| 1 | #!/usr/bin/perl
|
|---|
| 2 | # quickndirty browse-the-damned-by-web
|
|---|
| 3 | ##
|
|---|
| 4 | # $Id: browse.cgi 69 2018-07-19 21:03:38Z kdeugau $
|
|---|
| 5 | # Copyright 2009-2012,2014,2018 Kris Deugau <kdeugau@deepnet.cx>
|
|---|
| 6 | #
|
|---|
| 7 | # This program is free software: you can redistribute it and/or modify
|
|---|
| 8 | # it under the terms of the GNU General Public License as published by
|
|---|
| 9 | # the Free Software Foundation, either version 3 of the License, or
|
|---|
| 10 | # (at your option) any later version.
|
|---|
| 11 | #
|
|---|
| 12 | # This program is distributed in the hope that it will be useful,
|
|---|
| 13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|---|
| 14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|---|
| 15 | # GNU General Public License for more details.
|
|---|
| 16 | #
|
|---|
| 17 | # You should have received a copy of the GNU General Public License
|
|---|
| 18 | # along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|---|
| 19 | ##
|
|---|
| 20 |
|
|---|
| 21 | use strict;
|
|---|
| 22 | use warnings;
|
|---|
| 23 | use DBI;
|
|---|
| 24 | use CGI::Carp qw(fatalsToBrowser);
|
|---|
| 25 | use CGI::Simple;
|
|---|
| 26 | use HTML::Template;
|
|---|
| 27 |
|
|---|
| 28 | # push "the directory the script is in" into @INC
|
|---|
| 29 | use FindBin;
|
|---|
| 30 | use lib "$FindBin::RealBin/";
|
|---|
| 31 |
|
|---|
| 32 | use DNSBL 2.2;
|
|---|
| 33 | use DNSBLweb;
|
|---|
| 34 |
|
|---|
| 35 | my $dnsbl = new DNSBL;
|
|---|
| 36 |
|
|---|
| 37 | # default DB info - all other settings should be loaded from the DB.
|
|---|
| 38 | my $dbhost = "localhost";
|
|---|
| 39 | my $dbname = "dnsbl";
|
|---|
| 40 | my $dbuser = "dnsbl";
|
|---|
| 41 | my $dbpass = "spambgone";
|
|---|
| 42 |
|
|---|
| 43 | # Load a config ref containing DB host, name, user, and pass info based on
|
|---|
| 44 | # from the server name + full script web path. This allows us to host
|
|---|
| 45 | # multiple instances without having to duplicate the code.
|
|---|
| 46 | # This file is a Perl fragment to be processed inline.
|
|---|
| 47 | my $cfgname = $ENV{SERVER_NAME}.$ENV{SCRIPT_NAME};
|
|---|
| 48 | $cfgname =~ s|[./-]|_|g;
|
|---|
| 49 | $cfgname =~ s|_browse_cgi||;
|
|---|
| 50 | if (-e "/etc/dnsbl/$cfgname.conf") {
|
|---|
| 51 | my $cfg = `cat /etc/dnsbl/$cfgname.conf`;
|
|---|
| 52 | ($cfg) = ($cfg =~ /^(.+)$/s); # avoid warnings, failures, and general nastiness with taint mode
|
|---|
| 53 | eval $cfg;
|
|---|
| 54 | }
|
|---|
| 55 |
|
|---|
| 56 | # Set up the CGI object...
|
|---|
| 57 | my $q = new CGI::Simple;
|
|---|
| 58 | # ... and get query-string params as well as POST params if necessary
|
|---|
| 59 | $q->parse_query_string;
|
|---|
| 60 |
|
|---|
| 61 | my %webvar;
|
|---|
| 62 | # This is probably excessive fiddling, but it puts the parameters somewhere my fingers know about...
|
|---|
| 63 | foreach ($q->param()) {
|
|---|
| 64 | $webvar{$_} = $q->param($_);
|
|---|
| 65 | }
|
|---|
| 66 |
|
|---|
| 67 | # try to be friendly to non-US-ASCII characters. Still need to find what
|
|---|
| 68 | # difference from RH<->Debian is still at fault.
|
|---|
| 69 | print $q->header(-charset=>'utf8');
|
|---|
| 70 |
|
|---|
| 71 | my $dbh = $dnsbl->connect($dbhost, $dbname, $dbuser, $dbpass);
|
|---|
| 72 |
|
|---|
| 73 | my $block = '';
|
|---|
| 74 |
|
|---|
| 75 | my $templatedir = $ENV{SCRIPT_FILENAME};
|
|---|
| 76 | $templatedir =~ s/browse\.cgi//;
|
|---|
| 77 | $templatedir .= "templates";
|
|---|
| 78 | $ENV{HTML_TEMPLATE_ROOT} = $templatedir;
|
|---|
| 79 |
|
|---|
| 80 | my %config;
|
|---|
| 81 | my $sth = $dbh->prepare("SELECT key,value FROM misc");
|
|---|
| 82 | $sth->execute;
|
|---|
| 83 | while (my ($key,$value) = $sth->fetchrow_array) {
|
|---|
| 84 | $config{$key} = $value;
|
|---|
| 85 | }
|
|---|
| 86 |
|
|---|
| 87 | # basic validation so we don't try to look up something ridiculous
|
|---|
| 88 | if ($webvar{block}) {
|
|---|
| 89 | $webvar{block} =~ s/\s+//g;
|
|---|
| 90 | $block = $webvar{block} if $webvar{block} =~ /^[\d\.]+(?:\/\d+)?$/;
|
|---|
| 91 | }
|
|---|
| 92 |
|
|---|
| 93 | if ($block) {
|
|---|
| 94 | my $template = HTML::Template->new(filename => "browse.tmpl");
|
|---|
| 95 |
|
|---|
| 96 | $template->param(pgtitle => $config{pgtitle}) if defined($config{pgtitle});
|
|---|
| 97 | $template->param(pgcomment => $config{pgcomment}) if defined($config{pgcomment});
|
|---|
| 98 |
|
|---|
| 99 | my $out;
|
|---|
| 100 | if ($block =~ /^[\d\.]+$/) {
|
|---|
| 101 | $out = DNSBLweb::retlvl($dbh, $dnsbl, 0, ip => $block, block => $dnsbl->getcontainer($block,0) );
|
|---|
| 102 | } else {
|
|---|
| 103 | $out = DNSBLweb::retlvl($dbh, $dnsbl, 0, block => $block);
|
|---|
| 104 | }
|
|---|
| 105 |
|
|---|
| 106 | $template->param(enchilada => $out);
|
|---|
| 107 | print $template->output;
|
|---|
| 108 |
|
|---|
| 109 | } else {
|
|---|
| 110 | # refuse to show the whole tree, as in a "real" dataset it's horribly slow. even a /8 is often "a bit much"
|
|---|
| 111 | print qq(
|
|---|
| 112 | <html>
|
|---|
| 113 | <head>
|
|---|
| 114 | <title>$config{pgtitle}</title>
|
|---|
| 115 | <body>
|
|---|
| 116 | $config{pgcomment}<br>
|
|---|
| 117 | );
|
|---|
| 118 | if ($webvar{block}) {
|
|---|
| 119 | $webvar{block} =~ s{[^\w]+}{_}g; #neuter any attempts at funky data injection
|
|---|
| 120 | print qq(<span style="border: 1px solid #FF0000;">Invalid netblock specification $webvar{block}</span>\n);
|
|---|
| 121 | }
|
|---|
| 122 | print qq(
|
|---|
| 123 | <form action="browse.cgi" method="POST">
|
|---|
| 124 | Enter a CIDR netblock to browse.<br>
|
|---|
| 125 | This does not have to exactly match a netblock entered in the database.<br>
|
|---|
| 126 | <input name="block">
|
|---|
| 127 | <input type="submit">
|
|---|
| 128 | </form>
|
|---|
| 129 | </body>
|
|---|
| 130 | </html>
|
|---|
| 131 | );
|
|---|
| 132 | }
|
|---|
![(please configure the [header_logo] section in trac.ini)](/trac/dnsbl/chrome/site/your_project_logo.png){kind=logo}
