trunk/NP_Blacklist/blacklist/blacklist_lib.php

   1 <?php
   2 // Pivot-Blacklist version 0.4 (with Nucleus Support!)
   3 //
   4 // A simple (but effective) spam blocker based on the MT-Blacklist
   5 // available at: http://www.jayallen.org/comment_spam/
   6 //
   7 // Includes realtime blacklist check functions by
   8 // John Sinteur (http://weblog.sinteur.com/)
   9 //
  10 // This code (c) 2004 by Marco van Hylckama Vlieg
  11 //                    adapted and extended by Appie Verschoor
  12 // License is GPL, just like Pivot / Nucleus
  13 //
  14 // http://www.i-marco.nl/
  15 // marco@i-marco.nl
  16 //
  17 // http://xiffy.nl/
  18 // blacklist@xiffy.nl
  19
  20 define('__WEBLOG_ROOT', dirname(dirname(realpath(__FILE__))));
  21 define('__EXT', '/blacklist');
  22
  23 define('NP_BLACKLIST_CACHE_DIR', dirname(__FILE__).'/cache');
  24 define('NP_BLACKLIST_CACHE_LIFE', 86400);
  25 define('NP_BLACKLIST_CACHE_GC_INTERVAL', NP_BLACKLIST_CACHE_LIFE/8);
  26 define('NP_BLACKLIST_CACHE_GC_TIMESTAMP', 'gctime');
  27 define('NP_BLACKLIST_CACHE_GC_TIMESTAMP_LIFE', NP_BLACKLIST_CACHE_LIFE*3);
  28 //require_once(dirname(__FILE__).'/cache_file.php');
  29 require_once(dirname(__FILE__).'/cache_eaccelerator.php');
  30
  31 function pbl_getconfig()  {
  32     global $pbl_config;
  33         $pbl_config = array();
  34     $pbl_config['enabled']  = getPluginOption('enabled');
  35     $pbl_config['redirect'] = getPluginOption('redirect');
  36     //$pbl_config['update']   = getPluginOption('update');
  37     // convert 'yes' into '1'
  38     if ($pbl_config['enabled'] == 'yes') {$pbl_config['enabled'] = 1;}
  39         return $pbl_config;
  40 }
  41
  42 function pbl_checkforspam($text, $ipblock = false, $ipthreshold = 10, $logrule = true)  {
  43         // check whether a string contains spam
  44         // if it does, we return the rule that was matched first
  45         //$text = strtolower($text);
  46         $text = trim($text);
  47
  48     // first line of defense; block notorious spammers
  49     if ($ipblock) {
  50         if (pbl_blockIP()) {
  51             return "<b>IP Blocked</b>: ".serverVar('REMOTE_ADDR')." (".serverVar('REMOTE_HOST').")";
  52         }
  53     }
  54         // second line of defense: Check whether our poster is using
  55         // an open proxy
  56         //if(check_for_open_proxy())  {
  57     //    if ($ipblock == 'yes') {
  58     //        pbl_suspectIP ($ipthreshold);
  59     //    }
  60         //      return "open spam proxy";
  61         //}
  62
  63         // third line of defense: Check whether our poster promotes
  64         // known spamsite url's listed at www.surbl.org
  65         //if(check_for_surbl($text))    {
  66     //    if ($ipblock == 'yes') {
  67     //        pbl_suspectIP ($ipthreshold);
  68     //    }
  69         //      return("url(s) listed on www.surbl.org found");
  70         //}
  71
  72         // fourth line of defense: Run the MT-Blacklist check
  73         if( $text && file_exists(__WEBLOG_ROOT.__EXT."/settings/blacklist.pbl") ){
  74                 $handle = fopen(__WEBLOG_ROOT.__EXT."/settings/blacklist.pbl", "r");
  75                 while (!feof($handle)) {
  76                         $buffer = fgets($handle, 4096);
  77                         $splitbuffer = explode("####", $buffer);
  78                         $expression = $splitbuffer[0];
  79                         $explodedSplitBuffer = explode("/", $expression);
  80                         $expression = $explodedSplitBuffer[0];
  81                         if (strlen($expression) > 0)  {
  82                                 if(preg_match("/".trim($expression)."/im", $text))  {
  83                         if ($ipblock) {
  84                             pbl_suspectIP ($ipthreshold);
  85                         }
  86                         if ($logrule) {
  87                             pbl_logRule($expression);
  88                         }
  89                                         return $expression;
  90                                 }
  91                         }
  92                 }
  93                 fclose($handle);
  94         }
  95
  96         // fifth line of defense: run the personal blacklist entries
  97         if ($text &&file_exists(__WEBLOG_ROOT.__EXT.'/settings/personal_blacklist.pbl'))  {
  98                 $handle = fopen(__WEBLOG_ROOT.__EXT."/settings/personal_blacklist.pbl", "r");
  99                 while (!feof($handle)) {
 100                         $buffer = fgets($handle, 4096);
 101                         $splitbuffer = explode("####", $buffer);
 102                         $expression = $splitbuffer[0];
 103                     if (strlen($expression) > 0)  {
 104 //                  if(is_domain($expression))  {
 105 //                          $expression = str_replace(".","\.",$expression);
 106 //                      }
 107                             if(preg_match("/".trim($expression)."/im", $text))  {
 108                     if ($ipblock) {
 109                         pbl_suspectIP ($ipthreshold);
 110                     }
 111                     if ($logrule) {
 112                         pbl_logRule($expression);
 113                     }
 114                                         fclose($handle);
 115                                     return $expression;
 116                                 }
 117                         }
 118                 }
 119                 fclose($handle);
 120         }
 121
 122         if( $ipblock && $listedrbl = check_for_iprbl() )  {
 123                 pbl_suspectIP ($ipthreshold);
 124                 $ref = serverVar('HTTP_REFERER');
 125                 return "ip listed on {$listedrbl[0]} found (Referer:{$ref})";
 126         }
 127
 128         if( $text && ($listedrbl = check_for_domainrbl($text)) ) {
 129         if ($ipblock) {
 130             pbl_suspectIP ($ipthreshold);
 131         }
 132                 return("url(s) listed on {$listedrbl[0]} ({$listedrbl[1]}) found");
 133         }
 134
 135         // w00t! it's probably not spam!
 136         return "";
 137 }
 138
 139 function pbl_updateblacklist($url, $force=false)  {
 140 /*
 141         $listAge = time() - @filemtime(__WEBLOG_ROOT.__EXT.'/settings/blacklist.txt');
 142         // 86400 is 24hours (24*60*60)
 143         if ((($listAge > 86400 ) || (!file_exists(__WEBLOG_ROOT.__EXT.'/settings/blacklist.txt'))) || ($force))  {
 144                 $handle = @fopen($url, "r");
 145                 if ($handle) {
 146                     while (!feof($handle)) {
 147                             $buffer = fgets($handle, 4096);
 148                         $newBlackList .= $buffer;
 149                 }
 150                 fclose($handle);
 151         }
 152
 153                 // Check whether we really have the file
 154                 // if not we keep the old one because we don't want to break
 155                 // the engine with a bad or missing file
 156
 157                 if(strstr($newBlackList, "MT-Blacklist Master Copy"))  {
 158                         $newFile = fopen(__WEBLOG_ROOT.__EXT.'/settings/blacklist.txt', 'w');
 159                         fwrite($newFile, $newBlackList);
 160                         fclose($newFile);
 161                         pbl_processblacklist();
 162                 }
 163         }
 164 */
 165         return true;
 166 }
 167
 168 /*
 169 function pbl_processblacklist()  {
 170         // reformat the list to match our own format
 171         $listString = "";
 172         $handle = fopen(__WEBLOG_ROOT.__EXT."/settings/blacklist.txt", "r")  or die ("could not open: ".__WEBLOG_ROOT.__EXT."/settings/blacklist.txt");
 173         while (!feof($handle)) {
 174                 $buffer = fgets($handle, 4096);
 175                 $splitbuffer = explode("#", $buffer);
 176                 $expression = $splitbuffer[0];
 177                 $explodedSplitBuffer = explode("/", $expression);
 178                 $expression = $explodedSplitBuffer[0];
 179                 if (strlen($expression) > 0)  {
 180                         $listString .= preg_replace("/([^\\\|^_]|^)\./",'$1\\.',trim($expression));
 181                         if(strlen($splitbuffer[1]) > 5)  {
 182                                 $listString .= " #### ".trim($splitbuffer[1]);
 183                         }
 184                         $listString .= "\n";
 185                 }
 186         }
 187         fclose($handle);
 188         if(file_exists(__WEBLOG_ROOT.__EXT.'/settings/blacklist.pbl'))  {
 189         }
 190         $newhandle = fopen(__WEBLOG_ROOT.__EXT."/settings/blacklist.pbl", "w");
 191         fwrite($newhandle, $listString);
 192         fclose($newhandle);
 193 }
 194 */
 195
 196 function is_domain($stheDomain) {
 197         return ( (strpos($stheDomain,"\\")==0) && (strpos($stheDomain,"[")==0) && (strpos($stheDomain, "(")==0) );
 198 }
 199
 200
 201 function pbl_nucmenu() {
 202         global $manager;
 203         echo "<h2>Blacklist menu</h2>\n";
 204         echo "<ul>\n";
 205         echo "<li><a href=\"".htmlspecialchars($manager->addTicketToUrl(serverVar('PHP_SELF')."?action=blacklist"),ENT_QUOTES)."\"><img src=\"".dirname(serverVar('PHP_SELF'))."/icons/i_edit.gif\" /> Blacklist Editor</a></li>\n";
 206         echo "<li><a href=\"".htmlspecialchars($manager->addTicketToUrl(serverVar('PHP_SELF')."?action=log"),ENT_QUOTES)."\"><img src=\"".dirname(serverVar('PHP_SELF'))."/icons/i_log.gif\" /> Blacklist Log</a></li>\n";
 207         echo "<li><a href=\"".htmlspecialchars($manager->addTicketToUrl(dirname(serverVar('PHP_SELF'))."/../../index.php?action=pluginoptions&plugid=".getPlugid()),ENT_QUOTES)."\"><img src=\"".dirname(serverVar('PHP_SELF'))."/icons/i_prefs.gif\" /> Blacklist options</a></li>\n";
 208         echo "<li><a href=\"".htmlspecialchars($manager->addTicketToUrl(serverVar('PHP_SELF')."?action=testpage"),ENT_QUOTES)."\"><img src=\"".dirname(serverVar('PHP_SELF'))."/icons/i_edit.gif\" /> Test Blacklist</a></li>\n";
 209         echo "<li><a href=\"".htmlspecialchars($manager->addTicketToUrl(serverVar('PHP_SELF')."?action=showipblock"),ENT_QUOTES)."\"><img src=\"".dirname(serverVar('PHP_SELF'))."/icons/i_log.gif\" /> Show blocked ip addresses</a></li>\n";
 210         echo "<li><a href=\"".htmlspecialchars($manager->addTicketToUrl(serverVar('PHP_SELF')."?action=htaccess"),ENT_QUOTES)."\"><img src=\"".dirname(serverVar('PHP_SELF'))."/icons/i_edit.gif\" /> Generate .htaccess snippets</a></li>\n";
 211         echo "<li><a href=\"".htmlspecialchars($manager->addTicketToUrl(serverVar('PHP_SELF')."?action=spamsubmission"),ENT_QUOTES)."\"><img src=\"".dirname(serverVar('PHP_SELF'))."/icons/i_edit.gif\" /> Spam submission (Bulkfeeds)</a></li>\n";
 212         echo "</ul>\n";
 213 }
 214
 215 function pbl_blacklisteditor()  {
 216
 217         global $pblmessage, $manager;
 218
 219         if(strlen($pblmessage) > 0)  {
 220                 echo "<div class=\"pblmessage\">$pblmessage</div>\n";
 221         }
 222
 223 /*
 224         echo "<div id=\"jayallen\">\n";
 225         echo "<div class=\"pbldescription\">";
 226         if(!file_exists(__WEBLOG_ROOT.__EXT."/settings/blacklist.pbl"))  {
 227                 echo "You don't have a blacklist file yet!<br />";
 228                 echo "Click the button below to get the latest MT-Blacklist from Jay Allen's site.";
 229                 echo "</div>";
 230                 echo "<div class=\"pbform\">\n";
 231                 echo "<form action=\"index.php\" method=\"get\">\n";
 232                 echo "<input type=\"hidden\" name=\"page\" value=\"getblacklist\" />\n";
 233                 echo "<input type=\"submit\" value=\"Download and install\" />\n";
 234                 echo "</form>\n";
 235                 echo "</div>\n";
 236         }
 237         else  {
 238                 $updatetime = @filemtime(__WEBLOG_ROOT.__EXT."/settings/blacklist.txt");
 239                 echo "Your MT-Blacklist file was last updated at: ";
 240                 echo date("Y/m/d H:i:s", $updatetime)." <br />";
 241 #               echo date("F d Y H:i", $updatetime)." <br />";
 242                 echo "It's updated automatically every day but you can click below to update it immediately";
 243                 echo "</div>\n";
 244                 echo "<div class=\"pbform\" style=\"margin-left:10px;\">\n";
 245                 echo "<form action=\"".serverVar('PHP_SELF')."\" method=\"get\">\n";
 246                 echo "<input type=\"hidden\" name=\"page\" value=\"getblacklist\" />\n";
 247                 echo "<input type=\"submit\" value=\"Update now\" />\n";
 248                 echo "</form>\n";
 249                 echo "</div>\n";
 250         }
 251         echo "</div>\n";
 252 */
 253         echo "<div id=\"personal\">\n";
 254         echo "<div class=\"pbldescription\">";
 255         echo "You can add url's, regular expressions or words to your personal blacklist below.";
 256         echo "</div>\n";
 257         echo "<div class=\"pbform\">\n";
 258         echo "<form action=\"".serverVar('PHP_SELF')."\" method=\"get\">\n";
 259         $manager->addTicketHidden();
 260
 261         echo "<input type=\"hidden\" name=\"action\" value=\"addpersonal\" />\n";
 262         echo "<table class=\"pblform\">\n";
 263         echo "<tr>\n";
 264         echo "<td>expression</td>\n";
 265         echo "<td><input class=\"pbltextinput\" type=\"text\" name=\"expression\" /></td>\n";
 266         echo "</tr>\n";
 267         echo "<tr>";
 268         echo "  <td>comment</td>\n";
 269         echo "  <td><input class=\"pbltextinput\" type=\"text\" name=\"comment\" /></td>\n";
 270         echo "</tr>\n";
 271         echo "<tr>";
 272         echo "  <td>enable regular expressions ?</td>\n";
 273         echo "  <td><input class=\"pbltextinput\" type=\"checkbox\" name=\"enable_regex\" value=\"1\" /></td>\n";
 274         echo "</tr>\n";
 275         echo "<tr><td colspan=\"2\" style=\"border:none;\"><input type=\"submit\" value=\"Add\" /></td>\n";
 276         echo "</tr>\n";
 277         echo "</table>\n";
 278         echo "</form>\n";
 279         echo "</div>\n";
 280         echo "<div class=\"pbldescription\">Below is your personal blacklist</div>\n";
 281         if (file_exists(__WEBLOG_ROOT.__EXT.'/settings/personal_blacklist.pbl'))  {
 282                 $handle = fopen(__WEBLOG_ROOT.__EXT."/settings/personal_blacklist.pbl", "r");
 283                 echo "<table>\n";
 284                 echo "<tr>\n";
 285                 echo "<th>expression</th>\n";
 286                 echo "<th>comment</th>\n";
 287                 echo "<th>deletion</th>\n";
 288                 echo "</tr>\n";
 289                 $line = 0;
 290                 while (!feof($handle)) {
 291                         $buffer = fgets($handle, 4096);
 292                         $line++;
 293                         $configParam = explode("####", $buffer);
 294                         $key = $configParam[0];
 295                         $value = $configParam[1];
 296                         if(strlen($key) > 0)  {
 297                                 echo "<tr>\n";
 298                                 echo "<td>".htmlspecialchars($key,ENT_QUOTES)."</td>\n";
 299                                 echo "<td>".htmlspecialchars($value,ENT_QUOTES)."</td>\n";
 300                                 echo "<td>";
 301                                 echo "<a href=\"".htmlspecialchars($manager->addTicketToUrl(serverVar('PHP_SELF')."?action=deleteexpression&line=".$line),ENT_QUOTES)."\">delete</a>";
 302                                 echo "</td>";
 303                                 echo "</tr>\n";
 304                         }
 305                 }
 306                 echo "</table>\n";
 307         }
 308 }
 309 function pbl_deleteexpression()  {
 310         if(isset($_GET["line"]))  {
 311                 if( ! is_writable(__WEBLOG_ROOT.__EXT."/settings/personal_blacklist.pbl") ){
 312                         echo "Error: personal_blacklist.pbl is not writable. ";
 313                 }
 314                 $handle = fopen(__WEBLOG_ROOT.__EXT."/settings/personal_blacklist.pbl", "r");
 315                 $line = 0;
 316                 $newFile = "";
 317                 while (!feof($handle)) {
 318                         $buffer = fgets($handle, 4096);
 319                         $line++;
 320                         if($line != getVar("line"))  {
 321                                 $newFile .= $buffer;
 322                         }
 323                 }
 324                 fclose($handle);
 325                 $handle = fopen(__WEBLOG_ROOT.__EXT."/settings/personal_blacklist.pbl", "w");
 326                 fwrite($handle, $newFile);
 327                 fclose($handle);
 328         }
 329 }
 330 function pbl_addexpression($expression, $comment)  {
 331         if(strlen($expression) > 0)  {
 332                 if( ! is_writable(__WEBLOG_ROOT.__EXT."/settings/personal_blacklist.pbl") ){
 333                         echo "Error: personal_blacklist.pbl is not writable. ";
 334                 }
 335                 $handle = fopen(__WEBLOG_ROOT.__EXT."/settings/personal_blacklist.pbl", "a");
 336                 if(strlen($comment) > 0)  {
 337                                 $expression = $expression." #### ".$comment;
 338                 }
 339                 fwrite($handle, $expression."\n");
 340                 fclose($handle);
 341
 342         }
 343 }
 344
 345 $g_reOk = false;
 346 function _hdl($errno, $errstr) {
 347         global $g_reOk;
 348         $g_reOk = false;
 349 }
 350
 351 function pbl_checkregexp($re) {
 352         // Thanks to 'OneOfBorg' on Gathering Of Tweakers
 353         // http://gathering.tweakers.net/forum/user_profile/109376
 354         global $g_reOk;
 355         $g_reOk = true;
 356         set_error_handler("_hdl");
 357         preg_match("/".trim($re)."/im", "");
 358         restore_error_handler();
 359         return $g_reOk;
 360 }
 361
 362 function pbl_addpersonal()  {
 363         if(isset($_GET["expression"]))  {
 364                 $expression = getVar("expression");
 365                 if( getVar('comment') ){
 366                         $comment = getVar('comment');
 367                 }
 368                 if($expression != "")  {
 369                         $enable_regex = true;
 370                         if( ! getVar('enable_regex') ){
 371                                 $enable_regex = false;
 372                                 $expression = preg_quote($expression,'/');
 373                         }
 374
 375                         if($enable_regex && (!pbl_checkregexp($expression)))  {
 376                                 echo "<div class=\"pblmessage\">Your expression contained errors and couldn't be added: <b>".htmlspecialchars($expression,ENT_QUOTES)."</b></div>\n";
 377                         }
 378                         else  {
 379                                 $existTest = pbl_checkforspam($expression);
 380
 381                                 if (strlen($existTest) > 0)  {
 382                                         echo "<div class=\"pblmessage\">Expression <b>".htmlspecialchars($expression,ENT_QUOTES)."</b> already matched by the following rule in your system:<br/> <b>$existTest</b></div>\n";
 383                                 }
 384                                 else  {
 385                                         pbl_addexpression($expression,$comment);
 386                                         echo "<div class=\"pblmessage\">New entry added to your list: <b>".htmlspecialchars($expression,ENT_QUOTES)."</b></div>";
 387                                 }
 388                         }
 389                 }
 390                 else  {
 391                         echo "<div class=\"pblmessage\">There's no use in adding empty expressions.<b>".htmlspecialchars($expression,ENT_QUOTES)."</b></div>";
 392                 }
 393         }
 394 }
 395
 396 function pbl_logspammer($spam)  {
 397         $spam = trim($spam);
 398         if( ! is_writable(__WEBLOG_ROOT.__EXT."/settings/blacklist.log") ){
 399                 echo "Error: blacklist.log is not writable. ";
 400         }
 401         $handle = fopen(__WEBLOG_ROOT.__EXT."/settings/blacklist.log", "a");
 402         $lastVisit = cookieVar($CONF['CookiePrefix'] .'lastVisit');
 403         if( $lastVisit ){
 404                 //$lastVisit = $this->getCorrectTime($lastVisit);
 405                 $logline = date("Y/m/d H:i:s")." #### ".serverVar("REMOTE_ADDR")." #### ".$spam. ' [lastVisit ' .date("Y/m/d H:i:s", $lastVisit). "]\n";
 406         } else {
 407                 $logline = date("Y/m/d H:i:s")." #### ".serverVar("REMOTE_ADDR")." #### ".$spam."\n";
 408         }
 409         fwrite($handle, $logline);
 410         fclose($handle);
 411 }
 412
 413 function pbl_log($text)  {
 414         $text = trim($text);
 415         if( ! is_writable(__WEBLOG_ROOT.__EXT."/settings/blacklist.log") ){
 416                 echo "Error: blacklist.log is not writable. ";
 417         }
 418         $handle = fopen(__WEBLOG_ROOT.__EXT."/settings/blacklist.log", "a");
 419         $logline = date("Y/m/d H:i:s")." #### localhost #### ".$text."\n";
 420         fwrite($handle, $logline);
 421         fclose($handle);
 422 }
 423
 424
 425 function pbl_logtable()  {
 426         global $manager;
 427         if (file_exists(__WEBLOG_ROOT.__EXT."/settings/blacklist.log"))  {
 428                 $handle = fopen(__WEBLOG_ROOT.__EXT."/settings/blacklist.log", "r");
 429                 $logrows = "";
 430                 $numb=0;
 431                 while (!feof($handle)) {
 432                         $buffer = fgets($handle, 4096);
 433                         $thisline = explode("####", $buffer);
 434                         if($thisline[0] != "")  {
 435                                 $logrows .= "<tr>";
 436                                 $logrows .= "<td class=\"log$numb\" >$thisline[0]</td>";
 437                                 if( getPluginOption('SkipNameResolve') == 'no' )
 438                                         $logrows .= "<td class=\"log$numb\" >$thisline[1]<br />(" . gethostbyaddr( trim($thisline[1]) ) .  ")</td>";
 439                                 else
 440                                         $logrows .= "<td class=\"log$numb\" >$thisline[1]</td>";
 441                                 $logrows .= "<td class=\"log$numb\" >$thisline[2]</td>";
 442                                 $logrows .= "</tr>\n";
 443                         }
 444                         if($numb == 0)
 445                         $numb=1;
 446                         else
 447                         $numb=0;
 448                 }
 449                 fclose($handle);
 450                 echo "<table class=\"pbllog\">\n";
 451                 echo "<tr><th>Date/Time</th><th>IP</th><th>Rule Matched</th></tr>\n";
 452                 echo $logrows;
 453                 echo "</table>\n";
 454         }
 455         if(strlen($logrows) < 10)  {
 456                 echo "<div class=\"pbldescription\">Your log is empty.</div>\n";
 457         }
 458         echo "<div class=\"pbform\" style=\"margin-left:10px;\">\n";
 459         echo "<form action=\"".serverVar('PHP_SELF')."\" method=\"get\">\n";
 460         echo "<input type=\"hidden\" name=\"action\" value=\"resetlog\" />\n";
 461         echo "<input type=\"submit\" value=\"Reset log\" />\n";
 462         $manager->addTicketHidden();
 463
 464         echo "</form>\n";
 465         echo "</div>\n";
 466 }
 467
 468 function check_for_open_proxy() {
 469         $spammer_ip = serverVar('REMOTE_ADDR');
 470         list($a, $b, $c, $d) = split('.', $spammer_ip);
 471         if( gethostbyname("$d.$c.$b.$a.list.dsbl.org") != "$d.$c.$b.$a.list.dsbl.org") {
 472                 return true;
 473         }
 474         return false;
 475 }
 476
 477 function check_for_surbl ( $comment_text ) {
 478         /*  for a full explanation, see http://www.surbl.org
 479         summary: blocks comment if it contains an url that's on a known spammers list.
 480         */
 481         //get site names found in body of comment.
 482         $regex_url   = "/(www\.)([^\/\"<\s]*)/i";
 483         $mk_regex_array = array();
 484         preg_match_all($regex_url, $comment_text, $mk_regex_array);
 485
 486         for( $cnt=0; $cnt < count($mk_regex_array[2]); $cnt++ ) {
 487                 $domain_to_test = rtrim($mk_regex_array[2][$cnt],"\\");
 488
 489                 if (strlen($domain_to_test) > 3)
 490                 {
 491                         $domain_to_test = $domain_to_test . ".multi.surbl.org";
 492                         if( strstr(gethostbyname($domain_to_test),'127.0.0')) {
 493                                 return true;
 494                         }
 495                 }
 496         }
 497         return false;
 498 }
 499
 500 //add hsur +++++++++++++
 501
 502 function check_for_iprbl () {
 503         if( pbl_ipcache_read() ) return false;
 504
 505         //$iprbl = array('sc.surbl.org', 'bsb.spamlookup.net', 'opm.blitzed.org', 'list.dsbl.org');
 506         $iprbl = array('niku.2ch.net', 'list.dsbl.org', 'bsb.spamlookup.net');
 507
 508         $spammer_ip = serverVar('REMOTE_ADDR');
 509         list($a, $b, $c, $d) = explode('.', $spammer_ip);
 510
 511         foreach($iprbl as $rbl ){
 512                 if( strstr( gethostbyname( "$d.$c.$b.$a.$rbl" ),'127.0.0') ) {
 513                         return array($rbl, $spammer_ip);
 514                 }
 515         }
 516         pbl_ipcache_write();
 517         return false;
 518 }
 519
 520 function check_for_domainrbl ( $comment_text ) {
 521         $domainrbl = array('rbl.bulkfeeds.jp', 'url.rbl.jp', 'bsb.spamlookup.net');
 522         //$regex_url   = "/((http:\/\/)|(www\.))([^\/\"<\s]*)/i";
 523         $regex_url   = "{https?://(?:www\.)?([a-z0-9._-]{2,})(?::[0-9]+)?((?:/[_.!~*a-z0-9;@&=+$,%-]+){0,2})}m";
 524         $comment_text = mb_strtolower($comment_text);
 525
 526         $mk_regex_array = array();
 527         preg_match_all($regex_url, $comment_text, $mk_regex_array);
 528
 529         $mk_regex_array[1] = array_unique($mk_regex_array[1]);
 530
 531         for( $cnt=0; $cnt < count($mk_regex_array[1]); $cnt++ ) {
 532                 $domain_to_test = rtrim($mk_regex_array[1][$cnt],"\\");
 533                 foreach($domainrbl as $rbl ){
 534                         if (strlen($domain_to_test) > 3)
 535                         {
 536                                 if( strstr(gethostbyname($domain_to_test.'.'.$rbl),'127.0.0')) {
 537                                         return array($rbl, $domain_to_test);
 538                                 }
 539                         }
 540                 }
 541         }
 542         return false;
 543 }
 544
 545 //add hsur end ++++++++++++++
 546
 547 function pbl_blockIP() {
 548     $remote_ip = trim(serverVar('REMOTE_ADDR'));
 549         $filename  = __WEBLOG_ROOT.__EXT."/settings/blockip.pbl";
 550         $block     = false;
 551         // already in ipblock?
 552         if (file_exists($filename)) {
 553         $fp = fopen(__WEBLOG_ROOT.__EXT."/settings/blockip.pbl", "r");
 554         while ($line = trim(fgets($fp,255))) {
 555             if( strpos($remote_ip, $line) !== false){$block = true;}
 556         }
 557         fclose ($fp);
 558     } else {
 559         $fp = fopen(__WEBLOG_ROOT.__EXT."/settings/blockip.pbl", "w");
 560         fwrite($fp, "");
 561         fclose ($fp);
 562     }
 563     return $block;
 564 }
 565
 566 function pbl_logRule($expression) {
 567     $filename  = __WEBLOG_ROOT.__EXT."/settings/matched.pbl";
 568     $count = 0;
 569     $fp = fopen($filename,"r+");
 570     if ($fp) {
 571         while ($line = fgets($fp, 4096)) {
 572             if (! (strpos($line, $expression) === false )) {
 573                 $count++;
 574                 break;
 575             }
 576         }
 577         fclose($fp);
 578     }
 579     if ($count == 0 && !trim($expression) == "" ) {
 580         $fp = fopen($filename,"a+");
 581         fwrite($fp,$expression."\n");
 582     }
 583 }
 584
 585 // this function logs all ip-adresses in a 'suspected ip-list'
 586 // if the ip of the currently catched spammer is above the ip-treshold (plugin option) then
 587 // the spamming ipaddress is transfered to the blocked-ip list.
 588 // this list is the first line of defense, so notorious spamming machine will be kicked of real fast
 589 // improves blacklist performance
 590 // possible danger: blacklisting real humans who post on-the-edge comments
 591 function pbl_suspectIP($threshold, $remote_ip = '') {
 592         if ($remote_ip == '' ) {$remote_ip = serverVar('REMOTE_ADDR');}
 593         $filename  = __WEBLOG_ROOT.__EXT."/settings/suspects.pbl";
 594         $blockfile = __WEBLOG_ROOT.__EXT."/settings/blockip.pbl";
 595         $count     = 0;
 596     // suspectfile ?
 597         if (! file_exists($filename)) {
 598         $fp = fopen($filename, "w");
 599         fwrite($fp, "");
 600         fclose ($fp);
 601     }
 602
 603     $fp = fopen($filename, "r");
 604     while ($line = fgets($fp,255)) {
 605         if ( strpos($line, $remote_ip) !== false ) {
 606             $count++;
 607         }
 608     }
 609     fclose ($fp);
 610
 611     // not above threshold ? add ip to suspect ...
 612     if ($count < $threshold) {
 613         $fp = fopen($filename,'a+');
 614         fwrite($fp,$remote_ip."\n");
 615         fclose($fp);
 616     } else {
 617         // remove from suspect to ip-block
 618         $fp = fopen($filename, "r");
 619         $rewrite = "";
 620         while ($line = fgets($fp,255)) {
 621             // keep all lines except the catched ip-address
 622             if(strpos ($line, $remote_ip) !== false) {
 623                 $rewrite .= $line;
 624             }
 625         }
 626         fclose($fp);
 627         $fp = fopen($filename, "w");
 628         fwrite($fp, $rewrite);
 629         fclose ($fp);
 630         // transfer to blocked-ip file
 631         $fp = fopen($blockfile,'a+');
 632         fwrite($fp,$remote_ip."\n");
 633         fclose($fp);
 634     }
 635 }
 636
 637 function pbl_showipblock() {
 638     global $pblmessage, $manager;
 639         $filename  = __WEBLOG_ROOT.__EXT."/settings/blockip.pbl";
 640         $line = 0;
 641         $fp = fopen($filename,'r');
 642         echo "<div class=\"pbform\">\n";
 643         echo "<form action=\"".serverVar('PHP_SELF')."\" method=\"get\">\n";
 644         echo "<input type=\"hidden\" name=\"action\" value=\"addip\" />\n";
 645         $manager->addTicketHidden();
 646
 647         echo "Add IP to block: ";
 648         echo "<input class=\"pbltextinput\" type=\"text\" name=\"ipaddress\" />\n";
 649         echo "<input type=\"submit\" value=\"Add\" />\n";
 650         echo "</form>";
 651         echo "</div>\n";
 652         echo "<table>";
 653         echo "<tr>\n";
 654         echo "<th>IP Address</th>\n";
 655         echo "<th>reversed lookup</th>\n";
 656         echo "<th>deletion</th>\n";
 657         echo "</tr>\n";
 658         while ($ip = fgets($fp,255)) {
 659             $line++;
 660                 if( getPluginOption('SkipNameResolve') == 'no' )
 661                         echo "<tr><td>".$ip."</td><td>[".gethostbyaddr(rtrim($ip))."]</td><td>";
 662                 else
 663                         echo "<tr><td>".$ip."</td><td>[<em>skipped</em>]</td><td>";
 664                 // TODO: aaa
 665                 echo "<a href=\"".htmlspecialchars($manager->addTicketToUrl(serverVar('PHP_SELF')."?action=deleteipblock&line=".$line),ENT_QUOTES)."\">delete</a>";
 666                 echo "</td></tr>";
 667         }
 668         echo "</table>";
 669 }
 670 function pbl_addipblock() {
 671         if(isset($_GET["ipaddress"]))  {
 672             pbl_suspectIP(0,getVar("ipaddress"));
 673         }
 674 }
 675
 676 function pbl_deleteipblock() {
 677     global $pblmessage;
 678         $filename  = __WEBLOG_ROOT.__EXT."/settings/blockip.pbl";
 679         if(isset($_GET["line"]))  {
 680                 $handle = fopen($filename, "r");
 681                 $line = 0;
 682                 $newFile = "";
 683                 while (!feof($handle)) {
 684                         $buffer = fgets($handle, 4096);
 685                         $line++;
 686                         if($line != getVar("line"))  {
 687                                 $newFile .= $buffer;
 688                         }
 689                 }
 690                 fclose($handle);
 691                 $handle = fopen($filename, "w");
 692                 fwrite($handle, $newFile);
 693                 fclose($handle);
 694         }
 695 }
 696
 697 function pbl_htaccess($type) {
 698     $htaccess = "";
 699     switch($type) {
 700         case "ip":
 701             $filename  = __WEBLOG_ROOT.__EXT."/settings/blockip.pbl";
 702             $htaccess  = "# This htaccess snippet blocks machine based on IP Address. \n"
 703                        . "# these lines are generated by NP_Blackist\n";
 704             break;
 705         case "rules":
 706             $filename  = __WEBLOG_ROOT.__EXT."/settings/matched.pbl";
 707             $htaccess  = "# This htaccess snippet blocks machine based on referrers. \n"
 708                        . "# these lines are generated by NP_Blackist\n"
 709                        . "# You need to have the following line once in your .htaccess file\n"
 710                        . "# RewriteEngine On\n";
 711             break;
 712         default:
 713             $htaccess = "Here you can generate two types of .htaccess snippets. The first part is based on blocked ip's. This is only relevant if you have IP blocking enabled in the options. \nThe other part is referrer based rewrite rules. Blacklist stores all rules matched in a different file. With this tool you convert these matched rules into .htaccess rewrite rules which you can incorporate into your existings .htaccess file (Apache only)\n After you've added the snippet to your .htaccess file it's safe and wise to reset the blocked ip list and/or matched rules file. That way you won't end up with double rules inside your .htaccess file\n";
 714             return $htaccess;
 715     }
 716
 717     $fp = fopen($filename, 'r');
 718     $count = 0;
 719     while ($line = fgets($fp,4096)) {
 720         if ($type == "ip") {
 721             $htaccess .= "deny from ".$line;
 722         } else {
 723             if (rtrim($line) != "" ) {
 724                 if ($count > 0) {$htaccess .= "[NC,OR]\n";}
 725                 // preg_replace does the magic of converting . into \. while keeping \. and _. intact
 726                 $htaccess .= "RewriteCond %{HTTP_REFERER} ". preg_replace("/([^\\\|^_]|^)\./",'$1\\.',rtrim($line)).".*$ ";
 727                 $count++;
 728             }
 729         }
 730     }
 731     if ($type != "ip") {
 732         $htaccess .= "\nRewriteRule .* ?¿½ [F,L]\n";
 733     }
 734     return $htaccess;
 735 }
 736
 737 function pbl_htaccesspage() {
 738         global $pblmessage, $manager;
 739         if(strlen($pblmessage) > 0)  {
 740                 echo "<div class=\"pblmessage\">$pblmessage</div>\n";
 741         }
 742
 743     if (isset($_POST["type"])) {
 744         if (strstr(postVar("type"),"blocked")) {
 745             $type = 'ip';
 746         } else {
 747             $type = 'rules';
 748         }
 749     }
 750         echo "<div class=\"pbform\" style=\"margin-left:10px;\">\n";
 751         echo "<form action=\"".serverVar('PHP_SELF')."\" method=\"post\">\n";
 752         $manager->addTicketHidden();
 753
 754     echo "<input type=\"submit\" label=\"ip\" value=\"Generate blocked IP's\" name=\"type\" />\n";
 755     echo "<input type=\"submit\" label=\"ip\" value=\"Generate rewrite rules\" name=\"type\" />\n";
 756     echo "<br />";
 757     echo "<br />";
 758         echo "<input type=\"hidden\" name=\"action\" value=\"htaccess\" />\n";
 759     echo "<textarea class=\"pbltextinput\" cols=\"60\" rows=\"15\" name=\"snippet\" >". pbl_htaccess($type)."</textarea><br />";
 760     echo "<br />";
 761     echo "<input title=\"this will clean your block IP addresses file\" type=\"submit\" label=\"ip\" value=\"Reset blocked IP's\" name=\"type\" />\n";
 762     echo "<input title=\"This will clean your matched file\" type=\"submit\" label=\"ip\" value=\"Reset rewrite rules\" name=\"type\" />\n";
 763         echo "</form>\n";
 764         // if user asked for a reset, do it now
 765     if (stristr(postVar("type"),"reset")) {
 766         echo "restting file ...";
 767         pbl_resetfile($type);
 768     }
 769         echo "</div>\n";
 770 } // pbl_htaccesspage()
 771
 772 function pbl_resetfile($type){
 773     global $pblmessage;
 774     switch ($type) {
 775         case 'log':
 776             $filename = __WEBLOG_ROOT.__EXT."/settings/blacklist.log";
 777             break;
 778         case 'ip':
 779             $filename  = __WEBLOG_ROOT.__EXT."/settings/blockip.pbl";
 780             break;
 781         case 'rules':
 782             $filename  = __WEBLOG_ROOT.__EXT."/settings/matched.pbl";
 783             break;
 784     }
 785         if(file_exists($filename))      {
 786         $fp = fopen($filename, "w");
 787         fwrite($fp, "");
 788             fclose($fp);
 789         }
 790 }
 791
 792 function pbl_test () {
 793     // test's user input, no loggin.
 794         global $pblmessage;
 795         if(isset($_GET["expression"]))  {
 796                 if(getVar("expression") != "")  {
 797             $pblmessage = "Your expression: <br />".htmlspecialchars(getVar("expression"), ENT_QUOTES);
 798             $return = pbl_checkforspam(getVar("expression"),false,0,false);
 799
 800             if (! $return == "" ) {
 801                 $pblmessage .= "<br />matched rule: <strong>".$return."</strong>";
 802             } else {
 803                 $pblmessage .= "<br /> did not match any rule.";
 804             }
 805         }
 806     }
 807 }
 808
 809 function pbl_testpage () {
 810         global $manager;
 811
 812     // shows user testpage ...
 813         global $pblmessage;
 814         if(strlen($pblmessage) > 0)  {
 815                 echo "<div class=\"pblmessage\">$pblmessage</div>\n";
 816         }
 817         echo "<div class=\"pbform\" style=\"margin-left:10px;\">\n";
 818         echo "<form action=\"".serverVar('PHP_SELF')."\" method=\"get\">\n";
 819         echo "<input type=\"hidden\" name=\"action\" value=\"test\" />\n";
 820         $manager->addTicketHidden();
 821
 822     echo "<textarea class=\"pbltextinput\" cols=\"60\" rows=\"6\" name=\"expression\" ></textarea><br />";
 823         echo "<input type=\"submit\" value=\"Test this\" />\n";
 824         echo "</form>\n";
 825         echo "</div>\n";
 826 }
 827
 828 function pbl_spamsubmission_form()  {
 829                 global $manager;
 830
 831                 // form
 832                 echo "<form action=\"".serverVar('PHP_SELF')."\" method=\"post\">\n";
 833                 echo "<input type=\"hidden\" name=\"action\" value=\"spamsubmission\" />\n";
 834                 echo "<input type=\"hidden\" name=\"type\" value=\"send\" />\n";
 835                 $manager->addTicketHidden();
 836
 837                 // table
 838                 echo "<table>\n";
 839                 echo "<tr>\n";
 840                 echo "<th>Report Spam</th>\n";
 841                 echo "</tr>\n";
 842
 843                 echo "<tr>\n";
 844                 echo "<td><textarea name=\"url\" rows=\"6\" cols=\"60\"></textarea></td>\n";
 845                 echo "</tr>\n";
 846
 847                 echo '<tr><td><div align="right"><input type="submit" name="submit" value="submit" /></div></td></tr>';
 848
 849                 echo "</table>\n";
 850                 echo "</form>\n";
 851 }
 852
 853 ?>