note 61650 added to ref.mail

I added a few more improvements to "anton at basehost dot net"'s script: - changed ereg to strpos and ereg_replace to str_ireplace (preg_replace) for a bit more speed (I hope) - added $_GET $_REQUEST $HTTP_POST_VARS $HTTP_GET_VARS <?php function _local_replace_bad($value) { # mail adress(ess) for reports... $report_to = "anti-spam@example.de"; # array holding strings to check, we do not trust these strings in $_POST $suspicious_str = array ( "content-type:" ,"charset=" ,"mime-version:" ,"multipart/mixed" ,"bcc:" ); $suspect_found = false; // remove added slashes from $value... $value = stripslashes($value); # checks if $value contains $suspect... foreach($suspicious_str as $suspect) { if(strpos(strtolower($value),$suspect)!==false) { //if(eregi($suspect, strtolower($value))) { # if we found some suspicios string, then we add our string, so it # will be messed a little bit. :) $suspect_found = true; //$value = str_ireplace($suspect, "(anti-spam-".$suspect.")", $value); // Use this, if you use PHP5 $value = preg_replace('/'.preg_quote($suspect,'/').'/i', "(anti-spam-".$suspect.")", $value); // Use this, if you use PHP < 5 //$value = eregi_replace($suspect, "(anti-spam-".$suspect.")", $value); } } if ($suspect_found) { # if at least one suspicios string was found, then do something more $ip = (empty($_SERVER['REMOTE_ADDR'])) ? 'empty' : $_SERVER['REMOTE_ADDR']; $rf = (empty($_SERVER['HTTP_REFERER'])) ? 'empty' : $_SERVER['HTTP_REFERER']; $ua = (empty($_SERVER['HTTP_USER_AGENT'])) ? 'empty' : $_SERVER['HTTP_USER_AGENT']; $ru = (empty($_SERVER['REQUEST_URI'])) ? 'empty' : $_SERVER['REQUEST_URI']; $rm = (empty($_SERVER['REQUEST_METHOD'])) ? 'empty' : $_SERVER['REQUEST_METHOD']; # very often HTTP_USER_AGENT is empty. We consider this is 100% spam if ($suspect_found && $ua == "empty") { exit(); } # if we are here, then HTTP_USER_AGENT is not empty. this is only 80-90% that it is spam # Remember, that POST values were already changed. But we still want to inform our # admin about this suspicios request. if(isset($report_to) && !empty($report_to)) { $warn_nachricht= "Stopped possible mail-injection @ " . $_SERVER['HTTP_HOST'] . " by " . $ip . " (" . date('d/m/Y H:i:s') . ")\r\n\r\n" . "*** IP/HOST\r\n" . $ip . "\r\n\r\n" . "*** USER AGENT\r\n" . $ua . "\r\n\r\n" . "*** REFERER\r\n" . $rf . "\r\n\r\n" . "*** REQUEST URI\r\n" . $ru . "\r\n\r\n" . "*** REQUEST METHOD\r\n" . $rm . "\r\n\r\n" . "*** SUSPECT\r\n-----\r\n" . $value . "\r\n-----"; @mail( $report_to, "[ABUSE] [SUSPECT] @ " . $_SERVER['HTTP_HOST'] . " by " . $ip, $warn_nachricht ); } # if report } # if suscpect found return($value); } # what we do - is we simply check all posted values. if(is_array($_POST)) { foreach($_POST as $f=>$v) { $_POST[$f] = _local_replace_bad($v); } } if(is_array($HTTP_POST_VARS)) $HTTP_POST_VARS=$_POST; if(is_array($_GET)) { foreach($_GET as $f=>$v) { $_GET[$f] = _local_replace_bad($v); } } if(is_array($HTTP_GET_VARS)) $HTTP_GET_VARS=$_GET; if(is_array($_REQUEST)) { foreach($_REQUEST as $f=>$v) { $_REQUEST[$f] = _local_replace_bad($v); } } # if register_globals is set to "on", then we should overwrite them once again. if (ini_get("register_globals") == 1) extract($_POST, EXTR_OVERWRITE); ?> ---- Server IP: 217.13.201.10 Probable Submitter: 195.39.239.33 ---- Manual Page -- http://www.php.net/manual/en/ref.mail.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+61650 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+61650&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+61650&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+61650&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+61650&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+61650&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+61650&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+61650&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+61650&report=yes Search -- http://master.php.net/manage/user-notes.php