CRM/Core/IDS.php

   1 <?php
   2 /*
   3  +--------------------------------------------------------------------+
   4  | CiviCRM version 4.7                                                |
   5  +--------------------------------------------------------------------+
   6  | Copyright CiviCRM LLC (c) 2004-2015                                |
   7  +--------------------------------------------------------------------+
   8  | This file is a part of CiviCRM.                                    |
   9  |                                                                    |
  10  | CiviCRM is free software; you can copy, modify, and distribute it  |
  11  | under the terms of the GNU Affero General Public License           |
  12  | Version 3, 19 November 2007 and the CiviCRM Licensing Exception.   |
  13  |                                                                    |
  14  | CiviCRM is distributed in the hope that it will be useful, but     |
  15  | WITHOUT ANY WARRANTY; without even the implied warranty of         |
  16  | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.               |
  17  | See the GNU Affero General Public License for more details.        |
  18  |                                                                    |
  19  | You should have received a copy of the GNU Affero General Public   |
  20  | License and the CiviCRM Licensing Exception along                  |
  21  | with this program; if not, contact CiviCRM LLC                     |
  22  | at info[AT]civicrm[DOT]org. If you have questions about the        |
  23  | GNU Affero General Public License or the licensing of CiviCRM,     |
  24  | see the CiviCRM license FAQ at http://civicrm.org/licensing        |
  25  +--------------------------------------------------------------------+
  26  */
  27
  28 /**
  29  *
  30  * @package CRM
  31  * @copyright CiviCRM LLC (c) 2004-2015
  32  * $Id$
  33  *
  34  */
  35 class CRM_Core_IDS {
  36
  37   /**
  38    * Define the threshold for the ids reactions.
  39    */
  40   private $threshold = array(
  41     'log' => 25,
  42     'warn' => 50,
  43     'kick' => 75,
  44   );
  45
  46   /**
  47    * The init object
  48    */
  49   private $init = NULL;
  50
  51   /**
  52    * This function includes the IDS vendor parts and runs the
  53    * detection routines on the request array.
  54    *
  55    * @param object $args cake controller object
  56    *
  57    * @return bool
  58    */
  59   public function check(&$args) {
  60     // lets bypass a few civicrm urls from this check
  61     static $skip = array('civicrm/admin/setting/updateConfigBackend', 'civicrm/admin/messageTemplates');
  62     $path = implode('/', $args);
  63     if (in_array($path, $skip)) {
  64       return NULL;
  65     }
  66
  67     #add request url and user agent
  68     $_REQUEST['IDS_request_uri'] = $_SERVER['REQUEST_URI'];
  69     if (isset($_SERVER['HTTP_USER_AGENT'])) {
  70       $_REQUEST['IDS_user_agent'] = $_SERVER['HTTP_USER_AGENT'];
  71     }
  72
  73     $configFile = self::createConfigFile(FALSE);
  74
  75     // init the PHPIDS and pass the REQUEST array
  76     require_once 'IDS/Init.php';
  77     try {
  78       $init = IDS_Init::init($configFile);
  79       $ids = new IDS_Monitor($_REQUEST, $init);
  80     }
  81     catch (Exception $e) {
  82       // might be an old stale copy of Config.IDS.ini
  83       // lets try to rebuild it again and see if it works
  84       $configFile = self::createConfigFile(TRUE);
  85       $init = IDS_Init::init($configFile);
  86       $ids = new IDS_Monitor($_REQUEST, $init);
  87     }
  88
  89     $result = $ids->run();
  90     if (!$result->isEmpty()) {
  91       $this->react($result);
  92     }
  93
  94     return TRUE;
  95   }
  96
  97   /**
  98    * Create the default config file for the IDS system.
  99    *
 100    * @param bool $force
 101    *   Should we recreate it irrespective if it exists or not.
 102    *
 103    * @return string
 104    *   the full path to the config file
 105    */
 106   public static function createConfigFile($force = FALSE) {
 107     $config = CRM_Core_Config::singleton();
 108     $configFile = $config->configAndLogDir . 'Config.IDS.ini';
 109     if (!$force && file_exists($configFile)) {
 110       return $configFile;
 111     }
 112
 113     $tmpDir = empty($config->uploadDir) ? CIVICRM_TEMPLATE_COMPILEDIR : $config->uploadDir;
 114
 115     // also clear the stat cache in case we are upgrading
 116     clearstatcache();
 117
 118     global $civicrm_root;
 119     $contents = "
 120 [General]
 121     filter_type         = xml
 122     filter_path         = {$civicrm_root}/packages/IDS/default_filter.xml
 123     tmp_path            = $tmpDir
 124     HTML_Purifier_Path  = IDS/vendors/htmlpurifier/HTMLPurifier.auto.php
 125     HTML_Purifier_Cache = $tmpDir
 126     scan_keys           = false
 127     exceptions[]        = __utmz
 128     exceptions[]        = __utmc
 129     exceptions[]        = widget_code
 130     exceptions[]        = html_message
 131     exceptions[]        = text_message
 132     exceptions[]        = body_html
 133     exceptions[]        = msg_html
 134     exceptions[]        = msg_text
 135     exceptions[]        = msg_subject
 136     exceptions[]        = description
 137     exceptions[]        = intro
 138     exceptions[]        = thankyou_text
 139     exceptions[]        = intro_text
 140     exceptions[]        = body_text
 141     exceptions[]        = footer_text
 142     exceptions[]        = thankyou_text
 143     exceptions[]        = tf_thankyou_text
 144     exceptions[]        = thankyou_footer
 145     exceptions[]        = thankyou_footer_text
 146     exceptions[]        = new_text
 147     exceptions[]        = renewal_text
 148     exceptions[]        = help_pre
 149     exceptions[]        = help_post
 150     exceptions[]        = confirm_title
 151     exceptions[]        = confirm_text
 152     exceptions[]        = confirm_footer_text
 153     exceptions[]        = confirm_email_text
 154     exceptions[]        = report_header
 155     exceptions[]        = report_footer
 156     exceptions[]        = data
 157     exceptions[]        = json
 158     exceptions[]        = instructions
 159     exceptions[]        = suggested_message
 160     exceptions[]        = page_text
 161 ";
 162     if (file_put_contents($configFile, $contents) === FALSE) {
 163       CRM_Core_Error::movedSiteError($configFile);
 164     }
 165
 166     // also create the .htaccess file so we prevent the reading of the log and ini files
 167     // via a browser, CRM-3875
 168     CRM_Utils_File::restrictAccess($config->configAndLogDir);
 169
 170     return $configFile;
 171   }
 172
 173   /**
 174    * This function rects on the values in
 175    * the incoming results array.
 176    *
 177    * Depending on the impact value certain actions are
 178    * performed.
 179    *
 180    * @param IDS_Report $result
 181    *
 182    * @return bool
 183    */
 184   private function react(IDS_Report $result) {
 185
 186     $impact = $result->getImpact();
 187     if ($impact >= $this->threshold['kick']) {
 188       $this->log($result, 3, $impact);
 189       $this->kick($result);
 190       return TRUE;
 191     }
 192     elseif ($impact >= $this->threshold['warn']) {
 193       $this->log($result, 2, $impact);
 194       $this->warn($result);
 195       return TRUE;
 196     }
 197     elseif ($impact >= $this->threshold['log']) {
 198       $this->log($result, 0, $impact);
 199       return TRUE;
 200     }
 201     else {
 202       return TRUE;
 203     }
 204   }
 205
 206   /**
 207    * This function writes an entry about the intrusion
 208    * to the intrusion database
 209    *
 210    * @param array $result
 211    * @param int $reaction
 212    *
 213    * @return bool
 214    */
 215   private function log($result, $reaction = 0) {
 216     $ip = (isset($_SERVER['SERVER_ADDR']) &&
 217       $_SERVER['SERVER_ADDR'] != '127.0.0.1') ? $_SERVER['SERVER_ADDR'] : (
 218       isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : '127.0.0.1'
 219       );
 220
 221     $data = array();
 222     $session = CRM_Core_Session::singleton();
 223     foreach ($result as $event) {
 224       $data[] = array(
 225         'name' => $event->getName(),
 226         'value' => stripslashes($event->getValue()),
 227         'page' => $_SERVER['REQUEST_URI'],
 228         'userid' => $session->get('userID'),
 229         'session' => session_id() ? session_id() : '0',
 230         'ip' => $ip,
 231         'reaction' => $reaction,
 232         'impact' => $result->getImpact(),
 233       );
 234     }
 235
 236     CRM_Core_Error::debug_var('IDS Detector Details', $data);
 237     return TRUE;
 238   }
 239
 240   /**
 241    * //todo
 242    */
 243   private function warn($result) {
 244     return $result;
 245   }
 246
 247   /**
 248    *  //todo
 249    */
 250   private function kick($result) {
 251     $session = CRM_Core_Session::singleton();
 252     $session->reset(2);
 253
 254     $msg = ts('There is a validation error with your HTML input. Your activity is a bit suspicious, hence aborting');
 255
 256     $path = implode('/', $args);
 257     if (in_array(
 258       $path,
 259       array("civicrm/ajax/rest", "civicrm/api/json")
 260     )) {
 261       require_once "api/v3/utils.php";
 262       $error = civicrm_api3_create_error(
 263         $msg,
 264         array(
 265           'IP' => $_SERVER['REMOTE_ADDR'],
 266           'error_code' => 'IDS_KICK',
 267           'level' => 'security',
 268           'referer' => $_SERVER['HTTP_REFERER'],
 269           'reason' => 'XSS suspected',
 270         )
 271       );
 272       CRM_Utils_JSON::output($error);
 273     }
 274     CRM_Core_Error::fatal($msg);
 275   }
 276
 277 }