1 | #!/usr/bin/perl
|
---|
2 | # quickndirty browse-the-damned-by-web
|
---|
3 | ##
|
---|
4 | # $Id: browse.cgi 67 2018-01-09 23:12:13Z kdeugau $
|
---|
5 | # Copyright 2009-2012,2014,2018 Kris Deugau <kdeugau@deepnet.cx>
|
---|
6 | #
|
---|
7 | # This program is free software: you can redistribute it and/or modify
|
---|
8 | # it under the terms of the GNU General Public License as published by
|
---|
9 | # the Free Software Foundation, either version 3 of the License, or
|
---|
10 | # (at your option) any later version.
|
---|
11 | #
|
---|
12 | # This program is distributed in the hope that it will be useful,
|
---|
13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
---|
15 | # GNU General Public License for more details.
|
---|
16 | #
|
---|
17 | # You should have received a copy of the GNU General Public License
|
---|
18 | # along with this program. If not, see <http://www.gnu.org/licenses/>.
|
---|
19 | ##
|
---|
20 |
|
---|
21 | use strict;
|
---|
22 | use warnings;
|
---|
23 | use DBI;
|
---|
24 | use CGI::Carp qw(fatalsToBrowser);
|
---|
25 | use CGI::Simple;
|
---|
26 | use HTML::Template;
|
---|
27 |
|
---|
28 | use DNSBL 2.2;
|
---|
29 | use DNSBLweb;
|
---|
30 |
|
---|
31 | my $dnsbl = new DNSBL;
|
---|
32 |
|
---|
33 | # default DB info - all other settings should be loaded from the DB.
|
---|
34 | my $dbhost = "localhost";
|
---|
35 | my $dbname = "dnsbl";
|
---|
36 | my $dbuser = "dnsbl";
|
---|
37 | my $dbpass = "spambgone";
|
---|
38 |
|
---|
39 | # Load a config ref containing DB host, name, user, and pass info based on
|
---|
40 | # from the server name + full script web path. This allows us to host
|
---|
41 | # multiple instances without having to duplicate the code.
|
---|
42 | # This file is a Perl fragment to be processed inline.
|
---|
43 | my $cfgname = $ENV{SERVER_NAME}.$ENV{SCRIPT_NAME};
|
---|
44 | $cfgname =~ s|[./-]|_|g;
|
---|
45 | $cfgname =~ s|_browse_cgi||;
|
---|
46 | if (-e "/etc/dnsbl/$cfgname.conf") {
|
---|
47 | my $cfg = `cat /etc/dnsbl/$cfgname.conf`;
|
---|
48 | ($cfg) = ($cfg =~ /^(.+)$/s); # avoid warnings, failures, and general nastiness with taint mode
|
---|
49 | eval $cfg;
|
---|
50 | }
|
---|
51 |
|
---|
52 | # Set up the CGI object...
|
---|
53 | my $q = new CGI::Simple;
|
---|
54 | # ... and get query-string params as well as POST params if necessary
|
---|
55 | $q->parse_query_string;
|
---|
56 |
|
---|
57 | my %webvar;
|
---|
58 | # This is probably excessive fiddling, but it puts the parameters somewhere my fingers know about...
|
---|
59 | foreach ($q->param()) {
|
---|
60 | $webvar{$_} = $q->param($_);
|
---|
61 | }
|
---|
62 |
|
---|
63 | # try to be friendly to non-US-ASCII characters. Still need to find what
|
---|
64 | # difference from RH<->Debian is still at fault.
|
---|
65 | print $q->header(-charset=>'utf8');
|
---|
66 |
|
---|
67 | my $dbh = $dnsbl->connect($dbhost, $dbname, $dbuser, $dbpass);
|
---|
68 |
|
---|
69 | my $block = '';
|
---|
70 |
|
---|
71 | my $templatedir = $ENV{SCRIPT_FILENAME};
|
---|
72 | $templatedir =~ s/browse\.cgi//;
|
---|
73 | $templatedir .= "templates";
|
---|
74 | $ENV{HTML_TEMPLATE_ROOT} = $templatedir;
|
---|
75 |
|
---|
76 | my %config;
|
---|
77 | my $sth = $dbh->prepare("SELECT key,value FROM misc");
|
---|
78 | $sth->execute;
|
---|
79 | while (my ($key,$value) = $sth->fetchrow_array) {
|
---|
80 | $config{$key} = $value;
|
---|
81 | }
|
---|
82 |
|
---|
83 | # basic validation so we don't try to look up something ridiculous
|
---|
84 | if ($webvar{block}) {
|
---|
85 | $webvar{block} =~ s/\s+//g;
|
---|
86 | $block = $webvar{block} if $webvar{block} =~ /^[\d\.]+(?:\/\d+)?$/;
|
---|
87 | }
|
---|
88 |
|
---|
89 | if ($block) {
|
---|
90 | my $template = HTML::Template->new(filename => "browse.tmpl");
|
---|
91 |
|
---|
92 | $template->param(pgtitle => $config{pgtitle}) if defined($config{pgtitle});
|
---|
93 | $template->param(pgcomment => $config{pgcomment}) if defined($config{pgcomment});
|
---|
94 |
|
---|
95 | my $out;
|
---|
96 | if ($block =~ /^[\d\.]+$/) {
|
---|
97 | $out = DNSBLweb::retlvl($dbh, $dnsbl, 0, ip => $block, block => $dnsbl->getcontainer($block,0) );
|
---|
98 | } else {
|
---|
99 | $out = DNSBLweb::retlvl($dbh, $dnsbl, 0, block => $block);
|
---|
100 | }
|
---|
101 |
|
---|
102 | $template->param(enchilada => $out);
|
---|
103 | print $template->output;
|
---|
104 |
|
---|
105 | } else {
|
---|
106 | # refuse to show the whole tree, as in a "real" dataset it's horribly slow. even a /8 is often "a bit much"
|
---|
107 | print qq(
|
---|
108 | <html>
|
---|
109 | <head>
|
---|
110 | <title>$config{pgtitle}</title>
|
---|
111 | <body>
|
---|
112 | $config{pgcomment}<br>
|
---|
113 | );
|
---|
114 | if ($webvar{block}) {
|
---|
115 | $webvar{block} =~ s{[^\w]+}{_}g; #neuter any attempts at funky data injection
|
---|
116 | print qq(<span style="border: 1px solid #FF0000;">Invalid netblock specification $webvar{block}</span>\n);
|
---|
117 | }
|
---|
118 | print qq(
|
---|
119 | <form action="browse.cgi" method="POST">
|
---|
120 | Enter a CIDR netblock to browse.<br>
|
---|
121 | This does not have to exactly match a netblock entered in the database.<br>
|
---|
122 | <input name="block">
|
---|
123 | <input type="submit">
|
---|
124 | </form>
|
---|
125 | </body>
|
---|
126 | </html>
|
---|
127 | );
|
---|
128 | }
|
---|