isValidApiKey($apiKey)) { throw new InvalidArgumentException('Invalid API key format. API key should start with "sk_" and be at least 20 characters.'); } $this->apiKey = $apiKey; $this->config = $options; $this->apiUrl = $options['api_url'] ?? $this->detectApiUrl(); $this->timeout = $options['timeout'] ?? self::DEFAULT_TIMEOUT; $this->debug = $options['debug'] ?? false; $this->cacheDir = $options['cache_dir'] ?? $this->getDefaultCacheDir(); if ($this->cacheDir && !is_dir($this->cacheDir)) { @mkdir($this->cacheDir, 0755, true); } // ==================== AUTO-BADGE SETUP ==================== self::$instance = $this; $showBadge = $this->config['show_badge'] ?? true; // Start output buffering to inject the badge automatically before if ($showBadge && !self::$bufferStarted && php_sapi_name() !== 'cli') { ob_start([$this, 'injectBadgeCallback']); self::$bufferStarted = true; } // ======================================================= $this->log("Kriosa initialized", [ 'version' => self::VERSION, 'api_url' => $this->apiUrl, 'cache_enabled' => $this->cacheDir !== null ]); } private function isGoodBot(): bool { $userAgent = $_SERVER['HTTP_USER_AGENT'] ?? ''; $goodBots = [ 'Googlebot', 'Bingbot', 'Slurp', 'DuckDuckBot', 'Baiduspider', 'YandexBot', 'facebookexternalhit', 'Twitterbot', 'LinkedInBot', 'Applebot', 'PetalBot' ]; foreach ($goodBots as $bot) { if (stripos($userAgent, $bot) !== false) return true; } return false; } public function protect(): bool { if ($this->isGoodBot()) { error_log("KRIOSA: Allowing good bot - " . $_SERVER['HTTP_USER_AGENT']); self::$isProtected = true; // Mark as protected to show badge return true; } $startTime = microtime(true); $requestId = $this->generateRequestId(); $this->log("Security check started", ['request_id' => $requestId]); try { $requestData = $this->buildRequestData($requestId); $cachedResult = $this->getCachedResult($requestData); if ($cachedResult !== null) { $this->log("Cache hit", ['request_id' => $requestId]); self::$isProtected = true; return $cachedResult; } $result = $this->callApi($requestData, $requestId); if ($result['allowed']) { self::$isProtected = true; // Mark as protected to show badge $this->cacheResult($requestData, $result['allowed']); } else { $this->showBlockPage($result); } $processingTime = (microtime(true) - $startTime) * 1000; $this->log("Security check completed", [ 'request_id' => $requestId, 'allowed' => $result['allowed'], 'processing_time_ms' => round($processingTime, 2) ]); return $result['allowed']; } catch (Exception $e) { $this->log("Security check failed", [ 'request_id' => $requestId, 'error' => $e->getMessage() ]); $allowed = !($this->config['fail_closed'] ?? false); if ($allowed) self::$isProtected = true; return $allowed; } } private function showBlockPage(array $result): void { http_response_code(403); header('X-Kriosa-Blocked: true'); $refId = substr(md5(uniqid()), 0, 12); echo << 403 - Access Denied

Access Denied

The server could not process your request.
Please verify your input and try again.

REF: {$refId}

Secure Connection

HTML; exit; } public static function quick(string $apiKey): bool { static $instance = null; if ($instance === null) $instance = new self($apiKey); return $instance->protect(); } public function check(): array { $startTime = microtime(true); $requestId = $this->generateRequestId(); try { $requestData = $this->buildRequestData($requestId); $result = $this->callApi($requestData, $requestId); $result['processing_time_ms'] = round((microtime(true) - $startTime) * 1000, 2); $result['request_id'] = $requestId; $result['kriosa_version'] = self::VERSION; return $result; } catch (Exception $e) { return [ 'allowed' => true, 'error' => $e->getMessage(), 'processing_time_ms' => round((microtime(true) - $startTime) * 1000, 2), 'request_id' => $requestId, 'kriosa_version' => self::VERSION, 'fallback' => true ]; } } private function buildRequestData(string $requestId): array { $server = $_SERVER; $ip = $this->getClientIp(); $userAgent = $server['HTTP_USER_AGENT'] ?? ''; $method = $server['REQUEST_METHOD'] ?? 'GET'; $uri = $server['REQUEST_URI'] ?? '/'; // FIX: Safely check session status to prevent PHP warnings $hasSession = session_status() === PHP_SESSION_ACTIVE; $sessionId = $hasSession ? session_id() : null; $userId = $hasSession ? ($_SESSION['user_id'] ?? $_SESSION['userid'] ?? $_SESSION['uid'] ?? 0) : 0; $username = $hasSession ? ($_SESSION['username'] ?? $_SESSION['user'] ?? $_SESSION['email'] ?? null) : null; $tenantId = $hasSession ? ($_SESSION['tenant_id'] ?? $_SESSION['tenant'] ?? null) : null; $companyId = $hasSession ? ($_SESSION['company_id'] ?? $_SESSION['company'] ?? null) : null; $isAuthenticated = ($userId > 0) || !empty($server['HTTP_AUTHORIZATION']) || !empty($server['HTTP_X_API_KEY']); return [ 'api_key' => $this->apiKey, 'request_id' => $requestId, 'timestamp' => time(), 'source' => 'kriosa_php_sdk_v3', 'ip_address' => $ip, 'user_agent' => $userAgent, 'session_id' => $sessionId, 'session_user_id' => $userId, 'session_username' => $username, 'session_tenant_id' => $tenantId, 'session_company_id' => $companyId, 'method' => $method, 'resource' => $uri, 'path' => $uri, 'query_string' => $server['QUERY_STRING'] ?? '', 'payload' => $this->getPayload(), 'query_params' => $_GET, 'headers' => $this->getRelevantHeaders(), 'is_authenticated' => $isAuthenticated, 'sdk_version' => self::VERSION, 'sdk_language' => 'php', 'php_version' => PHP_VERSION ]; } private function getPayload(): array { $contentType = $_SERVER['CONTENT_TYPE'] ?? ''; if (strpos($contentType, 'application/json') !== false) { $input = file_get_contents('php://input'); if ($input) { $data = json_decode($input, true); if (is_array($data)) return $data; } } return $_POST; } private function getRelevantHeaders(): array { $headers = []; $relevant = [ 'HTTP_REFERER' => 'Referer', 'HTTP_ORIGIN' => 'Origin', 'HTTP_ACCEPT_LANGUAGE' => 'Accept-Language', 'HTTP_ACCEPT_ENCODING' => 'Accept-Encoding', 'HTTP_X_FORWARDED_FOR' => 'X-Forwarded-For', 'HTTP_X_REAL_IP' => 'X-Real-IP', 'HTTP_X_REQUEST_ID' => 'X-Request-Id' ]; foreach ($relevant as $serverKey => $headerName) { if (isset($_SERVER[$serverKey]) && $_SERVER[$serverKey]) $headers[$headerName] = $_SERVER[$serverKey]; } return $headers; } private function getClientIp(): string { $ip = null; if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) $ip = $_SERVER['HTTP_CF_CONNECTING_IP']; elseif (isset($_SERVER['HTTP_X_REAL_IP'])) $ip = $_SERVER['HTTP_X_REAL_IP']; elseif (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) { $ips = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']); $ip = trim($ips[0]); } elseif (isset($_SERVER['REMOTE_ADDR']) && !empty($_SERVER['REMOTE_ADDR'])) $ip = $_SERVER['REMOTE_ADDR']; else $ip = '127.0.0.1'; if ($ip === '::1' || $ip === '0:0:0:0:0:0:0:1') $ip = '127.0.0.1'; if (empty($ip) || $ip === '0.0.0.0') $ip = '127.0.0.1'; return $ip; } private function isValidIp(string $ip): bool { return filter_var($ip, FILTER_VALIDATE_IP) !== false; } private function callApi(array $requestData, string $requestId): array { if (!function_exists('curl_init')) return $this->fallbackResponse('cURL not available'); $ch = curl_init($this->apiUrl); $jsonData = json_encode($requestData); if ($jsonData === false) return $this->fallbackResponse('JSON encoding failed'); $headers = [ 'Content-Type: application/json', 'Accept: application/json', 'User-Agent: Kriosa-PHP-SDK/' . self::VERSION, 'X-Request-ID: ' . $requestId ]; curl_setopt_array($ch, [ CURLOPT_RETURNTRANSFER => true, CURLOPT_POST => true, CURLOPT_POSTFIELDS => $jsonData, CURLOPT_HTTPHEADER => $headers, CURLOPT_TIMEOUT => $this->timeout, CURLOPT_CONNECTTIMEOUT => 3, CURLOPT_SSL_VERIFYPEER => true, CURLOPT_SSL_VERIFYHOST => 2, CURLOPT_FOLLOWLOCATION => true, CURLOPT_MAXREDIRS => 2 ]); $response = curl_exec($ch); $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE); $curlError = curl_error($ch); curl_close($ch); if ($response === false) return $this->fallbackResponse($curlError); if ($httpCode === 403) return ['allowed' => false, 'reason' => 'attack_blocked']; if ($httpCode !== 200) return $this->fallbackResponse("HTTP {$httpCode}"); $result = json_decode($response, true); if (!is_array($result)) return $this->fallbackResponse('Invalid JSON response'); return $result; } private function fallbackResponse(string $reason = ''): array { if ($this->hasLocalAttackPattern()) return ['allowed' => false, 'reason' => 'local_pattern_match']; return ['allowed' => true, 'fallback' => true, 'reason' => $reason]; } private function hasLocalAttackPattern(): bool { $input = json_encode($_POST) . ' ' . json_encode($_GET) . ' ' . ($_SERVER['REQUEST_URI'] ?? ''); $patterns = [ '/\b(union\s+select|select.*from|insert\s+into|delete\s+from|drop\s+table)\b/i', '/]*>.*<\/script[^>]*>/is', '/javascript\s*:/i', '/;.*(ls|dir|cat|whoami|id|pwd)/i', '/\.\.\//', '/\.\.\\\\/', '/\$\w+/' ]; foreach ($patterns as $pattern) { if (preg_match($pattern, $input)) return true; } return false; } private function getCachedResult(array $requestData): ?bool { if (!$this->cacheDir) return null; $cacheFile = $this->cacheDir . '/' . $this->getCacheKey($requestData) . '.cache'; if (file_exists($cacheFile) && (time() - filemtime($cacheFile)) < self::CACHE_TTL) { $data = @unserialize(@file_get_contents($cacheFile)); if (is_array($data) && isset($data['allowed'])) return $data['allowed']; } return null; } private function cacheResult(array $requestData, bool $allowed): void { if (!$this->cacheDir) return; $cacheFile = $this->cacheDir . '/' . $this->getCacheKey($requestData) . '.cache'; @file_put_contents($cacheFile, serialize(['allowed' => $allowed, 'cached_at' => time()])); } private function getCacheKey(array $requestData): string { $keyData = [ 'api_key' => substr(md5($this->apiKey), 0, 16), 'resource' => $requestData['resource'] ?? '/', 'method' => $requestData['method'] ?? 'GET' ]; return 'kriosa_' . md5(json_encode($keyData)); } private function isValidApiKey(string $apiKey): bool { return strpos($apiKey, 'sk_') === 0 && strlen($apiKey) >= 20; } private function detectApiUrl(): string { $host = $_SERVER['HTTP_HOST'] ?? ''; if (strpos($host, 'localhost') !== false || strpos($host, '127.0.0.1') !== false) return 'http://localhost/api.php/v1/protect'; return 'https://kriosa.com/api.php/v1/protect'; } private function getDefaultCacheDir(): ?string { $tempDir = sys_get_temp_dir() . '/kriosa_cache'; if (is_writable(dirname($tempDir))) return $tempDir; if (is_writable(__DIR__)) return __DIR__ . '/.kriosa_cache'; return null; } private function generateRequestId(): string { return 'req_' . uniqid() . '_' . bin2hex(random_bytes(4)); } private function log(string $message, array $context = []): void { if (!$this->debug) return; $log = date('Y-m-d H:i:s') . " [KRIOSA] " . $message; if (!empty($context)) $log .= " " . json_encode($context); error_log($log); } // ==================== AUTO-BADGE INJECTION METHODS ==================== /** * Output buffer callback to inject the badge before */ public function injectBadgeCallback($buffer) { if (!self::$isProtected) return $buffer; if ($this->isAdminPage()) return $buffer; // Skip injection for AJAX, API, or JSON responses $isAjax = isset($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest'; $isApi = strpos($_SERVER['REQUEST_URI'] ?? '', '/api/') !== false; $isJson = strpos($_SERVER['CONTENT_TYPE'] ?? '', 'application/json') !== false; if ($isAjax || $isApi || $isJson) return $buffer; if (self::$badgeInjected) return $buffer; self::$badgeInjected = true; $badgePosition = $this->config['badge_position'] ?? 'bottom-right'; $badgeSize = $this->config['badge_size'] ?? 'small'; $badgeHtml = $this->getBadgeHtml($badgePosition, $badgeSize); // Inject before closing body tag if (stripos($buffer, '') !== false) { return str_ireplace('', $badgeHtml . "\n", $buffer); } elseif (stripos($buffer, '') !== false) { return str_ireplace('', $badgeHtml . "\n", $buffer); } return $buffer . "\n" . $badgeHtml; } private function isAdminPage(): bool { $adminPaths = ['/admin', '/wp-admin', '/administrator', '/login', '/register']; $uri = $_SERVER['REQUEST_URI'] ?? ''; foreach ($adminPaths as $path) { if (strpos($uri, $path) !== false) return true; } return false; } /** * Allow users to manually disable the badge if needed */ public static function disableBadge(): void { self::$badgeInjected = true; } // private function getBadgeHtml($position, $size): string // { // $positions = [ // 'bottom-right' => 'bottom: 20px; right: 20px;', // 'bottom-left' => 'bottom: 20px; left: 20px;', // 'top-right' => 'top: 20px; right: 20px;', // 'top-left' => 'top: 20px; left: 20px;', // 'footer' => 'position: relative; text-align: center; margin: 20px 0;' // ]; // $positionStyle = $positions[$position] ?? $positions['bottom-right']; // $isFixed = !in_array($position, ['footer']); // $positionType = $isFixed ? 'fixed' : 'relative'; // $sizes = [ // 'small' => ['width' => 120, 'height' => 35, 'font-size' => 9, 'icon-size' => 14], // 'medium' => ['width' => 150, 'height' => 45, 'font-size' => 11, 'icon-size' => 18], // 'large' => ['width' => 200, 'height' => 55, 'font-size' => 13, 'icon-size' => 22] // ]; // $s = $sizes[$size] ?? $sizes['small']; // return ' // //

// //

// Protected by Kriosa // AI Security //

// //

'; // } private function getBadgeHtml($position, $size): string { return ' Protected by Kriosa '; } } // ==================== GLOBAL HELPER FUNCTIONS ==================== function kriosa_protect(string $apiKey): bool { return Kriosa::quick($apiKey); } function kriosa_check(string $apiKey): array { static $instance = null; if ($instance === null) $instance = new Kriosa($apiKey); return $instance->check(); } // ==================== AUTO-EXECUTION ==================== if (defined('KRIOSA_API_KEY') && constant('KRIOSA_API_KEY') && !defined('KRIOSA_SKIP_AUTO')) { if (!kriosa_protect(constant('KRIOSA_API_KEY'))) { http_response_code(403); die('Request blocked by Kriosa Security'); } }