crowdsecurity / php-cs-bouncer Goto Github PK

View Code? Open in Web Editor NEW

14.0 11.0 3.0 956 KB

The official PHP bouncers library for the CrowdSec LAPI

License: MIT License

PHP 92.18% Shell 0.41% Twig 7.42%

php security firewall captcha ip-blocker ip-blocking ip-address ip-database ip-range-check crowdsec

php-cs-bouncer's Introduction

CrowdSec Bouncer PHP library

The official PHP bouncer library for the CrowdSec LAPI

📚 Documentation 💠 Hub 💬 Discourse Forum

Overview

This library allows you to create CrowdSec bouncers for PHP applications or frameworks like e-commerce, blog or other exposed applications.

Usage

See User Guide

Installation

See Installation Guide

Technical notes

See Technical notes

Developer guide

See Developer guide

License

MIT

php-cs-bouncer's People

Contributors

Stargazers

Watchers

Forkers

julienloizelet nereng lelanta

php-cs-bouncer's Issues

Add compatibility with PHP 8.1

Do not use session anymore

The lib is using session to manage captcha interactions (is resolved, etc.) with the final user.

But, this session management can cause a lot of trouble (break login process, conflict with other session_start piece of code, etc.).

See for example :

To definitely avoid this kind of trouble, we could use another mechanism to manage the storage of these captcha interactions.

As we are already using a cache mechanism to store crowdsec decision for an IP, maybe we could use this cache to store the captcha interactions.

Deleted count after cache update is always 0

see crowdsecurity/cs-wordpress-bouncer#96 (comment)

Session and redirect issues (standalone bouncer)

Regarding this "bouncer" issue: crowdsecurity/cs-standalone-php-bouncer#15

Seems that:

there is something wrong with session, at least with some login process
there is something wrong with captcha "after resolution" redirect

Add Country scope for decision

php 8.1 (captcha) Implicit conversion from float to int loses precision

With PHP 8.1, an error is thrown when a captcha wall has to be displayed.
On my local environment, here is the error :

Fatal error: Uncaught CrowdSecBouncer\BouncerException: Implicit conversion from float 15.5 to int loses precision in /var/www/html/my-own-modules/crowdsec-php-lib/src/StandAloneBounce.php:346 Stack trace: #0 [internal function]: CrowdSecBouncer\StandAloneBounce->CrowdSecBouncer\{closure}(8192, 'Implicit conver...', '/var/www/html/m...', 365) #1 /var/www/html/my-own-modules/crowdsec-php-lib/vendor/gregwar/captcha/src/Gregwar/Captcha/CaptchaBuilder.php(365): imagettftext(Object(GdImage), 27, -6, 15.5, 36, 6120063, '/var/www/html/m...', 'N') #2 /var/www/html/my-own-modules/crowdsec-php-lib/vendor/gregwar/captcha/src/Gregwar/Captcha/CaptchaBuilder.php(459): Gregwar\Captcha\CaptchaBuilder->writePhrase(Object(GdImage), 'NVEQO', '/var/www/html/m...', 150, 40) #3 /var/www/html/my-own-modules/crowdsec-php-lib/src/Bouncer.php(227): Gregwar\Captcha\CaptchaBuilder->build() #4 /var/www/html/my-own-modules/crowdsec-php-lib/src/AbstractBounce.php(181): CrowdSecBouncer\Bouncer::buildCaptchaCouple() #5 /var/www/html/my-own-modules/crowdsec-php-lib/src/AbstractBounce.php(246): CrowdSecBouncer\AbstractBounce->storeNewCaptchaCoupleInSession() #6 /var/www/html/my-own-modules/crowdsec-php-lib/src/AbstractBounce.php(267): CrowdSecBouncer\AbstractBounce->handleCaptchaRemediation('172.21.0.1') #7 /var/www/html/my-own-modules/crowdsec-php-lib/src/AbstractBounce.php(124): CrowdSecBouncer\AbstractBounce->handleRemediation('captcha', '172.21.0.1') #8 /var/www/html/my-own-modules/crowdsec-php-lib/src/AbstractBounce.php(60): CrowdSecBouncer\AbstractBounce->bounceCurrentIp() #9 /var/www/html/my-own-modules/crowdsec-php-lib/src/StandAloneBounce.php(348): CrowdSecBouncer\AbstractBounce->run() #10 /var/www/html/my-own-modules/crowdsec-php-lib/examples/auto-prepend/scripts/bounce-via-auto-prepend.php(14): CrowdSecBouncer\StandAloneBounce->safelyBounce() #11 {main} thrown in /var/www/html/my-own-modules/crowdsec-php-lib/src/StandAloneBounce.php on line 346

It seems that this is due to the gregwar/captcha package:

@see Gregwar/Captcha#100

I'm not sure that the package is still being maintained.

Remediations prority should be handle in the bouncer configuration directly

Hello,

From what i see here, remediations priorities are hardcoded in the bouncer library directly. I think it would be better to handle this directly in the bouncer configurations.

For example for the php bouncer, i would like to configure this in https://github.com/crowdsecurity/cs-php-bouncer/blob/main/settings.example.php directly.

I installed this on my ubuntu 16 vps now can't access anything php

500 errors

I want to completely remove it. I ran the uninstall for the php bouncer apache and restarted apache and still 500 errors showing

PHP Fatal error: Unknown: Failed opening required '/usr/local/php/crowdsec/crowdsec-php-bouncer.php' (include_path='.:/usr/share/php') in Unknown on line 0, referer: https://www.website.com