Ecran de securite : (ab5c2562) · Validations · eldk / spip

config/ecran_securite.php

+10 −6

Numéro de ligne d'origine	Numéro de ligne de diff	Ligne de diff
		@@ -5,7 +5,7 @@
		* ------------------
		*/

		define('_ECRAN_SECURITE', '1.3.8'); // 2018-10-31
		define('_ECRAN_SECURITE', '1.3.9'); // 2019-02-12

		/*
		* Documentation : http://www.spip.net/fr_article4200.html
		@@ -197,17 +197,18 @@ if (!defined('_IS_BOT_FRIEND')){
		* (sauf pour id_table, qui n'est pas numérique jusqu'à [5743])
		* (id_base est une variable de la config des widgets de WordPress)
		*/
		$_exceptions = array('id_table','id_base','id_parent','id_article_pdf');
		foreach ($_GET as $var => $val)
		if ($_GET[$var] and strncmp($var, "id_", 3) == 0
		and !in_array($var, array('id_table', 'id_base')))
		and !in_array($var, $_exceptions))
		$_GET[$var] = is_array($_GET[$var])?@array_map('intval', $_GET[$var]):intval($_GET[$var]);
		foreach ($_POST as $var => $val)
		if ($_POST[$var] and strncmp($var, "id_", 3) == 0
		and !in_array($var, array('id_table', 'id_base')))
		and !in_array($var, $_exceptions))
		$_POST[$var] = is_array($_POST[$var])?@array_map('intval', $_POST[$var]):intval($_POST[$var]);
		foreach ($GLOBALS as $var => $val)
		if ($GLOBALS[$var] and strncmp($var, "id_", 3) == 0
		and !in_array($var, array('id_table', 'id_base')))
		and !in_array($var, $_exceptions))
		$GLOBALS[$var] = is_array($GLOBALS[$var])?@array_map('intval', $GLOBALS[$var]):intval($GLOBALS[$var]);

		/*
		@@ -321,6 +322,8 @@ if (isset($_REQUEST['GLOBALS']))
		if (_IS_BOT and (
		(isset($_REQUEST['echelle']) and isset($_REQUEST['partie_cal']) and isset($_REQUEST['type']))
		or (strpos((string)$_SERVER['REQUEST_URI'], 'debut_') and preg_match(',[?&]debut_.*&debut_,', (string)$_SERVER['REQUEST_URI']))
		or (isset($_REQUEST['calendrier_annee']) and strpos((string)$_SERVER['REQUEST_URI'], 'debut_') )
		or (isset($_REQUEST['calendrier_annee']) and preg_match(',[?&]calendrier_annee=.*&calendrier_annee=,', (string)$_SERVER['REQUEST_URI']))
		)
		)
		$ecran_securite_raison = "robot agenda/double pagination";
		@@ -520,11 +523,12 @@ if (
		and $load > _ECRAN_SECURITE_LOAD // eviter l'evaluation suivante si de toute facon le load est inferieur a la limite
		and rand(0, $load * $load) > _ECRAN_SECURITE_LOAD * _ECRAN_SECURITE_LOAD
		) {
		header("HTTP/1.0 503 Service Unavailable");
		//https://webmasters.stackexchange.com/questions/65674/should-i-return-a-429-or-503-status-code-to-a-bot
		header("HTTP/1.0 429 Too Many Requests");
		header("Retry-After: 300");
		header("Expires: Wed, 11 Jan 1984 05:00:00 GMT");
		header("Cache-Control: no-cache, must-revalidate");
		header("Pragma: no-cache");
		header("Content-Type: text/html");
		die("<html><title>Status 503: Site temporarily unavailable</title><body><h1>Status 503</h1><p>Site temporarily unavailable (load average $load)</p></body></html>");
		die("<html><title>Status 429: Too Many Requests</title><body><h1>Status 429</h1><p>Too Many Requests (try again soon)</p></body></html>");
		}