WordPress.org
Get WordPress

Plugin Directory

Changeset 1782465


Ignore:
Timestamp:
12/07/2017 09:00:28 AM (8 years ago)
Author:
osexcel
Message:

7.1.3

  • Bug fix : Update links

7.1.2

  • Bug fix : detecting Joomla version ,change in the location of version.php file
  • Bug fix :Fixed var management bug - add white listed vars to request back
  • Updated version tags
Location:
ose-firewall/trunk
Files:
9 edited

Legend:

Unmodified
Added
Removed

  • ose-firewall/trunk/assets/views/login.php

    r1741247 r1782465  
    2424                <div class="col-sm-4">
    2525                    <div class="vs-line-1">
    26                         <a href="https://www.centrora.com/services/subscribe">
     26                        <a href="https://www.centrora.com/services/hosting-services-pricing">
    2727                        <div id="fw-overview" class="vs-line-1-title fw-hover"> <i class="fa fa-shopping-cart"></i></div>
    2828                        <div class="vs-line-1-number">
    … …  
    3434                <div class="col-sm-4">
    3535                    <div class="vs-line-1">
    36                         <a href="https://www.centrora.com/services">
     36                        <a href="https://www.centrora.com/services/hosting-services-pricing">
    3737                        <div id="fw-overview" class="vs-line-1-title fw-hover"> <i class="fa fa-info-circle"></i></div>
    3838                        <div class="vs-line-1-number">

  • ose-firewall/trunk/assets/views/whitelistmgmt.php

    r1762549 r1782465  
    5757                                    <select class="form-control" id="statusfield" name ="statusfield">
    5858                                        <option value="2"><?php oLang::_('O_SCANVARIABLES');?></option>
    59                                         <option value="1"><?php oLang::_('O_FILTERVARIABLES');?></option>
    6059                                        <option value="0"><?php oLang::_('O_WHITELISTVARIABLES');?></option>
    6160                                    </select>
    … …  
    145144                                    <button data-target="#formModal" data-toggle="modal" class="upload-btns wl-btns"><i class="text-primary glyphicon glyphicon-plus-sign"></i> <?php oLang::_('ADD_A_VARIABLE'); ?></button>
    146145                                    <button class="upload-btns wl-btns" type="button" onClick="changeBatchItemStatus('scan')"><i class="text-block glyphicon glyphicon-minus-sign"></i> <?php oLang::_('SCAN_VARIABLE'); ?></button>
    147                                     <button class="upload-btns wl-btns" type="button" onClick="changeBatchItemStatus('filter')"><i class="text-yellow glyphicon glyphicon-eye-open"></i> <?php oLang::_('FILTER_VARIABLE'); ?></button>
    148146                                    <button class="upload-btns wl-btns" type="button" onClick="changeBatchItemStatus('whitelist')"><i class="text-success glyphicon glyphicon-ok-sign"></i> <?php oLang::_('IGNORE_VARIABLE'); ?></button>
    149147                                    <?php

  • ose-firewall/trunk/classes/App/Model/BaseModel.php

    r1730340 r1782465  
    519519        return '<div class="row row-set" style="margin-top:14px;">
    520520                                <div class="col-sm-12" style="padding-left: 0px; padding-right: 20px;">
    521                                  <a href="https://www.centrora.com/services/" target="_blank"><div class="call-to-action">
     521                                 <a href="https://www.centrora.com/services/hosting-services-pricing" target="_blank"><div class="call-to-action">
    522522                                    <div class="call-to-action-txt">
    523523                                    <img width="35" height="35" alt="C_puma" src="'.OSE_FWPUBLICURL.'/images/C_puma.png"> &nbsp;

  • ose-firewall/trunk/classes/Library/fwscannerv7/fwscannerv7.php

    r1765585 r1782465  
    6464    private $allowExts = array();
    6565    protected $replaced = array();
     66    protected  $detected_whitelistedVars = array();
     67    protected  $orignal_request_backup = array();
    6668
    6769    //run shell commands
    … …  
    808810        $subscription_status = oseFirewallBase::checkSubscriptionStatus(false);
    809811        $this->type = $type;
    810 
    811812        $request = $this->getRequestVariables($type);
    812813        $this->original_request = $request; //store the value of original request
    813814        $this->detected_pentest = false;
     815        $this->orignal_request_backup = $request;
    814816        if(is_array($request) && !empty($request))
    815817        {
    816             $flatarray = $this->array_flatten($request);
    817 
     818            //remove white listed vars
     819            $request_variablesfiltered = $this->removeWhiteListVariable($request,$type);
     820            $flatarray = $this->array_flatten($request_variablesfiltered);
    818821            $request_stringsfiltered = $this->hasWhiteListString();
    819822            if(array_key_exists('accountpath',$flatarray))
    … …  
    822825            }
    823826            if(!$request_stringsfiltered)
    824            {
     827            {
    825828               //does not have any white list string
    826                $request_variablesfiltered = $this->removeWhiteListVariable($flatarray);
    827                //removed all the whitelisted variables
     829               unset($request_variablesfiltered);
     830               $request_variablesfiltered = $flatarray;
    828831               if(!empty($request_variablesfiltered))
    829832               {
    … …  
    866869                               if($this->detected_pentest== false)
    867870                               {
    868                                    $completereq = $this->getTheOriginalArrayStrucutre($request_variablesfiltered);
     871                                   $temp_completereq = $this->getTheOriginalArrayStrucutre($request_variablesfiltered);
     872                                   $completereq = $this->addWhiteListedVarsBack($temp_completereq);
    869873                                   $this->setRequestVariables($completereq,$type);
    870874                               }
    871875                               else {
    872                                    $completereq = $this->getTheOriginalArrayStrucutre($request_variablesfiltered_decoded);
     876                                   $temp_completereq = $this->getTheOriginalArrayStrucutre($request_variablesfiltered_decoded);
     877                                   $completereq = $this->addWhiteListedVarsBack($temp_completereq);
    873878                                   $this->setRequestVariables($completereq,$type);
    874879                               }
    … …  
    881886                               if($this->detected_pentest == false)
    882887                               {
    883                                    $completereq = $this->getTheOriginalArrayStrucutre($request_variablesfiltered);
     888                                   $temp_completereq = $this->getTheOriginalArrayStrucutre($request_variablesfiltered);
     889                                   $completereq = $this->addWhiteListedVarsBack($temp_completereq);
    884890                                   $this->setRequestVariables($completereq,$type);
    885891                               }else {
    886                                    $completereq = $this->getTheOriginalArrayStrucutre($temp);
     892                                   $temp_completereq = $this->getTheOriginalArrayStrucutre($temp);
     893                                   $completereq = $this->addWhiteListedVarsBack($temp_completereq);
    887894                                   $this->setRequestVariables($completereq,$type);
    888895                               }
    … …  
    892899                   }
    893900                   unset($this->completerequest);
     901                   unset($this->detected_whitelistedVars);
    894902//                   return $result;
    895903                   return false;
    … …  
    900908                 ////continue
    901909                 //return true //safe to use
     910                   unset($this->detected_whitelistedVars);
    902911                   return true;
    903912               }
    … …  
    905914           else{
    906915               //white list string was detected
     916               unset($this->detected_whitelistedVars);
    907917               return true;
    908918           }
    … …  
    911921        {
    912922            return true;
     923        }
     924    }
     925
     926
     927    //white list variables are removed from the scanning request
     928    //add them back to make sure the white listed vars are not ignored in the final requets
     929    public function addWhiteListedVarsBack($filtered_request)
     930    {
     931        if(!empty($this->detected_whitelistedVars))
     932        {
     933            foreach($this->detected_whitelistedVars as $whitelistedVarKey)
     934            {
     935                if(isset($this->orignal_request_backup[$whitelistedVarKey]))
     936                {
     937                    $filtered_request[$whitelistedVarKey] = $this->orignal_request_backup[$whitelistedVarKey];
     938                }
     939            }
     940            return $filtered_request;
     941        }else{
     942            return $filtered_request;
    913943        }
    914944    }
    … …  
    12351265
    12361266    //check if the the white listed variables from the user exists in the request
    1237     public function removeWhiteListVariable($temp)
     1267    public function removeWhiteListVariable($temp,$type)
    12381268    {
    12391269        $variablelist = null;
    … …  
    12441274        }else
    12451275        {
    1246             $whiteListVariables = $this->getWhiteListedVariables($variablelist);
     1276            $whiteListVariables = $this->getWhiteListedVariables($variablelist,$type);
    12471277            foreach($temp as $reqkey => $reqvalue)
    12481278            {
    12491279                if(in_array(urldecode($reqkey),$whiteListVariables))
    12501280                {
     1281                    array_push($this->detected_whitelistedVars,$reqkey);
    12511282                    unset($temp[$reqkey]);
    12521283                }
    … …  
    12561287    }
    12571288
    1258     public function getWhiteListedVariables($variablelist)
     1289    public function getWhiteListedVariables($variablelist,$type)
    12591290    {
    12601291        $whiteListVariables = array();
    … …  
    12621293        {
    12631294            $temp = explode('.',$record['variable']);
    1264             array_push($whiteListVariables,$temp[1]);
     1295            if($temp[0] == $type || $temp[0] == strtolower($type))
     1296            {
     1297                array_push($whiteListVariables,$temp[1]);
     1298            }
    12651299        }
    12661300        return $whiteListVariables;

  • ose-firewall/trunk/classes/Library/fwscannerv7/fwstatsv7.php

    r1741247 r1782465  
    185185        if(is_array($valuesArray))
    186186        {
    187             $strings = implode("<br/>",$valuesArray);
     187            if(count($valuesArray) == 1)
     188            {
     189                $temp_strings = explode('#',$valuesArray[0]);
     190                $strings = $temp_strings[0];
     191            }else{
     192                $temp_string = $valuesArray;
     193                $strings = implode("",$temp_string);
     194            }
    188195            $finalString = '<td class=\'shrink\' ><a href=\'javascript:void(0);\' title = \'Click to white List the variable\' onClick="whitelist_confirm(\'' . $strings . '\')">'.$strings."</a></td>";
    189196            return $finalString;
    … …  
    193200                $finalString = '<td class=\'shrink\'>'.$valuesArray."</a></td>";
    194201            }else{
    195                 $finalString = '<td class=\'shrink\' ><a href=\'javascript:void(0);\' title = \'Click to white List the variable\' onClick="whitelist_confirm(\'' . $valuesArray . '\')">'.$valuesArray."</a></td>";
     202                $temp_strings = explode('#',$valuesArray[0]);
     203                $finalString = '<td class=\'shrink\' ><a href=\'javascript:void(0);\' title = \'Click to white List the variable\' onClick="whitelist_confirm(\'' . $temp_strings[0] . '\')">'.$temp_strings[0]."</a></td>";
    196204            }
    197205            return $finalString;

  • ose-firewall/trunk/classes/Library/oem/oem.php

    r1741247 r1782465  
    9999                        <li><a href="https://www.centrora.com/my-account" title="My Account"><i class="glyphicon glyphicon-user"></i> <span class="hidden-xs hidden-sm hidden-md">My Account</span> </a></li>
    100100                        <li><a href="https://www.centrora.com/support" id="support-center" title="Support"><i class="glyphicon glyphicon-cd"></i> <span class="hidden-xs hidden-sm hidden-md">Support</span></a></li>
    101                         <li><a href="https://www.centrora.com/services/subscribe" title="Subscription"><i class="glyphicon glyphicon-share-alt"></i> <span class="hidden-xs hidden-sm hidden-md">Subscription</span></a></li>
     101                        <li><a href="https://www.centrora.com/services/hosting-services-pricing" title="Subscription"><i class="glyphicon glyphicon-share-alt"></i> <span class="hidden-xs hidden-sm hidden-md">Subscription</span></a></li>
    102102                        <li><a href="https://docs.centrora.com/en/latest/" title="Tutorial"><i class="glyphicon glyphicon-book"></i> <span class="hidden-xs hidden-sm hidden-md">Tutorial</span></a></li>
    103                         <li><a href="https://www.centrora.com/services" title="Malware Removal"><i class="glyphicon glyphicon-screenshot"></i> <span class="hidden-xs hidden-sm hidden-md">Malware Removal</span></a></li>';
     103                        <li><a href="https://www.centrora.com/services/hosting-services-pricing" title="Malware Removal"><i class="glyphicon glyphicon-screenshot"></i> <span class="hidden-xs hidden-sm hidden-md">Malware Removal</span></a></li>';
    104104            return $urls;
    105105        }
    … …  
    245245            if (!(defined('OSE_OEM_URL_PREMIUM_TUT'))) define('OSE_OEM_URL_PREMIUM_TUT', 'https://docs.centrora.com/en/latest/activate-premium.html');
    246246            if (!(defined('OSE_OEM_URL_AFFILIATE'))) define('OSE_OEM_URL_AFFILIATE', 'https://www.centrora.com/services/affiliate');
    247             if (!(defined('OSE_OEM_URL_SUBSCRIBE'))) define('OSE_OEM_URL_SUBSCRIBE', 'https://www.centrora.com/services/subscribe');
     247            if (!(defined('OSE_OEM_URL_SUBSCRIBE'))) define('OSE_OEM_URL_SUBSCRIBE', 'https://www.centrora.com/services/hosting-services-pricing');
    248248            if (!(defined('OSE_OEM_LANG_TAG'))) define('OSE_OEM_LANG_TAG','');
    249249        }

  • ose-firewall/trunk/ose_firewall_badge.php

    r1775810 r1782465  
    44   Description: Plugin For Showing Centrora Security Badge
    55   Author: Centrora Security
    6    Version: 7.1.1
     6   Version: 7.1.3
    77*/
    88include(dirname(__FILE__).'/includes/oseBadgeWidget.php');

  • ose-firewall/trunk/ose_wordpress_firewall.php

    r1775810 r1782465  
    55Description: Centrora Security (previously OSE Firewall) - A WordPress Security Firewall plugin created by Centrora. Protect your WordPress site by identify any malicious codes, spam, virus, SQL injection, and security vulnerabilities.
    66Author: Centrora (Previously ProWeb)
    7 Version: 7.1.1
     7Version: 7.1.3
    88Author URI: http://www.centrora.com/
    99*/

  • ose-firewall/trunk/readme.txt

    r1775810 r1782465  
    66Requires at least: 3.7
    77Tested up to: 4.8.2
    8 Stable tag: 7.1.1
     8Stable tag: 7.1.3
    99License: GPLv2 or later
    1010License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    170170
    171171== Changelog ==
     172
     173= 7.1.3 =
     174* Bug fix : Update links
     175
     176= 7.1.2 =
     177* Bug fix : detecting Joomla version ,change in the location of version.php file
     178* Bug fix :Fixed var management bug - add white listed vars to request back
     179* Updated version tags
    172180
    173181= 7.1.1 =
Note: See TracChangeset for help on using the changeset viewer.