[2] | 1 | #!/usr/bin/perl
|
---|
| 2 | # quickndirty browse-the-damned-by-web
|
---|
[40] | 3 | ##
|
---|
| 4 | # $Id: browse.cgi 69 2018-07-19 21:03:38Z kdeugau $
|
---|
[67] | 5 | # Copyright 2009-2012,2014,2018 Kris Deugau <kdeugau@deepnet.cx>
|
---|
[40] | 6 | #
|
---|
| 7 | # This program is free software: you can redistribute it and/or modify
|
---|
| 8 | # it under the terms of the GNU General Public License as published by
|
---|
| 9 | # the Free Software Foundation, either version 3 of the License, or
|
---|
| 10 | # (at your option) any later version.
|
---|
| 11 | #
|
---|
| 12 | # This program is distributed in the hope that it will be useful,
|
---|
| 13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
| 14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
---|
| 15 | # GNU General Public License for more details.
|
---|
| 16 | #
|
---|
| 17 | # You should have received a copy of the GNU General Public License
|
---|
| 18 | # along with this program. If not, see <http://www.gnu.org/licenses/>.
|
---|
| 19 | ##
|
---|
[2] | 20 |
|
---|
| 21 | use strict;
|
---|
| 22 | use warnings;
|
---|
| 23 | use DBI;
|
---|
| 24 | use CGI::Carp qw(fatalsToBrowser);
|
---|
[67] | 25 | use CGI::Simple;
|
---|
[2] | 26 | use HTML::Template;
|
---|
| 27 |
|
---|
[69] | 28 | # push "the directory the script is in" into @INC
|
---|
| 29 | use FindBin;
|
---|
| 30 | use lib "$FindBin::RealBin/";
|
---|
| 31 |
|
---|
[67] | 32 | use DNSBL 2.2;
|
---|
[51] | 33 | use DNSBLweb;
|
---|
[2] | 34 |
|
---|
| 35 | my $dnsbl = new DNSBL;
|
---|
| 36 |
|
---|
[25] | 37 | # default DB info - all other settings should be loaded from the DB.
|
---|
| 38 | my $dbhost = "localhost";
|
---|
| 39 | my $dbname = "dnsbl";
|
---|
| 40 | my $dbuser = "dnsbl";
|
---|
| 41 | my $dbpass = "spambgone";
|
---|
[2] | 42 |
|
---|
[25] | 43 | # Load a config ref containing DB host, name, user, and pass info based on
|
---|
| 44 | # from the server name + full script web path. This allows us to host
|
---|
| 45 | # multiple instances without having to duplicate the code.
|
---|
| 46 | # This file is a Perl fragment to be processed inline.
|
---|
| 47 | my $cfgname = $ENV{SERVER_NAME}.$ENV{SCRIPT_NAME};
|
---|
| 48 | $cfgname =~ s|[./-]|_|g;
|
---|
| 49 | $cfgname =~ s|_browse_cgi||;
|
---|
| 50 | if (-e "/etc/dnsbl/$cfgname.conf") {
|
---|
| 51 | my $cfg = `cat /etc/dnsbl/$cfgname.conf`;
|
---|
| 52 | ($cfg) = ($cfg =~ /^(.+)$/s); # avoid warnings, failures, and general nastiness with taint mode
|
---|
| 53 | eval $cfg;
|
---|
| 54 | }
|
---|
| 55 |
|
---|
[67] | 56 | # Set up the CGI object...
|
---|
| 57 | my $q = new CGI::Simple;
|
---|
| 58 | # ... and get query-string params as well as POST params if necessary
|
---|
| 59 | $q->parse_query_string;
|
---|
| 60 |
|
---|
| 61 | my %webvar;
|
---|
| 62 | # This is probably excessive fiddling, but it puts the parameters somewhere my fingers know about...
|
---|
| 63 | foreach ($q->param()) {
|
---|
| 64 | $webvar{$_} = $q->param($_);
|
---|
| 65 | }
|
---|
| 66 |
|
---|
| 67 | # try to be friendly to non-US-ASCII characters. Still need to find what
|
---|
| 68 | # difference from RH<->Debian is still at fault.
|
---|
| 69 | print $q->header(-charset=>'utf8');
|
---|
| 70 |
|
---|
[25] | 71 | my $dbh = $dnsbl->connect($dbhost, $dbname, $dbuser, $dbpass);
|
---|
| 72 |
|
---|
[67] | 73 | my $block = '';
|
---|
[2] | 74 |
|
---|
[25] | 75 | my $templatedir = $ENV{SCRIPT_FILENAME};
|
---|
| 76 | $templatedir =~ s/browse\.cgi//;
|
---|
| 77 | $templatedir .= "templates";
|
---|
| 78 | $ENV{HTML_TEMPLATE_ROOT} = $templatedir;
|
---|
[2] | 79 |
|
---|
[25] | 80 | my %config;
|
---|
| 81 | my $sth = $dbh->prepare("SELECT key,value FROM misc");
|
---|
| 82 | $sth->execute;
|
---|
| 83 | while (my ($key,$value) = $sth->fetchrow_array) {
|
---|
| 84 | $config{$key} = $value;
|
---|
| 85 | }
|
---|
| 86 |
|
---|
[67] | 87 | # basic validation so we don't try to look up something ridiculous
|
---|
| 88 | if ($webvar{block}) {
|
---|
| 89 | $webvar{block} =~ s/\s+//g;
|
---|
| 90 | $block = $webvar{block} if $webvar{block} =~ /^[\d\.]+(?:\/\d+)?$/;
|
---|
| 91 | }
|
---|
[25] | 92 |
|
---|
[67] | 93 | if ($block) {
|
---|
| 94 | my $template = HTML::Template->new(filename => "browse.tmpl");
|
---|
[25] | 95 |
|
---|
[67] | 96 | $template->param(pgtitle => $config{pgtitle}) if defined($config{pgtitle});
|
---|
| 97 | $template->param(pgcomment => $config{pgcomment}) if defined($config{pgcomment});
|
---|
[2] | 98 |
|
---|
[67] | 99 | my $out;
|
---|
| 100 | if ($block =~ /^[\d\.]+$/) {
|
---|
| 101 | $out = DNSBLweb::retlvl($dbh, $dnsbl, 0, ip => $block, block => $dnsbl->getcontainer($block,0) );
|
---|
| 102 | } else {
|
---|
| 103 | $out = DNSBLweb::retlvl($dbh, $dnsbl, 0, block => $block);
|
---|
| 104 | }
|
---|
| 105 |
|
---|
| 106 | $template->param(enchilada => $out);
|
---|
| 107 | print $template->output;
|
---|
| 108 |
|
---|
| 109 | } else {
|
---|
| 110 | # refuse to show the whole tree, as in a "real" dataset it's horribly slow. even a /8 is often "a bit much"
|
---|
| 111 | print qq(
|
---|
| 112 | <html>
|
---|
| 113 | <head>
|
---|
| 114 | <title>$config{pgtitle}</title>
|
---|
| 115 | <body>
|
---|
| 116 | $config{pgcomment}<br>
|
---|
| 117 | );
|
---|
| 118 | if ($webvar{block}) {
|
---|
| 119 | $webvar{block} =~ s{[^\w]+}{_}g; #neuter any attempts at funky data injection
|
---|
| 120 | print qq(<span style="border: 1px solid #FF0000;">Invalid netblock specification $webvar{block}</span>\n);
|
---|
| 121 | }
|
---|
| 122 | print qq(
|
---|
| 123 | <form action="browse.cgi" method="POST">
|
---|
| 124 | Enter a CIDR netblock to browse.<br>
|
---|
| 125 | This does not have to exactly match a netblock entered in the database.<br>
|
---|
| 126 | <input name="block">
|
---|
| 127 | <input type="submit">
|
---|
| 128 | </form>
|
---|
| 129 | </body>
|
---|
| 130 | </html>
|
---|
| 131 | );
|
---|
| 132 | }
|
---|