2 /***************************************************************************
3 * Copyright (C) 2003-2008 Polytechnique.org *
4 * http://opensource.polytechnique.org/ *
6 * This program is free software; you can redistribute it and/or modify *
7 * it under the terms of the GNU General Public License as published by *
8 * the Free Software Foundation; either version 2 of the License, or *
9 * (at your option) any later version. *
11 * This program is distributed in the hope that it will be useful, *
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
14 * GNU General Public License for more details. *
16 * You should have received a copy of the GNU General Public License *
17 * along with this program; if not, write to the Free Software *
19 * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA *
20 ***************************************************************************/
22 /******************************************************************************
24 *****************************************************************************/
26 function check_ip($level)
28 if (empty($_SERVER['REMOTE_ADDR'])) {
31 if (empty($_SESSION['check_ip'])) {
33 if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
34 $ips = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
36 $ips[] = $_SERVER['REMOTE_ADDR'];
37 foreach ($ips as &$ip) {
38 $ip = '(ip & mask) = (' . ip_to_uint($ip) . '& mask)';
40 $res = XDB
::query('SELECT state, description
42 WHERE ' . implode(' OR ', $ips) . '
43 ORDER BY state DESC');
44 if ($res->numRows()) {
45 $state = $res->fetchOneAssoc();
46 $_SESSION['check_ip'] = $state['state'];
47 $_SESSION['check_ip_desc'] = $state['description'];
49 $_SESSION['check_ip'] = 'safe';
54 case 'unsafe': $test[] = 'unsafe';
55 case 'dangerous': $test[] = 'dangerous';
56 case 'ban': $test[] = 'ban'; break;
57 default: return false
;
59 return in_array($_SESSION['check_ip'], $test);
62 function check_email($email, $message)
64 $res = XDB
::query("SELECT state, description
66 WHERE state != 'safe' AND email = {?}", $email);
67 if ($res->numRows()) {
68 send_warning_mail($message);
74 function check_account()
76 return S
::v('watch_account');
79 function check_redirect($red = null
)
81 require_once 'emails.inc.php';
83 $red = new Redirect(S
::v('uid'));
85 if ($red->get_uid() == S
::v('uid')) {
86 $_SESSION['no_redirect'] = !$red->other_active('');
87 $_SESSION['mx_failures'] = $red->get_broken_mx();
91 function send_warning_mail($title)
94 $mailer = new PlMailer();
95 $mailer->setFrom("webmaster@" . $globals->mail
->domain
);
96 $mailer->addTo($globals->core
->admin_email
);
97 $mailer->setSubject("[Plat/al Security Alert] $title");
98 $mailer->setTxtBody("Identifiants de session :\n" . var_export($_SESSION, true
) . "\n\n"
99 ."Identifiants de connexion :\n" . var_export($_SERVER, true
));
103 function kill_sessions()
105 assert(S
::has_perms());
106 shell_exec('sudo -u root ' . dirname(dirname(__FILE__
)) . '/bin/kill_sessions.sh');
109 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8: