cvs: phpweb /manual add-note.php spam_challenge.php

nlopess Wed Jul 5 15:51:45 2006 UTC Added files: /phpweb/manual spam_challenge.php Modified files: /phpweb/manual add-note.php Log: add an initial (and basic) challenge to avoid spam (at least to try) http://cvs.php.net/viewvc.cgi/phpweb/manual/add-note.php?r1=1.69&r2=1.70&diff_format=u Index: phpweb/manual/add-note.php diff -u phpweb/manual/add-note.php:1.69 phpweb/manual/add-note.php:1.70 --- phpweb/manual/add-note.php:1.69 Fri Jun 9 11:24:46 2006 +++ phpweb/manual/add-note.php Wed Jul 5 15:51:45 2006 @@ -1,24 +1,25 @@ <?php -// $Id: add-note.php,v 1.69 2006/06/09 11:24:46 nlopess Exp $ +// $Id: add-note.php,v 1.70 2006/07/05 15:51:45 nlopess Exp $ $_SERVER['BASE_PAGE'] = 'manual/add-note.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/posttohost.inc'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/shared-manual.inc'; +include $_SERVER['DOCUMENT_ROOT'] . '/manual/spam_challenge.php'; site_header("Add Manual Note"); // Copy over "sect" and "redirect" from GET to POST -if (!isset($_POST['sect']) && isset($_GET['sect'])) { +if (empty($_POST['sect']) && isset($_GET['sect'])) { $_POST['sect'] = $_GET['sect']; } -if (!isset($_POST['redirect']) && isset($_GET['redirect'])) { +if (empty($_POST['redirect']) && isset($_GET['redirect'])) { $_POST['redirect'] = $_GET['redirect']; } // Decide on whether all vars are present for processing $process = TRUE; -$needed_vars = array('note', 'user', 'sect', 'redirect', 'action'); +$needed_vars = array('note', 'user', 'sect', 'redirect', 'action', 'func', 'arga', 'argb', 'answer'); foreach ($needed_vars as $varname) { - if (!isset($_POST[$varname])) { + if (empty($_POST[$varname])) { $process = FALSE; break; } @@ -49,13 +50,18 @@ if (strlen($note) == 0) { $error = "You have not specified the note text."; } - + + // SPAM challenge failed + elseif (!test_answer($_POST['func'], $_POST['arga'], $_POST['argb'], $_POST['answer'])) { + $error = 'SPAM challenge failed.'; + } + // The user name contains a malicious character elseif (stristr($user, "|")) { $error = "You have included bad characters within your username. We appreciate you may want to obfuscate your email further, but we have a system in place to do this for you."; } - // Check if the note is not too long + // Check if the note is too long elseif (strlen($note) >= 4096) { $error = "Your note is too long. You'll have to make it shorter before you can post it. Keep in mind that this is not the place for long code examples!"; } @@ -273,7 +279,16 @@ </td> </tr> <tr> + <th class="subr">Answer to this simple question (SPAM challenge):<br /> + <?php $c = gen_challenge(); echo $c[3]; ?>?</th> + <td><input type="text" name="answer" size="60" maxlength="10" /></td> + </td> + </tr> + <tr> <th colspan="2"> + <input type="hidden" name="func" value="<?php echo $c[0]; ?>" /> + <input type="hidden" name="arga" value="<?php echo $c[1]; ?>" /> + <input type="hidden" name="argb" value="<?php echo $c[2]; ?>" /> <input type="submit" name="action" value="Preview" /> <input type="submit" name="action" value="Add Note" /> </th> http://cvs.php.net/viewvc.cgi/phpweb/manual/spam_challenge.php?view=markup&rev=1.1 Index: phpweb/manual/spam_challenge.php +++ phpweb/manual/spam_challenge.php <?php // $Id: spam_challenge.php,v 1.1 2006/07/05 15:51:45 nlopess Exp $ // simple and stupid SPAM protection (using little challenges) $nums = array('zero', 'one', 'two', 'three', 'four', 'five', 'six', 'seven', 'eight', 'nine'); function plus($a, $b) { return $a + $b; } function gen_plus($a) { return rand(0, 9 - $a); } function minus($a, $b) { return $a - $b; } function gen_minus($a) { return rand(0, $a); } function print_infix($name, $a, $b) { return "$a $name $b"; } function print_prefix($name, $a, $b) { return "$name($a, $b)"; } $challenges = array( // name, print, generator array('max', 'print_prefix'), array('min', 'print_prefix'), array('minus', 'print_infix', 'gen_minus'), array('plus', 'print_infix', 'gen_plus'), ); // generate a challenge function gen_challenge() { global $challenges, $nums; $c = $challenges[rand(0, sizeof($challenges)-1)]; $a = rand(0, 9); $an = $nums[$a]; $b = isset($c[2]) ? $c[2]($a) : rand(0, 9); $bn = $nums[$b]; return array($c[0], $an, $bn, $c[1]($c[0], $an, $bn)); } // test an answer for validity function test_answer($name, $an, $bn, $answer) { global $challenges, $nums; foreach ($challenges as $x) { if ($x[0] === $name) { $c = $x; break; } } $a = array_search($an, $nums); $b = array_search($bn, $nums); if (empty($c) || $a === false || $b === false) return false; return ($nums[$c[0]($a, $b)] === $answer); } ?>