nettika/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

* exported the "IP-based Allow/Deny" code in a distinct library;

Browse Source 
* coding standards;
* improved PHP3 compliance;
* better ip checking.
This commit is contained in:
Loïc Chapeaux
2002-05-18 12:37:01 +00:00
parent 99051ee709
commit 9da7080d8d
3 changed files with 422 additions and 172 deletions
Download Patch File Download Diff File Expand all files Collapse all files

211
libraries/common.lib.php3
View File

@@ -311,144 +311,6 @@ if (!defined('PMA_COMMON_LIB_INCLUDED')){
return true;
} // end of the 'PMA_setFontSizes()' function
/**
* Based on IP Pattern Matcher
* Originally by J.Adams <jna@retina.net>
* Found on <http://www.php.net/manual/en/function.ip2long.php>
* Modified by Robbat2 <robbat2@users.sourceforge.net>
*
* Matches:
* xxx.xxx.xxx.xxx (exact)
* xxx.xxx.xxx.[yyy-zzz] (range)
* xxx.xxx.xxx.xxx/nn (CIDR)
*
* Does not match:
* xxx.xxx.xxx.xx[yyy-zzz] (range, partial octets not supported)
*
* @param string string of IP range to match
* @param string string of IP to test against range
*
* @return boolean always true
*
* @access public
*/
function PMA_IPMaskTest($TestRange,$IPtoTest)
{
$result = TRUE;
if (ereg( "([0-9]+)\.([0-9]+)\.([0-9]+)\.([0-9]+)/([0-9]+)", $TestRange, $regs) ) {
//perform a mask match
$ipl = ip2long($IPtoTest);
$rangel = ip2long($regs[1].'.'.$regs[2].'.'.$regs[3].'.'.$regs[4]);
$maskl = 0;
for ($i = 0; $i< 31; $i++) {
if ($i < $regs[5]-1) {
$maskl = $maskl + pow(2,(30-$i));
} // end if
} // end for
if (($maskl & $rangel) == ($maskl & $ipl)) {
return TRUE;
} else {
return FALSE;
}
} else {
// range based
$maskocts = split("\.",$TestRange);
$ipocts = split("\.",$IPtoTest);
// perform a range match
for ($i=0; $i<4; $i++) {
if (ereg("\[([0-9]+)\-([0-9]+)\]",$maskocts[$i],$regs)) {
if ( ($ipocts[$i] > $regs[2])
|| ($ipocts[$i] < $regs[1])) {
$result = FALSE;
} // end if
} else {
if ($maskocts[$i] <> $ipocts[$i]) {
$result = FALSE;
} // end if
} // end if/else
} //end for
} //end if/else
return $result;
}
/**
* Runs through IP Allow/Deny rules the use of it below for more information
*
* @param string 'allow' | 'deny' type of rule to match
*
* @return bool Matched a rule ?
*
* @access public
*/
function PMA_AllowDeny($type)
{
global $cfg;
// grab IP of user
if (getenv("HTTP_X_FORWARDED_FOR")) {
// try to behave properly with proxies, as per
// http://www.php.net/manual/en/function.getenv.php
$remoteip = getenv("HTTP_X_FORWARDED_FOR");
} else {
// possibly does not work in ISAPI?
$remoteip = getenv("REMOTE_ADDR");
}
// copy username
$username = $cfg['Server']['user'];
// copy rule database
$rules = $cfg['Server']['AllowDeny']['rules'];
// lookup table for some name shortcuts
$shortcuts = array(
"all" => "0.0.0.0/0",
"localhost" => "127.0.0.1/8"
);
reset ($rules); // used instead of a foreach look for PHP3 support
while ( list(, $rule) = each ($rules) ) {
// extract rule data
$rule_data = explode(' ',$rule);
// check for rule type
if( $rule_data[0] != $type )
continue;
// check for username
if( ($rule_data[1] != '%' ) //wildcarded first
&& ($rule_data[1] != $username) )
continue;
// check if the config file has the full string with an extra 'from' in it
// if it does, just discard it
if( $rule_data[2] == 'from' )
$rule_data[2] = $rule_data[3];
// Handle shortcuts with above array
// DON'T use "array_key_exists" as it's only PHP 4.1 and newer.
if( isset($shortcuts[$rule_data[2]]) )
$rule_data[2] = $shortcuts[$rule_data[2]];
// Add code for host lookups here
// Excluded for the moment
// Do the actual matching now
if(PMA_IPMaskTest($rule_data[2],$remoteip))
return TRUE;
}
return FALSE;
}
/**
* $cfg['PmaAbsoluteUri'] is a required directive else cookies won't be
@@ -543,41 +405,46 @@ if (!defined('PMA_COMMON_LIB_INCLUDED')){
PMA_auth_set_user();
}
// Check IP-based Allow/Deny rules as soon as possible to reject the user
// Based on mod_access in Apache
// http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/aaa/mod_access.c?rev=1.37&content-type=text/vnd.viewcvs-markup
// Look at: "static int check_dir_access(request_rec *r)"
// Robbat2 - May 10, 2002
// Check IP-based Allow/Deny rules as soon as possible to reject the
// user
// Based on mod_access in Apache:
// http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/aaa/mod_access.c?rev=1.37&content-type=text/vnd.viewcvs-markup
// Look at: "static int check_dir_access(request_rec *r)"
// Robbat2 - May 10, 2002
if ($cfg['Server']['AllowDeny']['order']) {
include('./libraries/ip_allow_deny.lib.php3');
$AllowDeny_forbidden = FALSE; //default
if ( $cfg['Server']['AllowDeny']['order'] == 'allow,deny' ) {
$AllowDeny_forbidden = TRUE;
if( PMA_AllowDeny('allow') ) {
$AllowDeny_forbidden = FALSE;
}
if( PMA_AllowDeny('deny') ) {
$AllowDeny_forbidden = TRUE;
}
} else if ( $cfg['Server']['AllowDeny']['order'] == 'deny,allow' ) {
if( PMA_AllowDeny('deny') ) {
$AllowDeny_forbidden = TRUE;
}
if( PMA_AllowDeny('allow') ) {
$AllowDeny_forbidden = FALSE;
}
} else if ( $cfg['Server']['AllowDeny']['order'] == 'explicit' ) {
if( PMA_AllowDeny('allow')
&& !PMA_AllowDeny('deny') ) {
$AllowDeny_forbidden = FALSE;
} else {
$AllowDeny_forbidden = TRUE;
}
}
if($AllowDeny_forbidden) {
// eject the user if they are bad
PMA_auth_fails();
}
unset($AllowDeny_forbidden); //Clean up after you!
$allowDeny_forbidden = FALSE; //default
if ($cfg['Server']['AllowDeny']['order'] == 'allow,deny') {
$allowDeny_forbidden = TRUE;
if (PMA_allowDeny('allow')) {
$allowDeny_forbidden = FALSE;
}
if (PMA_allowDeny('deny')) {
$allowDeny_forbidden = TRUE;
}
} else if ($cfg['Server']['AllowDeny']['order'] == 'deny,allow') {
if (PMA_allowDeny('deny')) {
$allowDeny_forbidden = TRUE;
}
if (PMA_allowDeny('allow')) {
$allowDeny_forbidden = FALSE;
}
} else if ($cfg['Server']['AllowDeny']['order'] == 'explicit') {
if (PMA_allowDeny('allow')
&& !PMA_allowDeny('deny')) {
$allowDeny_forbidden = FALSE;
} else {
$allowDeny_forbidden = TRUE;
}
} // end if... else if... else if
// Ejects the user if banished
if ($allowDeny_forbidden) {
PMA_auth_fails();
}
unset($allowDeny_forbidden); //Clean up after you!
} // end if
// The user can work with only some databases
if (isset($cfg['Server']['only_db']) && $cfg['Server']['only_db'] != '') {