note 61833 added to ref.mail
| From: | jobsnijders at osu1 dot php dot net | Date: | Mon, 13 Feb 2006 09:48:54 +0000 |
| Subject: | note 61833 added to ref.mail | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-103618@lists.php.net to get a copy of this message | ||
Indeed some apps break a little bit, this is a the script with a whitelist.
<?php
// base taken from nl2.php.net/mail
// modified to by used with a whitelist by Job Snijders <job at interlab.nl>
// 07-02-2006
$whitelistantispam = array
(
"webmail.company.nl"
,"phpmyadmin.company.nl"
);
// don't edit below this line
function _local_replace_bad($value_orig) {
# mail adress(ess) for reports...
$report_to = "job@interlab.nl";
# array holding strings to check, we do not trust these strings in $_POST
$suspicious_str = array
(
// "content-type:"
// ,"charset="
"mime-version:"
,"multipart/mixed"
,"bcc:"
);
$suspect_found = false;
// remove added slashes from $value...
$value = stripslashes($value_orig);
# checks if $value contains $suspect...
foreach($suspicious_str as $suspect) {
if(eregi($suspect, strtolower($value))) {
# if we found some suspicios string, then we add our string, so it
# will be messed a little bit. :)
$suspect_found = true;
$value = eregi_replace($suspect, "(anti-spam-".$suspect.")", $value);
}
}
if ($suspect_found) {
# if at least one suspicios string was found, then do something more
$ip = (empty($_SERVER['REMOTE_ADDR'])) ? 'empty' :
$_SERVER['REMOTE_ADDR'];
$rf = (empty($_SERVER['HTTP_REFERER'])) ? 'empty' :
$_SERVER['HTTP_REFERER'];
$ua = (empty($_SERVER['HTTP_USER_AGENT'])) ? 'empty' :
$_SERVER['HTTP_USER_AGENT'];
$ru = (empty($_SERVER['REQUEST_URI'])) ? 'empty' :
$_SERVER['REQUEST_URI'];
$rm = (empty($_SERVER['REQUEST_METHOD'])) ? 'empty' :
$_SERVER['REQUEST_METHOD'];
# very often HTTP_USER_AGENT is empty. We consider this is 100% spam
if ($suspect_found && $ua == "empty") {
exit();
}
if ($suspect_found && $ua == "-") {
exit();
}
# if we are here, then HTTP_USER_AGENT is not empty. this is only 80-90% that it is spam
# Remember, that POST values were already changed. But we still want to inform our
# admin about this suspicios request.
if(isset($report_to) && !empty($report_to)) {
@mail(
$report_to,
"[ABUSE] [SUSPECT] @ " . $_SERVER['HTTP_HOST'] . " by "
. $ip,
"Stopped possible mail-injection @ " .
$_SERVER['HTTP_HOST'] . " by " . $ip .
" (" . date('d/m/Y H:i:s') . ")\r\n\r\n" .
"*** IP/HOST\r\n" . $ip . "\r\n\r\n" .
"*** UID\r\n" . getmyuid() . "\r\n\r\n" .
"*** USER AGENT\r\n" . $ua . "\r\n\r\n" .
"*** REFERER\r\n" . $rf . "\r\n\r\n" .
"*** REQUEST URI\r\n" . $ru . "\r\n\r\n" .
"*** REQUEST METHOD\r\n" . $rm . "\r\n\r\n" .
"*** SUSPECT\r\n-----\r\n" . $value . "\r\n-----"
);
} # if report
} # if suscpect found
else { $value = $value_orig;} # this line to correct
return($value);
}
# what we do - is we simply check all posted values if they don't match our whitelist
if(!in_array($_SERVER['HTTP_HOST'], $whitelistantispam)) {
foreach($_POST as $f=>$v) {
$_POST[$f] = _local_replace_bad($v);
}
# if register_globals is set to "on", then we should overwrite them once again.
if (ini_get("register_globals") == 1)
extract($_POST, EXTR_OVERWRITE);
}
unset($whitelistantispam);
unset($suspicious_str);
unset($value);
?>
----
Server IP: 194.109.193.119
Probable Submitter: 82.168.174.64
----
Manual Page -- http://www.php.net/manual/en/ref.mail.php
Edit -- http://master.php.net/manage/user-notes.php?action=edit+61833
Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+61833&report=yes&reason=added+to+the+manual
Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+61833&report=yes&reason=bad+code
Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+61833&report=yes&reason=spam
Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+61833&report=yes&reason=useless
Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+61833&report=yes&reason=non-english
Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+61833&report=yes&reason=already+in+docs
Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+61833&report=yes
Reject -- http://master.php.net/manage/user-notes.php?action=reject+61833&report=yes
Search -- http://master.php.net/manage/user-notes.php