Home

Fix for Catch the cookie and start the crawler

June 12, 2008 - 10:51am — Anonymous
  1.   /**
  2.    *  Implementation of the crawler page.
  3.    */    
  4.   function page_security_scanner() {
  5.     //  Check if the auth session cookie value is already into the db, otherwise call
  6.     //  the function that retrieve this (enable multithreading)
  7.     if (variable_get('security_scanner_cookie','') == '')
  8.       drupal_security_scanner_get_auth_cookie();
  9.     $time = time() + 5;
  10.     while (time() < $time) {
  11.       // Initialize the crawler
  12.       db_query('INSERT INTO {crawler} VALUES (default)');
  13.       $crawler_id = db_last_insert_id('crawler', 'id');
  14.       //Mark the extracted page as visited
  15.       db_query("UPDATE {crawler_links} SET crawler_id = %d, status = 1 WHERE crawler_id = 0 LIMIT 1", $crawler_id);
  16.       // Get the link from crawler_links table
  17.       $page_to_visit = db_fetch_array(db_query("SELECT id,path FROM {crawler_links} WHERE crawler_id = %d AND status = 1 LIMIT 1", $crawler_id));
  18.       // Update the status field to sign as executed that link
  19.       db_query("UPDATE {crawler_links} SET status = 1 WHERE crawler_id = %d and status = 1 LIMIT 1", $crawler_id);
  20.       //Create a new object and parse the page
  21.       $obj = new drupal_security_scanner_test();
  22.       $obj->drupalGet($page_to_visit['path']);
  23.       $obj->parse();
  24.       $links = $obj->elements->xpath('//a');
  25.       foreach($links as $link) {
  26.         $absolute = getAbsoluteUrl($link['href']);
  27.         // Checking if the link is inside the website
  28.         if(!menu_path_is_external($absolute)) {
  29.           // Here we use IGNORE to insert only one time a link into the table. ("path" is a unique index)
  30.           db_query("INSERT IGNORE INTO crawler_links VALUES ('','%s','','','')", $absolute);
  31.         }
  32.       }
  33.       db_query("UPDATE {crawler_links} SET status = 2 WHERE crawler_id = %d and status = 1 LIMIT 1", $crawler_id);
  34.     }
  35.     variable_del('security_scanner_cookie');
  36.     return '<p>'. t('The quick brown fox jumps over the lazy dog.') .'</p>';
  37.   }
  38.  
  39.   /**
  40.    *  Get the cookie of the admin and insert the first link into the table crawler_links.
  41.    */
  42.    function drupal_security_scanner_get_auth_cookie() {
  43.     $initial_path = user_pass_reset_url(user_load(1));
  44.     //  Create a new object, set cURL options to call the function drupal_security_scanner_curl_headers that
  45.     //  saves into the variable table the admin cookie. Then set the cookie.
  46.     $obj = new drupal_security_scanner_test();
  47.     $obj->curl_options = array(
  48.       CURLOPT_HEADERFUNCTION => ('drupal_security_scanner_curl_headers'),
  49.       CURLOPT_FOLLOWLOCATION => FALSE,
  50.       );
  51.     $obj->drupalGet($initial_path);
  52.     $obj->drupalPost($initial_path,'',TRUE);
  53.     curl_setopt($ch, CURLOPT_COOKIE, variable_get('security_scanner_cookie',''));
  54.     //  Add the first url into the crawler_links table.
  55.     db_query("INSERT INTO {crawler_links} VALUES ('','%s','','','')", url('admin', array('absolute' => TRUE)));
  56.     return true;
  57.   }
  58.  
  59.   /**
  60.    *  This function will extract headers and return the lenght.
  61.    */  
  62.   function drupal_security_scanner_curl_headers($ch = NULL, $header = NULL) {
  63.     static $headers = array();
  64.     if (!isset($ch)) {
  65.       return $headers;
  66.     }
  67.     if(!strncmp($header, "Set-Cookie:", 11)) {
  68.       //  get the cookie
  69.       $cookiestr = trim(substr($header, 11, -1));
  70.       $cookie = explode(';', $cookiestr);
  71.       $cookie = explode('=', $cookie[0]);
  72.       $cookiename = trim(array_shift($cookie));
  73.       $cookiearr[$cookiename] = trim(implode('=', $cookie));
  74.       variable_set('security_scanner_cookie', $cookie);
  75.     }
  76.     return strlen($header);  
  77.   }

Submit Fix

Any tags you'd like to associate with your code, delimitered by commas (example: Views, CCK, Module, etc).
Select the syntax highlighting mode to use.