From 005633b1fffb7b6df70cb13b8c55bceb302be6b6 Mon Sep 17 00:00:00 2001
From: Rob Swindell <rob@synchro.net>
Date: Sun, 16 Jan 2022 22:22:53 -0800
Subject: [PATCH] Log requests that resolve outside of the web root as hack
attempts
"Request for x is outside of the web root" was already logged (with a "NOTICE" log level), but would not sound the hack attempt alarm (on Windows) or log to the hack.log. Now it does.
---
src/sbbs3/websrvr.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/src/sbbs3/websrvr.c b/src/sbbs3/websrvr.c
index c4c7ed65ba..7519753f9a 100644
--- a/src/sbbs3/websrvr.c
+++ b/src/sbbs3/websrvr.c
@@ -3633,8 +3633,13 @@ static BOOL check_request(http_session_t * session)
if(strnicmp(path,root_dir,strlen(root_dir))) {
session->req.keep_alive=FALSE;
send_error(session,__LINE__,"400 Bad Request");
- lprintf(LOG_NOTICE,"%04d !ERROR Request for %s is outside of web root %s"
- ,session->socket,path,root_dir);
+ SAFEPRINTF2(str, "Request for '%s' is outside of web root: %s", path, root_dir);
+ lprintf(LOG_NOTICE,"%04d !ERROR %s", session->socket, str);
+ hacklog(&scfg, session->client.protocol, session->username, str, session->client.host, &session->addr);
+#ifdef _WIN32
+ if(startup->sound.hack[0] && !sound_muted(&scfg))
+ PlaySound(startup->sound.hack, NULL, SND_ASYNC|SND_FILENAME);
+#endif
return(FALSE);
}
--
GitLab