Monday, September 5, 2011

Standard Vulnerability issue fix in Drupal

Hook Menu Creation:

$items['admin/links/vulnerable_url_list'] = array(
      'title' => t('Vulnerable URLs'),
      'description' => t('Manage The Vulnerabe URLs.'), 
      'page callback' => 'drupal_get_form',
      'page arguments' => array('vulnerable_url_list'),
      'access arguments' => array('access administration pages')
   );

Hook Function call:

/**
 *
 * Vulnerable URL's
 */
function vulnerable_url_list(){
    $form['vulnerable_link_lists'] = array(
    '#type' => 'textarea',
    '#title' =>  t('Vulnerable URLs'),
    '#description' => t('Vulnerable URL (each URL in separate line)'),
    '#default_value' => variable_get('vulnerable_link_lists', ''),
  );
  return system_settings_form($form);
}

Redirect Vulnerable URLs into Home page:

/* Redirect Vulnerable URLs into Home page for
   Both Authenticated and UnAuthenticated users */
function redirectVulnerablelinkstoHomePage(){
  global $user;
 
  /* Restricting rss.xml file access for Auth & UnAuthenticated users */
  if (preg_match("/rss.xml/", $_SERVER['REQUEST_URI'], $matches)) {
      $home_page = "http://" . $_SERVER['HTTP_HOST'] . base_path(); 
      drupal_goto($home_page);
  }
 
  /* ImCE folder access not to be happend */
  if (preg_match("/imce/", $_SERVER['REQUEST_URI'], $matches)) {
      $home_page = "http://" . $_SERVER['HTTP_HOST'] . base_path(); 
      drupal_goto($home_page);
  }
 
  /* Vulnerable URLs given from Admin Interface */
  if (!$user->uid){
    $vulnerable_links = variable_get("vulnerable_link_lists", "");
    $parseurl = parse_url($_SERVER['PHP_SELF']);
   
    foreach(explode("\n", $vulnerable_links) as $url){
        $url = trim($url);
        if ($url){
           
            $url = str_replace("/", "\/", $url); /* Replacing slashes into System readeable */
            $url = str_replace(range(0,9), "*", $url); /* Replacing Numbers into * (Astrisk) */
            $match_data = "/".$url."/";
            //echo "<br>".$match_data;
           
            if (preg_match($match_data, $_SERVER['REQUEST_URI'], $matches)) {
                //echo " found. ".$matches[0];
                $home_page = "http://" . $_SERVER['HTTP_HOST'] . base_path(); 
                drupal_goto($home_page);
            }    
       
        }
       
    }
   
  } 
}

Function CALL from Hook_init() - Redirect Vulnerable URLs into Home page:

/* Redirect function call from Hook_init() from any of the Commonly using Module
   More over this module must run for Front end as well as Back End purpose */

/**
 * Function to Implement hook_init
 */
function gems_administrator_init() {
    redirectVulnerablelinkstoHomePage();
}

No comments:

Post a Comment

Followers