diff --git a/interface/lib/classes/ids.inc.php b/interface/lib/classes/ids.inc.php index ac5cb1912897f0eb0355715c24985092bc4d386a..abdf32b30251543045b0302158378748eba17d8b 100644 --- a/interface/lib/classes/ids.inc.php +++ b/interface/lib/classes/ids.inc.php @@ -118,7 +118,25 @@ class ids { $impact = $ids_result->getImpact(); - if($impact >= $security_config['ids_log_level']) { + // Choose level from security config + if($app->auth->is_admin()) { + // User is admin + $ids_log_level = $security_config['ids_admin_log_level']; + $ids_warn_level = $security_config['ids_admin_warn_level']; + $ids_block_level = $security_config['ids_admin_block_level']; + } elseif(is_array($_SESSION['s']['user']) && $_SESSION['s']['user']['userid'] > 0) { + // User is Client or Reseller + $ids_log_level = $security_config['ids_user_log_level']; + $ids_warn_level = $security_config['ids_user_warn_level']; + $ids_block_level = $security_config['ids_user_block_level']; + } else { + // Not logged in + $ids_log_level = $security_config['ids_anon_log_level']; + $ids_warn_level = $security_config['ids_anon_warn_level']; + $ids_block_level = $security_config['ids_anon_block_level']; + } + + if($impact >= $ids_log_level) { $ids_log = ISPC_ROOT_PATH.'/temp/ids.log'; if(!is_file($ids_log)) touch($ids_log); @@ -132,11 +150,11 @@ class ids { } - if($impact >= $security_config['ids_warn_level']) { + if($impact >= $ids_warn_level) { $app->log("PHP IDS Alert.".$ids_result, 2); } - if($impact >= $security_config['ids_block_level']) { + if($impact >= $ids_block_level) { $app->error("Possible attack detected. This action has been logged.",'', true, 2); } diff --git a/security/security_settings.ini b/security/security_settings.ini index eb78e24d53d5ef1cce7d3d4176843bfcfafc66fd..e705b3574e2d46edf9e621f0d0bb51a5a1d23566 100644 --- a/security/security_settings.ini +++ b/security/security_settings.ini @@ -19,10 +19,18 @@ password_reset_allowed=yes session_regenerate_id=yes [ids] -ids_enabled=no -ids_log_level=1 -ids_warn_level=5 -ids_block_level=100 +ids_anon_enabled=yes +ids_anon_log_level=1 +ids_anon_warn_level=5 +ids_anon_block_level=10 +ids_user_enabled=yes +ids_user_log_level=1 +ids_user_warn_level=10 +ids_user_block_level=50 +ids_admin_enabled=no +ids_admin_log_level=1 +ids_admin_warn_level=5 +ids_admin_block_level=100 sql_scan_enabled=yes sql_scan_action=warn apache_directives_scan_enabled=yes