MAINHACK

Viewing / Editing File: reqrouter.lua

File is not writable. Editing disabled.
local cookie = require('resty.cookie')
local digest = require('openssl').digest

local captchapassed = ngx.shared.captchapassed_clients


local function set_untrusted_uid_cookie()
    local cookie_obj, err = cookie:new()
    if not cookie_obj then
        ngx.log(ngx.ERR, "Failed to init cookie: ", err)
        return
    end

    local cookie_name = ngx.var.ws_cookie_name
    local user_agent = ngx.var.http_user_agent
    if user_agent == nil then
        user_agent = ''
    end
    local user_data = ngx.var.wsuserip .. user_agent
    local secret_key = ngx.var.ws_untrusted_secret_key
    local ttl = tostring(ngx.time() + ngx.var.ws_cookie_ttl)
    local hashsum = digest.digest('sha1', user_data .. secret_key .. ttl, false)
    local val = hashsum .. "." .. ttl .. ".0"

    local current_timestamp = os.time()
    local offset = 30 * 24 * 3600     -- 30 days
    local expiration_date = os.date(
        "!%a, %d-%b-%y %H:%M:%S GMT", current_timestamp + offset)

    local ok, err = cookie_obj:set({
        key = cookie_name,
        value = val,
        domain = ngx.var.host,
        samesite = "Lax",
        httponly = true,
        path = "/",
        expires = expiration_date
    })
    if not ok then
        ngx.log(ngx.ERR, "Could not set cookie: ", err)
    end
end


local function to_static()
    local uri, search_pattern = ngx.var.uri, "/a9bc224bd710f56d27affffddc764239b58c3faa0"
    local start_pos, end_pos = string.find(uri, search_pattern)
    if start_pos == 1 then
        return true
    end
    return false
end


local function request_is_text()
    if ngx.var.http_accept == nil then
        return false
    end
    if string.find(ngx.var.http_accept, "text/html") or ngx.var.http_accept == "*/*" then
        return true
    end
    return false
end


local function process_request()

    if to_static() then
        return ngx.exec("@to_static")
    end

    local ip_status = ngx.var.webshield_ip_status

    -- Whitelist ezoic traffic if a user wants to
    local trust_ezoic = ngx.var.trust_ezoic
    local ua_header = ngx.var.http_user_agent
    if trust_ezoic == "1" and ua_header ~= nil and ua_header:find('[Xx]%-[Mm]iddleton') then
        return ngx.exec("@to_backend")
    end

    -- Traffic from whitelisted sources is passed as is without checks
    if ip_status == "IP_WHITE" then
        ngx.var.webshield_verdict = "whitelisted"
        return ngx.exec("@to_backend")
    end

    -- Traffic from local blacklisted sources is denied
    if ip_status == "IP_BLACK_LOCAL" then
        ngx.var.webshield_verdict = "blacklisted"
        return ngx.exit(403)
    end

    if ip_status == "IP_COUNTRY_BLACK" then
        ngx.var.webshield_verdict = "blacklisted_country"
        return ngx.exit(403)
    end

    -- Traffic from static whitelisted sources is passed as is without checks
    if ip_status == "IP_WHITE_STATIC" then
        ngx.var.webshield_verdict = "whitelisted"
        return ngx.exec("@to_backend")
    end

    -- Traffic from blacklisted sources is denied
    if ip_status == "IP_BLACK" then
        ngx.var.webshield_verdict = "blacklisted"
        return ngx.exit(403)
    end

    local dest_domain_whitelisted = ngx.var.domain_whitelisted
    local wscheck = ngx.var.wscheck

    local wsuserid = ngx.var.wsuserid

    local userip = ngx.var.wsuserip                 -- client IP address
    local proxy_port = ngx.var.proxy_port           -- initial destination port

    local splashscreen_antibot = ngx.var.splashscreen_antibot

    if dest_domain_whitelisted == "1" then          -- If a user goes to a whitelisted domain
        if not wsuserid and splashscreen_antibot == "1" then
            set_untrusted_uid_cookie()              -- client checks enabled but no UID found
        end                                         -- set untrusted cookie (because we did not check its UA)

        return ngx.exec("@to_backend")              -- let him proceed
    end

    if ip_status == "IP_GRAY" then                  -- User is graylisted

        local remote_proxy       = ngx.var.remote_proxy
        local cloudflare_captcha = ngx.var.cloudflare_captcha
        -- pass cloudflare traffic to backend without attempts to show captcha
        if remote_proxy == "cloudflare" and cloudflare_captcha  == "0" then
            return ngx.exec("@to_backend")
        end

        local passed_captcha = captchapassed:get(userip)
        if passed_captcha then                      -- The client has already passed captcha
            return ngx.exec("@to_backend")          -- and sees captcha again my mistake
        end                                         -- Proxy him to destination until redirect is removed

        local splash_as_captcha = ngx.var.ws_splash_as_captcha
        local country_code = ngx.var.remote_country_code

        -- we show splashscreen to graylisted chinese users instead of captcha
        if splash_as_captcha == "1" and country_code == "CN" then
            if not wsuserid then
                ngx.var.wscaptcha = "2"                 -- indicate that splashscreen_as_captcha shown
                if request_is_text() then               -- if text/html
                    return ngx.exec("@to_splashscreen") -- show splashscreen to him
                end
                ngx.status = 415                        -- otherwise return
                ngx.say("")                             -- custom error code
                return ngx.exit(415)
            end

            return ngx.exec("@to_backend")              -- let him proceed
        end
        ngx.var.wscaptcha = "1"
        if request_is_text() then                       -- if text/html, show captcha to him
            ngx.var.webshield_verdict = "graylisted_captcha"
            return ngx.exec("@to_captcha")
        end
        ngx.var.webshield_verdict = "graylisted_blocked"
        ngx.status = 415                                -- otherwise return
        ngx.say("")                                     -- custom error code
        return ngx.exit(415)
    end

    if splashscreen_antibot == "1" and not wsuserid and (proxy_port == "2083" or proxy_port == "2082") and ngx.var.cpanel_protection == "1" and ip_status ~= "IP_WHITE" then
        ngx.var.webshield_verdict = "splashscreen"
        return ngx.exec("@to_splashscreen")         -- Show splashscreen
    end

    if splashscreen_antibot == "1" and not wsuserid and ip_status == "IP_GRAY_SPLASH" then
        ngx.var.webshield_verdict = "splashscreen"
        return ngx.exec("@to_splashscreen")         -- Show splashscreen
    end

    return ngx.exec("@to_backend")                  -- let him proceed
end

return process_request()
Cancel / Back
[ MAINHACK ]

Viewing / Editing File: reqrouter.lua

Server Info

System Features

User Info
