Bad Behavior - Version 2.2.5

Version Description

Download this release

Release Info

Developer error
Plugin Icon wp plugin Bad Behavior
Version 2.2.5
Comparing to
See all releases

Code changes from version 2.2.4 to 2.2.5

Files changed (4) hide show
  1. README.txt +2 -2
  2. bad-behavior-wordpress-admin.php +28 -23
  3. bad-behavior-wordpress.php +1 -1
  4. bad-behavior/core.inc.php +1 -1
README.txt CHANGED
@@ -2,9 +2,9 @@
2
  Tags: comment,trackback,referrer,spam,robot,antispam
3
  Contributors: error, markjaquith, skeltoac
4
  Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=error%40ioerror%2eus&item_name=Bad%20Behavior%20%28From%20WordPress%20Page%29&no_shipping=1&cn=Comments%20about%20Bad%20Behavior&tax=0&currency_code=USD&bn=PP%2dDonationsBF&charset=UTF%2d8
5
- Requires at least: 2.7
6
  Tested up to: 3.3.2
7
- Stable tag: 2.2.4
8
 
9
  Bad Behavior prevents spammers from ever delivering their junk, and in many
10
  cases, from ever reading your site in the first place.
2
  Tags: comment,trackback,referrer,spam,robot,antispam
3
  Contributors: error, markjaquith, skeltoac
4
  Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=error%40ioerror%2eus&item_name=Bad%20Behavior%20%28From%20WordPress%20Page%29&no_shipping=1&cn=Comments%20about%20Bad%20Behavior&tax=0&currency_code=USD&bn=PP%2dDonationsBF&charset=UTF%2d8
5
+ Requires at least: 3.1
6
  Tested up to: 3.3.2
7
+ Stable tag: 2.2.5
8
 
9
  Bad Behavior prevents spammers from ever delivering their junk, and in many
10
  cases, from ever reading your site in the first place.
bad-behavior-wordpress-admin.php CHANGED
@@ -149,7 +149,7 @@ function bb2_manage() {
149
  echo bb2_donate_button(admin_url("tools.php?page=bb2_manage"));
150
  ?>
151
  <h2><?php _e("Bad Behavior Log"); ?></h2>
152
- <form method="post" action="<?php echo $request_uri; ?>">
153
  <p>For more information please visit the <a href="http://www.bad-behavior.ioerror.us/">Bad Behavior</a> homepage.</p>
154
  <p>See also: <a href="<?php echo admin_url("options-general.php?page=bb2_options") ?>">Settings</a> | <a href="<?php echo admin_url("options-general.php?page=bb2_whitelist") ?>">Whitelist</a></p>
155
  <div class="tablenav">
@@ -160,17 +160,17 @@ function bb2_manage() {
160
  <div class="alignleft">
161
  <?php if ($count < $totalcount): ?>
162
  Displaying <strong><?php echo $count; ?></strong> of <strong><?php echo $totalcount; ?></strong> records filtered by:<br/>
163
- <?php if ($_GET['key']) echo "Status [<a href=\"" . remove_query_arg(array("paged", "key"), $request_uri) . "\">X</a>] "; ?>
164
- <?php if ($_GET['blocked']) echo "Blocked [<a href=\"" . remove_query_arg(array("paged", "blocked", "permitted"), $request_uri) . "\">X</a>] "; ?>
165
- <?php if ($_GET['permitted']) echo "Permitted [<a href=\"" . remove_query_arg(array("paged", "blocked", "permitted"), $request_uri) . "\">X</a>] "; ?>
166
- <?php if ($_GET['ip']) echo "IP [<a href=\"" . remove_query_arg(array("paged", "ip"), $request_uri) . "\">X</a>] "; ?>
167
- <?php if ($_GET['user_agent']) echo "User Agent [<a href=\"" . remove_query_arg(array("paged", "user_agent"), $request_uri) . "\">X</a>] "; ?>
168
- <?php if ($_GET['request_method']) echo "GET/POST [<a href=\"" . remove_query_arg(array("paged", "request_method"), $request_uri) . "\">X</a>] "; ?>
169
  <?php else: ?>
170
  Displaying all <strong><?php echo $totalcount; ?></strong> records<br/>
171
  <?php endif; ?>
172
- <?php if (!$_GET['key'] && !$_GET['blocked']) { ?><a href="<?php echo add_query_arg(array("blocked" => "1", "permitted" => "0", "paged" => false), $request_uri); ?>">Show Blocked</a> <?php } ?>
173
- <?php if (!$_GET['key'] && !$_GET['permitted']) { ?><a href="<?php echo add_query_arg(array("permitted" => "1", "blocked" => "0", "paged" => false), $request_uri); ?>">Show Permitted</a> <?php } ?>
174
  </div>
175
  </div>
176
 
@@ -202,12 +202,12 @@ Displaying all <strong><?php echo $totalcount; ?></strong> records<br/>
202
  } else {
203
  $host .= "<br/>\n";
204
  }
205
- echo "<td><a href=\"" . add_query_arg("ip", $result["ip"], remove_query_arg("paged", $request_uri)) . "\">" . $result["ip"] . "</a><br/>$host<br/>\n" . $result["date"] . "<br/><br/><a href=\"" . add_query_arg("key", $result["key"], remove_query_arg(array("paged", "blocked", "permitted"), $request_uri)) . "\">" . $key["log"] . "</a>\n";
206
  if ($httpbl) echo "<br/><br/><a href=\"http://www.projecthoneypot.org/ip_{$result['ip']}\">http:BL</a>:<br/>$httpbl\n";
207
  echo "</td>\n";
208
  $headers = str_replace("\n", "<br/>\n", htmlspecialchars($result['http_headers']));
209
- if (@strpos($headers, $result['user_agent']) !== FALSE) $headers = substr_replace($headers, "<a href=\"" . add_query_arg("user_agent", rawurlencode($result["user_agent"]), remove_query_arg("paged", $request_uri)) . "\">" . $result['user_agent'] . "</a>", strpos($headers, $result['user_agent']), strlen($result['user_agent']));
210
- if (@strpos($headers, $result['request_method']) !== FALSE) $headers = substr_replace($headers, "<a href=\"" . add_query_arg("request_method", rawurlencode($result["request_method"]), remove_query_arg("paged", $request_uri)) . "\">" . $result['request_method'] . "</a>", strpos($headers, $result['request_method']), strlen($result['request_method']));
211
  echo "<td>$headers</td>\n";
212
  echo "<td>" . str_replace("\n", "<br/>\n", htmlspecialchars($result["request_entity"])) . "</td>\n";
213
  echo "</tr>\n";
@@ -270,7 +270,7 @@ function bb2_whitelist()
270
  echo bb2_donate_button(admin_url("options-general.php?page=bb2_whitelist"));
271
  ?>
272
  <h2><?php _e("Bad Behavior Whitelist"); ?></h2>
273
- <form method="post" action="<?php echo $request_uri; ?>">
274
  <p>Inappropriate whitelisting WILL expose you to spam, or cause Bad Behavior to stop functioning entirely! DO NOT WHITELIST unless you are 100% CERTAIN that you should.</p>
275
  <p>For more information please visit the <a href="http://www.bad-behavior.ioerror.us/">Bad Behavior</a> homepage.</p>
276
  <p>See also: <a href="<?php echo admin_url("options-general.php?page=bb2_options") ?>">Settings</a> | <a href="<?php echo admin_url("tools.php?page=bb2_manage"); ?>">Log</a></p>
@@ -336,17 +336,21 @@ function bb2_options()
336
  $settings['logging'] = false;
337
  }
338
  if ($_POST['httpbl_key']) {
339
- $settings['httpbl_key'] = $_POST['httpbl_key'];
 
 
 
 
340
  } else {
341
  $settings['httpbl_key'] = '';
342
  }
343
  if ($_POST['httpbl_threat']) {
344
- $settings['httpbl_threat'] = $_POST['httpbl_threat'];
345
  } else {
346
  $settings['httpbl_threat'] = '25';
347
  }
348
  if ($_POST['httpbl_maxage']) {
349
- $settings['httpbl_maxage'] = $_POST['httpbl_maxage'];
350
  } else {
351
  $settings['httpbl_maxage'] = '30';
352
  }
@@ -366,12 +370,13 @@ function bb2_options()
366
  $settings['reverse_proxy'] = false;
367
  }
368
  if ($_POST['reverse_proxy_header']) {
369
- $settings['reverse_proxy_header'] = uc_all($_POST['reverse_proxy_header']);
370
  } else {
371
  $settings['reverse_proxy_header'] = 'X-Forwarded-For';
372
  }
373
  if ($_POST['reverse_proxy_addresses']) {
374
  $settings['reverse_proxy_addresses'] = preg_split("/[\s,]+/m", $_POST['reverse_proxy_addresses']);
 
375
  } else {
376
  $settings['reverse_proxy_addresses'] = array();
377
  }
@@ -386,7 +391,7 @@ function bb2_options()
386
  echo bb2_donate_button(admin_url("options-general.php?page=bb2_options"));
387
  ?>
388
  <h2><?php _e("Bad Behavior"); ?></h2>
389
- <form method="post" action="<?php echo $_SERVER['REQUEST_URI']; ?>">
390
  <p>For more information please visit the <a href="http://www.bad-behavior.ioerror.us/">Bad Behavior</a> homepage.</p>
391
  <p>See also: <a href="<?php echo admin_url("tools.php?page=bb2_manage"); ?>">Log</a> | <a href="<?php echo admin_url("options-general.php?page=bb2_whitelist") ?>">Whitelist</a></p>
392
 
@@ -412,9 +417,9 @@ function bb2_options()
412
  <h3><?php _e('http:BL'); ?></h3>
413
  <p>To use Bad Behavior's http:BL features you must have an <a href="http://www.projecthoneypot.org/httpbl_configure.php?rf=24694">http:BL Access Key</a>.</p>
414
  <table class="form-table">
415
- <tr><td><label><input type="text" size="12" maxlength="12" name="httpbl_key" value="<?php echo $settings['httpbl_key']; ?>" /> http:BL Access Key</label></td></tr>
416
- <tr><td><label><input type="text" size="3" maxlength="3" name="httpbl_threat" value="<?php echo $settings['httpbl_threat']; ?>" /> Minimum Threat Level (25 is recommended)</label></td></tr>
417
- <tr><td><label><input type="text" size="3" maxlength="3" name="httpbl_maxage" value="<?php echo $settings['httpbl_maxage']; ?>" /> Maximum Age of Data (30 is recommended)</label></td></tr>
418
  </table>
419
 
420
  <h3><?php _e('European Union Cookie'); ?></h3>
@@ -429,8 +434,8 @@ function bb2_options()
429
  <p>In addition, your reverse proxy servers must set the IP address of the Internet client from which they received the request in an HTTP header. If you don't specify a header, <a href="http://en.wikipedia.org/wiki/X-Forwarded-For">X-Forwarded-For</a> will be used. Most proxy servers already support X-Forwarded-For and you would then only need to ensure that it is enabled on your proxy servers. Some other header names in common use include <u>X-Real-Ip</u> (nginx) and <u>Cf-Connecting-Ip</u> (CloudFlare).</p>
430
  <table class="form-table">
431
  <tr><td><label><input type="checkbox" name="reverse_proxy" value="true" <?php if ($settings['reverse_proxy']) { ?>checked="checked" <?php } ?>/> <?php _e('Enable Reverse Proxy'); ?></label></td></tr>
432
- <tr><td><label><input type="text" size="32" name="reverse_proxy_header" value="<?php echo $settings['reverse_proxy_header']; ?>" /> Header containing Internet clients' IP address</label></td></tr>
433
- <tr><td><label>IP address or CIDR format address ranges for your proxy servers (one per line)<br/><textarea cols="24" rows="6" name="reverse_proxy_addresses"><?php echo implode("\n", $settings['reverse_proxy_addresses']); ?></textarea></td></tr>
434
  </table>
435
 
436
  <p class="submit"><input class="button" type="submit" name="submit" value="<?php _e('Update &raquo;'); ?>" /></p>
149
  echo bb2_donate_button(admin_url("tools.php?page=bb2_manage"));
150
  ?>
151
  <h2><?php _e("Bad Behavior Log"); ?></h2>
152
+ <form method="post" action="<?php echo admin_url("tools.php?page=bb2_manage") ?>">
153
  <p>For more information please visit the <a href="http://www.bad-behavior.ioerror.us/">Bad Behavior</a> homepage.</p>
154
  <p>See also: <a href="<?php echo admin_url("options-general.php?page=bb2_options") ?>">Settings</a> | <a href="<?php echo admin_url("options-general.php?page=bb2_whitelist") ?>">Whitelist</a></p>
155
  <div class="tablenav">
160
  <div class="alignleft">
161
  <?php if ($count < $totalcount): ?>
162
  Displaying <strong><?php echo $count; ?></strong> of <strong><?php echo $totalcount; ?></strong> records filtered by:<br/>
163
+ <?php if ($_GET['key']) echo "Status [<a href=\"" . esc_url( remove_query_arg(array("paged", "key"), $request_uri) ) . "\">X</a>] "; ?>
164
+ <?php if ($_GET['blocked']) echo "Blocked [<a href=\"" . esc_url( remove_query_arg(array("paged", "blocked", "permitted"), $request_uri) ) . "\">X</a>] "; ?>
165
+ <?php if ($_GET['permitted']) echo "Permitted [<a href=\"" . esc_url( remove_query_arg(array("paged", "blocked", "permitted"), $request_uri) ) . "\">X</a>] "; ?>
166
+ <?php if ($_GET['ip']) echo "IP [<a href=\"" . esc_url( remove_query_arg(array("paged", "ip"), $request_uri) ) . "\">X</a>] "; ?>
167
+ <?php if ($_GET['user_agent']) echo "User Agent [<a href=\"" . esc_url( remove_query_arg(array("paged", "user_agent"), $request_uri) ) . "\">X</a>] "; ?>
168
+ <?php if ($_GET['request_method']) echo "GET/POST [<a href=\"" . esc_url( remove_query_arg(array("paged", "request_method"), $request_uri) ) . "\">X</a>] "; ?>
169
  <?php else: ?>
170
  Displaying all <strong><?php echo $totalcount; ?></strong> records<br/>
171
  <?php endif; ?>
172
+ <?php if (!$_GET['key'] && !$_GET['blocked']) { ?><a href="<?php echo esc_url( add_query_arg(array("blocked" => "1", "permitted" => "0", "paged" => false), $request_uri) ); ?>">Show Blocked</a> <?php } ?>
173
+ <?php if (!$_GET['key'] && !$_GET['permitted']) { ?><a href="<?php echo esc_url( add_query_arg(array("permitted" => "1", "blocked" => "0", "paged" => false), $request_uri) ); ?>">Show Permitted</a> <?php } ?>
174
  </div>
175
  </div>
176
 
202
  } else {
203
  $host .= "<br/>\n";
204
  }
205
+ echo "<td><a href=\"" . esc_url( add_query_arg("ip", $result["ip"], remove_query_arg("paged", $request_uri)) ) . "\">" . $result["ip"] . "</a><br/>$host<br/>\n" . $result["date"] . "<br/><br/><a href=\"" . esc_url( add_query_arg("key", $result["key"], remove_query_arg(array("paged", "blocked", "permitted"), $request_uri)) ) . "\">" . $key["log"] . "</a>\n";
206
  if ($httpbl) echo "<br/><br/><a href=\"http://www.projecthoneypot.org/ip_{$result['ip']}\">http:BL</a>:<br/>$httpbl\n";
207
  echo "</td>\n";
208
  $headers = str_replace("\n", "<br/>\n", htmlspecialchars($result['http_headers']));
209
+ if (@strpos($headers, $result['user_agent']) !== FALSE) $headers = substr_replace($headers, "<a href=\"" . esc_url( add_query_arg("user_agent", rawurlencode($result["user_agent"]), remove_query_arg("paged", $request_uri)) ) . "\">" . $result['user_agent'] . "</a>", strpos($headers, $result['user_agent']), strlen($result['user_agent']));
210
+ if (@strpos($headers, $result['request_method']) !== FALSE) $headers = substr_replace($headers, "<a href=\"" . esc_url( add_query_arg("request_method", rawurlencode($result["request_method"]), remove_query_arg("paged", $request_uri)) ) . "\">" . $result['request_method'] . "</a>", strpos($headers, $result['request_method']), strlen($result['request_method']));
211
  echo "<td>$headers</td>\n";
212
  echo "<td>" . str_replace("\n", "<br/>\n", htmlspecialchars($result["request_entity"])) . "</td>\n";
213
  echo "</tr>\n";
270
  echo bb2_donate_button(admin_url("options-general.php?page=bb2_whitelist"));
271
  ?>
272
  <h2><?php _e("Bad Behavior Whitelist"); ?></h2>
273
+ <form method="post" action="<?php echo admin_url("options-general.php?page=bb2_whitelist"); ?>">
274
  <p>Inappropriate whitelisting WILL expose you to spam, or cause Bad Behavior to stop functioning entirely! DO NOT WHITELIST unless you are 100% CERTAIN that you should.</p>
275
  <p>For more information please visit the <a href="http://www.bad-behavior.ioerror.us/">Bad Behavior</a> homepage.</p>
276
  <p>See also: <a href="<?php echo admin_url("options-general.php?page=bb2_options") ?>">Settings</a> | <a href="<?php echo admin_url("tools.php?page=bb2_manage"); ?>">Log</a></p>
336
  $settings['logging'] = false;
337
  }
338
  if ($_POST['httpbl_key']) {
339
+ if (preg_match("/^[:alpha:]{12}$/", $_POST['httpbl_key'])) {
340
+ $settings['httpbl_key'] = $_POST['httpbl_key'];
341
+ } else {
342
+ $settings['httpbl_key'] = '';
343
+ }
344
  } else {
345
  $settings['httpbl_key'] = '';
346
  }
347
  if ($_POST['httpbl_threat']) {
348
+ $settings['httpbl_threat'] = intval($_POST['httpbl_threat']);
349
  } else {
350
  $settings['httpbl_threat'] = '25';
351
  }
352
  if ($_POST['httpbl_maxage']) {
353
+ $settings['httpbl_maxage'] = intval($_POST['httpbl_maxage']);
354
  } else {
355
  $settings['httpbl_maxage'] = '30';
356
  }
370
  $settings['reverse_proxy'] = false;
371
  }
372
  if ($_POST['reverse_proxy_header']) {
373
+ $settings['reverse_proxy_header'] = sanitize_text_field(uc_all($_POST['reverse_proxy_header']));
374
  } else {
375
  $settings['reverse_proxy_header'] = 'X-Forwarded-For';
376
  }
377
  if ($_POST['reverse_proxy_addresses']) {
378
  $settings['reverse_proxy_addresses'] = preg_split("/[\s,]+/m", $_POST['reverse_proxy_addresses']);
379
+ $settings['reverse_proxy_addresses'] = array_map('sanitize_text_field', $settings['reverse_proxy_addresses']);
380
  } else {
381
  $settings['reverse_proxy_addresses'] = array();
382
  }
391
  echo bb2_donate_button(admin_url("options-general.php?page=bb2_options"));
392
  ?>
393
  <h2><?php _e("Bad Behavior"); ?></h2>
394
+ <form method="post" action="<?php echo admin_url("options-general.php?page=bb2_options"); ?>">
395
  <p>For more information please visit the <a href="http://www.bad-behavior.ioerror.us/">Bad Behavior</a> homepage.</p>
396
  <p>See also: <a href="<?php echo admin_url("tools.php?page=bb2_manage"); ?>">Log</a> | <a href="<?php echo admin_url("options-general.php?page=bb2_whitelist") ?>">Whitelist</a></p>
397
 
417
  <h3><?php _e('http:BL'); ?></h3>
418
  <p>To use Bad Behavior's http:BL features you must have an <a href="http://www.projecthoneypot.org/httpbl_configure.php?rf=24694">http:BL Access Key</a>.</p>
419
  <table class="form-table">
420
+ <tr><td><label><input type="text" size="12" maxlength="12" name="httpbl_key" value="<?php echo sanitize_text_field($settings['httpbl_key']); ?>" /> http:BL Access Key</label></td></tr>
421
+ <tr><td><label><input type="text" size="3" maxlength="3" name="httpbl_threat" value="<?php echo intval($settings['httpbl_threat']); ?>" /> Minimum Threat Level (25 is recommended)</label></td></tr>
422
+ <tr><td><label><input type="text" size="3" maxlength="3" name="httpbl_maxage" value="<?php echo intval($settings['httpbl_maxage']); ?>" /> Maximum Age of Data (30 is recommended)</label></td></tr>
423
  </table>
424
 
425
  <h3><?php _e('European Union Cookie'); ?></h3>
434
  <p>In addition, your reverse proxy servers must set the IP address of the Internet client from which they received the request in an HTTP header. If you don't specify a header, <a href="http://en.wikipedia.org/wiki/X-Forwarded-For">X-Forwarded-For</a> will be used. Most proxy servers already support X-Forwarded-For and you would then only need to ensure that it is enabled on your proxy servers. Some other header names in common use include <u>X-Real-Ip</u> (nginx) and <u>Cf-Connecting-Ip</u> (CloudFlare).</p>
435
  <table class="form-table">
436
  <tr><td><label><input type="checkbox" name="reverse_proxy" value="true" <?php if ($settings['reverse_proxy']) { ?>checked="checked" <?php } ?>/> <?php _e('Enable Reverse Proxy'); ?></label></td></tr>
437
+ <tr><td><label><input type="text" size="32" name="reverse_proxy_header" value="<?php echo sanitize_text_field($settings['reverse_proxy_header']); ?>" /> Header containing Internet clients' IP address</label></td></tr>
438
+ <tr><td><label>IP address or CIDR format address ranges for your proxy servers (one per line)<br/><textarea cols="24" rows="6" name="reverse_proxy_addresses"><?php echo esc_textarea(implode("\n", $settings['reverse_proxy_addresses'])); ?></textarea></td></tr>
439
  </table>
440
 
441
  <p class="submit"><input class="button" type="submit" name="submit" value="<?php _e('Update &raquo;'); ?>" /></p>
bad-behavior-wordpress.php CHANGED
@@ -1,7 +1,7 @@
1
  <?php
2
  /*
3
  Plugin Name: Bad Behavior
4
- Version: 2.2.4
5
  Description: Deny automated spambots access to your PHP-based Web site.
6
  Plugin URI: http://bad-behavior.ioerror.us/
7
  Author: Michael Hampton
1
  <?php
2
  /*
3
  Plugin Name: Bad Behavior
4
+ Version: 2.2.5
5
  Description: Deny automated spambots access to your PHP-based Web site.
6
  Plugin URI: http://bad-behavior.ioerror.us/
7
  Author: Michael Hampton
bad-behavior/core.inc.php CHANGED
@@ -1,5 +1,5 @@
1
  <?php if (!defined('BB2_CWD')) die("I said no cheating!");
2
- define('BB2_VERSION', "2.2.4");
3
 
4
  // Bad Behavior entry point is bb2_start()
5
  // If you're reading this, you are probably lost.
1
  <?php if (!defined('BB2_CWD')) die("I said no cheating!");
2
+ define('BB2_VERSION', "2.2.5");
3
 
4
  // Bad Behavior entry point is bb2_start()
5
  // If you're reading this, you are probably lost.