# This patch file was generated by NetBeans IDE
# This patch can be applied using context Tools: Apply Diff Patch action on respective folder.
# It uses platform neutral UTF-8 encoding.
# Above lines and this line are ignored by the patching process.
--- D:\Archive\Webserver\Drupal 6 contrib\modules\phpids\phpids.module
+++ D:\Archive\Webserver\Drupal 6 contrib\modules\phpids\phpids.module.modified
@@ -64,7 +64,7 @@
  * Sent an infomail about attack detected by PHPIDS to configured mail address.
  *
  * @param $action
- *      Action which is taken after checked by PHPIDS (warning, blocking, unknown)
+ *      Action which is taken after checked by PHPIDS (warning, blocking, trollipbanning, unknown)
  *
  * @see phpids_mail()
  * @see drupal_mail()
@@ -76,15 +76,21 @@
   if (!$to == '' && (!variable_get('phpids_testonly_activated', FALSE) || (variable_get('phpids_testonly_activated', FALSE) && variable_get('phpids_testonly_withmail', FALSE)))) {
     switch ($action) {
       case 'warning':
-        $params['subject'] = 'PHPIDS detect a warning on '. variable_get('site_name', 'Drupal');
+        $params['subject'] = variable_get('site_name', 'Drupal') . ': PHPIDS detect a warning.';
         break;
       case 'blocking':
-        $params['subject'] = 'PHPIDS detect a blocking on '. variable_get('site_name', 'Drupal');
+        $params['subject'] = variable_get('site_name', 'Drupal') . ': PHPIDS detect a blocking.';
         break;
+      case 'troll_ip_banning':
+        $params['subject'] = variable_get('site_name', 'Drupal') . ': PHPIDS detect a Troll IP ban.';
+        break;
+      case 'troll_ip_ban_fail':
+        $params['subject'] = variable_get('site_name', 'Drupal') . ': PHPIDS detect an aborted Troll IP ban.';
+        break;
       default:
-        $params['subject'] = 'PHPIDS detect an unknown attack type on '. variable_get('site_name', 'Drupal');
+        $params['subject'] = variable_get('site_name', 'Drupal') . ': PHPIDS detect an unknown attack type.';
     }
-    $params['body'] = 'Please check your logging on your website to get detailed informations.'."\r\n\r\n".'Attacker: '. $_SERVER['REMOTE_ADDR'] ."\r\n".'Attack-Time: '. date('c');
+    $params['body'] = 'Please check your logging on your website to get detailed information.'."\r\n\r\n".'Attacker: '. $_SERVER['REMOTE_ADDR'] ."\r\n".'Attack-Time: '. date('c');
     if (phpids_getDrupalMajorVersion() == '5' )
       drupal_mail($action, $to, $params['subject'], $params['body']);
     else
@@ -108,6 +114,8 @@
  *     1: do logging (default)
  *     2: log and sent warning
  *     3: block request
+ *     4: block request without logging
+ *     5: invoke Troll block
  *
  * @see phpids_getHandling()
  */
@@ -116,8 +124,15 @@
   $log_level = variable_get('phpids_loglevel', 1);  
   $warn_level = variable_get('phpids_warnlevel', 9);
   $block_level = variable_get('phpids_blocklevel', 27);
+  $log_disable = variable_get('phpids_log_disable', 0);
+  $troll_enable = variable_get('phpids_troll_enable',0);
+  $troll_level = variable_get('phpids_troll_level', 28);
 
-  if ($impact >= $block_level && $handling == 2)
+  if ($impact >= $troll_level && $handling == 2 && $troll_enable == 1)
+    return 5;
+  elseif ($impact >= $block_level && $handling == 2 && $log_disable == 1)
+    return 4;
+  elseif ($impact >= $block_level && $handling == 2)
     return 3;
   elseif ($impact >= $warn_level && $handling == 2)
     return 2;
@@ -172,17 +187,65 @@
 }
 
 /**
+ * Returns name of host
+ *
+ * @return
+ *      Host name or IP address
+ */
+function phpids_get_host($ip) {
+  if (!$ip == '') {
+    $hostname = gethostbyaddr($ip);
+    if ($ip_hostname == '' || 'FALSE') $ip_hostame = $ip;
+    }
+return $hostname;
+}
+
+/**
  * Implements hook_init().
  */
 function phpids_init() {
   if (file_exists(variable_get('phpids_path', realpath(dirname(__FILE__))) .'/IDS/Config/Config.ini')
     || file_exists(variable_get('phpids_path', realpath(dirname(__FILE__))) .'/IDS/Config/Config.ini.php')) {
-
     $phpids_handling = phpids_getHandling();
     if ($phpids_handling > 0) {
       $phpids_report = phpids_runPHPIDS();
       if (!$phpids_report->isEmpty()) {
+        $ip = $_SERVER['REMOTE_ADDR'];
         switch (phpids_getAction($phpids_report->getImpact(), $phpids_handling)) {
+          case 5:
+            if (!function_exists('drupal_goto')) {
+              require_once './includes/common.inc';
+              require_once './includes/path.inc';
+              }
+            phpids_get_host($ip);
+// $expires todo: could be a user set expiry date - see Troll module. 0=forever
+            $expires = 0;
+            if (!$ip == '') {
+              if (db_query("INSERT INTO {troll_ip_ban} (ip_address, domain_name, created, expires, uid) VALUES ('%s', '%s', %d, %d, %d)", $ip, $hostname, time(), $expires, $user->uid)) {
+                  $message = 'Troll IP ban created for ' .$ip. '</ br> ' .phpids_createReport($phpids_report);
+                  phpids_doLogging($message,  (phpids_getDrupalMajorVersion() > 5) ? WATCHDOG_ALERT : WATCHDOG_ERROR);
+                  phpids_doWarning('troll_ip_banning');
+             }
+           }
+           else {
+             $message = 'Troll IP ban aborted : IP is unknown: ' .phpids_createReport($phpids_report);
+             phpids_doLogging($message,  (phpids_getDrupalMajorVersion() > 5) ? WATCHDOG_ALERT : WATCHDOG_ERROR);
+             phpids_doWarning('troll_ip_ban_fail');
+           }
+           if (!variable_get('phpids_testonly_activated', FALSE))
+             drupal_goto('warning.html');
+           break;
+         case 4:
+            if (!function_exists('drupal_goto')) {
+              require_once './includes/common.inc';
+              require_once './includes/path.inc';
+              }
+            $message = 'IP blocked: ' .$ip. 'Logging is turned off.';
+            phpids_doLogging($message,  (phpids_getDrupalMajorVersion() > 5) ? WATCHDOG_ALERT : WATCHDOG_ERROR);
+            phpids_doWarning('blocking');
+            if (!variable_get('phpids_testonly_activated', FALSE))
+              drupal_goto('warning.html');
+            break;
           case 3:
             if (!function_exists('drupal_goto')) {
               require_once './includes/common.inc';
@@ -218,16 +281,16 @@
   else {
     switch (phpids_getDrupalMajorVersion()) {
       case 7:
-        phpids_doLogging('PHPIDS problem detected. Please check your status report for more informations.', WATCHDOG_EMERGENCY);
+        phpids_doLogging('PHPIDS problem detected. Please check your status report for more information.', WATCHDOG_EMERGENCY);
         break;
       case 6:
-        phpids_doLogging('PHPIDS problem detected. Please check your status report for more informations.', WATCHDOG_EMERG);
+        phpids_doLogging('PHPIDS problem detected. Please check your status report for more information.', WATCHDOG_EMERG);
         break;
       case 5:
-        phpids_doLogging('PHPIDS problem detected. Please check your status report for more informations.', WATCHDOG_ERROR);
+        phpids_doLogging('PHPIDS problem detected. Please check your status report for more information.', WATCHDOG_ERROR);
         break;
       default:
-        phpids_doLogging('PHPIDS problem detected. Please check your status report for more informations.', WATCHDOG_ERROR);
+        phpids_doLogging('PHPIDS problem detected. Please check your status report for more information.', WATCHDOG_ERROR);
     }
   }
 }