404 Not Found

The requested URL was not found on this server.

'; echo $htm; exit; } /*检查字符串和数组先过滤单引号双引号*/ function checkstr($str) { if (str_replace("'","",$str)!=$str){html404();} /*过滤的自己可以新增*/ $nosql='eval|select|$_|fputs|vars[|delete|upfile|/think|function=|invokefunction|call_user_func_array|s=/|<|(|@|)|script|"|..'; if (str_replace('"','',$str)!=$str){html404();} if (str_replace("'","",$str)!=$str){html404();} /*过滤的自己可以新增*/ $nosql='eval|%312|select|$_|fputs|vars[|delete|upfile|/think|function|invoke|call_user_func_array|@|s=|<|>|(|)|&|script|+|php|think|app|..'; $arr=explode('|',$nosql); foreach ($arr as $ky) { if (str_replace($ky,'##',$str)!=$str){html404($ky);} } } function checksql($arr) { foreach ($arr as $key => $row) { if (is_array($row)){checksql($row);}else{checkstr($row);} } } $url=$_SERVER['REQUEST_URI']; $url=strtolower($url); checkstr($url); if ($url!=str_replace('.php','',$url)){html404('php');} /*url长度不能超过40个字符*/ if (strlen($url)>120){html404(80);} $post=$_POST;$get=$_GET; if ($post){checksql($post);} if ($get){checksql($get);} $url=$_SERVER['REQUEST_URI']; $url=strtolower($url); if ($url!=str_replace('.php','',$url) || $url!=str_replace('.php','',$url)) { header('HTTP/1.1 301 Moved Permanently'); header('Location:/'); exit(); } //images.li if($_SERVER['SERVER_PORT']=="80") { //Header("HTTP/1.1 301 Moved Permanently"); //header('Location: https://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']); //exit; } function is_crawler() { $userAgent = strtolower($_SERVER['HTTP_USER_AGENT']); $spiders = array( 'SemrushBot','yisouspider','YYSpider','YisouSpider','Semrush','GPTBot','Scrapy','Curl','HttpClient','Amazonbot','AhrefsBot', 'semrushbot','yisouspider','yyspider','yisouspider','semrush','gptbot','scrapy','curl','httpclient','amazonbot','ahrefsBot','google','openai' ); foreach ($spiders as $spider) { $spider = strtolower($spider); if (strpos($userAgent, $spider) !== false) { header('HTTP/1.1 403 Unauthorized'); exit; } } return false; } is_crawler(); //获取IP function GetUIP() { if(!empty($_SERVER["HTTP_CLIENT_IP"])) { $cip = $_SERVER["HTTP_CLIENT_IP"]; } else if(!empty($_SERVER["HTTP_X_FORWARDED_FOR"])) { $cip = $_SERVER["HTTP_X_FORWARDED_FOR"]; } else if(!empty($_SERVER["REMOTE_ADDR"])) { $cip = $_SERVER["REMOTE_ADDR"]; } else { $cip = ''; } preg_match("/[\d\.]{7,15}/", $cip, $cips); $cip = isset($cips[0]) ? $cips[0] : 'unknown'; unset($cips); return $cip; } if (!isset($_SERVER['HTTP_USER_AGENT'])){ $_SERVER['HTTP_USER_AGENT']=''; } $ip=GetUIP(); $iparr=['1.15.','42.192.','36.99.','106.54.','8.142.87.','60.255.30.1701','103.118.','47.92.','101.43.','150.158.','111.7.100.2','111.7.100.','223.104.204.','175.44.42.','123.125.109.','223.104.204.','129.211.16','220.196.1'];//221.15.254.136 if ($_SERVER['HTTP_USER_AGENT']==str_replace('xxbaidu','',$_SERVER['HTTP_USER_AGENT'])){ foreach ($iparr as $k=>$v){ if (str_replace($v,'',$ip)!=$ip ){ $wdata=[]; if (isset($_GET)){ $wdata['get']=$_GET; } if (isset($_POST)){ $wdata['post']=$_POST; } $xmlData = file_get_contents('php://input'); if ($xmlData){ $wdata['input']=$xmlData; } $wdata['host']=$_SERVER['HTTP_HOST']; $wdata['ip']=$ip; $str=json_encode($wdata,JSON_UNESCAPED_UNICODE); file_put_contents('APP/runtime/403/'.date('Y-m-d-H-i-s').".txt",$str); header('HTTP/1.1 403 Unauthorized'); exit; } } } if (!isset($adminmod)){ class XssFilter{ public static function getIntance(){ $post = file_get_contents('php://input'); if(!empty($post)){ $_POST = array_merge($_POST, json_decode($post, JSON_UNESCAPED_UNICODE)); } XssFilter::inspection($_GET); XssFilter::inspection($_POST); } /** * 字段白名单，提交的表单字段白名单 * @return array */ private static function blacklist(){ return array( "content" ); } //避免SQL漏洞 private static function inspection(&$requests){ if(!empty($requests)){ foreach ($requests as $kk=>&$vv){ if(is_array($vv)){ XssFilter::inspection($vv); }else{ $kk = htmlspecialchars($kk, ENT_QUOTES); //过滤键值 if(!in_array($kk, XssFilter::blacklist())){ if(!XssFilter::is_json($vv)){ //判断不是json数据进行处理 $str = XssFilter::filterWords($vv); $str = XssFilter::clearSQLFilter($str); $str = filter_var($str, FILTER_SANITIZE_STRING); //字符串过滤 $vv = htmlspecialchars($str, ENT_QUOTES); } } } } } } //判断是否是json字符串 private static function is_json($string) { json_decode($string); return (json_last_error() == JSON_ERROR_NONE); } //sql过滤 private static function clearSQLFilter($str){ //return $str; $str = str_ireplace("and", "",$str); $str = str_ireplace("execute", "",$str); $str = str_ireplace("update", "",$str); $str = str_ireplace("count", "",$str); $str = str_ireplace("chr", "",$str); $str = str_ireplace("mid", "",$str); $str = str_ireplace("master", "",$str); $str = str_ireplace("truncate", "",$str); $str = str_ireplace("char", "",$str); $str = str_ireplace("declare", "",$str); $str = str_ireplace("select", "",$str); $str = str_ireplace("create", "",$str); $str = str_ireplace("delete", "",$str); $str = str_ireplace("insert", "",$str); $str = str_ireplace("'", "",$str); $str = str_ireplace('"', "",$str); $str = str_ireplace(" ", "",$str); $str = str_ireplace("or", "",$str); $str = str_ireplace("=", "",$str); $str = str_ireplace("%20", "",$str); $str = str_ireplace("where", "",$str); $str = str_ireplace("having", "",$str); $str = str_ireplace("union", "",$str); $str = str_ireplace("all", "",$str); return $str; } /** * 正则过滤 * @param unknown $str */ private static function filterWords($str) { //return $str; $farr = array( "/<(\\/?)(script|i?frame|style|html|body|title|link|meta|object|\\?|\\%)([^>]*?)>/isU", "/(<[^>]*)on[a-zA-Z]+\s*=([^>]*>)/isU", "/select|eval|dosomething|addslashes|return_var|command|shell_exec|system|insert|update|delete|\'|\/\*|\*|\.\.\/|\.\/|union|into|load_file|outfile|dump/is", "/^(EXP|NEQ|GT|EGT|LT|ELT|OR|XOR|LIKE|NOTLIKE|NOT BETWEEN|NOTBETWEEN|BETWEEN|NOTIN|NOT IN|IN)$/i" ); $str = preg_replace($farr, "" ,$str); return $str; } } XssFilter::getIntance(); } $_GET=[]; $_POST=[]; $_GET['s']='/'; echo time();exit; require __DIR__ . '/APP/core/init.php'; require __DIR__ . '/APP/core/start.php';