Skip to content

Commit e63a14d

Browse files
firesunCNfiresunCN
committed
Version 3.4.0
1. 增加了ADMIN_IP_CHECK_ENABLE与XFF_ENABLE两个选项，在有反代或负载均衡的情况下可开启XFF_ENABLE，关闭ADMIN_IP_CHECK_ENABLE 2. 修复一系列bug
1 parent 2377ad9 commit e63a14d

11 files changed

+448
-394
lines changed

‎admin.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?php
22
define("IN_XSS_PLATFORM", true);
3-
require("auth.php");
3+
require_once("auth.php");
44
?>
55
<!DOCTYPE html>
66
<html>

‎api.php

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
<?php
2+
error_reporting(0);
23
define("IN_XSS_PLATFORM", true);
34
require_once('auth.php');
4-
require_once("load.php");
5-
require_once("functions.php");
65
require_once("dio.php");
76
header('Content-Type: application/json');
87

‎auth.php

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,24 @@
33
exit('Access Denied');
44
}
55

6+
require_once("functions.php");
7+
68
//设置httponly
79
ini_set("session.cookie_httponly", 1);
810
session_start();
911

1012
//判断登陆情况，ip和useragent是否改变，改变则强制退出
11-
if (!(isset($_SESSION['isLogin']) && $_SESSION['isLogin'] === true && isset($_SESSION['user_IP']) && $_SESSION['user_IP'] != "" && $_SESSION['user_IP'] === $_SERVER['REMOTE_ADDR'] && isset($_SESSION['user_agent']) && $_SESSION['user_agent'] != "" && $_SESSION['user_agent'] === $_SERVER['HTTP_USER_AGENT'])) {
13+
if ( !(isset($_SESSION['isLogin']) && $_SESSION['isLogin'] === true && isset($_SESSION['user_agent']) && $_SESSION['user_agent'] != "" && $_SESSION['user_agent'] === $_SERVER['HTTP_USER_AGENT']) ) {
14+
$_SESSION['isLogin'] = false;
15+
$_SESSION['user_IP'] = "";
16+
$_SESSION['user_agent'] = "";
17+
session_unset();
18+
session_destroy();
19+
header("Location: login.php");
20+
exit();
21+
}
22+
23+
if ( ADMIN_IP_CHECK_ENABLE && !(isset($_SESSION['user_IP']) && $_SESSION['user_IP'] != "" && $_SESSION['user_IP'] === getRealIP()) ) {
1224
$_SESSION['isLogin'] = false;
1325
$_SESSION['user_IP'] = "";
1426
$_SESSION['user_agent'] = "";

‎config-sample.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111
define("ENCRYPT_PASS", "bluelotus"); //加密密码
1212
define("ENCRYPT_TYPE", "RC4"); //加密方法（AES或RC4）
1313
define("KEEP_SESSION", true); //是否启用KEEP_SESSION功能，需要外部定时访问keepsession.php
14+
define("ADMIN_IP_CHECK_ENABLE", true);//是否启用管理员ip认证，启用后，当xss平台发现ip变化，将会踢出管理员要求重新登录，如果发现经常异常退出控制面板，请关闭此项认证
15+
define("XFF_ENABLE", false);//是否使用HTTP_X_FORWARDED_FOR的地址来代替REMOTE_ADDR，当且仅当存在反代的情况下才须开启，开启须谨慎！
1416
define("IPDATA_PATH", "qqwry.dat"); //ip归属地数据库地址
1517

1618
/*邮件通知相关配置*/

‎dio.php

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
if ( !defined('IN_XSS_PLATFORM') ) {
33
exit('Access Denied');
44
}
5-
require_once("load.php");
65
require_once("functions.php");
76

87
//时间戳的正则表达式

‎functions.php

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,27 @@ function decrypt($info) {
121121
return $info;
122122
}
123123

124+
//获得访问者真实ip
125+
function getRealIP(){
126+
$ip="unknown";
127+
if (XFF_ENABLE) {
128+
foreach (array('HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_FORWARDED_FOR', 'HTTP_VIA', 'HTTP_FROM', 'REMOTE_ADDR') as $v) {
129+
if (isset($_SERVER[$v])) {
130+
if (! preg_match('/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/', $_SERVER[$v])) {
131+
continue;
132+
}
133+
$ip = $_SERVER[$v];
134+
break;
135+
}
136+
}
137+
}
138+
else {
139+
if ( isset($_SERVER['REMOTE_ADDR']) )
140+
$ip = $_SERVER['REMOTE_ADDR'];
141+
}
142+
return $ip;
143+
}
144+
124145
//基于Discuz X3.1 function_misc.php 函数已过滤，可直接输出
125146
function convertip($ip, $ipdatafile) {
126147
$ipaddr = '未知';

‎index.php

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,20 +3,19 @@
33
ignore_user_abort(true);
44
error_reporting(0);
55

6-
//sometimes we only need "referfer".
6+
//sometimes we only need "referer".
77

88
/*
99
if(count($_GET)==0&&count($_POST)==0&&count($_COOKIE)==0)
1010
exit();
1111
*/
1212
header("Access-Control-Allow-Origin:*");
13-
require_once("load.php");
1413
require_once("functions.php");
1514
require_once("dio.php");
1615

1716
$info = array();
1817

19-
$user_IP = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : "unknown";
18+
$user_IP = getRealIP();
2019
$user_port = isset($_SERVER['REMOTE_PORT']) ? $_SERVER['REMOTE_PORT'] : "unknown";
2120
$protocol = isset($_SERVER['SERVER_PROTOCOL']) ? $_SERVER['SERVER_PROTOCOL'] : "unknown";
2221
$request_method = isset($_SERVER['REQUEST_METHOD']) ? $_SERVER['REQUEST_METHOD'] : "unknown";

0 commit comments

Comments
 (0)