Re: cvs: phpweb /manual add-note.php spam_challenge.php

Are you kidding? Did you even look at the patches from Etienne Kneuss? -Hannes On 7/5/06, Nuno Lopes <nlopess@php.net> wrote:

nlopess         Wed Jul  5 15:51:45 2006 UTC

Added files:

    /phpweb/manual      spam_challenge.php

Modified files:

    /phpweb/manual      add-note.php

Log: add an initial (and basic) challenge to avoid spam (at least to try) http://cvs.php.net/viewvc.cgi/phpweb/manual/add-note.php?r1=1.69&r2=1.70&diff_format=u Index: phpweb/manual/add-note.php diff -u phpweb/manual/add-note.php:1.69 phpweb/manual/add-note.php:1.70

--- phpweb/manual/add-note.php:1.69     Fri Jun  9 11:24:46 2006

+++ phpweb/manual/add-note.php Wed Jul 5 15:51:45 2006 @@ -1,24 +1,25 @@ <?php -// $Id: add-note.php,v 1.69 2006/06/09 11:24:46 nlopess Exp $ +// $Id: add-note.php,v 1.70 2006/07/05 15:51:45 nlopess Exp $ $_SERVER['BASE_PAGE'] = 'manual/add-note.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/posttohost.inc'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/shared-manual.inc';

+include      $_SERVER['DOCUMENT_ROOT'] . '/manual/spam_challenge.php';

site_header("Add Manual Note"); // Copy over "sect" and "redirect" from GET to POST -if (!isset($_POST['sect']) && isset($_GET['sect'])) { +if (empty($_POST['sect']) && isset($_GET['sect'])) {

     $_POST['sect'] = $_GET['sect'];

} -if (!isset($_POST['redirect']) && isset($_GET['redirect'])) { +if (empty($_POST['redirect']) && isset($_GET['redirect'])) {

     $_POST['redirect'] = $_GET['redirect'];

} // Decide on whether all vars are present for processing $process = TRUE; -$needed_vars = array('note', 'user', 'sect', 'redirect', 'action'); +$needed_vars = array('note', 'user', 'sect', 'redirect', 'action', 'func', 'arga', 'argb', 'answer'); foreach ($needed_vars as $varname) {

-    if (!isset($_POST[$varname])) {
+    if (empty($_POST[$varname])) {
         $process = FALSE;
         break;
     }

@@ -49,13 +50,18 @@

     if (strlen($note) == 0) {
         $error = "You have not specified the note text.";
     }

- +

+    // SPAM challenge failed
+    elseif (!test_answer($_POST['func'], $_POST['arga'], $_POST['argb'], $_POST['answer'])) {
+        $error = 'SPAM challenge failed.';
+    }

+

     // The user name contains a malicious character
     elseif (stristr($user, "|")) {
         $error = "You have included bad characters within your username. We appreciate you may want to obfuscate your email further, but we have a system in place to do this for you.";
     }

-    // Check if the note is not too long
+    // Check if the note is too long
     elseif (strlen($note) >= 4096) {
         $error = "Your note is too long. You'll have to make it shorter before you can post it. Keep in mind that this is not the place for long code examples!";
     }

@@ -273,7 +279,16 @@ </td> </tr> <tr> + <th class="subr">Answer to this simple question (SPAM challenge):<br /> + <?php $c = gen_challenge(); echo $c[3]; ?>?</th> + <td><input type="text" name="answer" size="60" maxlength="10" /></td> + </td> + </tr> + <tr>

    <th colspan="2">
+    <input type="hidden" name="func" value="<?php echo $c[0]; ?>" />
+    <input type="hidden" name="arga" value="<?php echo $c[1]; ?>" />
+    <input type="hidden" name="argb" value="<?php echo $c[2]; ?>" />
     <input type="submit" name="action" value="Preview" />
     <input type="submit" name="action" value="Add Note" />
    </th>

http://cvs.php.net/viewvc.cgi/phpweb/manual/spam_challenge.php?view=markup&rev=1.1 Index: phpweb/manual/spam_challenge.php +++ phpweb/manual/spam_challenge.php <?php // $Id: spam_challenge.php,v 1.1 2006/07/05 15:51:45 nlopess Exp $ // simple and stupid SPAM protection (using little challenges) $nums = array('zero', 'one', 'two', 'three', 'four', 'five', 'six', 'seven', 'eight', 'nine'); function plus($a, $b) {

        return $a + $b;

} function gen_plus($a) {

        return rand(0, 9 - $a);

} function minus($a, $b) {

        return $a - $b;

} function gen_minus($a) {

        return rand(0, $a);

} function print_infix($name, $a, $b) {

        return "$a $name $b";

} function print_prefix($name, $a, $b) {

        return "$name($a, $b)";

} $challenges = array(

        // name, print, generator
        array('max',   'print_prefix'),
        array('min',   'print_prefix'),
        array('minus', 'print_infix', 'gen_minus'),
        array('plus',  'print_infix', 'gen_plus'),

); // generate a challenge function gen_challenge() {

        global $challenges, $nums;
        $c = $challenges[rand(0, sizeof($challenges)-1)];

        $a  = rand(0, 9);
        $an = $nums[$a];
        $b  = isset($c[2]) ? $c[2]($a) : rand(0, 9);
        $bn = $nums[$b];

        return array($c[0], $an, $bn, $c[1]($c[0], $an, $bn));

} // test an answer for validity function test_answer($name, $an, $bn, $answer) {

        global $challenges, $nums;

        foreach ($challenges as $x) {
                if ($x[0] === $name) {
                        $c = $x;
                        break;
                }
        }

        $a = array_search($an, $nums);
        $b = array_search($bn, $nums);

        if (empty($c) || $a === false || $b === false) return false;

        return ($nums[$c[0]($a, $b)] === $answer);

} ?>