLIT_DELIM_CAPTURE);
-
-                    if (array_sum($match) >= 20 && array_sum($match) <= 127) {
-                        $converted .= chr(array_sum($match));
-                    }
-
-                } elseif (!empty($char) && $char >= 20 && $char <= 127) {
-                    $converted .= chr($char);
-                }
-            }
-
-            $value .= "\n" . $converted;
-        }
-
-        // check for octal charcode pattern
-        if (preg_match_all('/(?:(?:[\\\]+\d+[ \t]*){8,})/ims', $value, $matches)) {
-
-            $converted = '';
-            $charcode  = explode('\\', preg_replace('/\s/', '', implode(',',
-                $matches[0])));
-
-            foreach ($charcode as $char) {
-                if (!empty($char)) {
-                    if (octdec($char) >= 20 && octdec($char) <= 127) {
-                        $converted .= chr(octdec($char));
-                    }
-                }
-            }
-            $value .= "\n" . $converted;
-        }
-
-        // check for hexadecimal charcode pattern
-        if (preg_match_all('/(?:(?:[\\\]+\w+\s*){8,})/ims', $value, $matches)) {
-
-            $converted = '';
-            $charcode  = explode('\\', preg_replace('/[ux]/', '', implode(',',
-                $matches[0])));
-
-            foreach ($charcode as $char) {
-                if (!empty($char)) {
-                    if (hexdec($char) >= 20 && hexdec($char) <= 127) {
-                        $converted .= chr(hexdec($char));
-                    }
-                }
-            }
-            $value .= "\n" . $converted;
-        }
-
-        return $value;
-    }
-
-    /**
-     * Eliminate JS regex modifiers
-     *
-     * @param string $value the value to convert
-     *
-     * @static
-     * @return string
-     */
-    public static function convertJSRegexModifiers($value)
-    {
-        $value = preg_replace('/\/[gim]+/', '/', $value);
-
-        return $value;
-    }
-
-    /**
-     * Converts from hex/dec entities
-     *
-     * @param string $value the value to convert
-     *
-     * @static
-     * @return string
-     */
-    public static function convertEntities($value)
-    {
-        $converted = null;
-        
-        //deal with double encoded payload 
-        $value = preg_replace('/&amp;/', '&', $value);     
-        
-        if (preg_match('/&#x?[\w]+/ms', $value)) {
-            $converted = preg_replace('/(&#x?[\w]{2}\d?);?/ms', '$1;', $value);
-            $converted = html_entity_decode($converted, ENT_QUOTES, 'UTF-8');
-            $value    .= "\n" . str_replace(';;', ';', $converted);
-        }
-        // normalize obfuscated protocol handlers
-        $value = preg_replace(
-            '/(?:j\s*a\s*v\s*a\s*s\s*c\s*r\s*i\s*p\s*t\s*:)|(d\s*a\s*t\s*a\s*:)/ms', 
-            'javascript:', $value
-        );
-        
-        return $value;
-    }
-
-    /**
-     * Normalize quotes
-     *
-     * @param string $value the value to convert
-     *
-     * @static
-     * @return string
-     */
-    public static function convertQuotes($value)
-    {
-        // normalize different quotes to "
-        $pattern = array('\'', '`', '´', '’', '‘');
-        $value   = str_replace($pattern, '"', $value);
-
-        //make sure harmless quoted strings don't generate false alerts
-        $value = preg_replace('/^"([^"=\\!><~]+)"$/', '$1', $value);
-
-        return $value;
-    }
-
-    /**
-     * Converts SQLHEX to plain text
-     *
-     * @param string $value the value to convert
-     *
-     * @static
-     * @return string
-     */
-    public static function convertFromSQLHex($value)
-    {
-        $matches = array();
-        if(preg_match_all('/(?:(?:\A|[^\d])0x[a-f\d]{3,}[a-f\d]*)+/im', $value, $matches)) {
-            foreach($matches[0] as $match) {
-                $converted = '';
-                foreach(str_split($match, 2) as $hex_index) {
-                    if(preg_match('/[a-f\d]{2,3}/i', $hex_index)) {
-                      $converted .= chr(hexdec($hex_index));
-                    }
-                }
-                $value = str_replace($match, $converted, $value);
-            }
-        }
-        // take care of hex encoded ctrl chars
-        $value = preg_replace('/0x\d+/m', ' 1 ', $value);
-        
-        return $value;
-    }
-
-    /**
-     * Converts basic SQL keywords and obfuscations
-     *
-     * @param string $value the value to convert
-     *
-     * @static
-     * @return string
-     */
-    public static function convertFromSQLKeywords($value)
-    {
-        $pattern = array('/(?:is\s+null)|(like\s+null)|' .
-            '(?:(?:^|\W)in[+\s]*\([\s\d"]+[^()]*\))/ims');
-        $value   = preg_replace($pattern, '"=0', $value);
-        
-        $value   = preg_replace('/[^\w\)]+\s*like\s*[^\w\s]+/ims', '1" OR "1"', $value);
-        $value   = preg_replace('/null([,"\s])/ims', '0$1', $value);
-        $value   = preg_replace('/\d+\./ims', ' 1', $value);
-        $value   = preg_replace('/,null/ims', ',0', $value);
-        $value   = preg_replace('/(?:between)/ims', 'or', $value);
-        $value   = preg_replace('/(?:and\s+\d+\.?\d*)/ims', '', $value);
-        $value   = preg_replace('/(?:\s+and\s+)/ims', ' or ', $value);
-
-        $pattern = array('/(?:not\s+between)|(?:is\s+not)|(?:not\s+in)|' .
-                         '(?:xor|<>|rlike(?:\s+binary)?)|' .
-                         '(?:regexp\s+binary)|' .
-                         '(?:sounds\s+like)/ims');
-        $value   = preg_replace($pattern, '!', $value);
-        $value   = preg_replace('/"\s+\d/', '"', $value);
-        $value   = preg_replace('/(\W)div(\W)/ims', '$1 OR $2', $value);
-        $value   = preg_replace('/\/(?:\d+|null)/', null, $value);
-
-        return $value;
-    }
-
-    /**
-     * Detects nullbytes and controls chars via ord()
-     *
-     * @param string $value the value to convert
-     *
-     * @static
-     * @return string
-     */
-    public static function convertFromControlChars($value)
-    {
-        // critical ctrl values
-        $search = array(
-            chr(0), chr(1), chr(2), chr(3), chr(4), chr(5),
-            chr(6), chr(7), chr(8), chr(11), chr(12), chr(14),
-            chr(15), chr(16), chr(17), chr(18), chr(19), chr(24), 
-            chr(25), chr(192), chr(193), chr(238), chr(255), '\\0'
-        );
-        
-        $value = str_replace($search, '%00', $value);
-
-        //take care for malicious unicode characters
-        $value = urldecode(preg_replace('/(?:%E(?:2|3)%8(?:0|1)%(?:A|8|9)' .
-            '\w|%EF%BB%BF|%EF%BF%BD)|(?:&#(?:65|8)\d{3};?)/i', null,
-                urlencode($value)));
-        $value = urldecode(
-            preg_replace('/(?:%F0%80%BE)/i', '>', urlencode($value)));
-        $value = urldecode(
-            preg_replace('/(?:%F0%80%BC)/i', '<', urlencode($value)));
-        $value = urldecode(
-            preg_replace('/(?:%F0%80%A2)/i', '"', urlencode($value)));
-        $value = urldecode(
-            preg_replace('/(?:%F0%80%A7)/i', '\'', urlencode($value)));		
-
-        $value = preg_replace('/(?:%ff1c)/', '<', $value);
-        $value = preg_replace(
-            '/(?:&[#x]*(200|820|200|820|zwn?j|lrm|rlm)\w?;?)/i', null,$value
-        );
-        $value = preg_replace('/(?:&#(?:65|8)\d{3};?)|' .
-                '(?:&#(?:56|7)3\d{2};?)|' .
-                '(?:&#x(?:fe|20)\w{2};?)|' .
-                '(?:&#x(?:d[c-f])\w{2};?)/i', null,
-                $value);
-                
-        $value = str_replace(
-            array('«', '〈', '＜', '‹', '〈', '⟨'), '<', $value
-        );
-        $value = str_replace(
-            array('»', '〉', '＞', '›', '〉', '⟩'), '>', $value
-        );
-
-        return $value;
-    }
-
-    /**
-     * This method matches and translates base64 strings and fragments
-     * used in data URIs
-     *
-     * @param string $value the value to convert
-     *
-     * @static
-     * @return string
-     */
-    public static function convertFromNestedBase64($value)
-    {
-        $matches = array();
-        preg_match_all('/(?:^|[,&?])\s*([a-z0-9]{30,}=*)(?:\W|$)/im',
-            $value,
-            $matches);
-
-        foreach ($matches[1] as $item) {
-            if (isset($item) && !preg_match('/[a-f0-9]{32}/i', $item)) {
-                $base64_item = base64_decode($item);
-                $value = str_replace($item, $base64_item, $value);
-            }
-        }
-
-        return $value;
-    }
-
-    /**
-     * Detects nullbytes and controls chars via ord()
-     *
-     * @param string $value the value to convert
-     *
-     * @static
-     * @return string
-     */
-    public static function convertFromOutOfRangeChars($value)
-    {
-        $values = str_split($value);
-        foreach ($values as $item) {
-            if (ord($item) >= 127) {
-                $value = str_replace($item, ' ', $value);
-            }
-        }
-
-        return $value;
-    }
-
-    /**
-     * Strip XML patterns
-     *
-     * @param string $value the value to convert
-     *
-     * @static
-     * @return string
-     */
-    public static function convertFromXML($value)
-    {
-        $converted = strip_tags($value);
-
-        if ($converted && ($converted != $value)) {
-            return $value . "\n" . $converted;
-        }
-        return $value;
-    }
-
-    /**
-     * This method converts JS unicode code points to
-     * regular characters
-     *
-     * @param string $value the value to convert
-     *
-     * @static
-     * @return string
-     */
-    public static function convertFromJSUnicode($value)
-    {
-        $matches = array();
-
-        preg_match_all('/\\\u[0-9a-f]{4}/ims', $value, $matches);
-
-        if (!empty($matches[0])) {
-            foreach ($matches[0] as $match) {
-                $chr = chr(hexdec(substr($match, 2, 4))); 
-                $value = str_replace($match, $chr, $value);
-            }
-            $value .= "\n\u0001";
-        }
-
-        return $value;
-    }
-
-    /**
-     * Converts relevant UTF-7 tags to UTF-8
-     *
-     * @param string $value the value to convert
-     *
-     * @static
-     * @return string
-     */
-    public static function convertFromUTF7($value)
-    {
-        if(preg_match('/\+A\w+-?/m', $value)) {
-            if (function_exists('mb_convert_encoding')) {
-                if(version_compare(PHP_VERSION, '5.2.8', '<')) {
-                    $tmp_chars = str_split($value);
-                    $value = '';
-                    foreach($tmp_chars as $char) {
-                        if(ord($char) <= 127) {
-                            $value .= $char;	
-                        }
-                    }     
-                }
-                $value .= "\n" . mb_convert_encoding($value, 'UTF-8', 'UTF-7');
-            } else {
-                //list of all critical UTF7 codepoints
-                $schemes = array(
-                    '+ACI-'      => '"',
-                    '+ADw-'      => '<',
-                    '+AD4-'      => '>',
-                    '+AFs-'      => '[',
-                    '+AF0-'      => ']',
-                    '+AHs-'      => '{',
-                    '+AH0-'      => '}',
-                    '+AFw-'      => '\\',
-                    '+ADs-'      => ';',
-                    '+ACM-'      => '#',
-                    '+ACY-'      => '&',
-                    '+ACU-'      => '%',
-                    '+ACQ-'      => '$',
-                    '+AD0-'      => '=',
-                    '+AGA-'      => '`',
-                    '+ALQ-'      => '"',
-                    '+IBg-'      => '"',
-                    '+IBk-'      => '"',
-                    '+AHw-'      => '|',
-                    '+ACo-'      => '*',
-                    '+AF4-'      => '^',
-                    '+ACIAPg-'   => '">',
-                    '+ACIAPgA8-' => '">'
-                );
-    
-                $value = str_ireplace(array_keys($schemes),
-                    array_values($schemes), $value);
-            }
-        }
-        return $value;
-    }
-
-    /**
-     * Converts basic concatenations
-     *
-     * @param string $value the value to convert
-     *
-     * @static
-     * @return string
-     */
-    public static function convertFromConcatenated($value)
-    {
-        //normalize remaining backslashes
-        if ($value != preg_replace('/(\w)\\\/', "$1", $value)) {
-            $value .= preg_replace('/(\w)\\\/', "$1", $value);
-        }
-
-        $compare = stripslashes($value);
-        
-        $pattern = array('/(?:<\/\w+>\+<\w+>)/s',
-            '/(?:":\d+[^"[]+")/s',
-            '/(?:"?"\+\w+\+")/s',
-            '/(?:"\s*;[^"]+")|(?:";[^"]+:\s*")/s',
-            '/(?:"\s*(?:;|\+).{8,18}:\s*")/s',
-            '/(?:";\w+=)|(?:!""&&")|(?:~)/s',
-            '/(?:"?"\+""?\+?"?)|(?:;\w+=")|(?:"[|&]{2,})/s',
-            '/(?:"\s*\W+")/s',
-            '/(?:";\w\s*\+=\s*\w?\s*")/s',
-            '/(?:"[|&;]+\s*[^|&\n]*[|&]+\s*"?)/s',
-            '/(?:";\s*\w+\W+\w*\s*[|&]*")/s',
-            '/(?:"\s*"\s*\.)/s',
-            '/(?:\s*new\s+\w+\s*[+",])/',
-            '/(?:(?:^|\s+)(?:do|else)\s+)/',
-            '/(?:[{(]\s*new\s+\w+\s*[)}])/',
-            '/(?:(this|self)\.)/',
-            '/(?:undefined)/',
-            '/(?:in\s+)/');
-
-        // strip out concatenations
-        $converted = preg_replace($pattern, null, $compare);
-
-        //strip object traversal
-        $converted = preg_replace('/\w(\.\w\()/', "$1", $converted);
-
-        // normalize obfuscated method calls
-        $converted = preg_replace('/\)\s*\+/', ")", $converted);
-
-        //convert JS special numbers
-        $converted = preg_replace('/(?:\(*[.\d]e[+-]*[^a-z\W]+\)*)' .
-            '|(?:NaN|Infinity)\W/ims', 1, $converted);
-
-        if ($converted && ($compare != $converted)) {
-            $value .= "\n" . $converted;
-        }
-
-        return $value;
-    }
-
-    /**
-     * This method collects and decodes proprietary encoding types
-     *
-     * @param string $value the value to convert
-     *
-     * @static
-     * @return string
-     */
-    public static function convertFromProprietaryEncodings($value) {
-
-        //Xajax error reportings
-        $value = preg_replace('/<!\[CDATA\[(\W+)\]\]>/im', '$1', $value);
-
-        //strip false alert triggering apostrophes
-        $value = preg_replace('/(\w)\"(s)/m', '$1$2', $value);
-
-        //strip quotes within typical search patterns
-        $value = preg_replace('/^"([^"=\\!><~]+)"$/', '$1', $value);
-
-        //OpenID login tokens
-        $value = preg_replace('/{[\w-]{8,9}\}(?:\{[\w=]{8}\}){2}/', null, $value);
-
-        //convert Content and \sdo\s to null
-        $value = preg_replace('/Content|\Wdo\s/', null, $value);
-
-        //strip emoticons
-        $value = preg_replace(
-            '/(?:\s[:;]-[)\/PD]+)|(?:\s;[)PD]+)|(?:\s:[)PD]+)|-\.-|\^\^/m',
-            null,
-            $value
-        );
-        
-        //normalize separation char repetion
-        $value = preg_replace('/([.+~=*_\-;])\1{2,}/m', '$1', $value);
-
-        //normalize multiple single quotes
-        $value = preg_replace('/"{2,}/m', '"', $value);
-        
-        //normalize quoted numerical values and asterisks
-        $value = preg_replace('/"(\d+)"/m', '$1', $value);
-
-        //normalize pipe separated request parameters
-        $value = preg_replace('/\|(\w+=\w+)/m', '&$1', $value);
-
-        //normalize ampersand listings
-        $value = preg_replace('/(\w\s)&\s(\w)/', '$1$2', $value);
-        
-        //normalize escaped RegExp modifiers
-        $value = preg_replace('/\/\\\(\w)/', '/$1', $value);        
-        
-        return $value;
-    }
-
-    /**
-     * This method is the centrifuge prototype
-     *
-     * @param string      $value   the value to convert
-     * @param IDS_Monitor $monitor the monitor object
-     *
-     * @static
-     * @return string
-     */
-    public static function runCentrifuge($value, IDS_Monitor $monitor = null)
-    {
-        $threshold = 3.49;
-        if (strlen($value) > 25) {
-            
-            //strip padding
-            $tmp_value = preg_replace('/\s{4}|==$/m', null, $value);
-            $tmp_value = preg_replace(
-                '/\s{4}|[\p{L}\d\+\-=,.%()]{8,}/m', 
-                'aaa', 
-                $tmp_value
-            );
-            
-            // Check for the attack char ratio
-            $tmp_value = preg_replace('/([*.!?+-])\1{1,}/m', '$1', $tmp_value);
-            $tmp_value = preg_replace('/"[\p{L}\d\s]+"/m', null, $tmp_value);
-
-            $stripped_length = strlen(preg_replace('/[\d\s\p{L}\.:,%&\/><\-)!|]+/m',
-                null, $tmp_value));
-            $overall_length  = strlen(
-                preg_replace('/([\d\s\p{L}:,\.]{3,})+/m', 'aaa',
-                preg_replace('/\s{2,}/m', null, $tmp_value))
-            );
-
-            if ($stripped_length != 0
-                && $overall_length/$stripped_length <= $threshold) {
-
-                $monitor->centrifuge['ratio']     =
-                    $overall_length/$stripped_length;
-                $monitor->centrifuge['threshold'] =
-                    $threshold;
-
-                $value .= "\n$[!!!]";
-            }
-        }
-
-        if (strlen($value) > 40) {
-            // Replace all non-special chars
-            $converted =  preg_replace('/[\w\s\p{L},.:!]/', null, $value);
-
-            // Split string into an array, unify and sort
-            $array = str_split($converted);
-            $array = array_unique($array);
-            asort($array);
-
-            // Normalize certain tokens
-            $schemes = array(
-                '~' => '+',
-                '^' => '+',
-                '|' => '+',
-                '*' => '+',
-                '%' => '+',
-                '&' => '+',
-                '/' => '+'
-            );
-
-            $converted = implode($array);
-            
-            $_keys = array_keys($schemes);
-            $_values = array_values($schemes);
-            
-            $converted = str_replace($_keys, $_values, $converted);
-            
-            $converted = preg_replace('/[+-]\s*\d+/', '+', $converted);
-            $converted = preg_replace('/[()[\]{}]/', '(', $converted);
-            $converted = preg_replace('/[!?:=]/', ':', $converted);
-            $converted = preg_replace('/[^:(+]/', null, stripslashes($converted));
-
-            // Sort again and implode
-            $array = str_split($converted);
-            asort($array);
-
-            $converted = implode($array);
-
-            if (preg_match('/(?:\({2,}\+{2,}:{2,})|(?:\({2,}\+{2,}:+)|' .
-                '(?:\({3,}\++:{2,})/', $converted)) {
-
-                $monitor->centrifuge['converted'] = $converted;
-
-                return $value . "\n" . $converted;
-            }
-        }
-
-        return $value;
-    }
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Event.php

@@ -1,235 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- * 
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. 
- *
- * PHP version 5.1.6+
- * 
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-/**
- * PHPIDS event object
- *
- * This class represents a certain event that occured while applying the filters 
- * to the supplied data. It aggregates a bunch of IDS_Filter implementations and 
- * is a assembled in IDS_Report.
- *
- * Note that this class implements both Countable and IteratorAggregate
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Group
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @version   Release: $Id:Event.php 517 2007-09-15 15:04:13Z mario $
- * @link      http://php-ids.org/
- */
-class IDS_Event implements Countable, IteratorAggregate
-{
-
-    /**
-     * Event name
-     *
-     * @var scalar
-     */
-    protected $name = null;
-
-    /**
-     * Value of the event
-     *
-     * @var scalar
-     */
-    protected $value = null;
-
-    /**
-     * List of filter objects
-     *
-     * Filter objects in this array are those that matched the events value
-     *
-     * @var array
-     */
-    protected $filters = array();
-
-    /**
-     * Calculated impact
-     *
-     * Total impact of the event
-     *
-     * @var integer
-     */
-    protected $impact = 0;
-
-    /**
-     * Affecte tags
-     *
-     * @var array
-     */
-    protected $tags = array();
-
-    /**
-     * Constructor
-     *
-     * Fills event properties
-     *
-     * @param scalar $name    the event name
-     * @param scalar $value   the event value
-     * @param array  $filters the corresponding filters
-     * 
-     * @return void
-     */
-    public function __construct($name, $value, Array $filters) 
-    {
-        if (!is_scalar($name)) {
-            throw new InvalidArgumentException(
-                'Expected $name to be a scalar,' . gettype($name) . ' given'
-            );
-        }
-
-        if (!is_scalar($value)) {
-            throw new InvalidArgumentException('
-                Expected $value to be a scalar,' . gettype($value) . ' given'
-            );
-        }
-
-        $this->name  = $name;
-        $this->value = $value;
-
-        foreach ($filters as $filter) {
-            if (!$filter instanceof IDS_Filter) {
-                throw new InvalidArgumentException(
-                    'Filter must be derived from IDS_Filter'
-                );
-            }
-
-            $this->filters[] = $filter;
-        }
-    }
-
-    /**
-     * Returns event name
-     *
-     * The name of the event usually is the key of the variable that was 
-     * considered to be malicious
-     *
-     * @return scalar
-     */
-    public function getName() 
-    {
-        return $this->name;
-    }
-
-    /**
-     * Returns event value
-     *
-     * @return scalar
-     */
-    public function getValue() 
-    {
-        return $this->value;
-    }
-
-    /**
-     * Returns calculated impact
-     *
-     * @return integer
-     */
-    public function getImpact() 
-    {
-        if (!$this->impact) {
-            $this->impact = 0;
-            foreach ($this->filters as $filter) {
-                $this->impact += $filter->getImpact();
-            }
-        }
-
-        return $this->impact;
-    }
-
-    /**
-     * Returns affected tags
-     *
-     * @return array
-     */
-    public function getTags() 
-    {
-        $filters = $this->getFilters();
-
-        foreach ($filters as $filter) {
-            $this->tags = array_merge($this->tags,
-                                      $filter->getTags());
-        }
-
-        $this->tags = array_values(array_unique($this->tags));
-
-        return $this->tags;
-    }
-
-    /**
-     * Returns list of filter objects
-     *
-     * @return array
-     */
-    public function getFilters() 
-    {
-        return $this->filters;
-    }
-
-    /**
-     * Returns number of filters
-     *
-     * To implement interface Countable this returns the number of filters
-     * appended.
-     *
-     * @return integer
-     */
-    public function count() 
-    {
-        return count($this->getFilters());
-    }
-
-    /**
-     * IteratorAggregate iterator getter
-     *
-     * Returns an iterator to iterate over the appended filters.
-     *
-     * @return ArrayObject the filter collection
-     */
-    public function getIterator() 
-    {
-        return new ArrayObject($this->getFilters());
-    }
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Filter.php

@@ -1,187 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- * 
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. 
- *
- * PHP version 5.1.6+
- * 
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-/**
- * PHPIDS Filter object
- *
- * Each object of this class serves as a container for a specific filter. The 
- * object provides methods to get information about this particular filter and 
- * also to match an arbitrary string against it.
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Group
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @version   Release: $Id:Filter.php 517 2007-09-15 15:04:13Z mario $
- * @link      http://php-ids.org/
- * @since     Version 0.4
- */
-class IDS_Filter
-{
-
-    /**
-     * Filter rule
-     *
-     * @var    string
-     */
-    protected $rule;
-
-    /**
-     * List of tags of the filter
-     *
-     * @var    array
-     */
-    protected $tags = array();
-
-    /**
-     * Filter impact level
-     *
-     * @var    integer
-     */
-    protected $impact = 0;
-
-    /**
-     * Filter description
-     *
-     * @var    string
-     */
-    protected $description = null;
-
-    /**
-     * Constructor
-     *
-     * @param integer $id          filter id
-     * @param mixed   $rule        filter rule
-     * @param string  $description filter description
-     * @param array   $tags        list of tags
-     * @param integer $impact      filter impact level
-     * 
-     * @return void
-     */
-    public function __construct($id, $rule, $description, array $tags, $impact) 
-    {
-        $this->id          = $id;
-        $this->rule        = $rule;
-        $this->tags        = $tags;
-        $this->impact      = $impact;
-        $this->description = $description;
-    }
-
-    /**
-     * Matches a string against current filter
-     *
-     * Matches given string against the filter rule the specific object of this
-     * class represents
-     *
-     * @param string $string the string to match
-     * 
-     * @throws InvalidArgumentException if argument is no string
-     * @return boolean
-     */
-    public function match($string)
-    {
-        if (!is_string($string)) {
-            throw new InvalidArgumentException('
-                Invalid argument. Expected a string, received ' . gettype($string)
-            );
-        }
-
-        return (bool) preg_match(
-            '/' . $this->getRule() . '/ms', strtolower($string)
-        );
-    }
-
-    /**
-     * Returns filter description
-     *
-     * @return string
-     */
-    public function getDescription() 
-    {
-        return $this->description;
-    }
-
-    /**
-     * Return list of affected tags
-     *
-     * Each filter rule is concerned with a certain kind of attack vectors. 
-     * This method returns those affected kinds.
-     *
-     * @return array
-     */
-    public function getTags() 
-    {
-        return $this->tags;
-    }
-
-    /**
-     * Returns filter rule
-     *
-     * @return string
-     */
-    public function getRule() 
-    {
-        return $this->rule;
-    }
-
-    /**
-     * Get filter impact level
-     *
-     * @return integer
-     */
-    public function getImpact() 
-    {
-        return $this->impact;
-    }
-    
-    /**
-     * Get filter ID
-     *
-     * @return integer
-     */
-    public function getId() 
-    {
-        return $this->id;
-    }
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Filter/Storage.php

@@ -1,381 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- * 
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.  
- *
- * PHP version 5.1.6+
- * 
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-/**
- * Filter Storage
- *
- * This class provides various default functions for gathering filter patterns 
- * to be used later on by the detection mechanism. You might extend this class 
- * to your requirements.
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Group
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL 
- * @version   Release: $Id:Storage.php 517 2007-09-15 15:04:13Z mario $
- * @link      http://php-ids.org/
- */
-class IDS_Filter_Storage
-{
-
-    /**
-     * Filter source file
-     *
-     * @var string
-     */
-    protected $source = null;
-
-    /**
-     * Holds caching settings
-     *
-     * @var array
-     */
-    protected $cacheSettings = null;
-
-    /**
-     * Cache container
-     *
-     * @var object IDS_Caching wrapper
-     */
-    protected $cache = null;
-
-    /**
-     * Filter container
-     *
-     * @var array
-     */
-    protected $filterSet = array();
-
-    /**
-     * Constructor
-     *
-     * Loads filters based on provided IDS_Init settings.
-     *
-     * @param object $init IDS_Init instance
-     * 
-     * @throws Exception if unsupported filter type is given
-     * @return void
-     */
-    public final function __construct(IDS_Init $init) 
-    {
-        if ($init->config) {
-
-            $caching = isset($init->config['Caching']['caching']) ? 
-                $init->config['Caching']['caching'] : 'none';
-                
-            $type         = $init->config['General']['filter_type'];
-            $this->source = $init->getBasePath() 
-                . $init->config['General']['filter_path'];
-
-            if ($caching && $caching != 'none') {
-                $this->cacheSettings = $init->config['Caching'];
-                include_once 'IDS/Caching/Factory.php';
-                $this->cache = IDS_Caching::factory($init, 'storage');
-            }
-
-            switch ($type) {
-            case 'xml' :
-                $this->getFilterFromXML();
-                break;
-            case 'json' :
-                $this->getFilterFromJson();
-                break;
-            default :
-                throw new Exception('Unsupported filter type.');
-            }
-        }
-    }
-
-    /**
-     * Sets the filter array
-     *
-     * @param array $filterSet array containing multiple IDS_Filter instances
-     * 
-     * @return object $this
-     */
-    public final function setFilterSet($filterSet) 
-    {
-        foreach ($filterSet as $filter) {
-            $this->addFilter($filter);
-        }
-
-        return $this;
-    }
-
-    /**
-     * Returns registered filters
-     *
-     * @return array
-     */
-    public final function getFilterSet() 
-    {
-        return $this->filterSet;
-    }
-
-    /**
-     * Adds a filter
-     *
-     * @param object $filter IDS_Filter instance
-     * 
-     * @return object $this
-     */
-    public final function addFilter(IDS_Filter $filter) 
-    {
-        $this->filterSet[] = $filter;
-        return $this;
-    }
-
-    /**
-     * Checks if any filters are cached
-     *
-     * @return mixed $filters cached filters or false
-     */
-    private function _isCached() 
-    {
-        $filters = false;
-
-        if ($this->cacheSettings) {
-        
-            if ($this->cache) {
-                $filters = $this->cache->getCache();
-            }
-        }
-
-        return $filters;
-    }
-
-    /**
-     * Loads filters from XML using SimpleXML
-     *
-     * This function parses the provided source file and stores the result. 
-     * If caching mode is enabled the result will be cached to increase 
-     * the performance.
-     *
-     * @throws Exception if problems with fetching the XML data occur
-     * @return object $this
-     */
-    public function getFilterFromXML() 
-    {
-
-        if (extension_loaded('SimpleXML')) {
-
-            /*
-             * See if filters are already available in the cache
-             */
-            $filters = $this->_isCached();
-
-            /*
-             * If they aren't, parse the source file
-             */
-            if (!$filters) {
-                if (file_exists($this->source)) {
-                    if (LIBXML_VERSION >= 20621) {
-                        $filters = simplexml_load_file($this->source,
-                                                       null,
-                                                       LIBXML_COMPACT);
-                    } else {
-                        $filters = simplexml_load_file($this->source);
-                    }
-                }
-            }
-
-            /*
-             * In case we still don't have any filters loaded and exception
-             * will be thrown
-             */
-            if (empty($filters)) {
-                throw new Exception(
-                    'XML data could not be loaded.' . 
-                        ' Make sure you specified the correct path.'
-                );
-            }
-
-            /*
-             * Now the storage will be filled with IDS_Filter objects
-             */
-            $data    = array();
-            $nocache = $filters instanceof SimpleXMLElement;
-            $filters = $nocache ? $filters->filter : $filters;
-
-            include_once 'IDS/Filter.php';
-
-            foreach ($filters as $filter) {
-
-                $id          = $nocache ? (string) $filter->id : 
-                    $filter['id'];
-                $rule        = $nocache ? (string) $filter->rule : 
-                    $filter['rule'];
-                $impact      = $nocache ? (string) $filter->impact : 
-                    $filter['impact'];
-                $tags        = $nocache ? array_values((array) $filter->tags) : 
-                    $filter['tags'];
-                $description = $nocache ? (string) $filter->description : 
-                    $filter['description'];
-
-                $this->addFilter(new IDS_Filter($id,
-                                                $rule,
-                                                $description,
-                                                (array) $tags[0],
-                                                (int) $impact));
-
-                $data[] = array(
-                    'id'          => $id, 
-                    'rule'        => $rule,
-                    'impact'      => $impact,
-                    'tags'        => $tags,
-                    'description' => $description
-                );
-            }
-
-            /*
-             * If caching is enabled, the fetched data will be cached
-             */
-            if ($this->cacheSettings) {
-
-                $this->cache->setCache($data);
-            }
-
-        } else {
-            throw new Exception(
-                'SimpleXML not loaded.'
-            );
-        }
-
-        return $this;
-    }
-
-    /**
-     * Loads filters from Json file using ext/Json
-     *
-     * This function parses the provided source file and stores the result. 
-     * If caching mode is enabled the result will be cached to increase 
-     * the performance.
-     *
-     * @throws Exception if problems with fetching the JSON data occur
-     * @return object $this
-     */
-    public function getFilterFromJson() 
-    {
-
-        if (extension_loaded('Json')) {
-
-            /*
-             * See if filters are already available in the cache
-             */
-            $filters = $this->_isCached();
-
-            /*
-             * If they aren't, parse the source file
-             */
-            if (!$filters) {
-                if (file_exists($this->source)) {
-                    $filters = json_decode(file_get_contents($this->source));
-                } else {
-                    throw new Exception(
-                        'JSON data could not be loaded.' . 
-                            ' Make sure you specified the correct path.'
-                    );
-                }
-            }
-
-            if (!$filters) {
-                throw new Exception(
-                    'JSON data could not be loaded.' . 
-                        ' Make sure you specified the correct path.'
-                );
-            }
-
-            /*
-             * Now the storage will be filled with IDS_Filter objects
-             */
-            $data    = array();
-            $nocache = !is_array($filters);
-            $filters = $nocache ? $filters->filters->filter : $filters;
-
-            include_once 'IDS/Filter.php';
-
-            foreach ($filters as $filter) {
-
-                $id          = $nocache ? (string) $filter->id : 
-                    $filter['id'];            	
-                $rule        = $nocache ? (string) $filter->rule : 
-                    $filter['rule'];
-                $impact      = $nocache ? (string) $filter->impact : 
-                    $filter['impact'];
-                $tags        = $nocache ? array_values((array) $filter->tags) : 
-                    $filter['tags'];
-                $description = $nocache ? (string) $filter->description : 
-                    $filter['description'];
-
-                $this->addFilter(new IDS_Filter($id,
-                                                $rule,
-                                                $description,
-                                                (array) $tags[0],
-                                                (int) $impact));
-
-                $data[] = array(
-                    'id'          => $id,
-                    'rule'        => $rule,
-                    'impact'      => $impact,
-                    'tags'        => $tags,
-                    'description' => $description
-                );
-            }
-
-            /*
-             * If caching is enabled, the fetched data will be cached
-             */
-            if ($this->cacheSettings) {
-                $this->cache->setCache($data);
-            }
-
-        } else {
-            throw new Exception(
-                'ext/json not loaded.'
-            );
-        }
-
-        return $this;
-    }
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Init.php

@@ -1,232 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- * 
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. 
- *
- * PHP version 5.1.6+
- * 
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-/**
- * Framework initiation
- *
- * This class is used for the purpose to initiate the framework and inhabits
- * functionality to parse the needed configuration file.
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Groupup
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @version   Release: $Id:Init.php 517 2007-09-15 15:04:13Z mario $
- * @link      http://php-ids.org/
- * @since     Version 0.4
- */
-class IDS_Init
-{
-
-    /**
-     * Holds config settings
-     *
-     * @var array
-     */
-    public $config = array();
-
-    /**
-     * Instance of this class depending on the supplied config file
-     *
-     * @var array
-     * @static
-     */
-    private static $instances = array();
-
-    /**
-     * Path to the config file
-     *
-     * @var string
-     */
-    private $configPath = null;
-
-    /**
-     * Constructor
-     *
-     * Includes needed classes and parses the configuration file
-     *
-     * @param string $configPath the path to the config file
-     * 
-     * @return object $this
-     */
-    private function __construct($configPath = null) 
-    {
-        include_once 'IDS/Monitor.php';
-        include_once 'IDS/Filter/Storage.php';
-
-        if ($configPath) {
-            $this->setConfigPath($configPath);
-            $this->config = parse_ini_file($this->configPath, true);
-        }
-    }
-
-    /**
-     * Permitting to clone this object
-     *
-     * For the sake of correctness of a singleton pattern, this is necessary
-     * 
-     * @return void
-     */
-    public final function __clone() 
-    {
-    }
-
-    /**
-     * Returns an instance of this class. Also a PHP version check 
-     * is being performed to avoid compatibility problems with PHP < 5.1.6
-     *
-     * @param string $configPath the path to the config file
-     * 
-     * @return object
-     */
-    public static function init($configPath = null)
-    {
-        if (!isset(self::$instances[$configPath])) {
-            self::$instances[$configPath] = new IDS_Init($configPath);
-        }
-
-        return self::$instances[$configPath];
-    }
-
-    /**
-     * Sets the path to the configuration file
-     *
-     * @param string $path the path to the config
-     * 
-     * @throws Exception if file not found
-     * @return void
-     */
-    public function setConfigPath($path) 
-    {
-        if (file_exists($path)) {
-            $this->configPath = $path;
-        } else {
-            throw new Exception(
-                'Configuration file could not be found at ' .
-                htmlspecialchars($path, ENT_QUOTES, 'UTF-8')
-            );
-        }
-    }
-
-    /**
-     * Returns path to configuration file
-     *
-     * @return string the config path
-     */
-    public function getConfigPath() 
-    {
-        return $this->configPath;
-    }
-
-    /**
-     * This method checks if a base path is given and usage is set to true. 
-     * If all that tests succeed the base path will be returned as a string - 
-     * else null will be returned.
-     *
-     * @return string the base path or null
-     */
-    public function getBasePath() {
-    	
-    	return ((isset($this->config['General']['base_path']) 
-            && $this->config['General']['base_path'] 
-            && isset($this->config['General']['use_base_path']) 
-            && $this->config['General']['use_base_path']) 
-                ? $this->config['General']['base_path'] : null);
-    }
-    
-    /**
-     * Merges new settings into the exsiting ones or overwrites them
-     *
-     * @param array   $config    the config array
-     * @param boolean $overwrite config overwrite flag
-     * 
-     * @return void
-     */
-    public function setConfig(array $config, $overwrite = false) 
-    {
-        if ($overwrite) {
-            $this->config = $this->_mergeConfig($this->config, $config);
-        } else {
-            $this->config = $this->_mergeConfig($config, $this->config);
-        }
-    }
-
-    /**
-     * Merge config hashes recursivly
-     *
-     * The algorithm merges configuration arrays recursively. If an element is
-     * an array in both, the values will be appended. If it is a scalar in both,
-     * the value will be replaced.
-     *
-     * @param  array $current The legacy hash
-     * @param  array $successor The hash which values count more when in doubt
-     * @return array Merged hash
-     */
-    protected function _mergeConfig($current, $successor)
-    {
-        if (is_array($current) and is_array($successor)) {
-            foreach ($successor as $key => $value) {
-                if (isset($current[$key])
-                    and is_array($value)
-                    and is_array($current[$key])) {
-
-                    $current[$key] = $this->_mergeConfig($current[$key], $value);
-                } else {
-                    $current[$key] = $successor[$key];
-                }
-            }
-        }
-        return $current;
-    }
-
-    /**
-     * Returns the config array
-     *
-     * @return array the config array
-     */
-    public function getConfig() 
-    {
-        return $this->config;
-    }
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Log/Composite.php

@@ -1,136 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- * 
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. 
- *
- * PHP version 5.1.6+
- * 
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-require_once 'IDS/Log/Interface.php';
-
-/**
- * Log Composite
- *
- * This class implements the composite pattern to allow to work with multiple
- * logging wrappers at once.
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Group
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL 
- * @version   Release: $Id:Composite.php 517 2007-09-15 15:04:13Z mario $
- * @link      http://php-ids.org/
- */
-class IDS_Log_Composite
-{
-
-    /**
-     * Holds registered logging wrapper
-     *
-     * @var array
-     */
-    public $loggers = array();
-
-    /**
-     * Iterates through registered loggers and executes them
-     *
-     * @param object $data IDS_Report object
-     * 
-     * @return void
-     */
-    public function execute(IDS_Report $data) 
-    {
-    	// make sure request uri is set right on IIS
-        if (!isset($_SERVER['REQUEST_URI'])) {
-            $_SERVER['REQUEST_URI'] = substr($_SERVER['PHP_SELF'], 1);
-            if (isset($_SERVER['QUERY_STRING']) && $_SERVER['QUERY_STRING']) { 
-                $_SERVER['REQUEST_URI'] .= '?' . $_SERVER['QUERY_STRING']; 
-            } 
-        } 
-        
-        // make sure server address is set right on IIS
-        if (isset($_SERVER['LOCAL_ADDR'])) {
-            $_SERVER['SERVER_ADDR'] = $_SERVER['LOCAL_ADDR'];
-        } 
-    	
-        foreach ($this->loggers as $logger) {
-            $logger->execute($data);
-        }
-    }
-
-    /**
-     * Registers a new logging wrapper
-     *
-     * Only valid IDS_Log_Interface instances passed to this function will be 
-     * registered
-     *
-     * @return void
-     */
-    public function addLogger() 
-    {
-
-        $args = func_get_args();
-
-        foreach ($args as $class) {
-            if (!in_array($class, $this->loggers) && 
-                ($class instanceof IDS_Log_Interface)) {
-                $this->loggers[] = $class;
-            }
-        }
-    }
-
-    /**
-     * Removes a logger
-     *
-     * @param object $logger IDS_Log_Interface object
-     * 
-     * @return boolean
-     */
-    public function removeLogger(IDS_Log_Interface $logger) 
-    {
-        $key = array_search($logger, $this->loggers);
-
-        if (isset($this->loggers[$key])) {
-            unset($this->loggers[$key]);
-            return true;
-        }
-
-        return false;
-    }
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Log/Database.php

@@ -1,300 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- * 
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.  
- *
- * PHP version 5.1.6+
- * 
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-require_once 'IDS/Log/Interface.php';
-
-/*
- * Needed SQL:
- *
-    CREATE DATABASE IF NOT EXISTS `phpids` DEFAULT CHARACTER 
-        SET utf8 COLLATE utf8_general_ci;
-    DROP TABLE IF EXISTS `intrusions`;
-    CREATE TABLE IF NOT EXISTS `intrusions` (
-      `id` int(11) unsigned NOT null auto_increment,
-      `name` varchar(128) NOT null,
-      `value` text NOT null,
-      `page` varchar(255) NOT null,
-      `tags` varchar(128) NOT null,
-      `ip` varchar(15) NOT null,
-      `ip2` varchar(15) NOT null,
-      `impact` int(11) unsigned NOT null,
-      `origin` varchar(15) NOT null,
-      `created` datetime NOT null,
-      PRIMARY KEY  (`id`)
-    ) ENGINE=MyISAM ;
- *
- *
- *
- */
-
-/**
- * Database logging wrapper
- *
- * The database wrapper is designed to store reports into an sql database. It 
- * implements the singleton pattern and is based in PDO, supporting 
- * different database types.
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Group
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @version   Release: $Id:Database.php 517 2007-09-15 15:04:13Z mario $
- * @link      http://php-ids.org/
- */
-class IDS_Log_Database implements IDS_Log_Interface
-{
-
-    /**
-     * Database wrapper
-     *
-     * @var string
-     */
-    private $wrapper = null;
-
-    /**
-     * Database user
-     *
-     * @var string
-     */
-    private $user = null;
-
-    /**
-     * Database password
-     *
-     * @var string
-     */
-    private $password = null;
-
-    /**
-     * Database table
-     *
-     * @var string
-     */
-    private $table = null;
-
-    /**
-     * Database handle
-     *
-     * @var object  PDO instance
-     */
-    private $handle    = null;
-
-    /**
-     * Prepared SQL statement
-     *
-     * @var string
-     */
-    private $statement = null;
-
-    /**
-     * Holds current remote address
-     *
-     * @var string
-     */
-    private $ip = 'local/unknown';
-
-    /**
-     * Instance container
-     *
-     * Due to the singleton pattern this class allows to initiate only one instance
-     * for each database wrapper.
-     *
-     * @var array
-     */
-    private static $instances = array();
-
-    /**
-     * Constructor
-     *
-     * Prepares the SQL statement
-     *
-     * @param mixed $config IDS_Init instance | array
-     * 
-     * @return void
-     * @throws PDOException if a db error occurred
-     */
-    protected function __construct($config) 
-    {
-
-        if ($config instanceof IDS_Init) {
-            $this->wrapper  = $config->config['Logging']['wrapper'];
-            $this->user     = $config->config['Logging']['user'];
-            $this->password = $config->config['Logging']['password'];
-            $this->table    = $config->config['Logging']['table'];
-
-        } elseif (is_array($config)) {
-            $this->wrapper  = $config['wrapper'];
-            $this->user     = $config['user'];
-            $this->password = $config['password'];
-            $this->table    = $config['table'];
-        }
-
-        // determine correct IP address and concat them if necessary
-        $this->ip  = $_SERVER['REMOTE_ADDR'];
-        $this->ip2 = isset($_SERVER['HTTP_X_FORWARDED_FOR']) 
-            ? $_SERVER['HTTP_X_FORWARDED_FOR'] 
-            : '';
-
-        try {
-            $this->handle = new PDO(
-                $this->wrapper,
-                $this->user,
-                $this->password
-            );
-
-            $this->statement = $this->handle->prepare('
-                INSERT INTO ' . $this->table . ' (
-                    name,
-                    value,
-                    page,
-                    tags,
-                    ip,
-                    ip2,
-                    impact,
-                    origin,
-                    created
-                )
-                VALUES (
-                    :name,
-                    :value,
-                    :page,
-                    :tags,
-                    :ip,
-                    :ip2,
-                    :impact,
-                    :origin,
-                    now()
-                )
-            ');
-
-        } catch (PDOException $e) {
-            throw new PDOException('PDOException: ' . $e->getMessage());
-        }
-    }
-
-    /**
-     * Returns an instance of this class
-     *
-     * This method allows the passed argument to be either an instance of IDS_Init or
-     * an array.
-     *
-     * @param  mixed  $config    IDS_Init | array
-     * @param  string $classname the class name to use
-     * 
-     * @return object $this
-     */
-    public static function getInstance($config, $classname = 'IDS_Log_Database')
-    {
-        if ($config instanceof IDS_Init) {
-            $wrapper = $config->config['Logging']['wrapper'];
-        } elseif (is_array($config)) {
-            $wrapper = $config['wrapper'];
-        }
-
-        if (!isset(self::$instances[$wrapper])) {
-            self::$instances[$wrapper] = new $classname($config);
-        }
-
-        return self::$instances[$wrapper];
-    }
-
-    /**
-     * Permitting to clone this object
-     *
-     * For the sake of correctness of a singleton pattern, this is necessary
-     * 
-     * @return void
-     */
-    private function __clone() 
-    { 
-    }
-
-    /**
-     * Stores given data into the database
-     *
-     * @param object $data IDS_Report instance
-     * 
-     * @throws Exception if db error occurred
-     * @return boolean
-     */
-    public function execute(IDS_Report $data) 
-    {
-        if (!isset($_SERVER['REQUEST_URI'])) {
-            $_SERVER['REQUEST_URI'] = substr($_SERVER['PHP_SELF'], 1);
-            if (isset($_SERVER['QUERY_STRING']) && $_SERVER['QUERY_STRING']) { 
-                $_SERVER['REQUEST_URI'] .= '?' . $_SERVER['QUERY_STRING']; 
-            } 
-        }     	
-
-        foreach ($data as $event) {
-            $page = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '';
-            $ip   = $this->ip;
-            $ip2  = $this->ip2;
-            
-            $name   = $event->getName();
-            $value  = $event->getValue();
-            $impact = $event->getImpact();
-            $tags   = implode(', ', $event->getTags());
-
-            $this->statement->bindParam('name', $name);
-            $this->statement->bindParam('value', $value);
-            $this->statement->bindParam('page', $page);
-            $this->statement->bindParam('tags', $tags);
-            $this->statement->bindParam('ip', $ip);
-            $this->statement->bindParam('ip2', $ip2);
-            $this->statement->bindParam('impact', $impact);
-            $this->statement->bindParam('origin', $_SERVER['SERVER_ADDR']);
-
-            if (!$this->statement->execute()) {
-
-                $info = $this->statement->errorInfo();
-                throw new Exception(
-                    $this->statement->errorCode() . ', ' . $info[1] . ', ' . $info[2]
-                );
-            }
-        }
-
-        return true;
-    }
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Log/Email.php

@@ -1,400 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- *
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. 
- *
- * PHP version 5.1.6+
- *
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-require_once 'IDS/Log/Interface.php';
-
-/**
- * Email logging wrapper
- *
- * The Email wrapper is designed to send reports via email. It implements the
- * singleton pattern.
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Group
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @version   Release: $Id:Email.php 517 2007-09-15 15:04:13Z mario $
- * @link      http://php-ids.org/
- */
-class IDS_Log_Email implements IDS_Log_Interface
-{
-
-    /**
-     * Recipient container
-     *
-     * @var array
-     */
-    protected $recipients    = array();
-
-    /**
-     * Mail subject
-     *
-     * @var string
-     */
-    protected $subject = null;
-
-    /**
-     * Additional mail headers
-     *
-     * @var string
-     */
-    protected $headers = null;
-
-    /**
-     * Safemode switch
-     *
-     * Using this switch it is possible to enable safemode, which is a spam
-     * protection based on the alert frequency.
-     *
-     * @var boolean
-     */
-    protected $safemode = true;
-
-    /**
-     * Urlencode for result strings
-     *
-     * This switch is true by default. Setting it to false removes 
-     * the 'better safe than sorry' urlencoding for the result string in 
-     * the report mails. Enhances readability but maybe XSSes email clients.
-     *
-     * @var boolean
-     */
-    protected $urlencode = true;
-
-    /**
-     * Send rate
-     *
-     * If safemode is enabled, this property defines how often reports will be
-     * sent out. Default value is 15, which means that a mail will be sent on
-     * condition that the last email has not been sent earlier than 15 seconds ago.
-     *
-     * @var integer
-     */
-    protected $allowed_rate = 15;
-
-    /**
-     * PHPIDS temp directory
-     *
-     * When safemod is enabled, a path to a temp directory is needed to
-     * store some information. Default is IDS/tmp/
-     *
-     * @var string
-     */
-    protected $tmp_path = 'IDS/tmp/';
-
-    /**
-     * File prefix for tmp files
-     *
-     * @var string
-     */
-    protected $file_prefix = 'PHPIDS_Log_Email_';
-
-    /**
-     * Holds current remote address
-     *
-     * @var string
-     */
-    protected $ip = 'local/unknown';
-
-    /**
-     * Instance container
-     *
-     * @var array
-     */
-    protected static $instance = array();
-
-    /**
-     * Constructor
-     *
-     * @param mixed $config IDS_Init instance | array
-     *
-     * @return void
-     */
-    protected function __construct($config)
-    {
-
-        if ($config instanceof IDS_Init) {
-            $this->recipients   = $config->config['Logging']['recipients'];
-            $this->subject      = $config->config['Logging']['subject'];
-            $this->headers      = $config->config['Logging']['header'];
-            $this->envelope     = $config->config['Logging']['envelope'];
-            $this->safemode     = $config->config['Logging']['safemode'];
-            $this->urlencode    = $config->config['Logging']['urlencode'];
-            $this->allowed_rate = $config->config['Logging']['allowed_rate'];
-            $this->tmp_path     = $config->getBasePath() 
-                . $config->config['General']['tmp_path'];
-
-        } elseif (is_array($config)) {
-            $this->recipients[]      = $config['recipients'];
-            $this->subject           = $config['subject'];
-            $this->additionalHeaders = $config['header'];
-        }
-
-        // determine correct IP address and concat them if necessary
-        $this->ip = $_SERVER['REMOTE_ADDR'] .
-            (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ?
-            ' (' . $_SERVER['HTTP_X_FORWARDED_FOR'] . ')' : '');
-    }
-
-    /**
-     * Returns an instance of this class
-     *
-     * This method allows the passed argument to be either an instance of
-     * IDS_Init or an array.
-     *
-     * @param  mixed  $config    IDS_Init | array
-     * @param  string $classname the class name to use
-     *
-     * @return object $this
-     */
-    public static function getInstance($config, $classname = 'IDS_Log_Email')
-    {
-        if (!self::$instance) {
-            self::$instance = new $classname($config);
-        }
-
-        return self::$instance;
-    }
-
-    /**
-     * Permitting to clone this object
-     *
-     * For the sake of correctness of a singleton pattern, this is necessary
-     *
-     * @return void
-     */
-    private function __clone()
-    {
-    }
-
-    /**
-     * Detects spam attempts
-     *
-     * To avoid mail spam through this logging class this function is used
-     * to detect such attempts based on the alert frequency.
-     *
-     * @return boolean
-     */
-    protected function isSpamAttempt()
-    {
-
-        /*
-        * loop through all files in the tmp directory and
-        * delete garbage files
-        */
-        $dir = $this->tmp_path;
-        $numPrefixChars = strlen($this->file_prefix);
-        $files = scandir($dir);
-        foreach ($files as $file) {
-            if (is_file($dir . DIRECTORY_SEPARATOR . $file)) {
-                if (substr($file, 0, $numPrefixChars) == $this->file_prefix) {
-                    $lastModified = filemtime($dir . DIRECTORY_SEPARATOR . $file);
-                    if ((time() - $lastModified) > 3600) {
-                        unlink($dir . DIRECTORY_SEPARATOR . $file);
-                    }
-                }
-            }
-        }
-
-        /*
-        * end deleting garbage files
-        */
-        $remoteAddr = $this->ip;
-        $userAgent  = $_SERVER['HTTP_USER_AGENT'];
-        $filename   = $this->file_prefix . md5($remoteAddr.$userAgent) . '.tmp';
-        $file       = $dir . DIRECTORY_SEPARATOR . $filename;
-
-        if (!file_exists($file)) {
-            $handle = fopen($file, 'w');
-            fwrite($handle, time());
-            fclose($handle);
-
-            return false;
-        }
-
-        $lastAttack = file_get_contents($file);
-        $difference = time() - $lastAttack;
-        if ($difference > $this->allowed_rate) {
-            unlink($file);
-        } else {
-            return true;
-        }
-
-        return false;
-    }
-
-    /**
-     * Prepares data
-     *
-     * Converts given data into a format that can be read in an email.
-     * You might edit this method to your requirements.
-     *
-     * @param mixed $data the report data
-     *
-     * @return string
-     */
-    protected function prepareData($data)
-    {
-
-        $format  = "The following attack has been detected by PHPIDS\n\n";
-        $format .= "IP: %s \n";
-        $format .= "Date: %s \n";
-        $format .= "Impact: %d \n";
-        $format .= "Affected tags: %s \n";
-
-        $attackedParameters = '';
-        foreach ($data as $event) {
-            $attackedParameters .= $event->getName() . '=' .
-                ((!isset($this->urlencode) ||$this->urlencode) 
-                    ? urlencode($event->getValue()) 
-                    : $event->getValue()) . ", ";
-        }
-
-        $format .= "Affected parameters: %s \n";
-        $format .= "Request URI: %s \n";
-        $format .= "Origin: %s \n";
-
-        return sprintf($format,
-                       $this->ip,
-                       date('c'),
-                       $data->getImpact(),
-                       join(' ', $data->getTags()),
-                       trim($attackedParameters),
-                       htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES, 'UTF-8'),
-                       $_SERVER['SERVER_ADDR']);
-    }
-
-    /**
-     * Sends the report to registered recipients
-     *
-     * @param object $data IDS_Report instance
-     *
-     * @throws Exception if data is no string
-     * @return boolean
-     */
-    public function execute(IDS_Report $data)
-    {
-
-        if ($this->safemode) {
-            if ($this->isSpamAttempt()) {
-                return false;
-            }
-        }
-
-        /*
-        * In case the data has been modified before it might
-        * be necessary to convert it to string since it's pretty
-        * senseless to send array or object via e-mail
-        */
-        $data = $this->prepareData($data);
-
-        if (is_string($data)) {
-            $data = trim($data);
-
-            // if headers are passed as array, we need to make a string of it
-            if (is_array($this->headers)) {
-                $headers = "";
-                foreach ($this->headers as $header) {
-                    $headers .= $header . "\r\n";
-                }
-            } else {
-                $headers = $this->headers;
-            }
-
-            if (!empty($this->recipients)) {
-                if (is_array($this->recipients)) {
-                    foreach ($this->recipients as $address) {
-                        $this->send(
-                            $address,
-                            $data,
-                            $headers,
-                            $this->envelope
-                        );
-                    }
-                } else {
-                    $this->send(
-                        $this->recipients,
-                        $data,
-                        $headers,
-                        $this->envelope
-                    );
-                }
-            }
-
-        } else {
-            throw new Exception(
-                'Please make sure that data returned by
-                 IDS_Log_Email::prepareData() is a string.'
-            );
-        }
-
-        return true;
-    }
-
-    /**
-     * Sends an email
-     *
-     * @param string $address  email address
-     * @param string $data     the report data
-     * @param string $headers  the mail headers
-     * @param string $envelope the optional envelope string
-     *
-     * @return boolean
-     */
-    protected function send($address, $data, $headers, $envelope = null)
-    {
-        if (!$envelope || strpos(ini_get('sendmail_path'),' -f') !== false) {
-            return mail($address,
-                $this->subject,
-                $data,
-                $headers);
-        } else {
-            return mail($address,
-                $this->subject,
-                $data,
-                $headers,
-                '-f' . $envelope);
-        }
-    }
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Log/File.php

@@ -1,229 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- * 
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. 
- *
- * PHP version 5.1.6+
- * 
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-require_once 'IDS/Log/Interface.php';
-
-/**
- * File logging wrapper
- *
- * The file wrapper is designed to store data into a flatfile. It implements the
- * singleton pattern.
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Group
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @version   Release: $Id:File.php 517 2007-09-15 15:04:13Z mario $
- * @link      http://php-ids.org/
- */
-class IDS_Log_File implements IDS_Log_Interface
-{
-
-    /**
-     * Path to the log file
-     *
-     * @var string
-     */
-    private $logfile = null;
-
-    /**
-     * Instance container
-     *
-     * Due to the singleton pattern this class allows to initiate only one 
-     * instance for each file.
-     *
-     * @var array
-     */
-    private static $instances = array();
-
-    /**
-     * Holds current remote address
-     *
-     * @var string
-     */
-    private $ip = 'local/unknown';
-
-    /**
-     * Constructor
-     *
-     * @param string $logfile path to the log file
-     * 
-     * @return void
-     */
-    protected function __construct($logfile) 
-    {
-
-        // determine correct IP address and concat them if necessary
-        $this->ip = $_SERVER['REMOTE_ADDR'] .
-            (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ?
-                ' (' . $_SERVER['HTTP_X_FORWARDED_FOR'] . ')' : '');
-
-        $this->logfile = $logfile;
-    }
-
-    /**
-     * Returns an instance of this class
-     *
-     * This method allows the passed argument to be either an instance of 
-     * IDS_Init or a path to a log file. Due to the singleton pattern only one 
-     * instance for each file can be initiated.
-     *
-     * @param  mixed  $config    IDS_Init or path to a file
-     * @param  string $classname the class name to use
-     * 
-     * @return object $this
-     */
-    public static function getInstance($config, $classname = 'IDS_Log_File') 
-    {
-        if ($config instanceof IDS_Init) {
-            $logfile = $config->getBasePath() . $config->config['Logging']['path'];
-        } elseif (is_string($config)) {
-            $logfile = $config;
-        }
-        
-        if (!isset(self::$instances[$logfile])) {
-            self::$instances[$logfile] = new $classname($logfile);
-        }
-
-        return self::$instances[$logfile];
-    }
-
-    /**
-     * Permitting to clone this object
-     *
-     * For the sake of correctness of a singleton pattern, this is necessary
-     * 
-     * @return void
-     */
-    private function __clone() 
-    { 
-    }
-
-    /**
-     * Prepares data
-     *
-     * Converts given data into a format that can be stored into a file. 
-     * You might edit this method to your requirements.
-     *
-     * @param mixed $data incoming report data
-     * 
-     * @return string
-     */
-    protected function prepareData($data) 
-    {
-
-        $format = '"%s",%s,%d,"%s","%s","%s","%s"';
-
-        $attackedParameters = '';
-        foreach ($data as $event) {
-            $attackedParameters .= $event->getName() . '=' .
-                rawurlencode($event->getValue()) . ' ';
-        }
-
-        $dataString = sprintf($format,
-            urlencode($this->ip),
-            date('c'),
-            $data->getImpact(),
-            join(' ', $data->getTags()),
-            urlencode(trim($attackedParameters)),
-            urlencode($_SERVER['REQUEST_URI']),
-            $_SERVER['SERVER_ADDR']
-        );
-
-        return $dataString;
-    }
-
-    /**
-     * Stores given data into a file
-     *
-     * @param  object $data IDS_Report
-     * 
-     * @throws Exception if the logfile isn't writeable
-     * @return boolean
-     */
-    public function execute(IDS_Report $data) 
-    {
-
-        /*
-         * In case the data has been modified before it might  be necessary 
-         * to convert it to string since we can't store array or object 
-         * into a file
-         */
-        $data = $this->prepareData($data);
-
-        if (is_string($data)) {
-
-            if (file_exists($this->logfile)) {
-                $data = trim($data);
-
-                if (!empty($data)) {
-                    if (is_writable($this->logfile)) {
-
-                        $handle = fopen($this->logfile, 'a');
-                        fwrite($handle, trim($data) . "\n");
-                        fclose($handle);
-
-                    } else {
-                        throw new Exception(
-                            'Please make sure that ' . $this->logfile . 
-                                ' is writeable.'
-                        );
-                    }
-                }
-            } else {
-                throw new Exception(
-                    'Given file does not exist. Please make sure the
-                    logfile is present in the given directory.'
-                );
-            }
-        } else {
-            throw new Exception(
-                'Please make sure that data returned by
-                IDS_Log_File::prepareData() is a string.'
-            );
-        }
-
-        return true;
-    }
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Log/Interface.php

@@ -1,65 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- * 
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. 
- *
- * PHP version 5.1.6+
- * 
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-/**
- * Interface for logging wrappers
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Group
- * @version   Release: $Id:Interface.php 517 2007-09-15 15:04:13Z mario $
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @link      http://php-ids.org/
- */
-interface IDS_Log_Interface
-{
-    /**
-     * Interface method
-     *
-     * @param IDS_Report $data the report data
-     * 
-     * @return void 
-     */
-    public function execute(IDS_Report $data);
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Monitor.php

@@ -1,778 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- *
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. 
- *
- * PHP version 5.1.6+
- *
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-/**
- * Monitoring engine
- *
- * This class represents the core of the frameworks attack detection mechanism
- * and provides functions to scan incoming data for malicious appearing script
- * fragments.
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Group
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @version   Release: $Id:Monitor.php 949 2008-06-28 01:26:03Z christ1an $
- * @link      http://php-ids.org/
- */
-class IDS_Monitor
-{
-
-    /**
-     * Tags to define what to search for
-     *
-     * Accepted values are xss, csrf, sqli, dt, id, lfi, rfe, spam, dos
-     *
-     * @var array
-     */
-    private $tags = null;
-
-    /**
-     * Request array
-     *
-     * Array containing raw data to search in
-     *
-     * @var array
-     */
-    private $request = null;
-
-    /**
-     * Container for filter rules
-     *
-     * Holds an instance of IDS_Filter_Storage
-     *
-     * @var object
-     */
-    private $storage = null;
-
-    /**
-     * Results
-     *
-     * Holds an instance of IDS_Report which itself provides an API to
-     * access the detected results
-     *
-     * @var object
-     */
-    private $report = null;
-
-    /**
-     * Scan keys switch
-     *
-     * Enabling this property will cause the monitor to scan both the key and
-     * the value of variables
-     *
-     * @var boolean
-     */
-    public $scanKeys = false;
-
-    /**
-     * Exception container
-     *
-     * Using this array it is possible to define variables that must not be
-     * scanned. Per default, utmz google analytics parameters are permitted.
-     *
-     * @var array
-     */
-    private $exceptions = array();
-
-    /**
-     * Html container
-     *
-     * Using this array it is possible to define variables that legally
-     * contain html and have to be prepared before hitting the rules to
-     * avoid too many false alerts
-     *
-     * @var array
-     */
-    private $html = array();
-
-    /**
-     * JSON container
-     *
-     * Using this array it is possible to define variables that contain
-     * JSON data - and should be treated as such
-     *
-     * @var array
-     */
-    private $json = array();
-
-    /**
-     * Holds HTMLPurifier object
-     *
-     * @var object
-     */
-    private $htmlpurifier = NULL;
-
-    /**
-     * Path to HTMLPurifier source
-     *
-     * This path might be changed in case one wishes to make use of a
-     * different HTMLPurifier source file e.g. if already used in the
-     * application PHPIDS is protecting
-     *
-     * @var string
-     */
-    private $pathToHTMLPurifier = '';
-
-    /**
-     * HTMLPurifier cache directory
-     *
-     * @var string
-     */
-    private $HTMLPurifierCache = '';
-
-    /**
-     * This property holds the tmp JSON string from the
-     * _jsonDecodeValues() callback
-     *
-     * @var string
-     */
-    private $tmpJsonString = '';
-
-
-    /**
-     * Constructor
-     *
-     * @param array  $request array to scan
-     * @param object $init    instance of IDS_Init
-     * @param array  $tags    list of tags to which filters should be applied
-     *
-     * @return void
-     */
-    public function __construct(array $request, IDS_Init $init, array $tags = null)
-    {
-        $version = isset($init->config['General']['min_php_version'])
-            ? $init->config['General']['min_php_version'] : '5.1.6';
-
-        if (version_compare(PHP_VERSION, $version, '<')) {
-            throw new Exception(
-                'PHP version has to be equal or higher than ' . $version . ' or
-                PHP version couldn\'t be determined'
-            );
-        }
-
-
-        if (!empty($request)) {
-            $this->storage = new IDS_Filter_Storage($init);
-            $this->request = $request;
-            $this->tags    = $tags;
-
-            $this->scanKeys   = $init->config['General']['scan_keys'];
-
-            $this->exceptions = isset($init->config['General']['exceptions'])
-                ? $init->config['General']['exceptions'] : false;
-
-            $this->html       = isset($init->config['General']['html'])
-                ? $init->config['General']['html'] : false;
-
-            $this->json       = isset($init->config['General']['json'])
-                ? $init->config['General']['json'] : false;
-
-            if(isset($init->config['General']['HTML_Purifier_Path'])
-                && isset($init->config['General']['HTML_Purifier_Cache'])) {
-                
-                $this->pathToHTMLPurifier = 
-                    $init->config['General']['HTML_Purifier_Path'];
-                
-                $this->HTMLPurifierCache  = $init->getBasePath()
-                    . $init->config['General']['HTML_Purifier_Cache'];
-            }
-
-        }
-
-        if (!is_writeable($init->getBasePath()
-            . $init->config['General']['tmp_path'])) {
-            throw new Exception(
-                'Please make sure the ' . 
-                htmlspecialchars($init->getBasePath() . 
-                $init->config['General']['tmp_path'], ENT_QUOTES, 'UTF-8') . 
-                ' folder is writable'
-            );
-        }
-
-        include_once 'IDS/Report.php';
-        $this->report = new IDS_Report;
-    }
-
-    /**
-     * Starts the scan mechanism
-     *
-     * @return object IDS_Report
-     */
-    public function run()
-    {
-        
-        if (!empty($this->request)) {
-            foreach ($this->request as $key => $value) {
-                $this->_iterate($key, $value);
-            }
-        }
-         
-        return $this->getReport();
-    }
-
-    /**
-     * Iterates through given data and delegates it to IDS_Monitor::_detect() in
-     * order to check for malicious appearing fragments
-     *
-     * @param mixed $key   the former array key
-     * @param mixed $value the former array value
-     *
-     * @return void
-     */
-    private function _iterate($key, $value)
-    {
-
-        if (!is_array($value)) {
-            if (is_string($value)) {
-
-                if ($filter = $this->_detect($key, $value)) {
-                    include_once 'IDS/Event.php';
-                    $this->report->addEvent(
-                        new IDS_Event(
-                            $key,
-                            $value,
-                            $filter
-                        )
-                    );
-                }
-            }
-        } else {
-            foreach ($value as $subKey => $subValue) {
-                $this->_iterate($key . '.' . $subKey, $subValue);
-            }
-        }
-    }
-
-    /**
-     * Checks whether given value matches any of the supplied filter patterns
-     *
-     * @param mixed $key   the key of the value to scan
-     * @param mixed $value the value to scan
-     *
-     * @return bool|array false or array of filter(s) that matched the value
-     */
-    private function _detect($key, $value)
-    {
-
-        // define the pre-filter
-        $prefilter = '/[^\w\s\/@!?\.]+|(?:\.\/)|(?:@@\w+)' 
-            . '|(?:\+ADw)|(?:union\s+select)/i';
-        
-        // to increase performance, only start detection if value
-        // isn't alphanumeric
-        if (!$this->scanKeys 
-            && (!$value || !preg_match($prefilter, $value))) {
-            return false;
-        } elseif($this->scanKeys) {
-            if((!$key || !preg_match($prefilter, $key)) 
-                && (!$value || !preg_match($prefilter, $value))) {
-                return false;
-            }
-        }
-        
-        // check if this field is part of the exceptions
-        if (is_array($this->exceptions)) {
-            foreach($this->exceptions as $exception) {
-                $matches = array();
-                if(preg_match('/(\/.*\/[^eE]*)$/', $exception, $matches)) {
-                    if(isset($matches[1]) && preg_match($matches[1], $key)) {
-                        return false;
-                    } 
-                } else {
-                    if($exception === $key) {
-                        return false;
-                    }
-                }
-            }
-        }
-
-        // check for magic quotes and remove them if necessary
-        if (function_exists('get_magic_quotes_gpc')
-            && get_magic_quotes_gpc()) {
-            $value = stripslashes($value);
-        }
-        if(function_exists('get_magic_quotes_gpc')
-            && !get_magic_quotes_gpc() 
-            && version_compare(PHP_VERSION, '5.3.0', '>=')) {
-            $value = preg_replace('/\\\(["\'\/])/im', '$1', $value);
-        }
-
-        // if html monitoring is enabled for this field - then do it!
-        if (is_array($this->html) && in_array($key, $this->html, true)) {
-            list($key, $value) = $this->_purifyValues($key, $value);
-        }
-
-        // check if json monitoring is enabled for this field
-        if (is_array($this->json) && in_array($key, $this->json, true)) {
-            list($key, $value) = $this->_jsonDecodeValues($key, $value);
-        }
-
-        // use the converter
-        include_once 'IDS/Converter.php';
-        $value = IDS_Converter::runAll($value);
-        $value = IDS_Converter::runCentrifuge($value, $this);
-
-        // scan keys if activated via config
-        $key = $this->scanKeys ? IDS_Converter::runAll($key)
-            : $key;
-        $key = $this->scanKeys ? IDS_Converter::runCentrifuge($key, $this)
-            : $key;
-
-        $filters   = array();
-        $filterSet = $this->storage->getFilterSet();
-        foreach ($filterSet as $filter) {
-
-            /*
-             * in case we have a tag array specified the IDS will only
-             * use those filters that are meant to detect any of the
-             * defined tags
-             */
-            if (is_array($this->tags)) {
-                if (array_intersect($this->tags, $filter->getTags())) {
-                    if ($this->_match($key, $value, $filter)) {
-                        $filters[] = $filter;
-                    }
-                }
-            } else {
-                if ($this->_match($key, $value, $filter)) {
-                    $filters[] = $filter;
-                }
-            }
-        }
-
-        return empty($filters) ? false : $filters;
-    }
-
-
-    /**
-     * Purifies given key and value variables using HTMLPurifier
-     *
-     * This function is needed whenever there is variables for which HTML
-     * might be allowed like e.g. WYSIWYG post bodies. It will dectect malicious
-     * code fragments and leaves harmless parts untouched.
-     *
-     * @param  mixed $key
-     * @param  mixed $value
-     * @since  0.5
-     * @throws Exception
-     *
-     * @return array
-     */
-    private function _purifyValues($key, $value) 
-    {
-        /*
-         * Perform a pre-check if string is valid for purification
-         */
-        if(!$this->_purifierPreCheck($key, $value)) {
-            return array($key, $value);
-        }
-
-        include_once $this->pathToHTMLPurifier;
-
-        if (!is_writeable($this->HTMLPurifierCache)) {
-            throw new Exception(
-                $this->HTMLPurifierCache . ' must be writeable');
-        }
-
-        if (class_exists('HTMLPurifier')) {
-            $config = HTMLPurifier_Config::createDefault();
-            $config->set('Attr.EnableID', true);
-            $config->set('Cache.SerializerPath', $this->HTMLPurifierCache);
-            $config->set('Output.Newline', "\n");
-            $this->htmlpurifier = new HTMLPurifier($config);
-        } else {
-            throw new Exception(
-                'HTMLPurifier class could not be found - ' .
-                'make sure the purifier files are valid and' .
-                ' the path is correct'
-            );
-        }
-
-        $value = preg_replace('/[\x0b-\x0c]/', ' ', $value);
-        $key = preg_replace('/[\x0b-\x0c]/', ' ', $key);   
-
-        $purified_value = $this->htmlpurifier->purify($value);
-        $purified_key   = $this->htmlpurifier->purify($key);
-
-        $redux_value = strip_tags($value);
-        $redux_key   = strip_tags($key);
-
-        if ($value != $purified_value || $redux_value) {
-            $value = $this->_diff($value, $purified_value, $redux_value);
-        } else {
-            $value = NULL;
-        }
-        if ($key != $purified_key) {
-            $key = $this->_diff($key, $purified_key, $redux_key);
-        } else {
-            $key = NULL;
-        }
-
-        return array($key, $value);
-    }
-    
-    /**
-     * This method makes sure no dangerous markup can be smuggled in 
-     * attributes when HTML mode is switched on. 
-     * 
-     * If the precheck considers the string too dangerous for 
-     * purification false is being returned.
-     * 
-     * @param  mixed $key
-     * @param  mixed $value
-     * @since  0.6
-     *
-     * @return boolean
-     */
-    private function _purifierPreCheck($key = '', $value = '') 
-    {
-        /*
-         * Remove control chars before pre-check
-         */
-        $tmp_value = preg_replace('/\p{C}/', null, $value);
-        $tmp_key = preg_replace('/\p{C}/', null, $key);
-        
-        $precheck = '/<(script|iframe|applet|object)\W/i';
-        if(preg_match($precheck, $tmp_key) 
-            || preg_match($precheck, $tmp_value)) {
-            
-            return false;
-        }
-        return true;
-    }
-    
-
-    /**
-     * This method calculates the difference between the original
-     * and the purified markup strings.
-     *
-     * @param string $original the original markup
-     * @param string $purified the purified markup
-     * @param string $redux    the string without html
-     * @since 0.5
-     *
-     * @return string the difference between the strings
-     */
-    private function _diff($original, $purified, $redux)
-    {
-        /*
-         * deal with over-sensitive alt-attribute addition of the purifier
-         * and other common html formatting problems
-         */
-        $purified = preg_replace('/\s+alt="[^"]*"/m', null, $purified);
-        $purified = preg_replace('/=?\s*"\s*"/m', null, $purified);
-        $original = preg_replace('/\s+alt="[^"]*"/m', null, $original);
-        $original = preg_replace('/=?\s*"\s*"/m', null, $original);
-        $original = preg_replace('/style\s*=\s*([^"])/m', 'style = "$1', $original);
-        
-        # deal with oversensitive CSS normalization
-        $original = preg_replace('/(?:([\w\-]+:)+\s*([^;]+;\s*))/m', '$1$2', $original);
-        
-        # strip whitespace between tags
-        $original = trim(preg_replace('/>\s*</m', '><', $original));
-        $purified = trim(preg_replace('/>\s*</m', '><', $purified));
-        
-        $original = preg_replace(
-            '/(=\s*(["\'`])[^>"\'`]*>[^>"\'`]*["\'`])/m', 'alt$1', $original
-        );
-
-        // no purified html is left
-        if (!$purified) {
-            return $original;
-        }
-        
-        // calculate the diff length
-        $length = mb_strlen($original) - mb_strlen($purified);
-
-        /*
-         * Calculate the difference between the original html input
-         * and the purified string.
-         */
-        $array_1 = preg_split('/(?<!^)(?!$)/u', html_entity_decode(urldecode($original)));
-        $array_2 = preg_split('/(?<!^)(?!$)/u', $purified);
-
-        // create an array containing the single character differences
-        $differences = array();
-        foreach ($array_1 as $key => $value) {
-            if (!isset($array_2[$key]) || $value !== $array_2[$key]) {
-                $differences[] = $value;
-            }
-        }
-
-        // return the diff - ready to hit the converter and the rules
-        if(intval($length) <= 10) {
-            $diff = trim(join('', $differences));
-        } else {
-            $diff = mb_substr(trim(join('', $differences)), 0, strlen($original));
-        }
-
-        // clean up spaces between tag delimiters
-        $diff = preg_replace('/>\s*</m', '><', $diff);
-
-        // correct over-sensitively stripped bad html elements
-        $diff = preg_replace('/[^<](iframe|script|embed|object' .
-            '|applet|base|img|style)/m', '<$1', $diff);
-
-        if (mb_strlen($diff) < 4) {
-            return null;
-        }
-
-        return $diff . $redux;
-    }
-
-    /**
-     * This method prepares incoming JSON data for the PHPIDS detection
-     * process. It utilizes _jsonConcatContents() as callback and returns a
-     * string version of the JSON data structures.
-     *
-     * @param  mixed $key
-     * @param  mixed $value
-     * @since  0.5.3
-     *
-     * @return array
-     */
-    private function _jsonDecodeValues($key, $value) {
-
-        $tmp_key   = json_decode($key);
-        $tmp_value = json_decode($value);
-
-        if($tmp_value && is_array($tmp_value) || is_object($tmp_value)) {
-            array_walk_recursive($tmp_value, array($this, '_jsonConcatContents'));
-            $value = $this->tmpJsonString;
-        } else {
-            $this->tmpJsonString .=  " " . $tmp_value . "\n";
-        }
-
-        if($tmp_key && is_array($tmp_key) || is_object($tmp_key)) {
-            array_walk_recursive($tmp_key, array($this, '_jsonConcatContents'));
-            $key = $this->tmpJsonString;
-        } else {
-            $this->tmpJsonString .=  " " . $tmp_key . "\n";
-        }
-
-        return array($key, $value);
-    }
-
-    /**
-     * This is the callback used in _jsonDecodeValues(). The method
-     * concatenates key and value and stores them in $this->tmpJsonString.
-     *
-     * @param  mixed $key
-     * @param  mixed $value
-     * @since  0.5.3
-     *
-     * @return void
-     */
-    private function _jsonConcatContents($key, $value) {
-
-        if(is_string($key) && is_string($value)) {
-            $this->tmpJsonString .=  $key . " " . $value . "\n";
-        } else {
-            $this->_jsonDecodeValues(
-                json_encode($key), json_encode($value)
-            );
-        }
-    }
-
-    /**
-     * Matches given value and/or key against given filter
-     *
-     * @param mixed  $key    the key to optionally scan
-     * @param mixed  $value  the value to scan
-     * @param object $filter the filter object
-     *
-     * @return boolean
-     */
-    private function _match($key, $value, $filter)
-    {
-        if ($this->scanKeys) {
-            if ($filter->match($key)) {
-                return true;
-            }
-        }
-
-        if ($filter->match($value)) {
-            return true;
-        }
-
-        return false;
-    }
-
-    /**
-     * Sets exception array
-     *
-     * @param mixed $exceptions the thrown exceptions
-     *
-     * @return void
-     */
-    public function setExceptions($exceptions)
-    {
-        if (!is_array($exceptions)) {
-            $exceptions = array($exceptions);
-        }
-
-        $this->exceptions = $exceptions;
-    }
-
-    /**
-     * Returns exception array
-     *
-     * @return array
-     */
-    public function getExceptions()
-    {
-        return $this->exceptions;
-    }
-
-    /**
-     * Sets html array
-     *
-     * @param mixed $html the fields containing html
-     * @since 0.5
-     *
-     * @return void
-     */
-    public function setHtml($html)
-    {
-        if (!is_array($html)) {
-            $html = array($html);
-        }
-
-        $this->html = $html;
-    }
-
-    /**
-     * Adds a value to the html array
-     *
-     * @since 0.5
-     *
-     * @return void
-     */
-    public function addHtml($value)
-    {
-        $this->html[] = $value;
-    }
-
-    /**
-     * Returns html array
-     *
-     * @since 0.5
-     *
-     * @return array the fields that contain allowed html
-     */
-    public function getHtml()
-    {
-        return $this->html;
-    }
-
-    /**
-     * Sets json array
-     *
-     * @param mixed $json the fields containing json
-     * @since 0.5.3
-     *
-     * @return void
-     */
-    public function setJson($json)
-    {
-        if (!is_array($json)) {
-            $json = array($json);
-        }
-
-        $this->json = $json;
-    }
-
-    /**
-     * Adds a value to the json array
-     *
-     * @param  string the value containing JSON data
-     * @since  0.5.3
-     *
-     * @return void
-     */
-    public function addJson($value)
-    {
-        $this->json[] = $value;
-    }
-
-    /**
-     * Returns json array
-     *
-     * @since 0.5.3
-     *
-     * @return array the fields that contain json
-     */
-    public function getJson()
-    {
-        return $this->json;
-    }
-
-    /**
-     * Returns storage container
-     *
-     * @return array
-     */
-    public function getStorage()
-    {
-        return $this->storage;
-    }
-
-    /**
-     * Returns report object providing various functions to work with
-     * detected results. Also the centrifuge data is being set as property
-     * of the report object.
-     *
-     * @return object IDS_Report
-     */
-    public function getReport()
-    {
-        if (isset($this->centrifuge) && $this->centrifuge) {
-            $this->report->setCentrifuge($this->centrifuge);
-        }
-
-        return $this->report;
-    }
-
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Report.php

@@ -1,341 +0,0 @@
-<?php
-
-/**
- * PHPIDS
- *
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or 
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>. 
- *
- * PHP version 5.1.6+
- *
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-/**
- * PHPIDS report object
- *
- * The report objects collects a number of events and thereby presents the
- * detected results. It provides a convenient API to work with the results.
- *
- * Note that this class implements Countable, IteratorAggregate and
- * a __toString() method
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Group
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @version   Release: $Id:Report.php 517 2007-09-15 15:04:13Z mario $
- * @link      http://php-ids.org/
- */
-class IDS_Report implements Countable, IteratorAggregate
-{
-
-    /**
-     * Event container
-     *
-     * @var array
-     */
-    protected $events = array();
-
-    /**
-     * List of affected tags
-     *
-     * This list of tags is collected from the collected event objects on
-     * demand when IDS_Report->getTags() is called
-     *
-     * @var    array
-     */
-    protected $tags = array();
-
-    /**
-     * Impact level
-     *
-     * The impact level is calculated on demand by adding the results of the
-     * event objects on IDS_Report->getImpact()
-     *
-     * @var integer
-     */
-    protected $impact = 0;
-
-    /**
-     * Centrifuge data
-     *
-     * This variable - initiated as an empty array - carries all information
-     * about the centrifuge data if available
-     *
-     * @var array
-     */
-    protected $centrifuge = array();
-
-    /**
-     * Constructor
-     *
-     * @param array $events the events the report should include
-     *
-     * @return void
-     */
-    public function __construct(array $events = null)
-    {
-        if ($events) {
-            foreach ($events as $event) {
-                $this->addEvent($event);
-            }
-        }
-    }
-
-    /**
-     * Adds an IDS_Event object to the report
-     *
-     * @param object $event IDS_Event
-     *
-     * @return object $this
-     */
-    public function addEvent(IDS_Event $event)
-    {
-        $this->clear();
-        $this->events[$event->getName()] = $event;
-
-        return $this;
-    }
-
-    /**
-     * Get event by name
-     *
-     * In most cases an event is identified by the key of the variable that
-     * contained maliciously appearing content
-     *
-     * @param scalar $name the event name
-     *
-     * @throws InvalidArgumentException if argument is invalid
-     * @return mixed IDS_Event object or false if the event does not exist
-     */
-    public function getEvent($name)
-    {
-        if (!is_scalar($name)) {
-            throw new InvalidArgumentException(
-                'Invalid argument type given'
-            );
-        }
-
-        if ($this->hasEvent($name)) {
-            return $this->events[$name];
-        }
-
-        return false;
-    }
-
-    /**
-     * Returns list of affected tags
-     *
-     * @return array
-     */
-    public function getTags()
-    {
-        if (!$this->tags) {
-            $this->tags = array();
-
-            foreach ($this->events as $event) {
-                $this->tags = array_merge($this->tags,
-                                          $event->getTags());
-            }
-
-            $this->tags = array_values(array_unique($this->tags));
-        }
-
-        return $this->tags;
-    }
-
-    /**
-     * Returns total impact
-     *
-     * Each stored IDS_Event object and its IDS_Filter sub-object are called
-     * to calculate the overall impact level of this request
-     *
-     * @return integer
-     */
-    public function getImpact()
-    {
-        if (!$this->impact) {
-            $this->impact = 0;
-            foreach ($this->events as $event) {
-                $this->impact += $event->getImpact();
-            }
-        }
-
-        return $this->impact;
-    }
-
-    /**
-     * Checks if a specific event with given name exists
-     *
-     * @param scalar $name the event name
-     *
-     * @throws InvalidArgumentException if argument is illegal
-     *
-     * @return boolean
-     */
-    public function hasEvent($name)
-    {
-        if (!is_scalar($name)) {
-            throw new InvalidArgumentException('Invalid argument given');
-        }
-
-        return isset($this->events[$name]);
-    }
-
-    /**
-     * Returns total amount of events
-     *
-     * @return integer
-     */
-    public function count()
-    {
-        return count($this->events);
-    }
-
-     /**
-     * Return iterator object
-     *
-     * In order to provide the possibility to directly iterate over the
-     * IDS_Event object the IteratorAggregate is implemented. One can easily
-     * use foreach() to iterate through all stored IDS_Event objects.
-     *
-     * @return ArrayObject the event collection
-     */
-    public function getIterator()
-    {
-        return new ArrayObject($this->events);
-    }
-
-    /**
-     * Checks if any events are registered
-     *
-     * @return boolean
-     */
-    public function isEmpty()
-    {
-        return empty($this->events);
-    }
-
-    /**
-     * Clears calculated/collected values
-     *
-     * @return void
-     */
-    protected function clear()
-    {
-        $this->impact = 0;
-        $this->tags   = array();
-    }
-
-    /**
-     * This method returns the centrifuge property or null if not
-     * filled with data
-     *
-     * @return array/null
-     */
-    public function getCentrifuge()
-    {
-        return ($this->centrifuge && count($this->centrifuge) > 0)
-            ? $this->centrifuge : null;
-    }
-
-    /**
-     * This method sets the centrifuge property
-     *
-     * @param array $centrifuge the centrifuge data
-     *
-     * @throws InvalidArgumentException if argument is illegal
-     *
-     * @return boolean true is arguments were valid
-     */
-    public function setCentrifuge($centrifuge = array())
-    {
-        if (is_array($centrifuge) && $centrifuge) {
-            $this->centrifuge = $centrifuge;
-            return true;
-        }
-        throw new InvalidArgumentException('Invalid argument given');
-    }
-
-    /**
-     * Directly outputs all available information
-     *
-     * @return string
-     */
-    public function __toString()
-    {
-        if (!$this->isEmpty()) {
-            $output  = '';
-            $output .= 'Total impact: ' . $this->getImpact() . "<br/>\n";
-            $output .= 'Affected tags: ' . join(', ', $this->getTags()) .
-                "<br/>\n";
-
-            foreach ($this->events as $event) {
-                $output .= "<br/>\nVariable: " .
-                    htmlspecialchars($event->getName()) . ' | Value: ' .
-                    htmlspecialchars($event->getValue()) . "<br/>\n";
-                $output .= 'Impact: ' . $event->getImpact() . ' | Tags: ' .
-                    join(', ', $event->getTags()) . "<br/>\n";
-
-                foreach ($event as $filter) {
-                    $output .= 'Description: ' . $filter->getDescription() .
-                        ' | ';
-                    $output .= 'Tags: ' . join(', ', $filter->getTags()) .
-                        ' | ';
-                    $output .= 'ID: ' . $filter->getId() .
-                        "<br/>\n";
-                }
-            }
-
-            $output .= '<br/>';
-
-            if ($centrifuge = $this->getCentrifuge()) {
-                $output .= 'Centrifuge detection data';
-                $output .= '<br/>  Threshold: ' . 
-                    ((isset($centrifuge['threshold'])&&$centrifuge['threshold']) ?
-                    $centrifuge['threshold'] : '---');
-                $output .= '<br/>  Ratio: ' . 
-                    ((isset($centrifuge['ratio'])&&$centrifuge['ratio']) ?
-                    $centrifuge['ratio'] : '---');
-                if(isset($centrifuge['converted'])) {
-                    $output .= '<br/>  Converted: ' . $centrifuge['converted'];
-                }
-                $output .= "<br/><br/>\n";
-            }
-        }
-
-        return isset($output) ? $output : '';
-    }
-}
-
-/**
- * Local variables:
- * tab-width: 4
- * c-basic-offset: 4
- * End:
- * vim600: sw=4 ts=4 expandtab
- */

plugins/phpids/IDS/Version.php

@@ -1,49 +0,0 @@
-<?php
-/**
- * PHPIDS
- *
- * Requirements: PHP5, SimpleXML
- *
- * Copyright (c) 2008 PHPIDS group (https://phpids.org)
- *
- * PHPIDS is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, version 3 of the License, or
- * (at your option) any later version.
- *
- * PHPIDS is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with PHPIDS. If not, see <http://www.gnu.org/licenses/>.
- *
- * PHP version 5.1.6+
- *
- * @category Security
- * @package  PHPIDS
- * @author   Mario Heiderich <mario.heiderich@gmail.com>
- * @author   Christian Matthies <ch0012@gmail.com>
- * @author   Lars Strojny <lars@strojny.net>
- * @license  http://www.gnu.org/licenses/lgpl.html LGPL
- * @link     http://php-ids.org/
- */
-
-/**
- * PHPIDS version class
- *
- * @category  Security
- * @package   PHPIDS
- * @author    Christian Matthies <ch0012@gmail.com>
- * @author    Mario Heiderich <mario.heiderich@gmail.com>
- * @author    Lars Strojny <lars@strojny.net>
- * @copyright 2007-2009 The PHPIDS Group
- * @license   http://www.gnu.org/licenses/lgpl.html LGPL
- * @version   Release: $Id:Converter.php 517 2007-09-15 15:04:13Z mario $
- * @link      http://php-ids.org/
- */
-abstract class IDS_Version
-{
-    const VERSION = '@@phpIdsVersion@@';
-}

plugins/phpids/IDS/default_filter.xml

@@ -1,799 +0,0 @@
-<filters>
-    <filter>
-        <id>1</id>
-        <rule><![CDATA[(?:"[^"]*[^-]?>)|(?:[^\w\s]\s*\/>)|(?:>")]]></rule>
-        <description>finds html breaking injections including whitespace attacks</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>
-    <filter>
-        <id>2</id>
-        <rule><![CDATA[(?:"+.*[<=]\s*"[^"]+")|(?:"\s*\w+\s*=)|(?:>\w=\/)|(?:#.+\)["\s]*>)|(?:"\s*(?:src|style|on\w+)\s*=\s*")|(?:[^"]?"[,;\s]+\w*[\[\(])]]></rule>
-        <description>finds attribute breaking injections including whitespace attacks</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>
-    <filter>
-        <id>3</id>
-        <rule><![CDATA[(?:^>[\w\s]*<\/?\w{2,}>)]]></rule>
-        <description>finds unquoted attribute breaking injections</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>2</impact>
-    </filter>
-    <filter>
-        <id>4</id>
-        <rule><![CDATA[(?:[+\/]\s*name[\W\d]*[)+])|(?:;\W*url\s*=)|(?:[^\w\s\/?:>]\s*(?:location|referrer|name)\s*[^\/\w\s-])]]></rule>
-        <description>Detects url-, name-, JSON, and referrer-contained payload attacks</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>5</id>
-        <rule><![CDATA[(?:\W\s*hash\s*[^\w\s-])|(?:\w+=\W*[^,]*,[^\s(]\s*\()|(?:\?"[^\s"]":)|(?:(?<!\/)__[a-z]+__)|(?:(?:^|[\s)\]\}])(?:s|g)etter\s*=)]]></rule>
-        <description>Detects hash-contained xss payload attacks, setter usage and property overloading</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>6</id>
-        <rule><![CDATA[(?:with\s*\(\s*.+\s*\)\s*\w+\s*\()|(?:(?:do|while|for)\s*\([^)]*\)\s*\{)|(?:\/[\w\s]*\[\W*\w)]]></rule>
-        <description>Detects self contained xss via with(), common loops and regex to string conversion</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>7</id>
-        <rule><![CDATA[(?:[=(].+\?.+:)|(?:with\([^)]*\)\))|(?:\.\s*source\W)]]></rule>
-        <description>Detects JavaScript with(), ternary operators and XML predicate attacks</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>8</id>
-        <rule><![CDATA[(?:\/\w*\s*\)\s*\()|(?:\([\w\s]+\([\w\s]+\)[\w\s]+\))|(?:(?<!(?:mozilla\/\d\.\d\s))\([^)[]+\[[^\]]+\][^)]*\))|(?:[^\s!][{([][^({[]+[{([][^}\])]+[}\])][\s+",\d]*[}\])])|(?:"\)?\]\W*\[)|(?:=\s*[^\s:;]+\s*[{([][^}\])]+[}\])];)]]></rule>
-        <description>Detects self-executing JavaScript functions</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>9</id>
-        <rule><![CDATA[(?:\\u00[a-f0-9]{2})|(?:\\x0*[a-f0-9]{2})|(?:\\\d{2,3})]]></rule>
-        <description>Detects the IE octal, hex and unicode entities</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>2</impact>
-    </filter>
-    <filter>
-        <id>10</id>
-        <rule><![CDATA[(?:(?:\/|\\)?\.+(\/|\\)(?:\.+)?)|(?:\w+\.exe\??\s)|(?:;\s*\w+\s*\/[\w*-]+\/)|(?:\d\.\dx\|)|(?:%(?:c0\.|af\.|5c\.))|(?:\/(?:%2e){2})]]></rule>
-        <description>Detects basic directory traversal</description>
-        <tags>
-            <tag>dt</tag>
-            <tag>id</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>11</id>
-        <rule><![CDATA[(?:%c0%ae\/)|(?:(?:\/|\\)(home|conf|usr|etc|proc|opt|s?bin|local|dev|tmp|kern|[br]oot|sys|system|windows|winnt|program|%[a-z_-]{3,}%)(?:\/|\\))|(?:(?:\/|\\)inetpub|localstart\.asp|boot\.ini)]]></rule>
-        <description>Detects specific directory and path traversal</description>
-        <tags>
-            <tag>dt</tag>
-            <tag>id</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>12</id>
-        <rule><![CDATA[(?:etc\/\W*passwd)]]></rule>
-        <description>Detects etc/passwd inclusion attempts</description>
-        <tags>
-            <tag>dt</tag>
-            <tag>id</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>13</id>
-        <rule><![CDATA[(?:%u(?:ff|00|e\d)\w\w)|(?:(?:%(?:e\w|c[^3\W]|))(?:%\w\w)(?:%\w\w)?)]]></rule>
-        <description>Detects halfwidth/fullwidth encoded unicode HTML breaking attempts</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>3</impact>
-    </filter>
-    <filter>
-        <id>14</id>
-        <rule><![CDATA[(?:#@~\^\w+)|(?:\w+script:|@import[^\w]|;base64|base64,)|(?:\w+\s*\([\w\s]+,[\w\s]+,[\w\s]+,[\w\s]+,[\w\s]+,[\w\s]+\))]]></rule>
-        <description>Detects possible includes, VBSCript/JScript encodeed and packed functions</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-            <tag>id</tag>
-            <tag>rfe</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>15</id>
-        <rule><![CDATA[([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z\/_@\-\|])(\s*return\s*)?(?:create(?:element|attribute|textnode)|[a-z]+events?|setattribute|getelement\w+|appendchild|createrange|createcontextualfragment|removenode|parentnode|decodeuricomponent|\wettimeout|(?:ms)?setimmediate|option|useragent)(?(1)[^\w%"]|(?:\s*[^@\s\w%",.+\-]))]]></rule>
-        <description>Detects JavaScript DOM/miscellaneous properties and methods</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-            <tag>id</tag>
-            <tag>rfe</tag>
-        </tags>
-        <impact>6</impact>
-    </filter>
-    <filter>
-        <id>16</id>
-        <rule><![CDATA[([^*\s\w,.\/?+-]\s*)?(?<![a-mo-z]\s)(?<![a-z\/_@])(\s*return\s*)?(?:alert|inputbox|showmod(?:al|eless)dialog|showhelp|infinity|isnan|isnull|iterator|msgbox|executeglobal|expression|prompt|write(?:ln)?|confirm|dialog|urn|(?:un)?eval|exec|execscript|tostring|status|execute|window|unescape|navigate|jquery|getscript|extend|prototype)(?(1)[^\w%"]|(?:\s*[^@\s\w%",.:\/+\-]))]]></rule>
-        <description>Detects possible includes and typical script methods</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-            <tag>id</tag>
-            <tag>rfe</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>17</id>
-        <rule><![CDATA[([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z\/_@])(\s*return\s*)?(?:hash|name|href|navigateandfind|source|pathname|close|constructor|port|protocol|assign|replace|back|forward|document|ownerdocument|window|top|this|self|parent|frames|_?content|date|cookie|innerhtml|innertext|csstext+?|outerhtml|print|moveby|resizeto|createstylesheet|stylesheets)(?(1)[^\w%"]|(?:\s*[^@\/\s\w%.+\-]))]]></rule>
-        <description>Detects JavaScript object properties and methods</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-            <tag>id</tag>
-            <tag>rfe</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>
-    <filter>
-        <id>18</id>
-        <rule><![CDATA[([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z\/_@\-\|])(\s*return\s*)?(?:join|pop|push|reverse|reduce|concat|map|shift|sp?lice|sort|unshift)(?(1)[^\w%"]|(?:\s*[^@\s\w%,.+\-]))]]></rule>
-        <description>Detects JavaScript array properties and methods</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-            <tag>id</tag>
-            <tag>rfe</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>
-    <filter>
-        <id>19</id>
-        <rule><![CDATA[([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z\/_@\-\|])(\s*return\s*)?(?:set|atob|btoa|charat|charcodeat|charset|concat|crypto|frames|fromcharcode|indexof|lastindexof|match|navigator|toolbar|menubar|replace|regexp|slice|split|substr|substring|escape|\w+codeuri\w*)(?(1)[^\w%"]|(?:\s*[^@\s\w%,.+\-]))]]></rule>
-        <description>Detects JavaScript string properties and methods</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-            <tag>id</tag>
-            <tag>rfe</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>
-    <filter>
-        <id>20</id>
-        <rule><![CDATA[(?:\)\s*\[)|([^*":\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z_@\|])(\s*return\s*)?(?:globalstorage|sessionstorage|postmessage|callee|constructor|content|domain|prototype|try|catch|top|call|apply|url|function|object|array|string|math|if|for\s*(?:each)?|elseif|case|switch|regex|boolean|location|(?:ms)?setimmediate|settimeout|setinterval|void|setexpression|namespace|while)(?(1)[^\w%"]|(?:\s*[^@\s\w%".+\-\/]))]]></rule>
-        <description>Detects JavaScript language constructs</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-            <tag>id</tag>
-            <tag>rfe</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>
-    <filter>
-        <id>21</id>
-        <rule><![CDATA[(?:,\s*(?:alert|showmodaldialog|eval)\s*,)|(?::\s*eval\s*[^\s])|([^:\s\w,.\/?+-]\s*)?(?<![a-z\/_@])(\s*return\s*)?(?:(?:document\s*\.)?(?:.+\/)?(?:alert|eval|msgbox|showmod(?:al|eless)dialog|showhelp|prompt|write(?:ln)?|confirm|dialog|open))\s*(?:[^.a-z\s\-]|(?:\s*[^\s\w,.@\/+-]))|(?:java[\s\/]*\.[\s\/]*lang)|(?:\w\s*=\s*new\s+\w+)|(?:&\s*\w+\s*\)[^,])|(?:\+[\W\d]*new\s+\w+[\W\d]*\+)|(?:document\.\w)]]></rule>
-        <description>Detects very basic XSS probings</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-            <tag>id</tag>
-            <tag>rfe</tag>
-        </tags>
-        <impact>3</impact>
-    </filter>
-    <filter>
-        <id>22</id>
-        <rule><![CDATA[(?:=\s*(?:top|this|window|content|self|frames|_content))|(?:\/\s*[gimx]*\s*[)}])|(?:[^\s]\s*=\s*script)|(?:\.\s*constructor)|(?:default\s+xml\s+namespace\s*=)|(?:\/\s*\+[^+]+\s*\+\s*\/)]]></rule>
-        <description>Detects advanced XSS probings via Script(), RexExp, constructors and XML namespaces</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-            <tag>id</tag>
-            <tag>rfe</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>	
-    <filter>
-        <id>23</id>
-        <rule><![CDATA[(?:\.\s*\w+\W*=)|(?:\W\s*(?:location|document)\s*\W[^({[;]+[({[;])|(?:\(\w+\?[:\w]+\))|(?:\w{2,}\s*=\s*\d+[^&\w]\w+)|(?:\]\s*\(\s*\w+)]]></rule>
-        <description>Detects JavaScript location/document property access and window access obfuscation</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>    
-    <filter>
-        <id>24</id>
-        <rule><![CDATA[(?:[".]script\s*\()|(?:\$\$?\s*\(\s*[\w"])|(?:\/[\w\s]+\/\.)|(?:=\s*\/\w+\/\s*\.)|(?:(?:this|window|top|parent|frames|self|content)\[\s*[(,"]*\s*[\w\$])|(?:,\s*new\s+\w+\s*[,;)])]]></rule>
-        <description>Detects basic obfuscated JavaScript script injections</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>25</id>
-        <rule><![CDATA[(?:=\s*[$\w]\s*[\(\[])|(?:\(\s*(?:this|top|window|self|parent|_?content)\s*\))|(?:src\s*=s*(?:\w+:|\/\/))|(?:\w+\[("\w+"|\w+\|\|))|(?:[\d\W]\|\|[\d\W]|\W=\w+,)|(?:\/\s*\+\s*[a-z"])|(?:=\s*\$[^([]*\()|(?:=\s*\(\s*")]]></rule>
-        <description>Detects obfuscated JavaScript script injections</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>26</id>
-        <rule><![CDATA[(?:[^:\s\w]+\s*[^\w\/](href|protocol|host|hostname|pathname|hash|port|cookie)[^\w])]]></rule>
-        <description>Detects JavaScript cookie stealing and redirection attempts</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>
-    <filter>
-        <id>27</id>
-        <rule><![CDATA[(?:(?:vbs|vbscript|data):.*[,+])|(?:\w+\s*=\W*(?!https?)\w+:)|(jar:\w+:)|(=\s*"?\s*vbs(?:ript)?:)|(language\s*=\s?"?\s*vbs(?:ript)?)|on\w+\s*=\*\w+\-"?]]></rule>
-        <description>Detects data: URL injections, VBS injections and common URI schemes</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>rfe</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>28</id>
-        <rule><![CDATA[(?:firefoxurl:\w+\|)|(?:(?:file|res|telnet|nntp|news|mailto|chrome)\s*:\s*[%&#xu\/]+)|(wyciwyg|firefoxurl\s*:\s*\/\s*\/)]]></rule>
-        <description>Detects IE firefoxurl injections, cache poisoning attempts and local file inclusion/execution</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>rfe</tag>
-            <tag>lfi</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>29</id>    
-        <rule><![CDATA[(?:binding\s?=|moz-binding|behavior\s?=)|(?:[\s\/]style\s*=\s*[-\\])]]></rule>
-        <description>Detects bindings and behavior injections</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-            <tag>rfe</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>
-    <filter>
-        <id>30</id>
-        <rule><![CDATA[(?:=\s*\w+\s*\+\s*")|(?:\+=\s*\(\s")|(?:!+\s*[\d.,]+\w?\d*\s*\?)|(?:=\s*\[s*\])|(?:"\s*\+\s*")|(?:[^\s]\[\s*\d+\s*\]\s*[;+])|(?:"\s*[&|]+\s*")|(?:\/\s*\?\s*")|(?:\/\s*\)\s*\[)|(?:\d\?.+:\d)|(?:]\s*\[\W*\w)|(?:[^\s]\s*=\s*\/)]]></rule>
-        <description>Detects common XSS concatenation patterns 1/2</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-            <tag>id</tag>
-            <tag>rfe</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>
-    <filter>
-        <id>31</id>
-        <rule><![CDATA[(?:=\s*\d*\.\d*\?\d*\.\d*)|(?:[|&]{2,}\s*")|(?:!\d+\.\d*\?")|(?:\/:[\w.]+,)|(?:=[\d\W\s]*\[[^]]+\])|(?:\?\w+:\w+)]]></rule>
-        <description>Detects common XSS concatenation patterns 2/2</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-            <tag>id</tag>
-            <tag>rfe</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>
-    <filter>
-        <id>32</id>
-        <rule><![CDATA[(?:[^\w\s=]on(?!g\&gt;)\w+[^=_+-]*=[^$]+(?:\W|\&gt;)?)]]></rule>
-        <description>Detects possible event handlers</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>
-    <filter>
-        <id>33</id>
-        <rule><![CDATA[(?:\<\w*:?\s(?:[^\>]*)t(?!rong))|(?:\<scri)|(<\w+:\w+)]]></rule>
-        <description>Detects obfuscated script tags and XML wrapped HTML</description>
-        <tags>
-            <tag>xss</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>
-    <filter>
-        <id>34</id>
-        <rule><![CDATA[(?:\<\/\w+\s\w+)|(?:@(?:cc_on|set)[\s@,"=])]]></rule>
-        <description>Detects attributes in closing tags and conditional compilation tokens</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>
-    <filter>
-        <id>35</id>
-        <rule><![CDATA[(?:--[^\n]*$)|(?:\<!-|-->)|(?:[^*]\/\*|\*\/[^*])|(?:(?:[\W\d]#|--|{)$)|(?:\/{3,}.*$)|(?:<!\[\W)|(?:\]!>)]]></rule>
-        <description>Detects common comment types</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-            <tag>id</tag>
-        </tags>
-        <impact>3</impact>
-    </filter>
-    <filter>
-        <id>37</id>
-        <rule><![CDATA[(?:\<base\s+)|(?:<!(?:element|entity|\[CDATA))]]></rule>
-        <description>Detects base href injections and XML entity injections</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-            <tag>id</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>38</id>
-        <rule><![CDATA[(?:\<[\/]?(?:[i]?frame|applet|isindex|marquee|keygen|script|audio|video|input|button|textarea|style|base|body|meta|link|object|embed|param|plaintext|xm\w+|image|im(?:g|port)))]]></rule>
-        <description>Detects possibly malicious html elements including some attributes</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-            <tag>id</tag>
-            <tag>rfe</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>   
-    <filter>
-        <id>39</id>
-        <rule><![CDATA[(?:\\x[01fe][\db-ce-f])|(?:%[01fe][\db-ce-f])|(?:&#[01fe][\db-ce-f])|(?:\\[01fe][\db-ce-f])|(?:&#x[01fe][\db-ce-f])]]></rule>
-        <description>Detects nullbytes and other dangerous characters</description>
-        <tags>
-            <tag>id</tag>
-            <tag>rfe</tag>
-            <tag>xss</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>   
-    <filter>
-        <id>40</id>
-        <rule><![CDATA[(?:\)\s*when\s*\d+\s*then)|(?:"\s*(?:#|--|{))|(?:\/\*!\s?\d+)|(?:ch(?:a)?r\s*\(\s*\d)|(?:(?:(n?and|x?or|not)\s+|\|\||\&\&)\s*\w+\()]]></rule>
-        <description>Detects MySQL comments, conditions and ch(a)r injections</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>6</impact>
-    </filter>   
-    <filter>
-        <id>41</id>
-        <rule><![CDATA[(?:[\s()]case\s*\()|(?:\)\s*like\s*\()|(?:having\s*[^\s]+\s*[^\w\s])|(?:if\s?\([\d\w]\s*[=<>~])]]></rule>
-        <description>Detects conditional SQL injection attempts</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>6</impact>
-    </filter>   
-    <filter>
-        <id>42</id>
-        <rule><![CDATA[(?:"\s*or\s*"?\d)|(?:\\x(?:23|27|3d))|(?:^.?"$)|(?:(?:^["\\]*(?:[\d"]+|[^"]+"))+\s*(?:n?and|x?or|not|\|\||\&\&)\s*[\w"[+&!@(),.-])|(?:[^\w\s]\w+\s*[|-]\s*"\s*\w)|(?:@\w+\s+(and|or)\s*["\d]+)|(?:@[\w-]+\s(and|or)\s*[^\w\s])|(?:[^\w\s:]\s*\d\W+[^\w\s]\s*".)|(?:\Winformation_schema|table_name\W)]]></rule>
-        <description>Detects classic SQL injection probings 1/2</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>6</impact>
-    </filter>  
-    <filter>
-        <id>43</id>
-        <rule><![CDATA[(?:"\s*\*.+(?:or|id)\W*"\d)|(?:\^")|(?:^[\w\s"-]+(?<=and\s)(?<=or\s)(?<=xor\s)(?<=nand\s)(?<=not\s)(?<=\|\|)(?<=\&\&)\w+\()|(?:"[\s\d]*[^\w\s]+\W*\d\W*.*["\d])|(?:"\s*[^\w\s?]+\s*[^\w\s]+\s*")|(?:"\s*[^\w\s]+\s*[\W\d].*(?:#|--))|(?:".*\*\s*\d)|(?:"\s*or\s[^\d]+[\w-]+.*\d)|(?:[()*<>%+-][\w-]+[^\w\s]+"[^,])]]></rule>
-        <description>Detects classic SQL injection probings 2/2</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>6</impact>
-    </filter> 
-    <filter>
-        <id>44</id>
-        <rule><![CDATA[(?:\d"\s+"\s+\d)|(?:^admin\s*"|(\/\*)+"+\s?(?:--|#|\/\*|{)?)|(?:"\s*or[\w\s-]+\s*[+<>=(),-]\s*[\d"])|(?:"\s*[^\w\s]?=\s*")|(?:"\W*[+=]+\W*")|(?:"\s*[!=|][\d\s!=+-]+.*["(].*$)|(?:"\s*[!=|][\d\s!=]+.*\d+$)|(?:"\s*like\W+[\w"(])|(?:\sis\s*0\W)|(?:where\s[\s\w\.,-]+\s=)|(?:"[<>~]+")]]></rule>
-        <description>Detects basic SQL authentication bypass attempts 1/3</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>7</impact>
-    </filter> 
-    <filter>
-        <id>45</id>
-        <rule><![CDATA[(?:union\s*(?:all|distinct|[(!@]*)?\s*[([]*\s*select)|(?:\w+\s+like\s+\")|(?:like\s*"\%)|(?:"\s*like\W*["\d])|(?:"\s*(?:n?and|x?or|not |\|\||\&\&)\s+[\s\w]+=\s*\w+\s*having)|(?:"\s*\*\s*\w+\W+")|(?:"\s*[^?\w\s=.,;)(]+\s*[(@"]*\s*\w+\W+\w)|(?:select\s*[\[\]()\s\w\.,"-]+from)|(?:find_in_set\s*\()]]></rule>
-        <description>Detects basic SQL authentication bypass attempts 2/3</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>7</impact>
-    </filter>
-     <filter>
-        <id>46</id>
-        <rule><![CDATA[(?:in\s*\(+\s*select)|(?:(?:n?and|x?or|not |\|\||\&\&)\s+[\s\w+]+(?:regexp\s*\(|sounds\s+like\s*"|[=\d]+x))|("\s*\d\s*(?:--|#))|(?:"[%&<>^=]+\d\s*(=|or))|(?:"\W+[\w+-]+\s*=\s*\d\W+")|(?:"\s*is\s*\d.+"?\w)|(?:"\|?[\w-]{3,}[^\w\s.,]+")|(?:"\s*is\s*[\d.]+\s*\W.*")]]></rule>
-        <description>Detects basic SQL authentication bypass attempts 3/3</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>7</impact>
-    </filter> 
-    <filter>
-        <id>47</id>
-        <rule><![CDATA[(?:[\d\W]\s+as\s*["\w]+\s*from)|(?:^[\W\d]+\s*(?:union|select|create|rename|truncate|load|alter|delete|update|insert|desc))|(?:(?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\s+(?:(?:group_)concat|char|load_file)\s?\(?)|(?:end\s*\);)|("\s+regexp\W)|(?:[\s(]load_file\s*\()]]></rule>
-        <description>Detects concatenated basic SQL injection and SQLLFI attempts</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>48</id>
-        <rule><![CDATA[(?:@.+=\s*\(\s*select)|(?:\d+\s*or\s*\d+\s*[\-+])|(?:\/\w+;?\s+(?:having|and|or|select)\W)|(?:\d\s+group\s+by.+\()|(?:(?:;|#|--)\s*(?:drop|alter))|(?:(?:;|#|--)\s*(?:update|insert)\s*\w{2,})|(?:[^\w]SET\s*@\w+)|(?:(?:n?and|x?or|not |\|\||\&\&)[\s(]+\w+[\s)]*[!=+]+[\s\d]*["=()])]]></rule>
-        <description>Detects chained SQL injection attempts 1/2</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-        </tags>
-        <impact>6</impact>
-    </filter>
-    <filter>
-        <id>49</id>
-        <rule><![CDATA[(?:"\s+and\s*=\W)|(?:\(\s*select\s*\w+\s*\()|(?:\*\/from)|(?:\+\s*\d+\s*\+\s*@)|(?:\w"\s*(?:[-+=|@]+\s*)+[\d(])|(?:coalesce\s*\(|@@\w+\s*[^\w\s])|(?:\W!+"\w)|(?:";\s*(?:if|while|begin))|(?:"[\s\d]+=\s*\d)|(?:order\s+by\s+if\w*\s*\()|(?:[\s(]+case\d*\W.+[tw]hen[\s(])]]></rule>
-        <description>Detects chained SQL injection attempts 2/2</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-        </tags>
-        <impact>6</impact>
-    </filter>
-    <filter>
-        <id>50</id>
-        <rule><![CDATA[(?:(select|;)\s+(?:benchmark|if|sleep)\s*?\(\s*\(?\s*\w+)]]></rule>
-        <description>Detects SQL benchmark and sleep injection attempts including conditional queries</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>
-    <filter>
-        <id>51</id>
-        <rule><![CDATA[(?:create\s+function\s+\w+\s+returns)|(?:;\s*(?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\s*[\[(]?\w{2,})]]></rule>
-        <description>Detects MySQL UDF injection and other data/structure manipulation attempts</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-        </tags>
-        <impact>6</impact>
-    </filter>
-    <filter>
-        <id>52</id>
-        <rule><![CDATA[(?:alter\s*\w+.*character\s+set\s+\w+)|(";\s*waitfor\s+time\s+")|(?:";.*:\s*goto)]]></rule>
-        <description>Detects MySQL charset switch and MSSQL DoS attempts</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-        </tags>
-        <impact>6</impact>
-    </filter>
-    <filter>
-        <id>53</id>
-        <rule><![CDATA[(?:procedure\s+analyse\s*\()|(?:;\s*(declare|open)\s+[\w-]+)|(?:create\s+(procedure|function)\s*\w+\s*\(\s*\)\s*-)|(?:declare[^\w]+[@#]\s*\w+)|(exec\s*\(\s*@)]]></rule>
-        <description>Detects MySQL and PostgreSQL stored procedure/function injections</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-        </tags>
-        <impact>7</impact>
-    </filter>
-    <filter>
-        <id>54</id>
-        <rule><![CDATA[(?:select\s*pg_sleep)|(?:waitfor\s*delay\s?"+\s?\d)|(?:;\s*shutdown\s*(?:;|--|#|\/\*|{))]]></rule>
-        <description>Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>55</id>
-        <rule><![CDATA[(?:\sexec\s+xp_cmdshell)|(?:"\s*!\s*["\w])|(?:from\W+information_schema\W)|(?:(?:(?:current_)?user|database|schema|connection_id)\s*\([^\)]*)|(?:";?\s*(?:select|union|having)\s*[^\s])|(?:\wiif\s*\()|(?:exec\s+master\.)|(?:union select @)|(?:union[\w(\s]*select)|(?:select.*\w?user\()|(?:into[\s+]+(?:dump|out)file\s*")]]></rule>
-        <description>Detects MSSQL code execution and information gathering attempts</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>56</id>
-        <rule><![CDATA[(?:merge.*using\s*\()|(execute\s*immediate\s*")|(?:\W+\d*\s*having\s*[^\s\-])|(?:match\s*[\w(),+-]+\s*against\s*\()]]></rule>
-        <description>Detects MATCH AGAINST, MERGE, EXECUTE IMMEDIATE and HAVING injections</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>57</id>
-        <rule><![CDATA[(?:,.*[)\da-f"]"(?:".*"|\Z|[^"]+))|(?:\Wselect.+\W*from)|((?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\s*\(\s*space\s*\()]]></rule>
-        <description>Detects MySQL comment-/space-obfuscated injections and backtick termination</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>   
-    <filter>
-        <id>58</id>
-        <rule><![CDATA[(?:@[\w-]+\s*\()|(?:]\s*\(\s*["!]\s*\w)|(?:<[?%](?:php)?.*(?:[?%]>)?)|(?:;[\s\w|]*\$\w+\s*=)|(?:\$\w+\s*=(?:(?:\s*\$?\w+\s*[(;])|\s*".*"))|(?:;\s*\{\W*\w+\s*\()]]></rule>
-        <description>Detects code injection attempts 1/3</description>
-        <tags>
-            <tag>id</tag>
-            <tag>rfe</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>7</impact>
-    </filter>   
-    <filter>
-        <id>59</id>
-        <rule><![CDATA[(?:(?:[;]+|(<[?%](?:php)?)).*(?:define|eval|file_get_contents|include|require|require_once|set|shell_exec|phpinfo|system|passthru|preg_\w+|execute)\s*["(@])]]></rule>
-        <description>Detects code injection attempts 2/3</description>
-        <tags>
-            <tag>id</tag>
-            <tag>rfe</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>7</impact>
-    </filter>
-    <filter>
-        <id>60</id>
-        <rule><![CDATA[(?:(?:[;]+|(<[?%](?:php)?)).*[^\w](?:echo|print|print_r|var_dump|[fp]open))|(?:;\s*rm\s+-\w+\s+)|(?:;.*{.*\$\w+\s*=)|(?:\$\w+\s*\[\]\s*=\s*)]]></rule>
-        <description>Detects code injection attempts 3/3</description>
-        <tags>
-            <tag>id</tag>
-            <tag>rfe</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>7</impact>
-    </filter>
-    <filter>
-        <id>61</id>
-        <rule><![CDATA[(?:\w+]?(?<!href)(?<!src)(?<!longdesc)(?<!returnurl)=(?:https?|ftp):)|(?:\{\s*\$\s*\{)]]></rule>
-        <description>Detects url injections and RFE attempts</description>
-        <tags>
-            <tag>id</tag>
-            <tag>rfe</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>   
-    <filter>
-        <id>62</id>
-        <rule><![CDATA[(?:function[^(]*\([^)]*\))|(?:(?:delete|void|throw|instanceof|new|typeof)[^\w.]+\w+\s*[([])|([)\]]\s*\.\s*\w+\s*=)|(?:\(\s*new\s+\w+\s*\)\.)]]></rule>
-        <description>Detects common function declarations and special JS operators</description>
-        <tags>
-            <tag>id</tag>
-            <tag>rfe</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>  
-    <filter>
-        <id>63</id>
-        <rule><![CDATA[(?:[\w.-]+@[\w.-]+%(?:[01][\db-ce-f])+\w+:)]]></rule>
-        <description>Detects common mail header injections</description>
-        <tags>
-            <tag>id</tag>
-            <tag>spam</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>64</id>
-        <rule><![CDATA[(?:\.pl\?\w+=\w?\|\w+;)|(?:\|\(\w+=\*)|(?:\*\s*\)+\s*;)]]></rule>
-        <description>Detects perl echo shellcode injection and LDAP vectors</description>
-        <tags>
-            <tag>lfi</tag>
-            <tag>rfe</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>65</id>
-        <rule><![CDATA[(?:(^|\W)const\s+[\w\-]+\s*=)|(?:(?:do|for|while)\s*\([^;]+;+\))|(?:(?:^|\W)on\w+\s*=[\w\W]*(?:on\w+|alert|eval|print|confirm|prompt))|(?:groups=\d+\(\w+\))|(?:(.)\1{128,})]]></rule>
-        <description>Detects basic XSS DoS attempts</description>
-        <tags>
-            <tag>rfe</tag>
-            <tag>dos</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>
-    <filter>
-        <id>67</id>
-        <rule><![CDATA[(?:\({2,}\+{2,}:{2,})|(?:\({2,}\+{2,}:+)|(?:\({3,}\++:{2,})|(?:\$\[!!!\])]]></rule>
-        <description>Detects unknown attack vectors based on PHPIDS Centrifuge detection</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-            <tag>id</tag>
-            <tag>rfe</tag>
-            <tag>lfi</tag>
-        </tags>
-        <impact>7</impact>
-    </filter>
-    <filter>
-        <id>68</id>
-        <rule><![CDATA[(?:[\s\/"]+[-\w\/\\\*]+\s*=.+(?:\/\s*>))]]></rule>
-        <description>Finds attribute breaking injections including obfuscated attributes</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>4</impact>
-    </filter> 
-    <filter>
-        <id>69</id>
-        <rule><![CDATA[(?:(?:msgbox|eval)\s*\+|(?:language\s*=\*vbscript))]]></rule>
-        <description>Finds basic VBScript injection attempts</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>
-    <filter>
-        <id>70</id>
-        <rule><![CDATA[(?:\[\$(?:ne|eq|lte?|gte?|n?in|mod|all|size|exists|type|slice|or)\])]]></rule>
-        <description>Finds basic MongoDB SQL injection attempts</description>
-        <tags>
-            <tag>sqli</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>
-    <filter>
-        <id>71</id>
-        <rule><![CDATA[(?:[\s\d\/"]+(?:on\w+|style|poster|background)=[$"\w])|(?:-type\s*:\s*multipart)]]></rule>
-        <description>finds malicious attribute injection attempts and MHTML attacks</description>
-        <tags>
-            <tag>xss</tag>
-            <tag>csrf</tag>
-        </tags>
-        <impact>6</impact>
-    </filter>
-  <filter>
-        <id>72</id>
-        <rule><![CDATA[(?:(sleep\((\s*)(\d*)(\s*)\)|benchmark\((.*)\,(.*)\)))]]></rule>
-        <description>Detects blind sqli tests using sleep() or benchmark().</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>
-    <filter>
-        <id>73</id>
-        <rule><![CDATA[(?i:(\%SYSTEMROOT\%))]]></rule>
-        <description>An attacker is trying to locate a file to read or write.</description>
-        <tags>
-            <tag>files</tag>
-            <tag>id</tag>
-        </tags>
-        <impact>4</impact>
-    </filter>   
-    <filter>
-        <id>74</id>
-        <rule><![CDATA[(?i:(ping(.*)[\-(.*)\w|\w(.*)\-]))]]></rule>
-        <description>Detects remote code exectuion tests. Will match "ping -n 3 localhost" and "ping localhost -n 3" </description>
-        <tags>
-            <tag>Command Execution</tag>
-            <tag>id</tag>
-        </tags>
-        <impact>5</impact>
-    </filter>       
-    <filter>
-        <id>75</id>
-        <rule><![CDATA[(?:(((.*)\%[c|d|i|e|f|g|o|s|u|x|p|n]){8}))]]></rule>
-        <description>Looking for a format string attack</description>
-        <tags>
-            <tag>format string</tag>
-        </tags>
-        <impact>4</impact>
-    </filter> 
-    <filter>
-        <id>76</id>
-        <rule><![CDATA[(?:(union(.*)select(.*)from))]]></rule>
-        <description>Looking for basic sql injection. Common attack string for mysql, oracle and others.</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-        </tags>
-        <impact>3</impact>
-    </filter>
-    <filter>
-        <id>77</id>
-        <rule><![CDATA[(?:^(-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|2.2250738585072007e-308|1e309)$)]]></rule>
-        <description>Looking for intiger overflow attacks, these are taken from skipfish, except 2.2250738585072007e-308 is the "magic number" crash</description>
-        <tags>
-            <tag>sqli</tag>
-            <tag>id</tag>
-        </tags>
-        <impact>3</impact>
-    </filter>        
-</filters>