1C-Bitrix 25.700.0
Загрузка...
Поиск...
Не найдено
iprule.php
См. документацию.
1<?php
2
4
6{
7 static $bActive = null;
8 public $LAST_ERROR = "";
9
10 public function Add($arFields)
11 {
12 global $DB, $CACHE_MANAGER;
13
14 if(!$this->CheckFields($arFields, 0))
15 return false;
16
17 if(!array_key_exists("RULE_TYPE", $arFields))
18 $arFields["RULE_TYPE"] = "M";
19
20 if(!array_key_exists("ADMIN_SECTION", $arFields))
21 $arFields["ADMIN_SECTION"] = "Y";
22
23 if(!array_key_exists("ACTIVE", $arFields))
24 $arFields["ACTIVE"] = "Y";
25
26 if(!array_key_exists("SORT", $arFields))
27 $arFields["SORT"] = 500;
28
29 $ID = $DB->Add("b_sec_iprule", $arFields);
30
31 if($ID > 0)
32 {
33 if(array_key_exists("INCL_MASKS", $arFields))
34 {
35 if(array_key_exists("EXCL_MASKS", $arFields))
36 $this->UpdateRuleMasks($ID, $arFields["INCL_MASKS"], $arFields["EXCL_MASKS"]);
37 else
38 $this->UpdateRuleMasks($ID, $arFields["INCL_MASKS"], false);
39 }
40 else
41 {
42 if(array_key_exists("EXCL_MASKS", $arFields))
43 $this->UpdateRuleMasks($ID, false, $arFields["EXCL_MASKS"]);
44 }
45
46 if(array_key_exists("INCL_IPS", $arFields))
47 {
48 if(array_key_exists("EXCL_IPS", $arFields))
49 $this->UpdateRuleIPs($ID, $arFields["INCL_IPS"], $arFields["EXCL_IPS"]);
50 else
51 $this->UpdateRuleIPs($ID, $arFields["INCL_IPS"], false);
52 }
53 else
54 {
55 if(array_key_exists("EXCL_IPS", $arFields))
56 $this->UpdateRuleIPs($ID, false, $arFields["EXCL_IPS"]);
57 }
58 }
59
60 COption::RemoveOption("security", "iprules_count");
62 if(CACHED_b_sec_iprule !== false)
63 $CACHE_MANAGER->CleanDir("b_sec_iprule");
64
65 return $ID;
66 }
67
68 public static function Delete($ID)
69 {
70 global $DB, $CACHE_MANAGER;
71 $ID = intval($ID);
72
73 $DB->StartTransaction();
74
75
76 $res = $DB->Query("DELETE FROM b_sec_iprule_incl_mask WHERE IPRULE_ID = ".$ID);
77
78 if($res)
79 $res = $DB->Query("DELETE FROM b_sec_iprule_excl_mask WHERE IPRULE_ID = ".$ID);
80
81 if($res)
82 $res = $DB->Query("DELETE FROM b_sec_iprule_incl_ip WHERE IPRULE_ID = ".$ID);
83
84 if($res)
85 $res = $DB->Query("DELETE FROM b_sec_iprule_excl_ip WHERE IPRULE_ID = ".$ID);
86
87 if($res)
88 $res = $DB->Query("DELETE FROM b_sec_iprule WHERE ID = ".$ID);
89
90 if($res)
91 $DB->Commit();
92 else
93 $DB->Rollback();
94
95 COption::RemoveOption("security", "iprules_count");
97 if(CACHED_b_sec_iprule !== false)
98 $CACHE_MANAGER->CleanDir("b_sec_iprule");
99
100 return $res;
101 }
102
103 public function Update($ID, $arFields)
104 {
105 global $DB, $CACHE_MANAGER;
106 $ID = intval($ID);
107
108 if($ID <= 0)
109 return false;
110
111 if(!$this->CheckFields($arFields, $ID))
112 return false;
113
114 $strUpdate = $DB->PrepareUpdate("b_sec_iprule", $arFields);
115 if($strUpdate <> '')
116 {
117 $strSql = "
118 UPDATE b_sec_iprule SET
119 ".$strUpdate."
120 WHERE ID = ".$ID."
121 ";
122 if(!$DB->Query($strSql))
123 return false;
124 }
125
126 if(array_key_exists("INCL_MASKS", $arFields))
127 {
128 if(array_key_exists("EXCL_MASKS", $arFields))
129 $this->UpdateRuleMasks($ID, $arFields["INCL_MASKS"], $arFields["EXCL_MASKS"]);
130 else
131 $this->UpdateRuleMasks($ID, $arFields["INCL_MASKS"], false);
132 }
133 else
134 {
135 if(array_key_exists("EXCL_MASKS", $arFields))
136 $this->UpdateRuleMasks($ID, false, $arFields["EXCL_MASKS"]);
137 }
138
139 if(array_key_exists("INCL_IPS", $arFields))
140 {
141 if(array_key_exists("EXCL_IPS", $arFields))
142 $this->UpdateRuleIPs($ID, $arFields["INCL_IPS"], $arFields["EXCL_IPS"]);
143 else
144 $this->UpdateRuleIPs($ID, $arFields["INCL_IPS"], false);
145 }
146 else
147 {
148 if(array_key_exists("EXCL_IPS", $arFields))
149 $this->UpdateRuleIPs($ID, false, $arFields["EXCL_IPS"]);
150 }
151
152 COption::RemoveOption("security", "iprules_count");
154 if(CACHED_b_sec_iprule !== false)
155 $CACHE_MANAGER->CleanDir("b_sec_iprule");
156
157 return true;
158 }
159
160 public static function UpdateRuleMasks($IPRULE_ID, $arInclMasks = false, $arExclMasks = false)
161 {
162 global $DB, $CACHE_MANAGER;
163 $IPRULE_ID = intval($IPRULE_ID);
164 if(!$IPRULE_ID)
165 return false;
166
167 $arLikeSearch = array("?", "*", ".");
168 $arLikeReplace = array("_", "%", "\\.");
169 $arPregSearch = array("\\", ".", "?", "*", "'");
170 $arPregReplace = array("/", "\\.", ".", ".*?", "\\'");
171
172 if(is_array($arInclMasks))
173 {
174 $res = $DB->Query("DELETE FROM b_sec_iprule_incl_mask WHERE IPRULE_ID = ".$IPRULE_ID);
175 if($res)
176 {
177
178 $added = array();
179 $i = 10;
180 foreach($arInclMasks as $mask)
181 {
182 $mask = trim($mask);
183 if($mask && !array_key_exists($mask, $added))
184 {
185 $arMask = array(
186 "ID" => 1,
187 "IPRULE_ID" => $IPRULE_ID,
188 "RULE_MASK" => $mask,
189 "SORT" => $i,
190 "LIKE_MASK" => str_replace($arLikeSearch, $arLikeReplace, $mask),
191 "PREG_MASK" => str_replace($arPregSearch, $arPregReplace, $mask),
192 );
193 $DB->Add("b_sec_iprule_incl_mask", $arMask);
194 $i += 10;
195 $added[$mask] = true;
196 }
197 }
198
199 if(CACHED_b_sec_iprule !== false)
200 $CACHE_MANAGER->CleanDir("b_sec_iprule");
201 }
202 }
203
204 if(is_array($arExclMasks))
205 {
206 $res = $DB->Query("DELETE FROM b_sec_iprule_excl_mask WHERE IPRULE_ID = ".$IPRULE_ID);
207 if($res)
208 {
209
210 $added = array();
211 $i = 10;
212 foreach($arExclMasks as $mask)
213 {
214 $mask = trim($mask);
215 if($mask && !array_key_exists($mask, $added))
216 {
217 $arMask = array(
218 "ID" => 1,
219 "IPRULE_ID" => $IPRULE_ID,
220 "RULE_MASK" => $mask,
221 "SORT" => $i,
222 "LIKE_MASK" => str_replace($arLikeSearch, $arLikeReplace, $mask),
223 "PREG_MASK" => str_replace($arPregSearch, $arPregReplace, $mask),
224 );
225 $DB->Add("b_sec_iprule_excl_mask", $arMask);
226 $i += 10;
227 $added[$mask] = true;
228 }
229 }
230
231 if(CACHED_b_sec_iprule !== false)
232 $CACHE_MANAGER->CleanDir("b_sec_iprule");
233 }
234 }
235
236 return true;
237 }
238
239 function UpdateRuleIPs($IPRULE_ID, $arInclIPs=false, $arExclIPs=false)
240 {
241 global $DB, $CACHE_MANAGER;
242 $IPRULE_ID = intval($IPRULE_ID);
243 if(!$IPRULE_ID)
244 return false;
245
246 if(is_array($arInclIPs))
247 {
248 $res = $DB->Query("DELETE FROM b_sec_iprule_incl_ip WHERE IPRULE_ID = ".$IPRULE_ID);
249 if($res)
250 {
251 $added = array();
252 $i = 10;
253 foreach($arInclIPs as $ip)
254 {
255 $ip = preg_replace("/[\\s]/u", "", $ip);
256 if($ip && !array_key_exists($ip, $added))
257 {
258 $ar = explode("-", $ip);
259 $ip1 = self::ip2number($ar[0]);
260 $ip2 = isset($ar[1]) ? self::ip2number($ar[1]) : 0;
261 if($ip2 <= 0)
262 $ip2 = $ip1;
263 $arIP = array(
264 "ID" => 1,
265 "IPRULE_ID" => $IPRULE_ID,
266 "RULE_IP" => $ip,
267 "SORT" => $i,
268 "~IP_START" => $ip1,
269 "~IP_END" => $ip2,
270 );
271 $DB->Add("b_sec_iprule_incl_ip", $arIP);
272 $i += 10;
273 $added[$ip] = true;
274 }
275 }
276
277 if(CACHED_b_sec_iprule !== false)
278 $CACHE_MANAGER->CleanDir("b_sec_iprule");
279
280 }
281 }
282
283 if(is_array($arExclIPs))
284 {
285 $res = $DB->Query("DELETE FROM b_sec_iprule_excl_ip WHERE IPRULE_ID = ".$IPRULE_ID);
286 if($res)
287 {
288 $added = array();
289 $i = 10;
290 foreach($arExclIPs as $ip)
291 {
292 $ip = preg_replace("/[\\s]/u", "", $ip);
293 if($ip && !array_key_exists($ip, $added))
294 {
295 $ar = explode("-", $ip);
296 $ip1 = self::ip2number($ar[0]);
297 $ip2 = isset($ar[1]) ? self::ip2number($ar[1]) : 0;
298 if($ip2 <= 0)
299 $ip2 = $ip1;
300 $arIP = array(
301 "ID" => 1,
302 "IPRULE_ID" => $IPRULE_ID,
303 "RULE_IP" => $ip,
304 "SORT" => $i,
305 "~IP_START" => $ip1,
306 "~IP_END" => $ip2,
307 );
308 $DB->Add("b_sec_iprule_excl_ip", $arIP);
309 $i += 10;
310 $added[$ip] = true;
311 }
312 }
313
314 if(CACHED_b_sec_iprule !== false)
315 $CACHE_MANAGER->CleanDir("b_sec_iprule");
316
317 }
318 }
319
320 return true;
321 }
322
323 protected static function ip2number($ip)
324 {
325 $ip = trim($ip);
326 if($ip <> '')
327 $res = doubleval(sprintf("%u", ip2long(trim($ip))));
328 else
329 $res = 0;
330 return $res;
331 }
332
333 function CheckIP($arInclIPs=false, $arExclIPs=false)
334 {
335 global $APPLICATION;
336
337 $idFound = null;
338
339 $ip2check = self::ip2number($_SERVER["REMOTE_ADDR"]);
340 if($ip2check > 0 && is_array($arInclIPs))
341 {
342 foreach($arInclIPs as $id => $ip)
343 {
344 $ip = preg_replace("/[\\s]/u", "", $ip);
345 if($ip)
346 {
347 $ar = explode("-", $ip);
348 $ip1 = self::ip2number($ar[0]);
349 $ip2 = isset($ar[1]) ? self::ip2number($ar[1]) : 0;
350 if($ip2 <= 0)
351 $ip2 = $ip1;
352 if($ip2check >= $ip1 && $ip2check <= $ip2)
353 {
354 $idFound = $id;
355 break;
356 }
357 }
358 }
359 }
360
361 if($idFound !== null && $ip2check > 0 && is_array($arExclIPs))
362 {
363 foreach($arExclIPs as $id => $ip)
364 {
365 $ip = preg_replace("/[\\s]/u", "", $ip);
366 if($ip)
367 {
368 $ar = explode("-", $ip);
369 $ip1 = self::ip2number($ar[0]);
370 $ip2 = isset($ar[1]) ? self::ip2number($ar[1]) : 0;
371 if($ip2 <= 0)
372 $ip2 = $ip1;
373 if($ip2check >= $ip1 && $ip2check <= $ip2)
374 {
375 $idFound = null;
376 break;
377 }
378 }
379 }
380 }
381
382 if($idFound !== null)
383 {
384 if(COption::GetOptionString("security", "ipcheck_allow_self_block")==="Y")
385 $text = GetMessage("SECURITY_IPRULE_ERROR_SELF_BLOCK", array("#IP#" => htmlspecialcharsEx($_SERVER["REMOTE_ADDR"])));
386 else
387 $text = GetMessage("SECURITY_IPRULE_ERROR_SELF_BLOCK_2", array("#IP#" => htmlspecialcharsEx($_SERVER["REMOTE_ADDR"])));
388
389 $e = new CAdminException(array(
390 array(
391 "id"=>"IPS[".htmlspecialcharsEx($idFound)."]",
392 "text"=>$text,
393 ),
394 ));
395 $APPLICATION->ThrowException($e);
396 $this->LAST_ERROR = $e->GetString();
397 return true;
398 }
399 else
400 {
401 $this->LAST_ERROR = "";
402 return false;
403 }
404 }
405
406 public function CheckFields(&$arFields, $ID)
407 {
408 global $APPLICATION;
409
410 $this->LAST_ERROR = "";
411 $aMsg = array();
412
413 if(array_key_exists("RULE_TYPE", $arFields))
414 {
415 if($arFields["RULE_TYPE"] !== "A")
416 $arFields["RULE_TYPE"] = "M";
417
418 }
419
420 if(array_key_exists("SORT", $arFields))
421 {
422 if(intval($arFields["SORT"]) <= 0)
423 $arFields["SORT"] = 500;
424 }
425
426 if(array_key_exists("NAME", $arFields))
427 {
428 $arFields["NAME"] = trim($arFields["NAME"]);
429 }
430
431 if(array_key_exists("ACTIVE_FROM", $arFields))
432 {
433 $arFields["ACTIVE_FROM_TIMESTAMP"] = MakeTimeStamp($arFields["ACTIVE_FROM"], CSite::GetDateFormat());
434 }
435
436 if(array_key_exists("ACTIVE_TO", $arFields))
437 {
438 $arFields["ACTIVE_TO_TIMESTAMP"] = MakeTimeStamp($arFields["ACTIVE_TO"], CSite::GetDateFormat());
439 }
440
441 if(array_key_exists("ACTIVE", $arFields))
442 {
443 $arFields["ACTIVE"] = $arFields["ACTIVE"] === "Y"? "Y": "N";
444 }
445
446 if(array_key_exists("ADMIN_SECTION", $arFields))
447 {
448 $arFields["ADMIN_SECTION"] = $arFields["ADMIN_SECTION"] === "Y"? "Y": "N";
449 }
450
451 if(array_key_exists("INCL_IPS", $arFields) && is_array($arFields["INCL_IPS"]))
452 {
453 foreach($arFields["INCL_IPS"] as $id => $ip)
454 {
455 $ip = preg_replace("/[\\s]/u", "", $ip);
456 if($ip)
457 {
458 $ar = explode("-", $ip);
459 $ip1 = self::ip2number($ar[0]);
460
461 if($ip1 <= 0)
462 {
463 $aMsg[] = array(
464 "id"=>"INCL_IPS[".htmlspecialcharsEx($id)."]",
465 "text"=>GetMessage("SECURITY_IPRULE_ERROR_WONG_IP", array(
466 "#IP#" => htmlspecialcharsEx($ar[0]),
467 )),
468 );
469 }
470
471 if(count($ar) > 1)
472 {
473 $ip2 = self::ip2number($ar[1]);
474 if($ip2 <= 0)
475 {
476 $aMsg[] = array(
477 "id"=>"INCL_IPS[".htmlspecialcharsEx($id)."]",
478 "text"=>GetMessage("SECURITY_IPRULE_ERROR_WONG_IP", array(
479 "#IP#" => htmlspecialcharsEx($ar[1]),
480 )),
481 );
482 }
483 elseif($ip2 < $ip1)
484 {
485 $aMsg[] = array(
486 "id"=>"INCL_IPS[".htmlspecialcharsEx($id)."]",
487 "text"=>GetMessage("SECURITY_IPRULE_ERROR_WONG_IP_RANGE", array(
488 "#END_IP#" => htmlspecialcharsEx($ar[1]),
489 "#START_IP#" => htmlspecialcharsEx($ar[0]),
490 )),
491 );
492 }
493
494 break;
495 }
496 }
497 }
498 }
499
500 if(array_key_exists("EXCL_IPS", $arFields) && is_array($arFields["EXCL_IPS"]))
501 {
502 foreach($arFields["EXCL_IPS"] as $id => $ip)
503 {
504 $ip = preg_replace("/[\\s]/u", "", $ip);
505 if($ip)
506 {
507 $ar = explode("-", $ip);
508 $ip1 = self::ip2number($ar[0]);
509
510 if($ip1 <= 0)
511 {
512 $aMsg[] = array(
513 "id"=>"EXCL_IPS[".htmlspecialcharsEx($id)."]",
514 "text"=>GetMessage("SECURITY_IPRULE_ERROR_WONG_IP", array(
515 "#IP#" => htmlspecialcharsEx($ar[0]),
516 )),
517 );
518 }
519
520 if(count($ar) > 1)
521 {
522 $ip2 = self::ip2number($ar[1]);
523 if($ip2 <= 0)
524 {
525 $aMsg[] = array(
526 "id"=>"EXCL_IPS[".htmlspecialcharsEx($id)."]",
527 "text"=>GetMessage("SECURITY_IPRULE_ERROR_WONG_IP", array(
528 "#IP#" => htmlspecialcharsEx($ar[1]),
529 )),
530 );
531 }
532 elseif($ip2 < $ip1)
533 {
534 $aMsg[] = array(
535 "id"=>"EXCL_IPS[".htmlspecialcharsEx($id)."]",
536 "text"=>GetMessage("SECURITY_IPRULE_ERROR_WONG_IP_RANGE", array(
537 "#END_IP#" => htmlspecialcharsEx($ar[1]),
538 "#START_IP#" => htmlspecialcharsEx($ar[0]),
539 )),
540 );
541 }
542 break;
543 }
544 }
545 }
546 }
547
548 if(!empty($aMsg))
549 {
550 $e = new CAdminException($aMsg);
551 $APPLICATION->ThrowException($e);
552 $this->LAST_ERROR = $e->GetString();
553 return false;
554 }
555 return true;
556 }
557
558 public static function GetRuleInclMasks($IPRULE_ID)
559 {
560 global $DB;
561 $IPRULE_ID = intval($IPRULE_ID);
562 $res = array();
563 if($IPRULE_ID)
564 {
565 $rs = $DB->Query("SELECT RULE_MASK FROM b_sec_iprule_incl_mask WHERE IPRULE_ID = ".$IPRULE_ID." ORDER BY SORT");
566 while($ar = $rs->Fetch())
567 $res[] = $ar["RULE_MASK"];
568 }
569 return $res;
570 }
571
572 public static function DeleteRuleExclFiles($files)
573 {
574 global $DB;
575 if (!is_array($files))
576 $files = array($files);
577
578 foreach ($files as $file)
579 $DB->Query("DELETE FROM b_sec_iprule_excl_mask WHERE RULE_MASK = '".$DB->ForSQL($file)."'");
580 }
581
582 public static function AddRuleExclFiles($files)
583 {
584 if (empty($files))
585 return;
586
587 $exclToUpdate = array();
588 if (!is_array($files))
589 $files = array($files);
590
591 foreach ($files as $file)
592 {
593 $rsIPRule = CSecurityIPRule::GetList(array("ID"), array(
594 "PATH" => $file,
595 "ACTIVE" => "Y",
596 ), array("ID" => "ASC"));
597
598 $masks = array();
599 while ($arIPRule = $rsIPRule->Fetch())
600 {
601
602 if (array_key_exists($arIPRule["ID"], $exclToUpdate))
603 $masks = array_merge($exclToUpdate[$arIPRule["ID"]],$masks);
604 else
605 $masks = array($file);
606
607 $exclToUpdate[$arIPRule["ID"]]= $masks;
608 }
609 }
610
611 foreach ($exclToUpdate as $rule_id => $excl_mask)
612 {
613 $masks=CSecurityIPRule::GetRuleExclMasks($rule_id);
614 $masks = array_unique(array_merge($masks,$excl_mask));
615 CSecurityIPRule::UpdateRuleMasks($rule_id,false,$masks);
616 }
617 }
618
619 public static function GetRuleExclFiles($files)
620 {
621 global $DB;
622 $res=array();
623 if (!is_array($files))
624 $files = array($files);
625
626 if (!empty($files))
627 {
628 $files=array_map(array($DB,'ForSQL'),$files);
629 $masks=implode("','", $files);
630 $rs = $DB->Query("SELECT IPRULE_ID FROM b_sec_iprule_excl_mask WHERE RULE_MASK IN ('".$masks."')");
631 while($ar = $rs->Fetch())
632 $res[] = $ar["IPRULE_ID"];
633 }
634 return $res;
635 }
636
637 public static function GetRuleExclMasks($IPRULE_ID)
638 {
639 global $DB;
640 $IPRULE_ID = intval($IPRULE_ID);
641 $res = array();
642 if($IPRULE_ID)
643 {
644 $rs = $DB->Query("SELECT RULE_MASK FROM b_sec_iprule_excl_mask WHERE IPRULE_ID = ".$IPRULE_ID." ORDER BY SORT");
645 while($ar = $rs->Fetch())
646 $res[] = $ar["RULE_MASK"];
647 }
648 return $res;
649 }
650
651 public static function GetRuleInclIPs($IPRULE_ID)
652 {
653 global $DB;
654 $IPRULE_ID = intval($IPRULE_ID);
655 $res = array();
656 if($IPRULE_ID)
657 {
658 $rs = $DB->Query("SELECT RULE_IP FROM b_sec_iprule_incl_ip WHERE IPRULE_ID = ".$IPRULE_ID." ORDER BY SORT");
659 while($ar = $rs->Fetch())
660 $res[] = $ar["RULE_IP"];
661 }
662 return $res;
663 }
664
665 public static function GetRuleExclIPs($IPRULE_ID)
666 {
667 global $DB;
668 $IPRULE_ID = intval($IPRULE_ID);
669 $res = array();
670 if($IPRULE_ID)
671 {
672 $rs = $DB->Query("SELECT RULE_IP FROM b_sec_iprule_excl_ip WHERE IPRULE_ID = ".$IPRULE_ID." ORDER BY SORT");
673 while($ar = $rs->Fetch())
674 $res[] = $ar["RULE_IP"];
675 }
676 return $res;
677 }
678
679 public static function GetList($arSelect, $arFilter, $arOrder)
680 {
681 global $DB;
682
683 if(!is_array($arSelect))
684 $arSelect = array();
685 if(count($arSelect) < 1)
686 $arSelect = array(
687 "ID",
688 "RULE_TYPE",
689 "ACTIVE",
690 "ADMIN_SECTION",
691 "SITE_ID",
692 "SORT",
693 "NAME",
694 "ACTIVE_FROM",
695 "ACTIVE_TO",
696 );
697
698 if(!is_array($arOrder))
699 $arOrder = array();
700
701 $arQueryOrder = array();
702 foreach($arOrder as $strColumn => $strDirection)
703 {
704 $strColumn = mb_strtoupper($strColumn);
705 $strDirection = mb_strtoupper($strDirection) == "ASC"? "ASC": "DESC";
706 switch($strColumn)
707 {
708 case "ID":
709 case "RULE_TYPE":
710 case "ACTIVE":
711 case "ADMIN_SECTION":
712 case "SITE_ID":
713 case "SORT":
714 case "NAME":
715 $arSelect[] = $strColumn;
716 $arQueryOrder[$strColumn] = $strColumn." ".$strDirection;
717 break;
718 case "ACTIVE_FROM":
719 case "ACTIVE_TO":
720 $arSelect[] = $strColumn;
721 $arSelect[] = $strColumn."_TIMESTAMP";
722 $arQueryOrder[$strColumn] = $strColumn."_TIMESTAMP ".$strDirection;
723 break;
724 }
725 }
726
727 $arQuerySelect = array();
728 foreach($arSelect as $strColumn)
729 {
730 $strColumn = mb_strtoupper($strColumn);
731 switch($strColumn)
732 {
733 case "ID":
734 case "RULE_TYPE":
735 case "ACTIVE":
736 case "ADMIN_SECTION":
737 case "SITE_ID":
738 case "SORT":
739 case "NAME":
740 case "ACTIVE_FROM_TIMESTAMP":
741 case "ACTIVE_TO_TIMESTAMP":
742 $arQuerySelect[$strColumn] = "r.".$strColumn;
743 break;
744 case "ACTIVE_FROM":
745 case "ACTIVE_TO":
746 $arQuerySelect[$strColumn] = $DB->DateToCharFunction("r.".$strColumn, "FULL")." AS ".$strColumn;
747 break;
748 }
749 }
750 if(count($arQuerySelect) < 1)
751 $arQuerySelect = array("ID"=>"r.ID");
752
753 $obQueryWhere = new CSQLWhere;
755 "ID" => array(
756 "TABLE_ALIAS" => "r",
757 "FIELD_NAME" => "r.ID",
758 "FIELD_TYPE" => "int",
759 "JOIN" => false,
760 ),
761 "RULE_TYPE" => array(
762 "TABLE_ALIAS" => "r",
763 "FIELD_NAME" => "r.RULE_TYPE",
764 "FIELD_TYPE" => "string",
765 "JOIN" => false,
766 ),
767 "ACTIVE" => array(
768 "TABLE_ALIAS" => "r",
769 "FIELD_NAME" => "r.ACTIVE",
770 "FIELD_TYPE" => "string",
771 "JOIN" => false,
772 ),
773 "ADMIN_SECTION" => array(
774 "TABLE_ALIAS" => "r",
775 "FIELD_NAME" => "r.ADMIN_SECTION",
776 "FIELD_TYPE" => "string",
777 "JOIN" => false,
778 ),
779 "SITE_ID" => array(
780 "TABLE_ALIAS" => "r",
781 "FIELD_NAME" => "r.SITE_ID",
782 "FIELD_TYPE" => "string",
783 "JOIN" => false,
784 ),
785 "SORT" => array(
786 "TABLE_ALIAS" => "r",
787 "FIELD_NAME" => "r.SORT",
788 "FIELD_TYPE" => "int",
789 "JOIN" => false,
790 ),
791 "NAME" => array(
792 "TABLE_ALIAS" => "r",
793 "FIELD_NAME" => "r.NAME",
794 "FIELD_TYPE" => "string",
795 "JOIN" => false,
796 ),
797 "ACTIVE_FROM" => array(
798 "TABLE_ALIAS" => "r",
799 "FIELD_NAME" => "r.ACTIVE_FROM",
800 "FIELD_TYPE" => "datetime",
801 "JOIN" => false,
802 ),
803 "ACTIVE_TO" => array(
804 "TABLE_ALIAS" => "r",
805 "FIELD_NAME" => "r.ACTIVE_TO",
806 "FIELD_TYPE" => "datetime",
807 "JOIN" => false,
808 ),
809 );
810 $obQueryWhere->SetFields($arFields);
811
812 if(!is_array($arFilter))
813 $arFilter = array();
814 $strQueryWhere = $obQueryWhere->GetQuery($arFilter);
815
816 $bDistinct = $obQueryWhere->bDistinctReqired;
817
818 $strMaskJoin = "";
819 if(array_key_exists("PATH", $arFilter))
820 {
821 $path = trim($arFilter["PATH"]);
822 if($path)
823 {
824 $bDistinct = true;
825 $strMaskJoin = "
826 INNER JOIN b_sec_iprule_incl_mask im on im.IPRULE_ID = r.ID
827 LEFT JOIN b_sec_iprule_excl_mask em on em.IPRULE_ID = r.ID AND '".$DB->ForSQL($path)."' like em.LIKE_MASK
828 ";
829 $strMaskWhere = "('".$DB->ForSQL($path)."' like im.LIKE_MASK AND em.IPRULE_ID is null)";
830
831 if($strQueryWhere)
832 $strQueryWhere = "(".$strQueryWhere.") AND ".$strMaskWhere;
833 else
834 $strQueryWhere = $strMaskWhere;
835 }
836 }
837
838 $strIPJoin = "";
839 if(array_key_exists("IP", $arFilter))
840 {
841 $ip = self::ip2number($arFilter["IP"]);
842 if($ip > 0)
843 {
844 $bDistinct = true;
845 $strIPJoin = "
846 INNER JOIN b_sec_iprule_incl_ip ii on ii.IPRULE_ID = r.ID
847 LEFT JOIN b_sec_iprule_excl_ip ei on ei.IPRULE_ID = r.ID AND ".$ip." between ei.IP_START AND ei.IP_END
848 ";
849 $strIPWhere = "(".$ip." between ii.IP_START AND ii.IP_END AND ei.IPRULE_ID is null)";
850 if($strQueryWhere)
851 $strQueryWhere = "(".$strQueryWhere.") AND ".$strIPWhere;
852 else
853 $strQueryWhere = $strIPWhere;
854 }
855 }
856
857 $strSql = "
858 SELECT ".($bDistinct? "DISTINCT": "")."
859 ".implode(", ", $arQuerySelect)."
860 FROM
861 b_sec_iprule r
862 ".$strMaskJoin."
863 ".$strIPJoin."
864 ".$obQueryWhere->GetJoins()."
865 ";
866
867 if($strQueryWhere)
868 {
869 $strSql .= "
870 WHERE
871 ".$strQueryWhere."
872 ";
873 }
874
875 if(count($arQueryOrder) > 0)
876 {
877 $strSql .= "
878 ORDER BY
879 ".implode(", ", $arQueryOrder)."
880 ";
881 }
882
883 return $DB->Query($strSql);
884 }
885
886 public static function GetActiveCount()
887 {
888 $c = COption::GetOptionInt("security", "iprules_count", -1);
889 if($c < 0)
890 {
891 global $DB;
892 $rs = $DB->Query("SELECT count(*) CNT FROM b_sec_iprule WHERE ACTIVE='Y'");
893 $ar = $rs->Fetch();
894 COption::SetOptionInt("security", "iprules_count", $ar["CNT"]);
895 $c = COption::GetOptionInt("security", "iprules_count", -1);
896 }
897 return $c;
898 }
899
900 public static function IsActive()
901 {
902 if(isset(self::$bActive) && self::$bActive === true)
903 return true;
904
905 $bActive = false;
906 foreach(GetModuleEvents("main", "OnPageStart", true) as $event)
907 {
908 if(
909 isset($event["TO_MODULE_ID"]) && $event["TO_MODULE_ID"] == "security"
910 && isset($event["TO_CLASS"]) && $event["TO_CLASS"] == "CSecurityIPRule"
911 )
912 {
913 $bActive = true;
914 break;
915 }
916 }
917 return $bActive;
918 }
919
920 public static function SetActive($bActive = false, $end_time = 0)
921 {
922 if($bActive)
923 {
925 RegisterModuleDependences("main", "OnPageStart", "security", "CSecurityIPRule", "OnPageStart", "2");
926 }
927 else
928 {
930 UnRegisterModuleDependences("main", "OnPageStart", "security", "CSecurityIPRule", "OnPageStart");
931 }
932
933 self::$bActive = $bActive;
934 }
935
936 public static function CheckAntiFile($return_message = false)
937 {
938 $file = COption::GetOptionString("security", "ipcheck_disable_file", "");
939 $res = ($file <> '') && file_exists($_SERVER["DOCUMENT_ROOT"].$file) && is_file($_SERVER["DOCUMENT_ROOT"].$file);
940
941 if($return_message)
942 {
943 if($res)
944 return new CAdminMessage(GetMessage("SECURITY_IPRULE_IPCHECK_DISABLE_FILE_WARNING"));
945 else
946 return false;
947 }
948 else
949 {
950 return $res;
951 }
952 }
953
954 public static function OnPageStart($use_query = false)
955 {
956 //ToDo: good candidate for refactoring
957 global $DB, $CACHE_MANAGER;
958
959 if(
960 !CSecuritySystemInformation::isCliMode()
962 )
963 {
965 return;
966
967 $bMatch = false;
968
969 $uri = $_SERVER['REQUEST_URI'];
970 if (($pos = mb_strpos($uri, '?')) !== false)
971 $uri = mb_substr($uri, 0, $pos);
972
973 $uri = urldecode($uri);
974 $uri = preg_replace('#/+#', '/', $uri);
975 //Block any invalid uri
976 if (!static::isValidUri($uri))
977 include($_SERVER['DOCUMENT_ROOT'].'/bitrix/admin/security_403.php'); //die inside
978
979 //Normalize on Windows, because my. == my
980 if (CSecuritySystemInformation::isRunOnWin())
981 $uri = preg_replace('#(. )+[/\\\]+#', '/', $uri);
982
983 $ip2check = CSecurityIPRule::ip2number($_SERVER["REMOTE_ADDR"]);
984
985 if(!$use_query && CACHED_b_sec_iprule !== false)
986 {
987 $cache_id = "b_sec_iprule";
988 if($CACHE_MANAGER->Read(CACHED_b_sec_iprule, $cache_id, "b_sec_iprule"))
989 {
990 $arRules = $CACHE_MANAGER->Get($cache_id);
991 }
992 else
993 {
994 $arRules = array();
995
996 $rs = $DB->Query("
997 SELECT
998 r.ID,
999 r.ADMIN_SECTION,
1000 r.SITE_ID,
1001 r.ACTIVE_FROM_TIMESTAMP,
1002 r.ACTIVE_TO_TIMESTAMP
1003 FROM
1004 b_sec_iprule r
1005 WHERE
1006 r.ACTIVE='Y'
1007 AND (
1008 r.ACTIVE_TO IS NULL
1009 OR r.ACTIVE_TO >= ".$DB->CurrentTimeFunction()."
1010 )
1011 ");
1012 while($ar = $rs->Fetch())
1013 {
1014 $ar["ACTIVE_FROM_TIMESTAMP"] = intval($ar["ACTIVE_FROM_TIMESTAMP"]);
1015 $ar["ACTIVE_TO_TIMESTAMP"] = intval($ar["ACTIVE_TO_TIMESTAMP"]);
1016 $ar["INCL_MASKS"] = array();
1017 $ar["EXCL_MASKS"] = array();
1018 $ar["INCL_IPS"] = array();
1019 $ar["EXCL_IPS"] = array();
1020 $arRules[$ar["ID"]] = $ar;
1021 }
1022
1023 $rs = $DB->Query("
1024 SELECT
1025 im.IPRULE_ID,
1026 im.PREG_MASK
1027 FROM
1028 b_sec_iprule r
1029 INNER JOIN b_sec_iprule_incl_mask im on im.IPRULE_ID = r.ID
1030 WHERE
1031 r.ACTIVE='Y'
1032 AND (
1033 r.ACTIVE_TO IS NULL
1034 OR r.ACTIVE_TO >= ".$DB->CurrentTimeFunction()."
1035 )
1036 ");
1037 while($ar = $rs->Fetch())
1038 if(array_key_exists($ar["IPRULE_ID"], $arRules))
1039 $arRules[$ar["IPRULE_ID"]]["INCL_MASKS"][] = $ar["PREG_MASK"];
1040
1041 foreach($arRules as $ID => $ar)
1042 if(count($ar["INCL_MASKS"]) <= 0)
1043 unset($arRules[$ID]);
1044
1045 $rs = $DB->Query("
1046 SELECT
1047 em.IPRULE_ID,
1048 em.PREG_MASK
1049 FROM
1050 b_sec_iprule r
1051 INNER JOIN b_sec_iprule_excl_mask em on em.IPRULE_ID = r.ID
1052 WHERE
1053 r.ACTIVE='Y'
1054 AND (
1055 r.ACTIVE_TO IS NULL
1056 OR r.ACTIVE_TO >= ".$DB->CurrentTimeFunction()."
1057 )
1058 ");
1059 while($ar = $rs->Fetch())
1060 if(array_key_exists($ar["IPRULE_ID"], $arRules))
1061 $arRules[$ar["IPRULE_ID"]]["EXCL_MASKS"][] = $ar["PREG_MASK"];
1062
1063 $rs = $DB->Query("
1064 SELECT
1065 ii.IPRULE_ID,
1066 ii.IP_START,
1067 ii.IP_END
1068 FROM
1069 b_sec_iprule r
1070 INNER JOIN b_sec_iprule_incl_ip ii on ii.IPRULE_ID = r.ID
1071 WHERE
1072 r.ACTIVE='Y'
1073 AND (
1074 r.ACTIVE_TO IS NULL
1075 OR r.ACTIVE_TO >= ".$DB->CurrentTimeFunction()."
1076 )
1077 ");
1078 while($ar = $rs->Fetch())
1079 if(array_key_exists($ar["IPRULE_ID"], $arRules))
1080 $arRules[$ar["IPRULE_ID"]]["INCL_IPS"][] = array(
1081 doubleval($ar["IP_START"]),
1082 doubleval($ar["IP_END"]),
1083 );
1084
1085 foreach($arRules as $ID => $ar)
1086 if(count($ar["INCL_IPS"]) <= 0)
1087 unset($arRules[$ID]);
1088
1089 $rs = $DB->Query("
1090 SELECT
1091 ei.IPRULE_ID,
1092 ei.IP_START,
1093 ei.IP_END
1094 FROM
1095 b_sec_iprule r
1096 INNER JOIN b_sec_iprule_excl_ip ei on ei.IPRULE_ID = r.ID
1097 WHERE
1098 r.ACTIVE='Y'
1099 AND (
1100 r.ACTIVE_TO IS NULL
1101 OR r.ACTIVE_TO >= ".$DB->CurrentTimeFunction()."
1102 )
1103 ");
1104 while($ar = $rs->Fetch())
1105 if(array_key_exists($ar["IPRULE_ID"], $arRules))
1106 $arRules[$ar["IPRULE_ID"]]["EXCL_IPS"][] = array(
1107 doubleval($ar["IP_START"]),
1108 doubleval($ar["IP_END"]),
1109 );
1110
1111 $CACHE_MANAGER->Set($cache_id, $arRules);
1112 }
1113
1114 foreach($arRules as $arRule)
1115 {
1116 //Check if this rule is active
1117 if(
1118 ($arRule["ACTIVE_FROM_TIMESTAMP"] <= 0 || $arRule["ACTIVE_FROM_TIMESTAMP"] <= time())
1119 && ($arRule["ACTIVE_TO_TIMESTAMP"] <= 0 || $arRule["ACTIVE_TO_TIMESTAMP"] >= time())
1120 )
1121 {
1122 $bMatch = true;
1123 }
1124 else
1125 {
1126 $bMatch = false;
1127 }
1128
1129 //Check if site does match
1130 if($bMatch)
1131 {
1132 if(defined("ADMIN_SECTION") && ADMIN_SECTION===true)
1133 $bMatch = $arRule["ADMIN_SECTION"] == "Y";
1134 else
1135 $bMatch = (!$arRule["SITE_ID"] || $arRule["SITE_ID"] == SITE_ID);
1136 }
1137 else
1138 {
1139 continue;
1140 }
1141
1142 //Check if IP in blocked
1143 if($bMatch)
1144 {
1145 $bMatch = false;
1146 foreach($arRule["INCL_IPS"] as $arIP)
1147 {
1148 if($ip2check >= $arIP[0] && $ip2check <= $arIP[1])
1149 {
1150 $bMatch = true;
1151 break;
1152 }
1153 }
1154 //IP is in blocked range so check if it is excluded
1155 if($bMatch)
1156 {
1157 foreach($arRule["EXCL_IPS"] as $arIP)
1158 {
1159 if($ip2check >= $arIP[0] && $ip2check <= $arIP[1])
1160 {
1161 $bMatch = false;
1162 break;
1163 }
1164 }
1165 }
1166 }
1167 else
1168 {
1169 continue;
1170 }
1171
1172 //IP does match to blocking condition let's check path
1173 if($bMatch)
1174 {
1175 if (defined("ADMIN_SECTION") && ADMIN_SECTION === true &&
1176 (!defined('SELF_FOLDER_URL') || SELF_FOLDER_URL == '/bitrix/admin/'))
1177 {
1178 $bMatch = $arRule["ADMIN_SECTION"] == "Y";
1179 }
1180 else
1181 {
1182 $bMatch = false;
1183 foreach($arRule["INCL_MASKS"] as $mask)
1184 {
1185 if(preg_match("#^".$mask."$#", $uri))
1186 {
1187 $bMatch = true;
1188 break;
1189 }
1190 }
1191 }
1192 //Check path for exclusion
1193 if($bMatch)
1194 {
1195 foreach($arRule["EXCL_MASKS"] as $mask)
1196 {
1197 if(preg_match("#^".$mask."$#", $uri))
1198 {
1199 $bMatch = false;
1200 break;
1201 }
1202 }
1203 }
1204 }
1205 else
1206 {
1207 continue;
1208 }
1209
1210 //Found blocking rule
1211 if($bMatch)
1212 break;
1213 }
1214 }
1215 else
1216 {
1217 $strSql = "
1218 SELECT r.ID
1219 FROM
1220 b_sec_iprule r
1221 INNER JOIN b_sec_iprule_incl_mask im on im.IPRULE_ID = r.ID
1222 LEFT JOIN b_sec_iprule_excl_mask em on em.IPRULE_ID = r.ID AND '".$DB->ForSQL($uri)."' like em.LIKE_MASK
1223 INNER JOIN b_sec_iprule_incl_ip ii on ii.IPRULE_ID = r.ID
1224 LEFT JOIN b_sec_iprule_excl_ip ei on ei.IPRULE_ID = r.ID AND ".$ip2check." between ei.IP_START and ei.IP_END
1225 WHERE
1226 r.ACTIVE = 'Y'
1227 AND (r.ACTIVE_FROM IS NULL OR r.ACTIVE_FROM <= ".$DB->CurrentTimeFunction().")
1228 AND (r.ACTIVE_TO IS NULL OR r.ACTIVE_TO >= ".$DB->CurrentTimeFunction().")
1229 ".(defined("ADMIN_SECTION") && ADMIN_SECTION===true?
1230 "AND r.ADMIN_SECTION = 'Y'":
1231 "AND (r.SITE_ID IS NULL OR r.SITE_ID = '".$DB->ForSQL(SITE_ID)."')"
1232 )."
1233 AND '".$DB->ForSQL($uri)."' like im.LIKE_MASK
1234 AND em.IPRULE_ID is null
1235 AND ".$ip2check." between ii.IP_START and ii.IP_END
1236 AND ei.IPRULE_ID is null
1237 ";
1238
1239 $rs = $DB->Query($strSql);
1240
1241 if($arRule = $rs->Fetch())
1242 $bMatch = true;
1243 else
1244 $bMatch = false;
1245 }
1246
1247 if($bMatch)
1248 include($_SERVER["DOCUMENT_ROOT"]."/bitrix/admin/security_403.php");
1249
1250 }
1251 }
1252
1253 protected static function isValidUri($uri)
1254 {
1255 if (trim($uri) == '')
1256 return false;
1257
1258 if (mb_strpos($uri, "\0") !== false)
1259 return false;
1260
1261 if (mb_strpos($uri, '/./') !== false)
1262 return false;
1263
1264 if (mb_strpos($uri, '/') !== 0)
1265 return false;
1266
1268 return false;
1269
1270 return true;
1271 }
1272
1273 public static function CleanUpAgent()
1274 {
1275 $agentName = "CSecurityIPRule::CleanUpAgent();";
1276 $cleanupDays = 2;
1277 $activeTo = ConvertTimeStamp(time() - $cleanupDays*24*60*60, "FULL");
1278 if(!$activeTo)
1279 return $agentName;
1280
1282 array("ID"),
1283 array(
1284 "=RULE_TYPE" => "A",
1285 "<=ACTIVE_TO" => $activeTo,
1286 ),
1287 array("ID"=>"ASC")
1288 );
1289 while($ar = $rs->Fetch())
1290 {
1292 }
1293 return $agentName;
1294 }
1295}
$path
Определения access_edit.php:21
global $APPLICATION
Определения include.php:80
Определения admin_lib.php:2166
static isPathTraversalUri($url)
Определения http.php:612
Определения sqlwhere.php:1359
Определения iprule.php:6
static GetRuleExclIPs($IPRULE_ID)
Определения iprule.php:665
static GetRuleInclIPs($IPRULE_ID)
Определения iprule.php:651
static GetRuleInclMasks($IPRULE_ID)
Определения iprule.php:558
static GetActiveCount()
Определения iprule.php:886
static GetRuleExclMasks($IPRULE_ID)
Определения iprule.php:637
static SetActive($bActive=false, $end_time=0)
Определения iprule.php:920
static Delete($ID)
Определения iprule.php:68
CheckFields(&$arFields, $ID)
Определения iprule.php:406
static CheckAntiFile($return_message=false)
Определения iprule.php:936
static IsActive()
Определения iprule.php:900
static OnPageStart($use_query=false)
Определения iprule.php:954
static ip2number($ip)
Определения iprule.php:323
static DeleteRuleExclFiles($files)
Определения iprule.php:572
static GetList($arSelect, $arFilter, $arOrder)
Определения iprule.php:679
static $bActive
Определения iprule.php:7
static AddRuleExclFiles($files)
Определения iprule.php:582
$LAST_ERROR
Определения iprule.php:8
static GetRuleExclFiles($files)
Определения iprule.php:619
static CleanUpAgent()
Определения iprule.php:1273
CheckIP($arInclIPs=false, $arExclIPs=false)
Определения iprule.php:333
static UpdateRuleMasks($IPRULE_ID, $arInclMasks=false, $arExclMasks=false)
Определения iprule.php:160
Add($arFields)
Определения iprule.php:10
UpdateRuleIPs($IPRULE_ID, $arInclIPs=false, $arExclIPs=false)
Определения iprule.php:239
Update($ID, $arFields)
Определения iprule.php:103
static isValidUri($uri)
Определения iprule.php:1253
global $CACHE_MANAGER
Определения clear_component_cache.php:7
$arFields
Определения dblapprove.php:5
</td ></tr ></table ></td ></tr >< tr >< td class="bx-popup-label bx-width30"><?=GetMessage("PAGE_NEW_TAGS")?> array( $site)
Определения file_new.php:804
$res
Определения filter_act.php:7
if($ajaxMode) $ID
Определения get_user.php:27
$_SERVER["DOCUMENT_ROOT"]
Определения cron_frame.php:9
global $DB
Определения cron_frame.php:29
if(file_exists($_SERVER['DOCUMENT_ROOT'] . "/urlrewrite.php")) $uri
Определения urlrewrite.php:61
RegisterModuleDependences($FROM_MODULE_ID, $MESSAGE_ID, $TO_MODULE_ID, $TO_CLASS="", $TO_METHOD="", $SORT=100, $TO_PATH="", $TO_METHOD_ARG=[])
Определения tools.php:5295
UnRegisterModuleDependences($FROM_MODULE_ID, $MESSAGE_ID, $TO_MODULE_ID, $TO_CLASS="", $TO_METHOD="", $TO_PATH="", $TO_METHOD_ARG=[])
Определения tools.php:5289
htmlspecialcharsEx($str)
Определения tools.php:2685
GetModuleEvents($MODULE_ID, $MESSAGE_ID, $bReturnArray=false)
Определения tools.php:5177
IncludeModuleLangFile($filepath, $lang=false, $bReturnArray=false)
Определения tools.php:3778
GetMessage($name, $aReplace=null)
Определения tools.php:3397
MakeTimeStamp($datetime, $format=false)
Определения tools.php:538
$event
Определения prolog_after.php:141
if( $daysToExpire >=0 &&$daysToExpire< 60 elseif)( $daysToExpire< 0)
Определения prolog_main_admin.php:393
$ar
Определения options.php:199
$text
Определения template_pdf.php:79
const ADMIN_SECTION
Определения rss.php:2
$i
Определения factura.php:643
</p ></td >< td valign=top style='border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0cm 2.0pt 0cm 2.0pt;height:9.0pt'>< p class=Normal align=center style='margin:0cm;margin-bottom:.0001pt;text-align:center;line-height:normal'>< a name=ТекстовоеПоле54 ></a ><?=($taxRate > count( $arTaxList) > 0) ? $taxRate."%"
Определения waybill.php:936
const SITE_ID
Определения sonet_set_content_view.php:12
$rs
Определения action.php:82
$arFilter
Определения user_search.php:106