Skip to content

Commit 0b204ea

Browse files
denisdulicidenisdulici
committed
added filter by input
1 parent f38dd78 commit 0b204ea

File tree

4 files changed

+78
-18
lines changed

4 files changed

+78
-18
lines changed

‎src/Abstracts/Middleware.php

Lines changed: 35 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -38,44 +38,44 @@ public function handle($request, Closure $next)
3838
public function skip($request)
3939
{
4040
$this->prepare($request);
41-
41+
4242
if (!$this->isEnabled()) {
4343
return true;
4444
}
45-
45+
4646
if ($this->isWhitelist()) {
4747
return true;
4848
}
49-
49+
5050
if (!$this->isMethod()) {
5151
return true;
5252
}
5353

5454
if ($this->isRoute()) {
5555
return true;
5656
}
57-
57+
5858
return false;
5959
}
60-
60+
6161
public function prepare($request)
6262
{
6363
$this->request = $request;
6464
$this->input = $request->input();
6565
$this->middleware = strtolower((new \ReflectionClass($this))->getShortName());
6666
$this->user_id = auth()->id() ?: 0;
6767
}
68-
68+
6969
public function isEnabled()
7070
{
7171
return config('firewall.enabled');
7272
}
73-
73+
7474
public function isWhitelist()
7575
{
7676
return in_array($this->ip(), config('firewall.whitelist'));
7777
}
78-
78+
7979
public function isMethod()
8080
{
8181
if (!$methods = config('firewall.middleware.' . $this->middleware . '.methods')) {
@@ -85,7 +85,7 @@ public function isMethod()
8585
if (in_array('all', $methods)) {
8686
return true;
8787
}
88-
88+
8989
return in_array(strtolower($this->request->method()), $methods);
9090
}
9191

@@ -113,23 +113,36 @@ public function isRoute()
113113

114114
return false;
115115
}
116-
116+
117+
public function isInput($name)
118+
{
119+
if (!$inputs = config('firewall.middleware.' . $this->middleware . '.inputs')) {
120+
return true;
121+
}
122+
123+
if (!empty($inputs['only']) && !in_array((string) $name, (array) $inputs['only'])) {
124+
return false;
125+
}
126+
127+
return !in_array((string) $name, (array) $inputs['except']);
128+
}
129+
117130
public function ip()
118131
{
119132
if ($cf_ip = $this->request->header('CF_CONNECTING_IP')) {
120133
$ip = $cf_ip;
121134
} else {
122135
$ip = $this->request->ip();
123136
}
124-
137+
125138
return $ip;
126139
}
127140

128141
public function getPatterns()
129142
{
130143
return config('firewall.middleware.' . $this->middleware . '.patterns', []);
131144
}
132-
145+
133146
public function check($patterns)
134147
{
135148
$log = null;
@@ -149,10 +162,10 @@ public function check($patterns)
149162
if ($log) {
150163
return true;
151164
}
152-
165+
153166
return false;
154167
}
155-
168+
156169
public function match($pattern, $input)
157170
{
158171
$result = false;
@@ -174,6 +187,10 @@ public function match($pattern, $input)
174187
break;
175188
}
176189

190+
if (!$this->isInput($key)) {
191+
continue;
192+
}
193+
177194
if (!$result = preg_match($pattern, $value)) {
178195
continue;
179196
}
@@ -183,7 +200,7 @@ public function match($pattern, $input)
183200

184201
return $result;
185202
}
186-
203+
187204
public function log()
188205
{
189206
$log = Log::create([
@@ -198,7 +215,7 @@ public function log()
198215

199216
return $log;
200217
}
201-
218+
202219
public function respond($response, $data = [])
203220
{
204221
if ($response['code'] == 200) {
@@ -208,7 +225,7 @@ public function respond($response, $data = [])
208225
if ($view = $response['view']) {
209226
return Response::view($view, $data);
210227
}
211-
228+
212229
if ($redirect = $response['redirect']) {
213230
if (($this->middleware == 'ip') && $this->request->is($redirect)) {
214231
abort($response['code'], trans('firewall::responses.block.message'));
@@ -220,7 +237,7 @@ public function respond($response, $data = [])
220237
if ($response['abort']) {
221238
abort($response['code'], trans('firewall::responses.block.message'));
222239
}
223-
240+
224241
return Response::make(trans('firewall::responses.block.message'), $response['code']);
225242
}
226243
}

‎src/Config/firewall.php

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,11 @@
169169
'except' => [], // i.e. 'admin/*'
170170
],
171171

172+
'inputs' => [
173+
'only' => [], // i.e. 'first_name'
174+
'except' => [], // i.e. 'password'
175+
],
176+
172177
'patterns' => [
173178
'#\.\/#is',
174179
],
@@ -198,6 +203,11 @@
198203
'except' => [], // i.e. 'admin/*'
199204
],
200205

206+
'inputs' => [
207+
'only' => [], // i.e. 'first_name'
208+
'except' => [], // i.e. 'password'
209+
],
210+
201211
'patterns' => [
202212
'bzip2://',
203213
'expect://',
@@ -243,6 +253,11 @@
243253
'except' => [], // i.e. 'admin/*'
244254
],
245255

256+
'inputs' => [
257+
'only' => [], // i.e. 'first_name'
258+
'except' => [], // i.e. 'password'
259+
],
260+
246261
'patterns' => [
247262
'#(http|ftp){1,1}(s){0,1}://.*#i',
248263
],
@@ -264,6 +279,11 @@
264279
'except' => [], // i.e. 'admin/*'
265280
],
266281

282+
'inputs' => [
283+
'only' => [], // i.e. 'first_name'
284+
'except' => [], // i.e. 'password'
285+
],
286+
267287
'patterns' => [
268288
'@[\|:]O:\d{1,}:"[\w_][\w\d_]{0,}":\d{1,}:{@i',
269289
'@[\|:]a:\d{1,}:{@i',
@@ -284,6 +304,11 @@
284304
'except' => [], // i.e. 'admin/*'
285305
],
286306

307+
'inputs' => [
308+
'only' => [], // i.e. 'first_name'
309+
'except' => [], // i.e. 'password'
310+
],
311+
287312
'patterns' => [
288313
'#[\d\W](union select|union join|union distinct)[\d\W]#is',
289314
'#[\d\W](union|union select|insert|from|where|concat|into|cast|truncate|select|delete|having)[\d\W]#is',
@@ -304,6 +329,11 @@
304329
'except' => [], // i.e. 'admin/*'
305330
],
306331

332+
'inputs' => [
333+
'only' => [], // i.e. 'first_name'
334+
'except' => [], // i.e. 'password'
335+
],
336+
307337
'words' => [],
308338

309339
'auto_block' => [
@@ -342,6 +372,11 @@
342372
'except' => [], // i.e. 'admin/*'
343373
],
344374

375+
'inputs' => [
376+
'only' => [], // i.e. 'first_name'
377+
'except' => ['password', 'password_confirmation'], // i.e. 'password'
378+
],
379+
345380
'patterns' => [
346381
'#<[^>]*\w*\"?[^>]*>#is',
347382
],

‎src/Middleware/Php.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@ public function match($pattern, $input)
2727
break;
2828
}
2929

30+
if (!$this->isInput($key)) {
31+
continue;
32+
}
33+
3034
if (!$result = (stripos($value, $pattern) === 0)) {
3135
continue;
3236
}

‎src/Middleware/Rfi.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,10 @@ public function match($pattern, $input)
3131
break;
3232
}
3333

34+
if (!$this->isInput($key)) {
35+
continue;
36+
}
37+
3438
if (!$result = preg_match($pattern, $this->applyExceptions($value))) {
3539
continue;
3640
}

0 commit comments

Comments
 (0)