<?php /*

 Composr
 Copyright (c) ocProducts, 2004-2016

 See text/EN/licence.txt for full licencing information.


 NOTE TO PROGRAMMERS:
   Do not edit this file. If you need to make changes, save your changed file to the appropriate *_custom folder
   **** If you ignore this advice, then your website upgrades (e.g. for bug fixes) will likely kill your changes ****

*/

/**
 * @license    http://opensource.org/licenses/cpal_1.0 Common Public Attribution License
 * @copyright  ocProducts Ltd
 * @package    core
 */

/**
 * Hook class.
 */
class Hook_check_modsecurity
{
    /**
     * Check various input var restrictions.
     *
     * @return array List of warnings
     */
    public function run()
    {
        $warning = array();

        // Test to see if we have any ModSecurity issue that blocks config form submissions, via posting through some perfectly legitimate things that it might be paranoid about
        if (get_zone_name() . ':' . get_page_name() != 'adminzone:start') {
            $test_url = get_custom_base_url() . '/data/empty.php';
            $test_a = http_download_file($test_url, 0, false, true);
            $message_a = $GLOBALS['HTTP_MESSAGE'];
            if ($message_a == '200') {
                $test_b = http_download_file($test_url, 0, false, true, 'Composr', array('test_a' => '/usr/bin/unzip -o @_SRC_@ -x -d @_DST_@', 'test_b' => '<iframe src="http://example.com/"></iframe>', 'test_c' => '<script>console.log(document.cookie);</script>'));
                $message_b = $GLOBALS['HTTP_MESSAGE'];
                if ($message_b != '200') {
                    $warning[] = do_lang_tempcode('MOD_SECURITY', escape_html($message_b));
                }
            }
        }

        return $warning;
    }
}
