· 10 years ago · Sep 13, 2016, 08:26 PM
1<?php
2
3/*
4 * Faucet in a BOX
5 * https://faucetinabox.com/
6 *
7 * Copyright (c) 2014-2016 LiveHome Sp. z o. o.
8 *
9 * This file is part of Faucet in a BOX.
10 *
11 * Faucet in a BOX is free software: you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation, either version 3 of the License, or
14 * (at your option) any later version.
15 *
16 * Faucet in a BOX is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License
22 * along with Faucet in a BOX. If not, see <http://www.gnu.org/licenses/>.
23 */
24
25$version = '64';
26
27if (get_magic_quotes_gpc()) {
28 $process = array(&$_GET, &$_POST, &$_COOKIE, &$_REQUEST);
29 while (list($key, $val) = each($process)) {
30 foreach ($val as $k => $v) {
31 unset($process[$key][$k]);
32 if (is_array($v)) {
33 $process[$key][stripslashes($k)] = $v;
34 $process[] = &$process[$key][stripslashes($k)];
35 } else {
36 $process[$key][stripslashes($k)] = stripslashes($v);
37 }
38 }
39 }
40 unset($process);
41}
42
43if(stripos($_SERVER['REQUEST_URI'], '@') !== FALSE ||
44 stripos(urldecode($_SERVER['REQUEST_URI']), '@') !== FALSE) {
45 header("Location: ."); die('Please wait...');
46}
47
48session_start();
49header('Content-Type: text/html; charset=utf-8');
50ini_set('display_errors', false);
51
52$missing_configs = array();
53
54$session_prefix = crc32(__FILE__);
55
56$disable_curl = false;
57$verify_peer = true;
58$local_cafile = false;
59require_once("config.php");
60if(!isset($disable_admin_panel)) {
61 $disable_admin_panel = false;
62 $missing_configs[] = array(
63 "name" => "disable_admin_panel",
64 "default" => "false",
65 "desc" => "Allows to disable Admin Panel for increased security"
66 );
67}
68
69if(!isset($connection_options)) {
70 $connection_options = array(
71 'disable_curl' => $disable_curl,
72 'local_cafile' => $local_cafile,
73 'verify_peer' => $verify_peer,
74 'force_ipv4' => false
75 );
76}
77if(!isset($connection_options['verify_peer'])) {
78 $connection_options['verify_peer'] = $verify_peer;
79}
80
81if (!isset($display_errors)) $display_errors = false;
82ini_set('display_errors', $display_errors);
83if($display_errors)
84 error_reporting(-1);
85
86
87if(array_key_exists('HTTP_REFERER', $_SERVER)) {
88 $referer = $_SERVER['HTTP_REFERER'];
89} else {
90 $referer = "";
91}
92
93$host = parse_url($referer, PHP_URL_HOST);
94if($_SERVER['HTTP_HOST'] != $host) {
95 if (
96 array_key_exists("$session_prefix-address_input_name", $_SESSION) &&
97 array_key_exists($_SESSION["$session_prefix-address_input_name"], $_POST)
98 ) {
99 $_POST[$_SESSION["$session_prefix-address_input_name"]] = "";
100 if ($display_errors) trigger_error("REFERER CHECK FAILED, ASSUMING CSRF!");
101 }
102}
103
104
105require_once('libs/faucetbox.php');
106
107try {
108 $sql = new PDO($dbdsn, $dbuser, $dbpass, array(PDO::ATTR_PERSISTENT => true,
109 PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION));
110} catch(PDOException $e) {
111 if ($display_errors) die("Can't connect to database. Check your config.php. Details: ".$e->getMessage());
112 else die("Can't connect to database. Check your config.php or set \$display_errors = true; to see details.");
113}
114
115$db_updates = array(
116 15 => array("INSERT IGNORE INTO `Faucetinabox_Settings` (`name`, `value`) VALUES ('version', '15');"),
117 17 => array("ALTER TABLE `Faucetinabox_Settings` CHANGE `value` `value` TEXT NOT NULL;", "INSERT IGNORE INTO `Faucetinabox_Settings` (`name`, `value`) VALUES ('balance', 'N/A');"),
118 33 => array("INSERT IGNORE INTO `Faucetinabox_Settings` (`name`, `value`) VALUES ('ayah_publisher_key', ''), ('ayah_scoring_key', '');"),
119 34 => array("INSERT IGNORE INTO `Faucetinabox_Settings` (`name`, `value`) VALUES ('custom_admin_link_default', 'true')"),
120 38 => array("INSERT IGNORE INTO `Faucetinabox_Settings` (`name`, `value`) VALUES ('reverse_proxy', 'none')", "INSERT IGNORE INTO `Faucetinabox_Settings` (`name`, `value`) VALUES ('default_captcha', 'recaptcha')"),
121 41 => array("INSERT IGNORE INTO `Faucetinabox_Settings` (`name`, `value`) VALUES ('captchme_public_key', ''), ('captchme_private_key', ''), ('captchme_authentication_key', ''), ('reklamper_enabled', '')"),
122 46 => array("INSERT IGNORE INTO `Faucetinabox_Settings` (`name`, `value`) VALUES ('last_balance_check', '0')"),
123 54 => array("INSERT IGNORE INTO `Faucetinabox_Settings` (`name`, `value`) VALUES ('funcaptcha_public_key', ''), ('funcaptcha_private_key', '')"),
124 55 => array("INSERT IGNORE INTO `Faucetinabox_Settings` (`name`, `value`) VALUES ('block_adblock', ''), ('button_timer', '0')"),
125 56 => array("INSERT IGNORE INTO `Faucetinabox_Settings` (`name`, `value`) VALUES ('ip_check_server', ''),('ip_ban_list', ''),('hostname_ban_list', ''),('address_ban_list', '')"),
126 58 => ["DELETE FROM `Faucetinabox_Settings` WHERE `name` IN ('captchme_public_key', 'captchme_private_key', 'captchme_authentication_key', 'reklamper_enabled')"],
127 63 => ["INSERT IGNORE INTO `Faucetinabox_Settings` (`name`, `value`) VALUES ('safety_limits_end_time', '')"],
128 64 => [
129 "INSERT IGNORE INTO `Faucetinabox_Settings` (`name`, `value`) VALUES ('iframe_sameorigin_only', ''), ('asn_ban_list', ''), ('country_ban_list', ''), ('nastyhosts_enabled', '')",
130 "UPDATE `Faucetinabox_Settings` new LEFT JOIN `Faucetinabox_Settings` old ON old.name = 'ip_check_server' SET new.value = IF(old.value = 'http://v1.nastyhosts.com/', 'on', '') WHERE new.name = 'nastyhosts_enabled'",
131 "DELETE FROM `Faucetinabox_Settings` WHERE `name` = 'ip_check_server'",
132 ],
133);
134
135$default_data_query = <<<QUERY
136create table if not exists Faucetinabox_Settings (
137 `name` varchar(64) not null,
138 `value` text not null,
139 primary key(`name`)
140);
141create table if not exists Faucetinabox_IPs (
142 `ip` varchar(20) not null,
143 `last_used` timestamp not null,
144 primary key(`ip`)
145);
146create table if not exists Faucetinabox_Addresses (
147 `address` varchar(60) not null,
148 `ref_id` int null,
149 `last_used` timestamp not null,
150 primary key(`address`)
151);
152create table if not exists Faucetinabox_Refs (
153 `id` int auto_increment not null,
154 `address` varchar(60) not null unique,
155 `balance` bigint unsigned default 0,
156 primary key(`id`)
157);
158create table if not exists Faucetinabox_Pages (
159 `id` int auto_increment not null,
160 `url_name` varchar(50) not null unique,
161 `name` varchar(255) not null,
162 `html` text not null,
163 primary key(`id`)
164);
165
166INSERT IGNORE INTO Faucetinabox_Settings (name, value) VALUES
167('apikey', ''),
168('timer', '180'),
169('rewards', '90*100, 10*500'),
170('referral', '15'),
171('solvemedia_challenge_key', ''),
172('solvemedia_verification_key', ''),
173('solvemedia_auth_key', ''),
174('recaptcha_private_key', ''),
175('recaptcha_public_key', ''),
176('ayah_publisher_key', ''),
177('ayah_scoring_key', ''),
178('funcaptcha_private_key', ''),
179('funcaptcha_public_key', ''),
180('name', 'Faucet in a Box'),
181('short', 'Just another Faucet in a Box :)'),
182('template', 'default'),
183('custom_body_cl_default', ''),
184('custom_box_bottom_cl_default', ''),
185('custom_box_bottom_default', ''),
186('custom_box_top_cl_default', ''),
187('custom_box_top_default', ''),
188('custom_box_left_cl_default', ''),
189('custom_box_left_default', ''),
190('custom_box_right_cl_default', ''),
191('custom_box_right_default', ''),
192('custom_css_default', '/* custom_css */\\n/* center everything! */\\n.row {\\n text-align: center;\\n}\\n#recaptcha_widget_div, #recaptcha_area {\\n margin: 0 auto;\\n}\\n/* do not center lists */\\nul, ol {\\n text-align: left;\\n}'),
193('custom_footer_cl_default', ''),
194('custom_footer_default', ''),
195('custom_main_box_cl_default', ''),
196('custom_palette_default', ''),
197('custom_admin_link_default', 'true'),
198('version', '$version'),
199('currency', 'BTC'),
200('balance', 'N/A'),
201('reverse_proxy', 'none'),
202('last_balance_check', '0'),
203('default_captcha', 'recaptcha'),
204('ip_ban_list', ''),
205('hostname_ban_list', ''),
206('address_ban_list', ''),
207('block_adblock', ''),
208('button_timer', '0'),
209('safety_limits_end_time', ''),
210('iframe_sameorigin_only', ''),
211('asn_ban_list', ''),
212('country_ban_list', ''),
213('nastyhosts_enabled', '')
214;
215QUERY;
216
217function randHash($length) {
218 $alphabet = str_split('qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890');
219 $hash = '';
220 for($i = 0; $i < $length; $i++) {
221 $hash .= $alphabet[array_rand($alphabet)];
222 }
223 return $hash;
224}
225
226function getNastyHostsServer() {
227 return "http://v1.nastyhosts.com/";
228}
229
230function checkRevProxyIp($file) {
231 require_once("libs/http-foundation/IpUtils.php");
232 return IpUtils::checkIp($_SERVER['REMOTE_ADDR'], array_map(function($v) { return trim($v); }, file($file)));
233}
234
235function detectRevProxyProvider() {
236 if(checkRevProxyIp("libs/ips/cloudflare.txt")) {
237 return "cloudflare";
238 } elseif(checkRevProxyIp("libs/ips/incapsula.txt")) {
239 return "incapsula";
240 }
241
242 return "none";
243}
244
245function getIP() {
246 global $sql;
247 static $cache_ip;
248 if($cache_ip) return $cache_ip;
249 $type = $sql->query("SELECT `value` FROM `Faucetinabox_Settings` WHERE `name` = 'reverse_proxy'")->fetch();
250 if (!$type) $type = array('none');
251 $ip = null;
252 switch ($type[0]) {
253 case 'cloudflare':
254 if(checkRevProxyIp("libs/ips/cloudflare.txt"))
255 $ip = array_key_exists('HTTP_CF_CONNECTING_IP', $_SERVER) ? $_SERVER['HTTP_CF_CONNECTING_IP'] : null;
256 break;
257 case 'incapsula':
258 if(checkRevProxyIp("libs/ips/incapsula.txt"))
259 $ip = array_key_exists('HTTP_INCAP_CLIENT_IP', $_SERVER) ? $_SERVER['HTTP_INCAP_CLIENT_IP'] : null;
260 break;
261 default:
262 $ip = $_SERVER['REMOTE_ADDR'];
263 }
264 if (empty($ip)) {
265 $sql->query("UPDATE `Faucetinabox_Settings` SET `value` = 'none-auto' WHERE `name` = 'reverse_proxy' AND `value` <> 'none' LIMIT 1");
266 $cache_ip = $_SERVER['REMOTE_ADDR'];
267 return $_SERVER['REMOTE_ADDR'];
268 }
269 $cache_ip = $ip;
270 return $ip;
271}
272
273function is_ssl(){
274 if(isset($_SERVER['HTTPS'])){
275 if('on' == strtolower($_SERVER['HTTPS']))
276 return true;
277 if('1' == $_SERVER['HTTPS'])
278 return true;
279 if(true == $_SERVER['HTTPS'])
280 return true;
281 }elseif(isset($_SERVER['SERVER_PORT']) && ('443' == $_SERVER['SERVER_PORT'])){
282 return true;
283 }
284 if(isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']) == 'https') {
285 return true;
286 }
287 return false;
288}
289
290function ipSubnetCheck ($ip, $network) {
291 $network = explode("/", $network);
292 $net = $network[0];
293
294 if(count($network) > 1) {
295 $mask = $network[1];
296 } else {
297 $mask = 32;
298 }
299
300 $net = ip2long ($net);
301 $mask = ~((1 << (32 - $mask)) - 1);
302
303 $ip_net = $ip & $mask;
304
305 return ($ip_net == $net);
306}
307
308function banned() {
309 trigger_error("Banned: ".getIP());
310 http_response_code(500);
311 die();
312}
313
314function suspicious($server, $comment) {
315 if($server) {
316 @file_get_contents($server."report/1/".urlencode(getIP())."/".urlencode($comment));
317 }
318}
319
320// check if configured
321try {
322 $pass = $sql->query("SELECT `value` FROM `Faucetinabox_Settings` WHERE `name` = 'password'")->fetch();
323} catch(PDOException $e) {
324 $pass = null;
325}
326
327if($pass) {
328 // check db updates
329 $dbversion = $sql->query("SELECT `value` FROM `Faucetinabox_Settings` WHERE `name` = 'version'")->fetch();
330 if($dbversion) {
331 $dbversion = intval($dbversion[0]);
332 } else {
333 $dbversion = -1;
334 }
335 foreach($db_updates as $v => $update) {
336 if($v > $dbversion) {
337 foreach($update as $query) {
338 $sql->exec($query);
339 }
340 }
341 }
342 if($dbversion < 17) {
343 // dogecoin changed from satoshi to doge
344 // better clear rewards...
345 $c = $sql->query("SELECT `value` FROM `Faucetinabox_Settings` WHERE `name` = 'currency'")->fetch();
346 if($c[0] == 'DOGE')
347 $sql->exec("UPDATE `Faucetinabox_Settings` SET `value` = '' WHERE name = 'rewards'");
348 }
349 if(intval($version) > intval($dbversion)) {
350 $q = $sql->prepare("UPDATE `Faucetinabox_Settings` SET `value` = ? WHERE `name` = 'version'");
351 $q->execute(array($version));
352 }
353
354 $iframe_sameorigin_only = $sql->query("SELECT `value` FROM `Faucetinabox_Settings` WHERE `name` = 'iframe_sameorigin_only'")->fetch();
355 if ($iframe_sameorigin_only && $iframe_sameorigin_only[0] == "on") {
356 header("X-Frame-Options: SAMEORIGIN");
357 }
358
359 $security_settings = array();
360 $nastyhosts_enabled = $sql->query("SELECT `value` FROM `Faucetinabox_Settings` WHERE `name` = 'nastyhosts_enabled' ")->fetch();
361 if ($nastyhosts_enabled && $nastyhosts_enabled[0]) {
362 $security_settings["ip_check_server"] = getNastyHostsServer();
363 } else {
364 $security_settings["ip_check_server"] = "";
365 }
366
367 $q = $sql->query("SELECT `name`, `value` FROM `Faucetinabox_Settings` WHERE `name` in ('ip_ban_list', 'hostname_ban_list', 'address_ban_list', 'asn_ban_list', 'country_ban_list')");
368 while($row = $q->fetch()) {
369 if(stripos($row["name"], "_list") !== false) {
370 $security_settings[$row["name"]] = array();
371 if(preg_match_all("/[^,;\s]+/", $row["value"], $matches)) {
372 foreach($matches[0] as $m) {
373 $security_settings[$row["name"]][] = $m;
374 }
375 }
376 } else {
377 $security_settings[$row["name"]] = $row["value"];
378 }
379 }
380
381 if($_SERVER["REQUEST_METHOD"] == "POST") {
382 if($security_settings["ip_check_server"]) {
383 if(!preg_match("#/$#", $security_settings["ip_check_server"])) {
384 $security_settings["ip_check_server"] .= "/";
385 }
386 }
387
388 // banning
389 $ip = ip2long(getIP());
390 if($ip) { // only ipv4 supported here
391 foreach($security_settings["ip_ban_list"] as $ban) {
392 if(ipSubnetCheck($ip, $ban)) {
393 banned();
394 }
395 }
396 }
397
398 if($security_settings["ip_check_server"]) {
399
400 $hostnames = @file_get_contents($security_settings["ip_check_server"].getIP());
401 $hostnames = json_decode($hostnames);
402
403 if($hostnames && property_exists($hostnames, "status") && $hostnames->status == 200) {
404 if(property_exists($hostnames, 'suggestion') && $hostnames->suggestion == "deny") {
405 banned();
406 }
407
408 if (property_exists($hostnames, "asn") && property_exists($hostnames->asn, "asn")) {
409 foreach ($security_settings["asn_ban_list"] as $ban) {
410 if ($ban == $hostnames->asn->asn) {
411 banned();
412 }
413 }
414 }
415
416 if (property_exists($hostnames, "country") && property_exists($hostnames->country, "code")) {
417 foreach ($security_settings["country_ban_list"] as $ban) {
418 if ($ban == $hostnames->country->code) {
419 banned();
420 }
421 }
422 }
423
424 if(property_exists($hostnames, 'hostnames')) {
425 foreach($security_settings["hostname_ban_list"] as $ban) {
426 foreach($hostnames->hostnames as $hostname) {
427 if(stripos($hostname, $ban) !== false) {
428 banned();
429 }
430 }
431 }
432 }
433
434 }
435 }
436 $fake_address_input_used = false;
437 if(!empty($_POST["address"])) {
438 $fake_address_input_used = true;
439 }
440 }
441}