Edit File by line

if (!$this->canLogHit) {

[500] Fix | Delete

return false;

[501] Fix | Delete

}

[502] Fix | Delete

if (is_admin()) { return false; } //Don't log admin pageviews

[503] Fix | Delete

if (isset($_SERVER['HTTP_USER_AGENT'])) {

[504] Fix | Delete

if (preg_match('/WordPress\/' . $this->wp_version . '/i', $_SERVER['HTTP_USER_AGENT'])) { return false; } //Ignore regular requests generated by WP UA.

[505] Fix | Delete

}

[506] Fix | Delete

$userID = get_current_user_id();

[507] Fix | Delete

if (!$userID) {

[508] Fix | Delete

$userID = $this->effectiveUserID;

[509] Fix | Delete

}

[510] Fix | Delete

if ($userID) {

[511] Fix | Delete

$user = new WP_User($userID);

[512] Fix | Delete

if ($user && $user->exists()) {

[513] Fix | Delete

if (wfConfig::get('liveTraf_ignorePublishers') && ($user->has_cap('publish_posts') || $user->has_cap('publish_pages'))) {

[514] Fix | Delete

return false;

[515] Fix | Delete

}

[516] Fix | Delete

[517] Fix | Delete

if (wfConfig::get('liveTraf_ignoreUsers')) {

[518] Fix | Delete

$ignored = explode(',', wfConfig::get('liveTraf_ignoreUsers'));

[519] Fix | Delete

foreach ($ignored as $entry) {

[520] Fix | Delete

if($user->user_login == $entry){

[521] Fix | Delete

return false;

[522] Fix | Delete

}

[523] Fix | Delete

}

[524] Fix | Delete

}

[525] Fix | Delete

}

[526] Fix | Delete

}

[527] Fix | Delete

if(wfConfig::get('liveTraf_ignoreIPs')){

[528] Fix | Delete

$IPs = explode(',', wfConfig::get('liveTraf_ignoreIPs'));

[529] Fix | Delete

$IP = wfUtils::getIP();

[530] Fix | Delete

foreach($IPs as $ignoreIP){

[531] Fix | Delete

if($ignoreIP == $IP){

[532] Fix | Delete

return false;

[533] Fix | Delete

}

[534] Fix | Delete

}

[535] Fix | Delete

}

[536] Fix | Delete

if( isset($_SERVER['HTTP_USER_AGENT']) && wfConfig::get('liveTraf_ignoreUA') ){

[537] Fix | Delete

if($_SERVER['HTTP_USER_AGENT'] == wfConfig::get('liveTraf_ignoreUA')){

[538] Fix | Delete

return false;

[539] Fix | Delete

}

[540] Fix | Delete

}

[541] Fix | Delete

[542] Fix | Delete

return true;

[543] Fix | Delete

}

[544] Fix | Delete

private function getDB(){

[545] Fix | Delete

if(! $this->db){

[546] Fix | Delete

$this->db = new wfDB();

[547] Fix | Delete

}

[548] Fix | Delete

return $this->db;

[549] Fix | Delete

}

[550] Fix | Delete

public function firewallBadIPs() {

[551] Fix | Delete

$IP = wfUtils::getIP();

[552] Fix | Delete

if (wfBlock::isWhitelisted($IP)) {

[553] Fix | Delete

return;

[554] Fix | Delete

}

[555] Fix | Delete

[556] Fix | Delete

//Range and UA pattern blocking

[557] Fix | Delete

$patternBlocks = wfBlock::patternBlocks(true);

[558] Fix | Delete

$userAgent = !empty($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '';

[559] Fix | Delete

$referrer = !empty($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';

[560] Fix | Delete

foreach ($patternBlocks as $b) {

[561] Fix | Delete

if ($b->matchRequest($IP, $userAgent, $referrer) !== wfBlock::MATCH_NONE) {

[562] Fix | Delete

$b->recordBlock();

[563] Fix | Delete

wfActivityReport::logBlockedIP($IP, null, 'advanced');

[564] Fix | Delete

$this->currentRequest->actionDescription = __('UA/Referrer/IP Range not allowed', 'wordfence');

[565] Fix | Delete

$this->do503(3600, __("Advanced blocking in effect.", 'wordfence')); //exits

[566] Fix | Delete

}

[567] Fix | Delete

}

[568] Fix | Delete

[569] Fix | Delete

// Country blocking

[570] Fix | Delete

$countryBlocks = wfBlock::countryBlocks(true);

[571] Fix | Delete

foreach ($countryBlocks as $b) {

[572] Fix | Delete

$match = $b->matchRequest($IP, false, false);

[573] Fix | Delete

if ($match === wfBlock::MATCH_COUNTRY_REDIR_BYPASS) {

[574] Fix | Delete

$bypassRedirDest = wfConfig::get('cbl_bypassRedirDest', '');

[575] Fix | Delete

[576] Fix | Delete

$this->initLogRequest();

[577] Fix | Delete

$this->getCurrentRequest()->actionDescription = __('redirected to bypass URL', 'wordfence');

[578] Fix | Delete

$this->getCurrentRequest()->statusCode = 302;

[579] Fix | Delete

$this->currentRequest->action = 'cbl:redirect';

[580] Fix | Delete

$this->logHit();

[581] Fix | Delete

[582] Fix | Delete

wfUtils::doNotCache();

[583] Fix | Delete

wp_redirect($bypassRedirDest, 302);

[584] Fix | Delete

exit();

[585] Fix | Delete

}

[586] Fix | Delete

else if ($match === wfBlock::MATCH_COUNTRY_REDIR) {

[587] Fix | Delete

$b->recordBlock();

[588] Fix | Delete

wfConfig::inc('totalCountryBlocked');

[589] Fix | Delete

[590] Fix | Delete

$this->initLogRequest();

[591] Fix | Delete

$this->getCurrentRequest()->actionDescription = sprintf(/* translators: URL */ __('blocked access via country blocking and redirected to URL (%s)', 'wordfence'), wfConfig::get('cbl_redirURL'));

[592] Fix | Delete

$this->getCurrentRequest()->statusCode = 503;

[593] Fix | Delete

if (!$this->getCurrentRequest()->action) {

[594] Fix | Delete

$this->currentRequest->action = 'blocked:wordfence';

[595] Fix | Delete

}

[596] Fix | Delete

$this->logHit();

[597] Fix | Delete

[598] Fix | Delete

wfActivityReport::logBlockedIP($IP, null, 'country');

[599] Fix | Delete

[600] Fix | Delete

wfUtils::doNotCache();

[601] Fix | Delete

wp_redirect(wfConfig::get('cbl_redirURL'), 302);

[602] Fix | Delete

exit();

[603] Fix | Delete

}

[604] Fix | Delete

else if ($match !== wfBlock::MATCH_NONE) {

[605] Fix | Delete

$b->recordBlock();

[606] Fix | Delete

$this->currentRequest->actionDescription = __('blocked access via country blocking', 'wordfence');

[607] Fix | Delete

wfConfig::inc('totalCountryBlocked');

[608] Fix | Delete

wfActivityReport::logBlockedIP($IP, null, 'country');

[609] Fix | Delete

$this->do503(3600, __('Access from your area has been temporarily limited for security reasons', 'wordfence'));

[610] Fix | Delete

}

[611] Fix | Delete

}

[612] Fix | Delete

[613] Fix | Delete

//Specific IP blocks

[614] Fix | Delete

$ipBlock = wfBlock::findIPBlock($IP);

[615] Fix | Delete

if ($ipBlock !== false) {

[616] Fix | Delete

$ipBlock->recordBlock();

[617] Fix | Delete

$secsToGo = max(0, $ipBlock->expiration - time());

[618] Fix | Delete

if (wfConfig::get('other_WFNet') && self::isAuthRequest()) { //It's an auth request and this IP has been blocked

[619] Fix | Delete

$this->getCurrentRequest()->action = 'blocked:wfsnrepeat';

[620] Fix | Delete

wordfence::wfsnReportBlockedAttempt($IP, 'login');

[621] Fix | Delete

}

[622] Fix | Delete

$reason = $ipBlock->reason;

[623] Fix | Delete

if ($ipBlock->type == wfBlock::TYPE_IP_MANUAL || $ipBlock->type == wfBlock::TYPE_IP_AUTOMATIC_PERMANENT) {

[624] Fix | Delete

$reason = __('Manual block by administrator', 'wordfence');

[625] Fix | Delete

}

[626] Fix | Delete

$this->do503($secsToGo, $reason); //exits

[627] Fix | Delete

}

[628] Fix | Delete

}

[629] Fix | Delete

[630] Fix | Delete

private function takeBlockingAction($configVar, $reason) {

[631] Fix | Delete

if ($this->googleSafetyCheckOK()) {

[632] Fix | Delete

$action = wfConfig::get($configVar . '_action');

[633] Fix | Delete

if (!$action) {

[634] Fix | Delete

return;

[635] Fix | Delete

}

[636] Fix | Delete

[637] Fix | Delete

$IP = wfUtils::getIP();

[638] Fix | Delete

$secsToGo = 0;

[639] Fix | Delete

if ($action == 'block') { //Rate limited - block temporarily

[640] Fix | Delete

$secsToGo = wfBlock::blockDuration();

[641] Fix | Delete

wfBlock::createRateBlock($reason, $IP, $secsToGo);

[642] Fix | Delete

wfActivityReport::logBlockedIP($IP, null, 'throttle');

[643] Fix | Delete

$this->tagRequestForBlock($reason);

[644] Fix | Delete

[645] Fix | Delete

$alertCallback = array(new wfBlockAlert($IP, $reason, $secsToGo), 'send');

[646] Fix | Delete

[647] Fix | Delete

do_action('wordfence_security_event', 'block', array(

[648] Fix | Delete

'ip' => $IP,

[649] Fix | Delete

'reason' => $reason,

[650] Fix | Delete

'duration' => $secsToGo,

[651] Fix | Delete

), $alertCallback);

[652] Fix | Delete

wordfence::status(2, 'info', sprintf(/* translators: 1. IP address. 2. Description of firewall action. */ __('Blocking IP %1$s. %2$s', 'wordfence'), $IP, $reason));

[653] Fix | Delete

}

[654] Fix | Delete

else if ($action == 'throttle') { //Rate limited - throttle

[655] Fix | Delete

$secsToGo = wfBlock::rateLimitThrottleDuration();

[656] Fix | Delete

wfBlock::createRateThrottle($reason, $IP, $secsToGo);

[657] Fix | Delete

wfActivityReport::logBlockedIP($IP, null, 'throttle');

[658] Fix | Delete

[659] Fix | Delete

do_action('wordfence_security_event', 'throttle', array(

[660] Fix | Delete

'ip' => $IP,

[661] Fix | Delete

'reason' => $reason,

[662] Fix | Delete

'duration' => $secsToGo,

[663] Fix | Delete

));

[664] Fix | Delete

wordfence::status(2, 'info', sprintf(/* translators: 1. IP address. 2. Description of firewall action. */ __('Throttling IP %1$s. %2$s', 'wordfence'), $IP, $reason));

[665] Fix | Delete

wfConfig::inc('totalIPsThrottled');

[666] Fix | Delete

}

[667] Fix | Delete

$this->do503($secsToGo, $reason, false);

[668] Fix | Delete

}

[669] Fix | Delete

[670] Fix | Delete

return;

[671] Fix | Delete

}

[672] Fix | Delete

[673] Fix | Delete

/**

[674] Fix | Delete

* Test if the current request is for wp-login.php or xmlrpc.php

[675] Fix | Delete

[676] Fix | Delete

* @return boolean

[677] Fix | Delete

[678] Fix | Delete

private static function isAuthRequest() {

[679] Fix | Delete

if ((strpos($_SERVER['REQUEST_URI'], '/wp-login.php') !== false)) {

[680] Fix | Delete

return true;

[681] Fix | Delete

}

[682] Fix | Delete

return false;

[683] Fix | Delete

}

[684] Fix | Delete

[685] Fix | Delete

public function do503($secsToGo, $reason, $sendEventToCentral = true){

[686] Fix | Delete

$this->initLogRequest();

[687] Fix | Delete

[688] Fix | Delete

if ($sendEventToCentral) {

[689] Fix | Delete

do_action('wordfence_security_event', 'block', array(

[690] Fix | Delete

'ip' => wfUtils::inet_ntop($this->currentRequest->IP),

[691] Fix | Delete

'reason' => $this->currentRequest->actionDescription ? $this->currentRequest->actionDescription : $reason,

[692] Fix | Delete

'duration' => $secsToGo,

[693] Fix | Delete

));

[694] Fix | Delete

}

[695] Fix | Delete

[696] Fix | Delete

$this->currentRequest->statusCode = 503;

[697] Fix | Delete

if (!$this->currentRequest->action) {

[698] Fix | Delete

$this->currentRequest->action = 'blocked:wordfence';

[699] Fix | Delete

}

[700] Fix | Delete

if (!$this->currentRequest->actionDescription) {

[701] Fix | Delete

$this->currentRequest->actionDescription = "blocked: " . $reason;

[702] Fix | Delete

}

[703] Fix | Delete

[704] Fix | Delete

$this->logHit();

[705] Fix | Delete

[706] Fix | Delete

wfConfig::inc('total503s');

[707] Fix | Delete

wfUtils::doNotCache();

[708] Fix | Delete

header('HTTP/1.1 503 Service Temporarily Unavailable');

[709] Fix | Delete

header('Status: 503 Service Temporarily Unavailable');

[710] Fix | Delete

if($secsToGo){

[711] Fix | Delete

header('Retry-After: ' . $secsToGo);

[712] Fix | Delete

}

[713] Fix | Delete

$customText = wpautop(wp_strip_all_tags(wfConfig::get('blockCustomText', '')));

[714] Fix | Delete

require_once(dirname(__FILE__) . '/wf503.php');

[715] Fix | Delete

exit();

[716] Fix | Delete

}

[717] Fix | Delete

private function redirect($URL){

[718] Fix | Delete

wfUtils::doNotCache();

[719] Fix | Delete

wp_redirect($URL, 302);

[720] Fix | Delete

exit();

[721] Fix | Delete

}

[722] Fix | Delete

private function googleSafetyCheckOK(){ //returns true if OK to block. Returns false if we must not block.

[723] Fix | Delete

$cacheKey = md5( (isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '') . ' ' . wfUtils::getIP());

[724] Fix | Delete

//Cache so we can call this multiple times in one request

[725] Fix | Delete

if(! isset(self::$gbSafeCache[$cacheKey])){

[726] Fix | Delete

$nb = wfConfig::get('neverBlockBG');

[727] Fix | Delete

if($nb == 'treatAsOtherCrawlers'){

[728] Fix | Delete

self::$gbSafeCache[$cacheKey] = true; //OK to block because we're treating google like everyone else

[729] Fix | Delete

} else if($nb == 'neverBlockUA' || $nb == 'neverBlockVerified'){

[730] Fix | Delete

if(wfCrawl::isGoogleCrawler()){ //Check the UA using regex

[731] Fix | Delete

if($nb == 'neverBlockVerified'){

[732] Fix | Delete

if(wfCrawl::isVerifiedGoogleCrawler(wfUtils::getIP())){ //UA check passed, now verify using PTR if configured to

[733] Fix | Delete

self::$gbSafeCache[$cacheKey] = false; //This is a verified Google crawler, so no we can't block it

[734] Fix | Delete

} else {

[735] Fix | Delete

self::$gbSafeCache[$cacheKey] = true; //This is a crawler claiming to be Google but it did not verify

[736] Fix | Delete

}

[737] Fix | Delete

} else { //neverBlockUA

[738] Fix | Delete

self::$gbSafeCache[$cacheKey] = false; //User configured us to only do a UA check and this claims to be google so don't block

[739] Fix | Delete

}

[740] Fix | Delete

} else {

[741] Fix | Delete

self::$gbSafeCache[$cacheKey] = true; //This isn't a Google UA, so it's OK to block

[742] Fix | Delete

}

[743] Fix | Delete

} else {

[744] Fix | Delete

//error_log("Wordfence error: neverBlockBG option is not set.");

[745] Fix | Delete

self::$gbSafeCache[$cacheKey] = false; //Oops the config option is not set. This should never happen because it's set on install. So we return false to indicate it's not OK to block just for safety.

[746] Fix | Delete

}

[747] Fix | Delete

}

[748] Fix | Delete

if(! isset(self::$gbSafeCache[$cacheKey])){

[749] Fix | Delete

//error_log("Wordfence assertion fail in googleSafetyCheckOK: cached value is not set.");

[750] Fix | Delete

return false; //for safety

[751] Fix | Delete

}

[752] Fix | Delete

return self::$gbSafeCache[$cacheKey]; //return cached value

[753] Fix | Delete

}

[754] Fix | Delete

public function addStatus($level, $type, $msg){

[755] Fix | Delete

//$msg = '[' . sprintf('%.2f', memory_get_usage(true) / (1024 * 1024)) . '] ' . $msg;

[756] Fix | Delete

$this->getDB()->queryWrite("insert into " . $this->statusTable . " (ctime, level, type, msg) values (%s, %d, '%s', '%s')", sprintf('%.6f', microtime(true)), $level, $type, $msg);

[757] Fix | Delete

}

[758] Fix | Delete

public function getStatusEvents($lastCtime){

[759] Fix | Delete

if($lastCtime < 1){

[760] Fix | Delete

$lastCtime = $this->getDB()->querySingle("select ctime from " . $this->statusTable . " order by ctime desc limit 1000,1");

[761] Fix | Delete

if(! $lastCtime){

[762] Fix | Delete

$lastCtime = 0;

[763] Fix | Delete

}

[764] Fix | Delete

}

[765] Fix | Delete

$results = $this->getDB()->querySelect("select ctime, level, type, msg from " . $this->statusTable . " where ctime > %f order by ctime asc", $lastCtime);

[766] Fix | Delete

$timeOffset = 3600 * get_option('gmt_offset');

[767] Fix | Delete

foreach($results as &$rec){

[768] Fix | Delete

//$rec['timeAgo'] = wfUtils::makeTimeAgo(time() - $rec['ctime']);

[769] Fix | Delete

$rec['date'] = date('M d H:i:s', (int) $rec['ctime'] + $timeOffset);

[770] Fix | Delete

$rec['msg'] = wp_kses_data( (string) $rec['msg']);

[771] Fix | Delete

}

[772] Fix | Delete

return $results;

[773] Fix | Delete

}

[774] Fix | Delete

public function getSummaryEvents(){

[775] Fix | Delete

$results = $this->getDB()->querySelect("select ctime, level, type, msg from " . $this->statusTable . " where level = 10 order by ctime desc limit 100");

[776] Fix | Delete

$timeOffset = 3600 * get_option('gmt_offset');

[777] Fix | Delete

foreach($results as &$rec){

[778] Fix | Delete

$rec['date'] = date('M d H:i:s', (int) $rec['ctime'] + $timeOffset);

[779] Fix | Delete

if(strpos($rec['msg'], 'SUM_PREP:') === 0){

[780] Fix | Delete

break;

[781] Fix | Delete

}

[782] Fix | Delete

}

[783] Fix | Delete

return array_reverse($results);

[784] Fix | Delete

}

[785] Fix | Delete

[786] Fix | Delete

/**

[787] Fix | Delete

* @return string

[788] Fix | Delete

[789] Fix | Delete

public function getGooglePattern() {

[790] Fix | Delete

return $this->googlePattern;

[791] Fix | Delete

}

[792] Fix | Delete

[793] Fix | Delete

}

[794] Fix | Delete

[795] Fix | Delete

/**

[796] Fix | Delete

[797] Fix | Delete

[798] Fix | Delete

class wfUserIPRange {

[799] Fix | Delete

[800] Fix | Delete

/**

[801] Fix | Delete

* @var string|null

[802] Fix | Delete

[803] Fix | Delete

private $ip_string;

[804] Fix | Delete

[805] Fix | Delete

/**

[806] Fix | Delete

* @param string|null $ip_string

[807] Fix | Delete

[808] Fix | Delete

public function __construct($ip_string = null) {

[809] Fix | Delete

$this->setIPString($ip_string);

[810] Fix | Delete

}

[811] Fix | Delete

[812] Fix | Delete

/**

[813] Fix | Delete

* Check if the supplied IP address is within the user supplied range.

[814] Fix | Delete

[815] Fix | Delete

* @param string $ip

[816] Fix | Delete

* @return bool

[817] Fix | Delete

[818] Fix | Delete

public function isIPInRange($ip) {

[819] Fix | Delete

$ip_string = $this->getIPString();

[820] Fix | Delete

[821] Fix | Delete

if (strpos($ip_string, '/') !== false) { //CIDR range -- 127.0.0.1/24

[822] Fix | Delete

return wfUtils::subnetContainsIP($ip_string, $ip);

[823] Fix | Delete

}

[824] Fix | Delete

else if (strpos($ip_string, '[') !== false) //Bracketed range -- 127.0.0.[1-100]

[825] Fix | Delete

{

[826] Fix | Delete

// IPv4 range

[827] Fix | Delete

if (strpos($ip_string, '.') !== false && strpos($ip, '.') !== false) {

[828] Fix | Delete

// IPv4-mapped-IPv6

[829] Fix | Delete

if (preg_match('/:ffff:([^:]+)$/i', $ip_string, $matches)) {

[830] Fix | Delete

$ip_string = $matches[1];

[831] Fix | Delete

}

[832] Fix | Delete

if (preg_match('/:ffff:([^:]+)$/i', $ip, $matches)) {

[833] Fix | Delete

$ip = $matches[1];

[834] Fix | Delete

}

[835] Fix | Delete

[836] Fix | Delete

// Range check

[837] Fix | Delete

if (preg_match('/\[\d+\-\d+\]/', $ip_string)) {

[838] Fix | Delete

$IPparts = explode('.', $ip);

[839] Fix | Delete

$whiteParts = explode('.', $ip_string);

[840] Fix | Delete

$mismatch = false;

[841] Fix | Delete

if (count($whiteParts) != 4 || count($IPparts) != 4) {

[842] Fix | Delete

return false;

[843] Fix | Delete

}

[844] Fix | Delete

[845] Fix | Delete

for ($i = 0; $i <= 3; $i++) {

[846] Fix | Delete

if (preg_match('/^\[(\d+)\-(\d+)\]$/', $whiteParts[$i], $m)) {

[847] Fix | Delete

if ($IPparts[$i] < $m[1] || $IPparts[$i] > $m[2]) {

[848] Fix | Delete

$mismatch = true;

[849] Fix | Delete

}

[850] Fix | Delete

}

[851] Fix | Delete

else if ($whiteParts[$i] != $IPparts[$i]) {

[852] Fix | Delete

$mismatch = true;

[853] Fix | Delete

}

[854] Fix | Delete

}

[855] Fix | Delete

if ($mismatch === false) {

[856] Fix | Delete

return true; // Is whitelisted because we did not get a mismatch

[857] Fix | Delete

}

[858] Fix | Delete

}

[859] Fix | Delete

else if ($ip_string == $ip) {

[860] Fix | Delete

return true;

[861] Fix | Delete

}

[862] Fix | Delete

[863] Fix | Delete

// IPv6 range

[864] Fix | Delete

}

[865] Fix | Delete

else if (strpos($ip_string, ':') !== false && strpos($ip, ':') !== false) {

[866] Fix | Delete

$ip = strtolower(wfUtils::expandIPv6Address($ip));

[867] Fix | Delete

$ip_string = strtolower(self::expandIPv6Range($ip_string));

[868] Fix | Delete

if (preg_match('/\[[a-f0-9]+\-[a-f0-9]+\]/i', $ip_string)) {

[869] Fix | Delete

$IPparts = explode(':', $ip);

[870] Fix | Delete

$whiteParts = explode(':', $ip_string);

[871] Fix | Delete

$mismatch = false;

[872] Fix | Delete

if (count($whiteParts) != 8 || count($IPparts) != 8) {

[873] Fix | Delete

return false;

[874] Fix | Delete

}

[875] Fix | Delete

[876] Fix | Delete

for ($i = 0; $i <= 7; $i++) {

[877] Fix | Delete

if (preg_match('/^\[([a-f0-9]+)\-([a-f0-9]+)\]$/i', $whiteParts[$i], $m)) {

[878] Fix | Delete

$ip_group = hexdec($IPparts[$i]);

[879] Fix | Delete

$range_group_from = hexdec($m[1]);

[880] Fix | Delete

$range_group_to = hexdec($m[2]);

[881] Fix | Delete

if ($ip_group < $range_group_from || $ip_group > $range_group_to) {

[882] Fix | Delete

$mismatch = true;

[883] Fix | Delete

break;

[884] Fix | Delete

}

[885] Fix | Delete

}

[886] Fix | Delete

else if ($whiteParts[$i] != $IPparts[$i]) {

[887] Fix | Delete

$mismatch = true;

[888] Fix | Delete

break;

[889] Fix | Delete

}

[890] Fix | Delete

}

[891] Fix | Delete

if ($mismatch === false) {

[892] Fix | Delete

return true; // Is whitelisted because we did not get a mismatch

[893] Fix | Delete

}

[894] Fix | Delete

}

[895] Fix | Delete

else if ($ip_string == $ip) {

[896] Fix | Delete

return true;

[897] Fix | Delete

}

[898] Fix | Delete

}

[899] Fix | Delete

}

[900] Fix | Delete

else if (strpos($ip_string, '-') !== false) { //Linear range -- 127.0.0.1 - 127.0.1.100

[901] Fix | Delete

list($ip1, $ip2) = explode('-', $ip_string);

[902] Fix | Delete

$ip1N = wfUtils::inet_pton($ip1);

[903] Fix | Delete

$ip2N = wfUtils::inet_pton($ip2);

[904] Fix | Delete

$ipN = wfUtils::inet_pton($ip);

[905] Fix | Delete

return (strcmp($ip1N, $ipN) <= 0 && strcmp($ip2N, $ipN) >= 0);

[906] Fix | Delete

}

[907] Fix | Delete

else { //Treat as a literal IP

[908] Fix | Delete

$ip1 = @wfUtils::inet_pton($ip_string);

[909] Fix | Delete

$ip2 = @wfUtils::inet_pton($ip);

[910] Fix | Delete

if ($ip1 !== false && $ip1 == $ip2) {

[911] Fix | Delete

return true;

[912] Fix | Delete

}

[913] Fix | Delete

}

[914] Fix | Delete

[915] Fix | Delete

return false;

[916] Fix | Delete

}

[917] Fix | Delete

[918] Fix | Delete

private static function repeatString($string, $count) {

[919] Fix | Delete

if ($count <= 0)

[920] Fix | Delete

return '';

[921] Fix | Delete

return str_repeat($string, $count);

[922] Fix | Delete

}

[923] Fix | Delete

[924] Fix | Delete

/**

[925] Fix | Delete

* Expand a compressed printable range representation of an IPv6 address.

[926] Fix | Delete

[927] Fix | Delete

* @todo Hook up exceptions for better error handling.

[928] Fix | Delete

* @todo Allow IPv4 mapped IPv6 addresses (::ffff:192.168.1.1).

[929] Fix | Delete

* @param string $ip_range

[930] Fix | Delete

* @return string

[931] Fix | Delete

[932] Fix | Delete

public static function expandIPv6Range($ip_range) {

[933] Fix | Delete

$colon_count = substr_count($ip_range, ':');

[934] Fix | Delete

$dbl_colon_count = substr_count($ip_range, '::');

[935] Fix | Delete

if ($dbl_colon_count > 1) {

[936] Fix | Delete

return false;

[937] Fix | Delete

}

[938] Fix | Delete

$dbl_colon_pos = strpos($ip_range, '::');

[939] Fix | Delete

if ($dbl_colon_pos !== false) {

[940] Fix | Delete

$ip_range = str_replace('::', self::repeatString(':0000',

[941] Fix | Delete

(($dbl_colon_pos === 0 || $dbl_colon_pos === strlen($ip_range) - 2) ? 9 : 8) - $colon_count) . ':', $ip_range);

[942] Fix | Delete

$ip_range = trim($ip_range, ':');

[943] Fix | Delete

}

[944] Fix | Delete

$colon_count = substr_count($ip_range, ':');

[945] Fix | Delete

if ($colon_count != 7) {

[946] Fix | Delete

return false;

[947] Fix | Delete

}

[948] Fix | Delete

[949] Fix | Delete

$groups = explode(':', $ip_range);

[950] Fix | Delete

$expanded = '';

[951] Fix | Delete

foreach ($groups as $group) {

[952] Fix | Delete

if (preg_match('/\[([a-f0-9]{1,4})\-([a-f0-9]{1,4})\]/i', $group, $matches)) {

[953] Fix | Delete

$expanded .= sprintf('[%s-%s]', str_pad(strtolower($matches[1]), 4, '0', STR_PAD_LEFT), str_pad(strtolower($matches[2]), 4, '0', STR_PAD_LEFT)) . ':';

[954] Fix | Delete

} else if (preg_match('/[a-f0-9]{1,4}/i', $group)) {

[955] Fix | Delete

$expanded .= str_pad(strtolower($group), 4, '0', STR_PAD_LEFT) . ':';

[956] Fix | Delete

} else {

[957] Fix | Delete

return false;

[958] Fix | Delete

}

[959] Fix | Delete

}

[960] Fix | Delete

return trim($expanded, ':');

[961] Fix | Delete

}

[962] Fix | Delete

[963] Fix | Delete

/**

[964] Fix | Delete

* @return bool

[965] Fix | Delete

[966] Fix | Delete

public function isValidRange() {

[967] Fix | Delete

return $this->isValidCIDRRange() || $this->isValidBracketedRange() || $this->isValidLinearRange() || wfUtils::isValidIP($this->getIPString());

[968] Fix | Delete

}

[969] Fix | Delete

[970] Fix | Delete

public function isValidCIDRRange() { //e.g., 192.0.2.1/24

[971] Fix | Delete

$ip_string = $this->getIPString();

[972] Fix | Delete

if (preg_match('/[^0-9a-f:\/\.]/i', $ip_string)) { return false; }

[973] Fix | Delete

return wfUtils::isValidCIDRRange($ip_string);

[974] Fix | Delete

}

[975] Fix | Delete

[976] Fix | Delete

public function isValidBracketedRange() { //e.g., 192.0.2.[1-10]

[977] Fix | Delete

$ip_string = $this->getIPString();

[978] Fix | Delete

if (preg_match('/[^0-9a-f:\.\[\]\-]/i', $ip_string)) { return false; }

[979] Fix | Delete

if (strpos($ip_string, '.') !== false) { //IPv4

[980] Fix | Delete

if (preg_match_all('/(\d+)/', $ip_string, $matches) > 0) {

[981] Fix | Delete

foreach ($matches[1] as $match) {

[982] Fix | Delete

$group = (int) $match;

[983] Fix | Delete

if ($group > 255 || $group < 0) {

[984] Fix | Delete

return false;

[985] Fix | Delete

}

[986] Fix | Delete

}

[987] Fix | Delete

}

[988] Fix | Delete

[989] Fix | Delete

$group_regex = '([0-9]{1,3}|\[[0-9]{1,3}\-[0-9]{1,3}\])';

[990] Fix | Delete

return preg_match('/^' . str_repeat("{$group_regex}\\.", 3) . $group_regex . '$/i', $ip_string) > 0;

[991] Fix | Delete

}

[992] Fix | Delete

[993] Fix | Delete

//IPv6

[994] Fix | Delete

if (strpos($ip_string, '::') !== false) {

[995] Fix | Delete

$ip_string = self::expandIPv6Range($ip_string);

[996] Fix | Delete

}

[997] Fix | Delete

if (!$ip_string) {

[998] Fix | Delete

return false;

[999] Fix | Delete

123 4 5