phpQueryStringVulnerabilityHoneypot.class.php

<?php

if( ! defined( 'XOOPS_ROOT_PATH' ) ) exit ;

class phpQueryStringVulnerabilityHoneypot extends XCube_ActionFilter
{
	function preBlockFilter() {
		if (isset($_GET['-s'])) {
			header('Content-type: text/plain');
			exit('<?php
// don\'t direct access
include_once \''.XOOPS_URL.'/?hp_view=main_pqsvh\';');
		} else if (isset($_GET['hp_view']) && $_GET['hp_view'] === 'main_pqsvh') {
			$this->ipBan();
		}

	}
	
	function ipBan($protectorTTL = 0) {
		global $xoopsUser;
		echo('XOOPS\'s Product Security team is seeking a passionate hacker. ');
		if (XC_CLASS_EXISTS('Protector')) {
			$protector =& Protector::getInstance();
			$conf = $protector->getConf() ;
			$can_ban = true;
			if (is_object($xoopsUser)) {
				$uid = $xoopsUser->getVar('uid') ;
				$can_ban = count( @array_intersect( $xoopsUser->getGroups() , @unserialize( @$conf['bip_except'] ) ) ) ? false : true ;
			}
			if ($can_ban) {
				$protectorTTL = intval($protectorTTL);
				if ($protectorTTL > 0) {
					$time = time() + $protectorTTL;
				} else {
					$time = 0;
				}
				if (!isset($_GET['test'])) {
					$protector->register_bad_ips($time);
				} else {
					echo('IP ban!');
				}
			}
		}
		exit();
	}
}