interface/main/myadmin/libraries/ip_allow_deny.lib.php

   1 <?php
   2 /* $Id$ */
   3 // vim: expandtab sw=4 ts=4 sts=4:
   4
   5 /**
   6  * This library is used with the server IP allow/deny host authentication
   7  * feature
   8  */
   9
  10
  11 /**
  12  * Gets the "true" IP address of the current user
  13  *
  14  * @return  string   the ip of the user
  15  *
  16  * @access  private
  17  */
  18 function PMA_getIp()
  19 {
  20     global $REMOTE_ADDR;
  21     global $HTTP_X_FORWARDED_FOR, $HTTP_X_FORWARDED, $HTTP_FORWARDED_FOR, $HTTP_FORWARDED;
  22     global $HTTP_VIA, $HTTP_X_COMING_FROM, $HTTP_COMING_FROM;
  23
  24     // Get some server/environment variables values
  25     if (empty($REMOTE_ADDR)) {
  26         if (!empty($_SERVER) && isset($_SERVER['REMOTE_ADDR'])) {
  27             $REMOTE_ADDR = $_SERVER['REMOTE_ADDR'];
  28         }
  29         else if (!empty($_ENV) && isset($_ENV['REMOTE_ADDR'])) {
  30             $REMOTE_ADDR = $_ENV['REMOTE_ADDR'];
  31         }
  32         else if (@getenv('REMOTE_ADDR')) {
  33             $REMOTE_ADDR = getenv('REMOTE_ADDR');
  34         }
  35     } // end if
  36     if (empty($HTTP_X_FORWARDED_FOR)) {
  37         if (!empty($_SERVER) && isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
  38             $HTTP_X_FORWARDED_FOR = $_SERVER['HTTP_X_FORWARDED_FOR'];
  39         }
  40         else if (!empty($_ENV) && isset($_ENV['HTTP_X_FORWARDED_FOR'])) {
  41             $HTTP_X_FORWARDED_FOR = $_ENV['HTTP_X_FORWARDED_FOR'];
  42         }
  43         else if (@getenv('HTTP_X_FORWARDED_FOR')) {
  44             $HTTP_X_FORWARDED_FOR = getenv('HTTP_X_FORWARDED_FOR');
  45         }
  46     } // end if
  47     if (empty($HTTP_X_FORWARDED)) {
  48         if (!empty($_SERVER) && isset($_SERVER['HTTP_X_FORWARDED'])) {
  49             $HTTP_X_FORWARDED = $_SERVER['HTTP_X_FORWARDED'];
  50         }
  51         else if (!empty($_ENV) && isset($_ENV['HTTP_X_FORWARDED'])) {
  52             $HTTP_X_FORWARDED = $_ENV['HTTP_X_FORWARDED'];
  53         }
  54         else if (@getenv('HTTP_X_FORWARDED')) {
  55             $HTTP_X_FORWARDED = getenv('HTTP_X_FORWARDED');
  56         }
  57     } // end if
  58     if (empty($HTTP_FORWARDED_FOR)) {
  59         if (!empty($_SERVER) && isset($_SERVER['HTTP_FORWARDED_FOR'])) {
  60             $HTTP_FORWARDED_FOR = $_SERVER['HTTP_FORWARDED_FOR'];
  61         }
  62         else if (!empty($_ENV) && isset($_ENV['HTTP_FORWARDED_FOR'])) {
  63             $HTTP_FORWARDED_FOR = $_ENV['HTTP_FORWARDED_FOR'];
  64         }
  65         else if (@getenv('HTTP_FORWARDED_FOR')) {
  66             $HTTP_FORWARDED_FOR = getenv('HTTP_FORWARDED_FOR');
  67         }
  68     } // end if
  69     if (empty($HTTP_FORWARDED)) {
  70         if (!empty($_SERVER) && isset($_SERVER['HTTP_FORWARDED'])) {
  71             $HTTP_FORWARDED = $_SERVER['HTTP_FORWARDED'];
  72         }
  73         else if (!empty($_ENV) && isset($_ENV['HTTP_FORWARDED'])) {
  74             $HTTP_FORWARDED = $_ENV['HTTP_FORWARDED'];
  75         }
  76         else if (@getenv('HTTP_FORWARDED')) {
  77             $HTTP_FORWARDED = getenv('HTTP_FORWARDED');
  78         }
  79     } // end if
  80     if (empty($HTTP_VIA)) {
  81         if (!empty($_SERVER) && isset($_SERVER['HTTP_VIA'])) {
  82             $HTTP_VIA = $_SERVER['HTTP_VIA'];
  83         }
  84         else if (!empty($_ENV) && isset($_ENV['HTTP_VIA'])) {
  85             $HTTP_VIA = $_ENV['HTTP_VIA'];
  86         }
  87         else if (@getenv('HTTP_VIA')) {
  88             $HTTP_VIA = getenv('HTTP_VIA');
  89         }
  90     } // end if
  91     if (empty($HTTP_X_COMING_FROM)) {
  92         if (!empty($_SERVER) && isset($_SERVER['HTTP_X_COMING_FROM'])) {
  93             $HTTP_X_COMING_FROM = $_SERVER['HTTP_X_COMING_FROM'];
  94         }
  95         else if (!empty($_ENV) && isset($_ENV['HTTP_X_COMING_FROM'])) {
  96             $HTTP_X_COMING_FROM = $_ENV['HTTP_X_COMING_FROM'];
  97         }
  98         else if (@getenv('HTTP_X_COMING_FROM')) {
  99             $HTTP_X_COMING_FROM = getenv('HTTP_X_COMING_FROM');
 100         }
 101     } // end if
 102     if (empty($HTTP_COMING_FROM)) {
 103         if (!empty($_SERVER) && isset($_SERVER['HTTP_COMING_FROM'])) {
 104             $HTTP_COMING_FROM = $_SERVER['HTTP_COMING_FROM'];
 105         }
 106         else if (!empty($_ENV) && isset($_ENV['HTTP_COMING_FROM'])) {
 107             $HTTP_COMING_FROM = $_ENV['HTTP_COMING_FROM'];
 108         }
 109         else if (@getenv('HTTP_COMING_FROM')) {
 110             $HTTP_COMING_FROM = getenv('HTTP_COMING_FROM');
 111         }
 112     } // end if
 113
 114     // Gets the default ip sent by the user
 115     if (!empty($REMOTE_ADDR)) {
 116         $direct_ip = $REMOTE_ADDR;
 117     }
 118
 119     // Gets the proxy ip sent by the user
 120     $proxy_ip     = '';
 121     if (!empty($HTTP_X_FORWARDED_FOR)) {
 122         $proxy_ip = $HTTP_X_FORWARDED_FOR;
 123     } else if (!empty($HTTP_X_FORWARDED)) {
 124         $proxy_ip = $HTTP_X_FORWARDED;
 125     } else if (!empty($HTTP_FORWARDED_FOR)) {
 126         $proxy_ip = $HTTP_FORWARDED_FOR;
 127     } else if (!empty($HTTP_FORWARDED)) {
 128         $proxy_ip = $HTTP_FORWARDED;
 129     } else if (!empty($HTTP_VIA)) {
 130         $proxy_ip = $HTTP_VIA;
 131     } else if (!empty($HTTP_X_COMING_FROM)) {
 132         $proxy_ip = $HTTP_X_COMING_FROM;
 133     } else if (!empty($HTTP_COMING_FROM)) {
 134         $proxy_ip = $HTTP_COMING_FROM;
 135     } // end if... else if...
 136
 137     // Returns the true IP if it has been found, else FALSE
 138     if (empty($proxy_ip)) {
 139         // True IP without proxy
 140         return $direct_ip;
 141     } else {
 142         $is_ip = preg_match('|^([0-9]{1,3}\.){3,3}[0-9]{1,3}|', $proxy_ip, $regs);
 143         if ($is_ip && (count($regs) > 0)) {
 144             // True IP behind a proxy
 145             return $regs[0];
 146         } else {
 147             // Can't define IP: there is a proxy but we don't have
 148             // information about the true IP
 149             return FALSE;
 150         }
 151     } // end if... else...
 152 } // end of the 'PMA_getIp()' function
 153
 154
 155 /**
 156  * Based on IP Pattern Matcher
 157  * Originally by J.Adams <jna@retina.net>
 158  * Found on <http://www.php.net/manual/en/function.ip2long.php>
 159  * Modified by Robbat2 <robbat2@users.sourceforge.net>
 160  *
 161  * Matches:
 162  * xxx.xxx.xxx.xxx        (exact)
 163  * xxx.xxx.xxx.[yyy-zzz]  (range)
 164  * xxx.xxx.xxx.xxx/nn     (CIDR)
 165  *
 166  * Does not match:
 167  * xxx.xxx.xxx.xx[yyy-zzz]  (range, partial octets not supported)
 168  *
 169  * @param   string   string of IP range to match
 170  * @param   string   string of IP to test against range
 171  *
 172  * @return  boolean    always true
 173  *
 174  * @access  public
 175  */
 176 function PMA_ipMaskTest($testRange, $ipToTest)
 177 {
 178    $result = TRUE;
 179
 180    if (preg_match('|([0-9]+)\.([0-9]+)\.([0-9]+)\.([0-9]+)/([0-9]+)|', $testRange, $regs)) {
 181        // performs a mask match
 182        $ipl    = ip2long($ipToTest);
 183        $rangel = ip2long($regs[1] . '.' . $regs[2] . '.' . $regs[3] . '.' . $regs[4]);
 184
 185        $maskl  = 0;
 186
 187        for ($i = 0; $i < 31; $i++) {
 188            if ($i < $regs[5] - 1) {
 189                $maskl = $maskl + pow(2, (30 - $i));
 190            } // end if
 191        } // end for
 192
 193        if (($maskl & $rangel) == ($maskl & $ipl)) {
 194            return TRUE;
 195        } else {
 196            return FALSE;
 197        }
 198    } else {
 199        // range based
 200        $maskocts = explode('.', $testRange);
 201        $ipocts   = explode('.', $ipToTest);
 202
 203        // perform a range match
 204        for ($i = 0; $i < 4; $i++) {
 205             if (preg_match('|\[([0-9]+)\-([0-9]+)\]|', $maskocts[$i], $regs)) {
 206                 if (($ipocts[$i] > $regs[2])
 207                     || ($ipocts[$i] < $regs[1])) {
 208                     $result = FALSE;
 209                 } // end if
 210             } else {
 211                 if ($maskocts[$i] <> $ipocts[$i]) {
 212                     $result = FALSE;
 213                 } // end if
 214             } // end if/else
 215        } //end for
 216    } //end if/else
 217
 218    return $result;
 219 } // end of the "PMA_IPMaskTest()" function
 220
 221
 222 /**
 223  * Runs through IP Allow/Deny rules the use of it below for more information
 224  *
 225  * @param   string 'allow' | 'deny' type of rule to match
 226  *
 227  * @return  bool   Matched a rule ?
 228  *
 229  * @access  public
 230  *
 231  * @see     PMA_getIp()
 232  */
 233 function PMA_allowDeny($type)
 234 {
 235     global $cfg;
 236
 237     // Grabs true IP of the user and returns if it can't be found
 238     $remote_ip = PMA_getIp();
 239     if (empty($remote_ip)) {
 240         return FALSE;
 241     }
 242
 243     // copy username
 244     $username  = $cfg['Server']['user'];
 245
 246     // copy rule database
 247     $rules     = $cfg['Server']['AllowDeny']['rules'];
 248
 249     // lookup table for some name shortcuts
 250     $shortcuts = array(
 251         'all'       => '0.0.0.0/0',
 252         'localhost' => '127.0.0.1/8'
 253     );
 254
 255     foreach($rules AS $rule) {
 256         // extract rule data
 257         $rule_data = explode(' ', $rule);
 258
 259         // check for rule type
 260         if ($rule_data[0] != $type) {
 261             continue;
 262         }
 263
 264         // check for username
 265         if (($rule_data[1] != '%') //wildcarded first
 266             && ($rule_data[1] != $username)) {
 267             continue;
 268         }
 269
 270         // check if the config file has the full string with an extra
 271         // 'from' in it and if it does, just discard it
 272         if ($rule_data[2] == 'from') {
 273             $rule_data[2] = $rule_data[3];
 274         }
 275
 276         // Handle shortcuts with above array
 277         // DON'T use "array_key_exists" as it's only PHP 4.1 and newer.
 278         if (isset($shortcuts[$rule_data[2]])) {
 279             $rule_data[2] = $shortcuts[$rule_data[2]];
 280         }
 281
 282         // Add code for host lookups here
 283         // Excluded for the moment
 284
 285         // Do the actual matching now
 286         if (PMA_ipMaskTest($rule_data[2], $remote_ip)) {
 287             return TRUE;
 288         }
 289     } // end while
 290
 291     return FALSE;
 292 } // end of the "PMA_AllowDeny()" function
 293
 294 ?>