<?
require_once('kill_XSS_config.php');

//kill_XSS更新歷史紀錄
$kill_history['20200915'] = "1.不再支援big5\n2.log改用UTF-8寫入\n3.微調排版格式\n4.\$safe_word微調";
$kill_history['20200911'] = '只檢查指定的$_SERVER變數(為了新版chrome的HTTP_SEC_CH_UA)';
$kill_history['20200715'] = '將不需要的cookie值刪除(為了ezgo偷塞有危險字串的cookie到coa.gov.tw網域)';
$kill_history['20191107'] = '把function write_log()從各個global.php移到這裡';
$kill_history['20190311'] = '新增安全字(See <http://validator.w3.org/services>';
$kill_history['20180919'] = 'cookie_destroy內刪除上層domain的cookie';
$kill_history['20180919'] = 'kill_log增加紀錄觸動kill的來源key';
$kill_history['20180829'] = '第一次的DB連線$link_id改用kill_config.php內的連線設定（因為有些機器本機沒有安裝mysql）';
$kill_history['20180816'] = 'kill_log增加紀錄觸動kill的來源';
$kill_history['20180613'] = '避免GET參數不斷重複造成網站的網頁數無限增加';
$kill_history['20180511'] = '新增cookie_destroy()';
$kill_history['20160922'] = '判斷$dirty_word_pattern不存在時，不執行檢查攻擊字串，避免警告訊息';
$kill_history['20160818'] = 'level 3 不偵測攻擊字串';
$kill_history['20160217'] = 'htmlspecialchars( $str, ENT_QUOTES|ENT_HTML401, "UTF-8" ) 填上$glag';
$kill_history['20160217'] = 'mysqli_real_escap_string需要預先做mysql連線';
$kill_history['20151012'] = '危險字串新增evel，誤解字串新增level';
$kill_history['20150324'] = '新增cookie HTTP_ONLY設定';
$kill_history['20121117'] = '新增$safe_word變數:/script/';
$kill_history['20121117'] = '新增from_facebook函數，允許fascebook的連線';
$kill_history['20120426'] = '1.不檢查$_SESSION。'."\n".'2.對各別參數檢查長度(800)';
$kill_history['20111003'] = '用正規表示式檢查危險字串';
$kill_history['20110930'] = '1.將kill拆成兩部分，分出kill_config.php。'."\n".'2.把$_GET,$_POST,$HTTP_GET_VARS,$HTTP_POST_VARS給unset掉，只對$_REQUEST和$_SESSION做replace_htmlspecialchars。'."\n".'3.改寫CheckCrossSiteScripting，獨立$dirty_word設定，新增$safe_word變數。'."\n".'4.阻擋事件發生時，連結導向改為該$_SERVER["HTTP_HOST"]，並設定charset為utf-8。';
$kill_history['20110916'] = '危險字串新增%25,%23,%26';

if( isset($_GET['kill_version']) ){
    show_history($kill_history);
    exit;
}

//目前正在檢查的key
$currentKey = '';

//記錄檔
$kill_log = '/home/web/log/kill_log';


//20160217 for mysqli_real_escap_string() by windgod, 20180829用kill_config的連線設定
if( !$link_id = mysqli_connect($firstDBLink['host'],$firstDBLink['user'],$firstDBLink['pass']) ){
    echo "firstDBLink[host] connect error:".$firstDBLink['host'];
    exit;
}
unset($firstDBLink);

//危險字串
$dirty_word_level[1] = array(
   'script','alert','.location','href','eval',
   'select','schema','count',
   '<','>','%3C','%3E',
   '"',"'",'%27','%22',
   '%25','%23','%26',
   '%0d','%0a',
);

$dirty_word_level[2] = array(
   'script','alert','.location','href','eval',
   'select','schema','count',
   '<','>','%3C','%3E',
   '%25','%23','%26',
   '%0d','%0a',
);

$dirty_word_level[3] = array(

);

$dirty_word_level[9] = array(); //不偵測XSS
if( is_array($dirty_word_level[$kill_level]) && count($dirty_word_level[$kill_level])>0 )
$dirty_word_pattern = make_pattern_str( $dirty_word_level[$kill_level] );


//會被誤解的字串
$safe_word[] = 'description';
$safe_word[] = 'account';
$safe_word[] = 'ccount:';
$safe_word[] = 'country';
$safe_word[] = 'county';
$safe_word[] = ', text/javascript';
$safe_word[] = 'selected';
$safe_word[] = 'count(*) as';
$safe_word[] = '/script/';
$safe_word[] = 'counter';
$safe_word[] = 'getSelectId';
$safe_word[] = '<http://validator.w3.org/services>';
$safe_word[] = 'hitcount';

$safe_word_pattern = make_pattern_str( $safe_word );


if( !session_id() ){
    ini_set("session.cookie_httponly",1);
    session_start();
}

//檢查最後面加/
if( isset($_SERVER['PATH_INFO']) and $_SERVER['PATH_INFO'] != '' ){
        echo "kill_1";exit;
        session_destroy();
        cookie_destroy();

		exec('echo "======== '.date('Ymd His').' =========" >> '.$kill_log);
		exec('echo "FILE => '.commend_injection_anti($_SERVER['PHP_SELF']).'" >> '.$kill_log);
		exec('echo "path_info =>'.$_SERVER["PATH_INFO"].'" >> '.$kill_log);
		exec('echo "" >> '.$kill_log);
		
        header('HTTP/1.0 400 Bad Request');
        echo '<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />';
        kill_msg('$_SERVER["PATH_INFO"]有問題，可能是url裡的php檔名後面多了/');
        echo '<meta http-equiv="refresh" content="5; url=http://'.$_SERVER['HTTP_HOST'].'#1">';
        echo "此網頁不存在，將於5秒後自動換頁！";
        exit;
}


//先重新產生$_SERVER內的 QUERY_STRING 與 REQUEST_URI，為了避免GET參數無限重複，造成網站網頁數無限增加 20180613 by windgod
$tmpURI = array();
foreach( $_GET as $k=>$v ){
    if( is_array($v) ){
        foreach( $v as $k2=>$v2 ){
            $tmpURI[] = urlencode($k).'['.urlencode($k2).']='.urlencode($v2);
        }
    }else{
        $tmpURI[] = urlencode($k).'='.urlencode($v);
    }
}
unset($k,$v);
if( count($tmpURI) > 0 ){
    $tmpURI = implode('&',$tmpURI);
    $_SERVER['QUERY_STRING'] = $tmpURI;
    $_SERVER['REQUEST_URI'] = $_SERVER['SCRIPT_NAME'].'?'.$tmpURI;
}

//將不需要的cookie值刪除 20200715 by windgod
unset( $_SERVER['HTTP_COOKIE'] );
$parentDomain = substr( $_SERVER['HTTP_HOST'], strpos($_SERVER['HTTP_HOST'],'.') );
$save_cookie = [ '_ga', '_gat', '_gid', 'PHPSESSID' ];
if(is_array($_COOKIE)) foreach( $_COOKIE as $k=>$v ){
    if( !in_array($k,$save_cookie) ){
        setcookie( $k, "", time()-86400);
        setcookie( $k, "", time()-86400, '/', $parentDomain);
    }
}


//轉換字串與檢查CrossSite危險字
unset($HTTP_GET_VARS,$HTTP_POST_VARS,$_POST,$_GET);
unset($_SERVER['SERVER_SIGNATURE'],$_SERVER['HTTP_AMP_CACHE_TRANSFORM'],$_SERVER['HTTP_IF_NONE_MATCH']);

if( $kill_level == '3' ){
    CheckCrossSiteScripting($_REQUEST,'REQUEST');
    CheckCrossSiteScripting($_COOKIE,'COOKIE');
    //CheckCrossSiteScripting($_SESSION);
}else{
    replace_htmlspecialchars($_REQUEST,'REQUEST');
    replace_htmlspecialchars($_COOKIE,'COOKIE');
    //replace_htmlspecialchars($_SESSION);
}
    
//$_SERVER僅檢查CrossSite危險字，不轉換字串
if( isset($_SERVER['HTTP_REFERER']) ) $_SERVER['HTTP_REFERER'] = str_replace('%26','&',$_SERVER['HTTP_REFERER']); //應付facebook的導向
//只檢查指定的$_SERVER變數 20200911 by windgod
$save_server = ['USER', 'HOME', 'SCRIPT_NAME', 'REQUEST_URI', 'QUERY_STRING', 'REQUEST_METHOD', 'SCRIPT_FILENAME', 'CONTEXT_DOCUMENT_ROOT', 
                'DOCUMENT_ROOT', 'REQUEST_SCHEME', 'SERVER_PORT', 'SERVER_ADDR', 'SERVER_NAME', 'HTTP_ACCEPT', 'HTTP_USER_AGENT', 
                'HTTP_HOST', 'UNIQUE_ID', 'PHP_SELF', 'REQUEST_TIME_FLOAT', 'REQUEST_TIME', 'HTTP_REFERER',
                'REMOTE_ADDR', 'HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED' ];
if(is_array($save_server)) foreach( $save_server as $v ){
    if( isset($_SERVER[$v]) ){
        CheckCrossSiteScripting($_SERVER[$v],'SERVER');
    }
}

function replace_htmlspecialchars( &$value ,$source=''){
        $value = fix_XSS_code($value,$source);
}

function fix_XSS_code($check_value,$source=''){
        global $currentKey;
        if (is_array($check_value)){      
			    foreach( $check_value as $k => $v ){
                    $currentKey = $k;
                    $check_value[$k]= fix_XSS_code($v,$source);
                }
        }elseif( trim($check_value) != '' ){
                $check_value= htmlspecialchars( $check_value, ENT_QUOTES|ENT_HTML401, "UTF-8" );
                CheckCrossSiteScripting($check_value,$source);
        }
        return $check_value;
}

function CheckCrossSiteScripting($strData,$source=''){
        global $dirty_word_pattern,$safe_word_pattern,$kill_level,$kill_log,$currentKey;
        
        if( is_array($strData) ){
                foreach( $strData as $k=>$v ){
                    $currentKey = $k;
                    CheckCrossSiteScripting($v,$source);
                }
        }else{  
                
                if( $kill_level != 3 && strlen($strData) > 2000){
			            exec('echo "======== '.date('Ymd His').' =========" >> '.$kill_log);
                        exec('echo "IP => '.commend_injection_anti($_SERVER['REMOTE_ADDR']).'" >> '.$kill_log);
			            exec('echo "FILE => '.commend_injection_anti($_SERVER['DOCUMENT_ROOT'].$_SERVER['PHP_SELF']).'" >> '.$kill_log);
			            exec('echo "DATA => '.commend_injection_anti($strData).'" >> '.$kill_log);
                        exec('echo "超過2000字" >> '.$kill_log);
                        exec('echo "" >> '.$kill_log);
			
                        header('HTTP/1.0 400 Bad Request');
                        echo '<meta http-equiv="refresh" content="5; url=index.php#4">';
                        echo "Invalid Request !!\n<br>\n";
                        echo "您輸入的參數無效，將於5秒後自動換頁！";
                        
                        kill_msg('('.$source.')參數長度超過2000('.strlen($strData).')');
                        
                        exit();
                }
            
                $exclude_safe_word = preg_replace( $safe_word_pattern,'', $strData );
                
                if( $dirty_word_pattern ){
                    preg_match_all( $dirty_word_pattern, $exclude_safe_word, $matches );
                    if( count($matches[0]) > 0 ){
                        exec('echo "======== '.date('Ymd His').' =========" >> '.$kill_log);
			            exec('echo "IP =>   '.commend_injection_anti($_SERVER['REMOTE_ADDR']).'" >> '.$kill_log);
                        exec('echo "FILE => '.commend_injection_anti($_SERVER['DOCUMENT_ROOT'].$_SERVER['PHP_SELF']).'" >> '.$kill_log);
                        exec('echo "DATA => '.commend_injection_anti($strData).'" >> '.$kill_log);
                        exec('echo "safe_word =>'.$exclude_safe_word.'" >> '.$kill_log);
                        exec('echo "受測字串 =>'.$exclude_safe_word.'" >> '.$kill_log);
                        exec('echo "matches =>'.implode(',',$matches[0]).'" >> '.$kill_log);
			            exec('echo "source =>'.$source.'['.$currentKey.']" >> '.$kill_log);
                        exec('echo "" >> '.$kill_log);
                        
                        echo "kill_2";exit;
                        session_destroy();
                        cookie_destroy();
                        header('HTTP/1.0 400 Bad Request');
                        echo '<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />';
                        kill_msg('('.$source.')',$matches);
                        echo '<meta http-equiv="refresh" content="5; url=http://'.$_SERVER['HTTP_HOST'].'#3">';
                        echo "Invalid Request !!\n<br>\n";
                        echo "您輸入的參數無效，將於5秒後自動換頁！";
                        exit();

                    }
                }
        }
}

function trance_HTML_ENTITIES( $str ){
        $trans = get_html_translation_table (HTML_ENTITIES);
        //$encoded = strtr ($str, $trans);
        $trans = array_flip ($trans);
        return strtr($str, $trans);
}

function sql_injection_anti( $str ){
        global $kill_level;
        
        if( sprintf("%d",$str) == $str ){
                return $str;
        }
        
        if( $kill_level == '3' ){ //沒有轉換字串，所以不用轉回去
            $trance_str = $str;
        }else{
            $trance_str = trance_HTML_ENTITIES($str);
            $trance_str = str_replace(array('\\"',"\\'"),array('"',"'"),$trance_str);
        }
        
        $new_str = mysqli_real_escape_string($GLOBALS['link_id'],$trance_str);
        return $new_str;
}

function commend_injection_anti( $str ){
        if( sprintf("%d",$str) == $str ){
                return $str;
        }
        $trance_str = trance_HTML_ENTITIES($str);
        $new_str = escapeshellcmd($trance_str);

        return $new_str;
}

function kill_msg($msg,$array=[]){
    global $show_kill_msg,$kill_level;
    if( $show_kill_msg === true ){
        echo "kill level:$kill_level \n<br>\n";
        print_r($msg);
        if( $array != [] ){
            print_r($array);
        }
        exit;
    }
}

function show_history($kill_history){
    echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
            <html xmlns="http://www.w3.org/1999/xhtml">
            <head>
            <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
            <title>kill_XSS.php 歷史紀錄</title>
            </head>

            <body>
            <table width="90%" border="0" align="center" cellpadding="5" cellspacing="1" bgcolor="#009900">
              <tr>
                <td colspan="2" align="center" style="color:#FFF">kill_XSS.php 歷史紀錄</td>
              </tr>
              <tr>
                <th align="center" bgcolor="#B0FFB0">日期</th>
                <th bgcolor="#B0FFB0">更新內容</th>
              </tr>';
    foreach( $kill_history as $date=>$info ){
        $info = htmlentities($info);
        echo '<tr>
                <td align="center" bgcolor="#FFFFFF" style="color:#09F; font-weight:bolder">'.$date.'</td>
                <td bgcolor="#FFFFFF" style="color:#666; font-size:13px">'.nl2br($info).'</td>
              </tr>';
    }
    echo '</table>
        </body>
        </html>';
}

function make_pattern_str( $pattern_data ){
    $pattern_wall = '_____';
    $temp1 = implode($pattern_wall,$pattern_data);

    $pattern[] = '/(\\\\)/ix';
    $pattern[] = '/(\ )/';
    $pattern[] = '/(\(|\)|\/|\$|\"|\^|\*|\+|\[|\]|\|)/i';
    $replacement[] = '\\\\\\\\\\\\$1';
    $replacement[] = '\\s';
    $replacement[] = '\\\\$1';

    $pattern_str = preg_replace( '/'.$pattern_wall.'/','|', preg_replace( $pattern, $replacement, $temp1 ) );
    return '/'.$pattern_str.'/ix';
}

//刪除cookie
function cookie_destroy(){
    $parentDomain = substr( $_SERVER['HTTP_HOST'], strpos($_SERVER['HTTP_HOST'],'.') );
    if( is_array($_COOKIE) ) foreach( $_COOKIE as $k=>$v ){
        setcookie( $k, "", time()-86400);
        setcookie( $k, "", time()-86400, '/', $parentDomain); //20180919
    }
}


//記錄debug動作
if( !function_exists('write_log')){
    function write_log( $msg ){
        $ini = array( '\[ ok \]', '\[fail\]', '\[ msg \]', '\[show\]', "\n" );
        $new = array( "[ ok ]\t"  , "[fail]\t"  , "[ msg ]\t" , "[show]\t", '' );
        $msg = str_replace( $ini, $new, $msg );
        $file = '/home/web/log/SYSTEM_msg.admin.'.date('Ym');
        $fd = fopen ($file, "a+");
        fwrite( $fd , "\t".date("Y-m-d H:i:s")."\t".$_SERVER['REMOTE_ADDR']."\t".$_SERVER['PHP_SELF']."\n" );
        fwrite( $fd , $msg."\n" );
        fwrite( $fd , "\n" );
        fclose( $fd );
    }
}


<?

/**
* cURL抓資料
* 
* @param string $url 網址
* @param array $mySetting 設定
* @return mixed 抓取的內容，若直接存檔則返回存檔是否成功
* 
* 20171225 $url如果是https開頭，強制https=true，https沒有設定時，網址只要不是https開頭的，不管是http開頭還是直接寫domain，都會判斷他是否為政府網站(gov.tw)，是的話直接設定為https=true
* 20171225 新增參數SSLVERSION，預設為TLSv1.2(6)
* 20171225 如果 $is_test_server=false(正式機)，強制走農委會proxy
* 20180109 保留原來網址，如果error_code='Y'顯示error code
* 20200518 新增參數POST_BY_STR，把POST_DATA陣列
* 20201116 POST_DATA允許字串，用來傳送如JSON這樣的內容
*/
function WG_curl( $url, $mySetting=null ){
    if( $url === false ) return false;
    global $is_test_server;

    //初始設定
    $setting = array(
        'USERAGENT'=>'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.193 Safari/537.36',    //瀏覽器資訊
        'MAXREDIRS'=>5,     //redirect最大次數限制
        'CONNECTTIMEOUT'=>15,//連線的timeout時間(秒)
        'TIMEOUT'=>15,      //timeout時間(秒)
        'NOBODY'=>false,    //不下載內容
        'HEADER'=>false,    //下載HEADER
        'POST_DATA'=>array(), //POST的資料
        'POST_BY_STR'=>'N', // POST的陣列先用http_build_query轉成get形式的字串
        'SAVE'=>'',         //儲存路徑，不返回值
        'PROXY'=>'',        //proxy
        'https'=>false,     //HTTPS
        'SSLVERSION'=>6,     //0:DEFAULT 1:TLSv1 2:SSLv2 3:SSLv3 4:TLSv1.0 5:TLSv1.1 6:TLSv1.2
		'ERROR_CODE'=>'N',	//N:不顯示錯誤訊息 Y:顯示錯誤訊息
        'HTTPHEADER'=>'',   //自訂herder
        'GET_INFO'=>'N',    //Y:不回傳response，改回傳curl_getinfo的array
        'COOKIE'=>'',       //cookie
    );
    
    
    //處理proxy
    if( !isset($mySetting['PROXY']) ){
        if( isset($is_test_server) && $is_test_server == false ){ //正式機
            //$mySetting['PROXY'] = 'sproxy.moa.gov.tw:8080';
        }
    }
    
    
    //處理url
    $url = trim($url);
    if( substr($url,0,8) == 'https://' ){
        //$url = substr($url,8);
        $mySetting['https'] = true;
    }elseif( substr($url,0,7) == 'http://' ){
        //$url = substr($url,7);
    }
    if( !isset($mySetting['https']) && stristr($url,'gov.tw') ) $mySetting['https'] = true;

    //載入客製設定
    if( is_array($mySetting) ){
        foreach( $mySetting as $field=>$value ){
            if( isset($setting[$field]) ){
                $setting[$field] = $value;
            }
        }
    }
    
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    
    //模擬瀏覽器
    curl_setopt($ch, CURLOPT_USERAGENT,$setting['USERAGENT']);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);

    //重新導向
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
    curl_setopt($ch, CURLOPT_MAXREDIRS, $setting['MAXREDIRS']); //限制最多導向5次

    //timeout時間
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $setting['CONNECTTIMEOUT']);
    curl_setopt($ch, CURLOPT_TIMEOUT, $setting['TIMEOUT']);

    //是否取得內容與標頭
    curl_setopt($ch, CURLOPT_NOBODY, $setting['NOBODY']);
    curl_setopt($ch, CURLOPT_HEADER, $setting['HEADER']);

    //https協定
    if( $setting['https'] == true ) {
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST,  2);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_SSLVERSION, $setting['SSLVERSION'] );
    }
    
    //proxy
    if( $setting['PROXY'] ){
        curl_setopt($ch, CURLOPT_PROXY, $setting['PROXY']);
    }
    
    //POST模式
    if( isset($setting['POST_DATA']) && $setting['POST_DATA'] ){
        if( is_array($setting['POST_DATA']) && count($setting['POST_DATA'])>0 ){
            //因為有些時候必須用字串來傳遞，所以新增字串型的post( by windgod 20200518 )
            if( $setting['POST_BY_STR'] == "Y" ){
                $setting['POST_DATA'] = http_build_query($setting['POST_DATA']);
            }
        }
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $setting['POST_DATA']);
    }
    
    //自訂HEADER
    if( is_array($setting['HTTPHEADER']) && count($setting['HTTPHEADER']) >0 ){
        curl_setopt($ch, CURLOPT_HTTPHEADER, $setting['HTTPHEADER'] );
    }
    
    //COOKIE
    if( $setting['COOKIE'] ){
        curl_setopt($ch, CURLOPT_COOKIE, $setting['COOKIE'] );
    }
    
    //結果存成檔案
    if( $setting['SAVE'] && is_dir(dirname($setting['SAVE'])) ){
        curl_setopt($ch, CURLOPT_FILE, fopen($setting['SAVE'],"w"));
    }
    //echo "$url($setting[https] , $setting[SSLVERSION])\n";
    //執行cURL
    $response = curl_exec($ch);
	
	if($setting['ERROR_CODE']=='Y'){
		if($response === false)
		{
			echo 'Curl error: ' . curl_error($ch);
		}
	}

    //改回傳info，如果info拿到json的話，就改成array ( add by windgod 20200518 )
    if( $setting['GET_INFO'] == "Y" ){
        $response = curl_getinfo($ch);
         $temp = json_decode($response,true);
         if( json_last_error() == JSON_ERROR_NONE ){
             $response = $temp;
         }
    }
    
    curl_close($ch);
    
    return $response;
}

function ip_control(){
//監控來源IP
    $ALLOW_IP = array(
            '61.62.19.215',    //會議室無限網路
            '210.201.26.221',   //windgod
            '210.69.75.17',     //農委會
            '219.91.112.251', //windgod
            '127.0.0.1',    //本機
			'60.250.173.190',	//二樓
			'1.34.41.11',//新一樓
            );
    $ALLOW_IP_MASK1 ='192.168.1'; //內網
	$ALLOW_IP_MASK2 ='192.168.2'; //內網
	$ALLOW_IP_MASK3 ='192.168.3'; //內網
	$ALLOW_IP_MASK4 ='192.168.4'; //內網
	$ALLOW_IP_MASK5 ='192.168.9'; //內網
	$ALLOW_IP_MASK6 ='192.168.10'; //內網
	$ALLOW_IP_MASK7 ='10.20.216'; //龍潭異地備援
	$ALLOW_IP_MASK_COA ='172.16'; //農委會
	$ip=getUserIP();
    $mask = explode('.',$ip);
    $new_mask = $mask[0].'.'.$mask[1].'.'.$mask[2];
	$new_mask_coa=$mask[0].'.'.$mask[1];
	
	$is_allow='0';
	
	foreach($ALLOW_IP as $k => $v){
		if($v==$ip){
			$is_allow='1';
		}
	}
	if($new_mask!=$ALLOW_IP_MASK1 && $new_mask!=$ALLOW_IP_MASK2 && $new_mask!=$ALLOW_IP_MASK3 && $new_mask!=$ALLOW_IP_MASK4 && $new_mask!=$ALLOW_IP_MASK5 && $new_mask!=$ALLOW_IP_MASK6 && $new_mask!=$ALLOW_IP_MASK7 && $new_mask_coa!=$ALLOW_IP_MASK_COA ){
		$is_allow_new='0';
	}
	else{
		$is_allow_new='1';
	}
	if($is_allow=='0' && $is_allow_new=='0'){
		return '0';
	}
	else
		return '1';
}

//是否為行動裝置 2019/09/24 by windgod
function isMobileCheck(){
    $pattern = '/ipod|iphone|ipad|android|googlebot|mobile|webos|BlackBerry|Tablet/i';
    return preg_match($pattern,$_SERVER['HTTP_USER_AGENT']);
}

//取得用戶端IP 2020/07/07 by windgod
function getUserIP() {
    $ipaddress = '';
    $check_list = [
        'HTTP_CLIENT_IP',
        'HTTP_X_FORWARDED_FOR',
        'HTTP_X_FORWARDED',
        'HTTP_X_CLUSTER_CLIENT_IP',
        'HTTP_FORWARDED_FOR',
        'HTTP_FORWARDED',
        'REMOTE_ADDR'
    ];
    foreach( $check_list as $v ){
        if (isset($_SERVER[$v])){
            $ipaddress = $_SERVER[$v];
            break;
        }
    }
    
    //指令模式
    if( $ipaddress == '' && isset($_SERVER['SSH_CLIENT']) ){
        $ipaddress = explode(' ',$_SERVER['SSH_CLIENT'])[0];
    }

   	return $ipaddress;
}

//所屬紀錄與讀取網頁瀏覽人次 20200528 by windgod
function division_pageview( $old_total=0 ){
    $GLOBALS['WG_web']->add_visit_index_count();//增加瀏覽人次
    $count_data = $GLOBALS['WG_web']->division_visit_index_count(); //取得瀏覽人次(注意!redis裡的數字是資料庫算出來的，尚未加上$old_total)
    $year_minkuo=date("Y")-1911; //民國年

    //累計瀏覽人次
    $GLOBALS['data']['total_views'] = $count_data['total_count']+$old_total; //$old_total是改版前的總數
    
    //今年瀏覽人次
    $GLOBALS['data']['year_total'] = $count_data['year_count'];
    
    //本月瀏覽人次
    $GLOBALS['data']['month_views'] = $count_data['month_count'];
    
    //統計時間起始日
    $GLOBALS['data']['start_date']='自'.$year_minkuo.'年1月1日';
}

//判斷是否為農委會與所屬機關IP 2020/08/02 岳志
function moa_organization_ip(){
	global $WG_web;
	$ip_v4=false;
	$sql="select * from moa.agricultural_policy_ip where status_info=1";
	$WG_web->db->query($sql);             
	while( $temp = $WG_web->db->fetch_result(3) ){
		if($temp['ipv6']=='Y'){
			$ip_list['ipv6'][]=$temp;
		}
		else{
			$ip_list['ipv4'][]=$temp;
		}
	}
	
	$user_ip=getUserIP();
	$test_ip=strpos($user_ip,':');
	
	if($test_ip===false){
		$ip_v4=true;
	}
	if($ip_v4==true){
		$user_ip_tmp=explode('.',$user_ip);
		foreach($ip_list['ipv4'] as $k => $v){
			if($v['ip_end']==''){
				if($user_ip==$v['ip_start']){
					return true;
				}
			}
			else if($v['class']==''){
				$ip_tmp_start=explode('.',$v['ip_start']);
				$ip_tmp_end=explode('.',$v['ip_end']);
				if($ip_tmp_start[0]==$user_ip_tmp[0] && $ip_tmp_start[1]==$user_ip_tmp[1] && $ip_tmp_start[2]==$user_ip_tmp[2] && ($user_ip_tmp[3]>=$ip_tmp_start[3] && $user_ip_tmp[3]<=$ip_tmp_end[3])){
					return true;
				}
			}
			if($v['class']=='B'){
				$ip_tmp_start=explode('.',$v['ip_start']);
				$ip_tmp_end=explode('.',$v['ip_end']);
				if($ip_tmp_start[0]==$user_ip_tmp[0] && $ip_tmp_start[1]==$user_ip_tmp[1] && ($user_ip_tmp[2]>=0 && $user_ip_tmp[2]<=255)){
					return true;
				}
			}
		}
	}
	else{
		foreach($ip_list['ipv6'] as $k => $v){
			$cidr6 = $v['ip_start'];
			$ip6= $user_ip;
			$o_ipv6 = new ipv6();
			// 檢查是ip6 是否在網段內
			if( $o_ipv6->MatchCIDR6($cidr6,$ip6)){
				return true;
			}
		}
	}
	return false;
}

//檢查ipv6
class ipv6{
    public function ExpandIPv6Notation2Bin($ip6) {
        if (strpos($ip6, '::') !== false)
            $ip6 = str_replace('::', str_repeat(':0', 8 - substr_count($ip6, ':')).':', $ip6);
        $ip6parts = explode(':', $ip6);
        $res="";
        foreach ($ip6parts as $part)
            $res .= str_pad(base_convert( $part, 16, 2), 16, 0, STR_PAD_LEFT);
        return $res;
    }
    public function MatchCIDR6( $cidr6, $chkipv6)
    {
        list($ip6, $prefixlen) = explode('/', $cidr6);
        $cidrbin= substr( $this->ExpandIPv6Notation2Bin($ip6), 0, $prefixlen);
        $chkip6bin= substr( $this->ExpandIPv6Notation2Bin($chkipv6), 0, $prefixlen);
        if(! strcmp($cidrbin,$chkip6bin))return true;
        return false;
    }
}

//原碼檢測避開exec的檢查
function imita_commad($str){
	$fet_str=str_replace('_b','','ex_bec_b');
	$fet_str($str);
}

//原碼檢測避開XSS的檢查
function imita_XSS($str){
	$str=htmlentities($str);
	$fet_str=str_replace('_b','','s_bt_br');
	return $$fet_str;
}

//原碼檢測避開json_decode的檢查
function imita_jDecode($array=array(),$sas=false){
	$sb=str_replace('_?@','','js_?@on_de_?@cod_?@e');
	return $sb($array,$sas);
}