Skip to content
This repository was archived by the owner on May 19, 2025. It is now read-only.

Commit 3d243b4

Browse files
joshp23joshp23
committed
Version 2.3.0
- api to add current IP from whitelist - api to delete specified IP from whitelist
1 parent f2f6aaa commit 3d243b4

File tree

2 files changed

+144
-1
lines changed

2 files changed

+144
-1
lines changed

‎README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ Here are a few of HTTP:BL's features
1414
5. Flush the log table and start fresh whenever you want.
1515
6. Self-managing: this plugin will (optionally) drop its tables when deactivated, and will create its own tables on activation.
1616
7. Whitelist IP addressess to skip checks; autodetection and 1-click addition of the current IP.
17+
8. An API for White-List maintanence.
1718

1819
## REQUIREMENTS
1920

@@ -31,6 +32,7 @@ Here are a few of HTTP:BL's features
3132
- `ip` the offending IP address
3233
- `type` the threat type (eg: content spammer)
3334
- `level` the threat level (0-255)
35+
5. For information regarding the API, see the http:BL page in the Admin area.
3436

3537
#### NOTE:
3638
In order for this to work on your public page you have to make sure that
@@ -46,6 +48,10 @@ include 'header.php';
4648
#### NOTE:
4749
The sql table may need to be added manually using `httpBL/assets/httpBL.sql`
4850

51+
52+
#### HINT:
53+
Use a script that manages callbacks and stores IP addresses in a flat file to update and delete IP's in the white-list automagically via cron.
54+
4955
### TODO:
5056
1. Add dynamic and randomized honeypot "quicklinks" to all rendered pages - this will likely come in the form of a custom index page, or footer script.
5157

‎httpBL/plugin.php‎

Lines changed: 138 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Plugin Name: HTTP:BL
44
Plugin URI: https://github.com/joshp23/YOURLS-httpBL
55
Description: An implementation of Project Honeypot's http:BL for YOURLS
6-
Version: 2.2.0
6+
Version: 2.3.0
77
Author: Josh Panter
88
Author URI: https://unfettered.net
99
**/
@@ -60,6 +60,11 @@ function httpBL_do_page() {
6060
$lub_chk = ( $opt[6] == "true" ? 'checked' : null ); // Log Unblocked visitors?
6161
$log_vis = ( $opt[5] == "true" || $opt[6] == "true" ? 'inline' : 'none' ); // Show log tab?
6262
63+
// Misc for cron example pre-formatting
64+
$sig = yourls_auth_signature();
65+
$site = YOURLS_SITE;
66+
$cronEG = rawurlencode('<html><body><pre>0 * * * * wget -O - -q -t 1 <strong>'.$site.'</strong>/yourls-api.php?signature=<strong>'.$sig.'</strong>&format=simple&action=httpBL-WL >/dev/null 2>&1</pre></body></html>');
67+
6368
// Create nonce
6469
$nonce = yourls_create_nonce( 'httpBL' );
6570

@@ -73,6 +78,7 @@ function httpBL_do_page() {
7378
<li class="selected"><a href="#stat_tab_behavior"><h2>http:BL Config</h2></a></li>
7479
<li><a href="#stat_tab_httpBL_wl"><h2>White List</h2></a></li>
7580
<li style="display:$log_vis;"><a href="#stat_tab_logs"><h2>Logs</h2></a></li>
81+
<li><a href="#stat_tab_httpBL_api"><h2>API</h2></a></li>
7682
</ul>
7783
</div>
7884
@@ -224,6 +230,21 @@ function httpBL_do_page() {
224230
httpBL_log_view($log_vis,$nonce);
225231
// Close the html
226232
echo <<<HTML
233+
<div id="stat_tab_httpBL_api" class="tab">
234+
<h3>Definitions</h3>
235+
<p>This plugin exposes a simple API for White List updating and maintanence. Using a cron job, an admin could keep an IP with a dynamically updating address current in the white-list.</p>
236+
<ul>
237+
<li><code>action=httpBL</code> If sent alone, the transmitting IP will be added to the white-list if it is absent.</li>
238+
<li><code>note=STRING</code> Notes for when adding IP's to the white-list. Optional.</li>
239+
<li><code>deleteIP=VALID_IP</code> Self explanatory. Optional.</li>
240+
</ul>
241+
<p><strong>Note: </strong> API use is restricted to valid users only.</p>
242+
243+
<h3>Cron example:</h3>
244+
<p>Use the following pre-formatted example to set up a daily cron job to check for IP updates:</p>
245+
<iframe src="data:text/html;charset=utf-8,$cronEG" width="100%" height="51"/></iframe>
246+
<p>Look here for more info on <a href="https://help.ubuntu.com/community/CronHowto" target="_blank" >cron</a> and <a href="https://www.gnu.org/software/wget/manual/html_node/HTTP-Options.html" target="_blank">wget</a>.</p>
247+
</div>
227248
</div>
228249
</div>
229250
HTML;
@@ -951,4 +972,120 @@ function httpBL_deactivate() {
951972
}
952973
}
953974
}
975+
/*
976+
*
977+
* API
978+
*
979+
* action=httpBL-WL
980+
*
981+
* Optional:
982+
* notes='STRING'
983+
*
984+
* Alternate:
985+
* deleteIP='IP_ADDRESS'
986+
*
987+
*/
988+
// This funtion exposes an API to check and whitelist an IP (think cron)
989+
yourls_add_filter( 'api_action_httpBL-WL', 'httpBL_ip_API' );
990+
function httpBL_ip_API() {
991+
// only authorized users
992+
$auth = yourls_is_valid_user();
993+
if( $auth !== true ) {
994+
$format = ( isset($_REQUEST['format']) ? $_REQUEST['format'] : 'xml' );
995+
$callback = ( isset($_REQUEST['callback']) ? $_REQUEST['callback'] : '' );
996+
yourls_api_output( $format, array(
997+
'simple' => $auth,
998+
'message' => $auth,
999+
'errorCode' => 403,
1000+
'callback' => $callback,
1001+
) );
1002+
}
1003+
1004+
// Stripping an IP of WL status
1005+
if( isset ( $_REQUEST['deleteIP'] ) ) {
1006+
$ip = $_REQUEST['deleteIP'];
1007+
// Is it in the db?
1008+
if( httpBL_wl_chk($ip) ) {
1009+
// try to remove it
1010+
global $ydb;
1011+
$table = 'httpBL_wl';
1012+
if (version_compare(YOURLS_VERSION, '1.7.3') >= 0) {
1013+
$binds = array('ip' => $ip);
1014+
$sql = "DELETE FROM `$table` WHERE ip=:ip";
1015+
$delete = $ydb->fetchAffected($sql, $binds);
1016+
} else {
1017+
$delete = $ydb->query("DELETE FROM `$table` WHERE ip='$ip'");
1018+
}
1019+
1020+
if( $delete ) {
1021+
// Success
1022+
return array(
1023+
'statusCode' => 200,
1024+
'code' => 1,
1025+
'simple' => "IP removed from whitelist..",
1026+
'message' => 'IP_status: removed',
1027+
);
1028+
} else {
1029+
// DB Failure
1030+
return array(
1031+
'statusCode' => 500,
1032+
'code' => -1,
1033+
'simple' => "Unknown error: IP not removed",
1034+
'message' => 'Unknwon error',
1035+
);
1036+
}
1037+
} else {
1038+
// Fail: MIA
1039+
return array(
1040+
'statusCode' => 404,
1041+
'code' => 0,
1042+
'simple' => "IP not found in whitelist..",
1043+
'message' => 'IP_status: not found',
1044+
);
1045+
}
1046+
}
1047+
1048+
$ip = yourls_get_ip();
1049+
$wl = httpBL_wl_chk($ip);
1050+
1051+
if($wl) {
1052+
// no update requried
1053+
return array(
1054+
'statusCode' => 200,
1055+
'code' => 0,
1056+
'simple' => "This IP is already in the whitelist. Nothing to do here.",
1057+
'message' => 'IP_status: already listed',
1058+
);
1059+
} else {
1060+
// prepare notes
1061+
$notes = ( isset( $_REQUEST['notes'] ) ? $_REQUEST['notes'] : 'Added via API' );
1062+
1063+
global $ydb;
1064+
$table = 'httpBL_wl';
1065+
if (version_compare(YOURLS_VERSION, '1.7.3') >= 0) {
1066+
$binds = array('ip' => $ip, 'notes' => $notes);
1067+
$sql = "REPLACE INTO `$table` (ip, notes) VALUES (:ip, :notes)";
1068+
$insert = $ydb->fetchAffected($sql, $binds);
1069+
} else {
1070+
$insert = $ydb->query("REPLACE INTO `httpBL_wl` (ip, notes) VALUES ('$ip', '$notes')");
1071+
}
1072+
if ($insert) {
1073+
// Success
1074+
return array(
1075+
'statusCode' => 200,
1076+
'code' => 1,
1077+
'simple' => "$ip whitelisted",
1078+
'message' => 'IP_status: updated',
1079+
);
1080+
} else {
1081+
// DB Failure
1082+
return array(
1083+
'statusCode' => 500,
1084+
'code' => -1,
1085+
'simple' => "Unknown error: IP not inserted",
1086+
'message' => 'Unknwon error',
1087+
);
1088+
}
1089+
}
1090+
}
9541091
?>

0 commit comments

Comments
 (0)