Exemplo n.º 1
0
function rs_wpss_first_action()
{
    if (rs_wpss_is_admin_sproc()) {
        return;
    }
    rs_wpss_start_session();
    /* Add all commands after this */
    /* Add Vars Here */
    $key_main_page_hits = 'wpss_page_hits_' . WPSS_HASH;
    $key_main_pages_hist = 'wpss_pages_hit_' . WPSS_HASH;
    $key_main_hits_per_page = 'wpss_pages_hit_count_' . WPSS_HASH;
    $key_first_ref = 'wpss_referer_init_' . WPSS_HASH;
    $current_ref = rs_wpss_get_referrer();
    $key_auth_hist = 'wpss_author_history_' . WPSS_HASH;
    $key_comment_auth = 'comment_author_' . WPSS_HASH;
    $key_email_hist = 'wpss_author_email_history_' . WPSS_HASH;
    $key_auth_url_hist = 'wpss_author_url_history_' . WPSS_HASH;
    if (empty($_SESSION['wpss_user_ip_init_' . WPSS_HASH])) {
        $_SESSION['wpss_user_ip_init_' . WPSS_HASH] = rs_wpss_get_ip_addr();
    }
    if (empty($_SESSION['wpss_user_agent_init_' . WPSS_HASH])) {
        $_SESSION['wpss_user_agent_init_' . WPSS_HASH] = rs_wpss_get_user_agent();
    }
    $_SESSION['wpss_version_' . WPSS_HASH] = WPSS_VERSION;
    $_SESSION['wpss_site_url_' . WPSS_HASH_ALT] = WPSS_SITE_URL;
    $_SESSION['wpss_plugin_url_' . WPSS_HASH_ALT] = WPSS_PLUGIN_URL;
    $_SESSION['wpss_user_ip_current_' . WPSS_HASH] = rs_wpss_get_ip_addr();
    $_SESSION['wpss_user_agent_current_' . WPSS_HASH] = rs_wpss_get_user_agent();
    if (!is_admin() && !current_user_can('moderate_comments')) {
        /* Page hits */
        if (empty($_SESSION[$key_main_page_hits])) {
            $_SESSION[$key_main_page_hits] = 0;
        }
        ++$_SESSION[$key_main_page_hits];
        /* Pages visited history */
        if (empty($_SESSION[$key_main_pages_hist])) {
            $_SESSION[$key_main_pages_hist] = array();
            $_SESSION[$key_main_hits_per_page] = array();
        }
        $_SESSION[$key_main_pages_hist][] = rs_wpss_get_url();
        /* Initial referrer */
        if (empty($_SESSION[$key_first_ref])) {
            if (!empty($current_ref)) {
                $_SESSION[$key_first_ref] = $current_ref;
            } else {
                $_SESSION[$key_first_ref] = '[No Data]';
            }
        }
        if (!empty($_COOKIE[$key_comment_auth])) {
            $stored_author_data = rs_wpss_get_author_data();
            $stored_author = $stored_author_data['comment_author'];
            $stored_author_email = $stored_author_data['comment_author_email'];
            $stored_author_url = $stored_author_data['comment_author_url'];
            if (empty($_SESSION[$key_auth_hist]) && !empty($stored_author)) {
                $_SESSION[$key_auth_hist] = array();
                $_SESSION[$key_auth_hist][] = $stored_author;
            }
            if (empty($_SESSION[$key_email_hist]) && !empty($stored_author_email)) {
                $_SESSION[$key_email_hist] = array();
                $_SESSION[$key_email_hist][] = $stored_author_email;
            }
            if (empty($_SESSION[$key_auth_url_hist]) && !empty($stored_author_url)) {
                $_SESSION[$key_auth_url_hist] = array();
                $_SESSION[$key_auth_url_hist][] = $stored_author_url;
            }
        }
    }
}
 public static function early_post_intercept()
 {
     /**
      * SECURITY - Checks all incoming POST requests early for malicious behavior
      * Added 1.9.7.8
      */
     if ('POST' !== $_SERVER['REQUEST_METHOD'] || rs_wpss_is_local_request() || is_user_logged_in()) {
         return;
     }
     global $spamshield_options;
     if (empty($spamshield_options)) {
         $spamshield_options = get_option('spamshield_options');
     }
     if (!empty($spamshield_options['disable_misc_form_shield'])) {
         return;
     }
     $url = rs_wpss_get_url();
     $url_lc = rs_wpss_casetrans('lower', $url);
     $req_uri = $_SERVER['REQUEST_URI'];
     $req_uri_lc = rs_wpss_casetrans('lower', $req_uri);
     $epc_filter_status = $wpss_error_code = $log_pref = '';
     $epc_jsck_error = $epc_badrobot_error = FALSE;
     $form_type = 'misc form';
     $pref = 'EPC-';
     $errors_3p = array();
     $error_txt = rs_wpss_error_txt();
     $server_name = WPSS_SERVER_NAME;
     $server_email_domain = rs_wpss_get_email_domain($server_name);
     $epc_serial_post = json_encode($_POST);
     $form_auth_dat = array('comment_author' => '', 'comment_author_email' => '', 'comment_author_url' => '');
     $blocked = FALSE;
     $c = array('name' => '', 'value' => '1', 'expire' => time() + 60 * 60 * 24 * 365 * 1, 'path' => '/', 'domain' => rs_wpss_get_cookie_domain(), 'secure' => FALSE, 'httponly' => FALSE);
     if (rs_wpss_is_xmlrpc()) {
         if (empty($_POST) || !empty($_GET)) {
             $blocked = TRUE;
         }
         rs_wpss_start_session();
         $c['name'] = 'P_XMLRPC';
     }
     if (rs_wpss_is_doing_ajax()) {
         if (empty($_POST) && empty($_GET) || empty($_REQUEST['action'])) {
             $wpss_error_code .= ' ' . $pref . 'FAR1020';
             $err_cod = 'fake_ajax_request_error';
             $err_msg = __('That action is currently not allowed.');
             $errors_3p[$err_cod] = $err_msg;
         }
     }
     if (rs_wpss_skiddie_ua_check()) {
         $wpss_error_code .= ' ' . $pref . 'UA1004';
         $err_cod = 'badrobot_skiddie_error';
         $err_msg = __('That action is currently not allowed.');
         $errors_3p[$err_cod] = $err_msg;
     }
     if (rs_wpss_ubl_cache()) {
         if (TRUE === WPSS_IP_BAN_ENABLE && rs_wpss_is_xmlrpc()) {
             self::ip_ban();
         }
         $wpss_error_code .= ' ' . $pref . '0-BL';
         $err_cod = 'blacklisted_user_error';
         $err_msg = __('That action is currently not allowed.');
         $errors_3p[$err_cod] = $err_msg;
     }
     if (!empty($c['name'])) {
         /* Setting cookie to honeypot bad actors */
         @setcookie($c['name'], $c['value'], $c['expire'], $c['path'], $c['domain'], $c['secure'], $c['httponly']);
     }
     if (!empty($wpss_error_code)) {
         rs_wpss_update_accept_status($form_auth_dat, 'r', 'Line: ' . __LINE__, $wpss_error_code);
         if (!empty($spamshield_options['comment_logging'])) {
             rs_wpss_log_data($form_auth_dat, $wpss_error_code, $form_type, $epc_serial_post);
         }
     } else {
         rs_wpss_update_accept_status($form_auth_dat, 'a', 'Line: ' . __LINE__);
     }
     /* Now output error message */
     if (!empty($wpss_error_code)) {
         $error_msg = '';
         foreach ($errors_3p as $c => $m) {
             $error_msg .= '<strong>' . $error_txt . ':</strong> ' . $m . '<br /><br />' . WPSS_EOL;
         }
         WP_SpamShield::wp_die($error_msg, TRUE);
     }
 }