From 0248cd497a5db74e0aae1d98fadbf7d43a40750d Mon Sep 17 00:00:00 2001 From: Sazpaimon Date: Tue, 26 Jul 2011 16:19:55 +0000 Subject: [PATCH] Added reCAPTCHA (still needs some testing), updated links (finally), fixed one more invalid token error, fix very minor "exploit" git-svn-id: http://kusabax.cultnet.net/svn/repo/stable@306 73d99b7e-4f53-4972-b7b7-2ecd3c4d89ee --- README | 6 +- config.php | 2 +- dwoo/templates/error.tpl | 2 +- dwoo/templates/img_footer.tpl | 2 +- dwoo/templates/img_header.tpl | 5 + dwoo/templates/oek_footer.tpl | 2 +- dwoo/templates/oek_header.tpl | 5 + dwoo/templates/txt_footer.tpl | 2 +- dwoo/templates/txt_header.tpl | 5 + dwoo/templates/upl_footer.tpl | 2 +- dwoo/templates/upl_header.tpl | 5 + inc/classes/board-post.class.php | 5 + inc/classes/manage.class.php | 6 +- inc/classes/posting.class.php | 25 ++- recaptchalib.php | 277 +++++++++++++++++++++++++++++++ 15 files changed, 336 insertions(+), 15 deletions(-) create mode 100644 recaptchalib.php diff --git a/README b/README index 10eaae3..4b15ff0 100644 --- a/README +++ b/README @@ -1,8 +1,8 @@ Installation Guide -http://kusabax.org/wiki/installation_guide +http://kusabax.cultnet.net/wiki/installation_guide Other Info (Including Upgrading) -http://kusabax.org/wiki/basics +http://kusabax.cultnet.net/wiki/basics Support Board -http://kusabax.org/sup/ \ No newline at end of file +http://kusabax.cultnet.net/sup/ \ No newline at end of file diff --git a/config.php b/config.php index 3c325ef..6e1d418 100644 --- a/config.php +++ b/config.php @@ -189,7 +189,7 @@ if (!$cache_loaded) { $cf['KU_DEBUG'] = false; // When enabled, debug information will be printed (Warning: all queries will be shown publicly) // Post-configuration actions, don't modify these - $cf['KU_VERSION'] = '0.9'; + $cf['KU_VERSION'] = '0.9.3'; $cf['KU_TAGS'] = serialize($cf['KU_TAGS']); $cf['KU_TRIPS'] = serialize($cf['KU_TRIPS']); $cf['KU_LINELENGTH'] = $cf['KU_LINELENGTH'] * 15; diff --git a/dwoo/templates/error.tpl b/dwoo/templates/error.tpl index 1097353..819895b 100644 --- a/dwoo/templates/error.tpl +++ b/dwoo/templates/error.tpl @@ -26,7 +26,7 @@ body {
{* I'd really appreciate it if you left the link to kusabax.org in the footer, if you decide to modify this. That being said, you are not bound by license or any other terms to keep it there *} -
- kusaba x {%KU_VERSION} - +
- kusaba x {%KU_VERSION} -
diff --git a/dwoo/templates/img_footer.tpl b/dwoo/templates/img_footer.tpl index 20b5f6c..4a886b2 100644 --- a/dwoo/templates/img_footer.tpl +++ b/dwoo/templates/img_footer.tpl @@ -89,7 +89,7 @@
{* I'd really appreciate it if you left the link to kusabax.org in the footer, if you decide to modify this. That being said, you are not bound by license or any other terms to keep it there *} - - kusaba x {%KU_VERSION} + - kusaba x {%KU_VERSION} {if $executiontime neq ''} + {t}Took{/t} {$executiontime}s -{/if} {if $botads neq ''}
diff --git a/dwoo/templates/img_header.tpl b/dwoo/templates/img_header.tpl index b678aeb..caf4a1f 100644 --- a/dwoo/templates/img_header.tpl +++ b/dwoo/templates/img_header.tpl @@ -30,6 +30,11 @@ +{if $board.enablecaptcha eq 1} + {literal} + + {/literal} +{/if}
diff --git a/dwoo/templates/oek_footer.tpl b/dwoo/templates/oek_footer.tpl index 20b5f6c..4a886b2 100644 --- a/dwoo/templates/oek_footer.tpl +++ b/dwoo/templates/oek_footer.tpl @@ -89,7 +89,7 @@
{* I'd really appreciate it if you left the link to kusabax.org in the footer, if you decide to modify this. That being said, you are not bound by license or any other terms to keep it there *} - - kusaba x {%KU_VERSION} + - kusaba x {%KU_VERSION} {if $executiontime neq ''} + {t}Took{/t} {$executiontime}s -{/if} {if $botads neq ''}
diff --git a/dwoo/templates/oek_header.tpl b/dwoo/templates/oek_header.tpl index b30686b..e63f237 100644 --- a/dwoo/templates/oek_header.tpl +++ b/dwoo/templates/oek_header.tpl @@ -30,6 +30,11 @@ +{if $board.enablecaptcha eq 1} + {literal} + + {/literal} +{/if}
diff --git a/dwoo/templates/txt_footer.tpl b/dwoo/templates/txt_footer.tpl index c03e767..808af6b 100644 --- a/dwoo/templates/txt_footer.tpl +++ b/dwoo/templates/txt_footer.tpl @@ -1,7 +1,7 @@
{* I'd really appreciate it if you left the link to kusabax.org in the footer, if you decide to modify this. That being said, you are not bound by license or any other terms to keep it there *} -
- kusaba x {%KU_VERSION} +
- kusaba x {%KU_VERSION} {if $executiontime neq ''} + {t}Took{/t} {$executiontime}s -{/if}
- {t}Manage boards{/t} -
{* botads go here *} diff --git a/dwoo/templates/txt_header.tpl b/dwoo/templates/txt_header.tpl index 7cedf02..9ab84b0 100644 --- a/dwoo/templates/txt_header.tpl +++ b/dwoo/templates/txt_header.tpl @@ -30,6 +30,11 @@ +{if $board.enablecaptcha eq 1} + {literal} + + {/literal} +{/if} {if $replythread eq 0} diff --git a/dwoo/templates/upl_footer.tpl b/dwoo/templates/upl_footer.tpl index 33386ab..b31e3bf 100644 --- a/dwoo/templates/upl_footer.tpl +++ b/dwoo/templates/upl_footer.tpl @@ -88,7 +88,7 @@
{* I'd really appreciate it if you left the link to kusabax.org in the footer, if you decide to modify this. That being said, you are not bound by license or any other terms to keep it there *} - - kusaba x {%KU_VERSION} + - kusaba x {%KU_VERSION} {if $executiontime neq ''} + {t}Took{/t} {$executiontime}s -{/if} {if $botads neq ''}
diff --git a/dwoo/templates/upl_header.tpl b/dwoo/templates/upl_header.tpl index b30686b..e63f237 100644 --- a/dwoo/templates/upl_header.tpl +++ b/dwoo/templates/upl_header.tpl @@ -30,6 +30,11 @@ +{if $board.enablecaptcha eq 1} + {literal} + + {/literal} +{/if}
diff --git a/inc/classes/board-post.class.php b/inc/classes/board-post.class.php index 01df0bb..8b49007 100644 --- a/inc/classes/board-post.class.php +++ b/inc/classes/board-post.class.php @@ -686,6 +686,11 @@ class Board { $oekposts = $tc_db->GetAll("SELECT `id` FROM `" . KU_DBPREFIX."posts` WHERE `boardid` = " . $this->board['id']." AND (`id` = ".$replythread." OR `parentid` = ".$replythread.") AND `file` != '' AND `file` != 'removed' AND `file_type` IN ('jpg', 'gif', 'png') AND `IS_DELETED` = 0 ORDER BY `parentid` ASC, `timestamp` ASC"); $this->dwoo_data->assign('oekposts', $oekposts); } + if ($this->board['enablecaptcha'] == 1) { + require_once(KU_ROOTDIR.'recaptchalib.php'); + $publickey = "6LdVg8YSAAAAAOhqx0eFT1Pi49fOavnYgy7e-lTO"; + $this->dwoo_data->assign('recaptcha', recaptcha_get_html($publickey)); + } if(($this->board['type'] == 1 && $replythread == 0) || $this->board['type'] != 1) { $postbox .= $this->dwoo->get(KU_TEMPLATEDIR . '/' . $this->board['text_readable'] . '_post_box.tpl', $this->dwoo_data); } diff --git a/inc/classes/manage.class.php b/inc/classes/manage.class.php index ad96d01..bdb465b 100644 --- a/inc/classes/manage.class.php +++ b/inc/classes/manage.class.php @@ -2083,7 +2083,9 @@ class Manage { function editfiletypes() { global $tc_db, $tpl_page; $this->AdministratorsOnly(); - + if ($_POST['filetype'] == "htaccess") { + exitWithErrorPage(_gettext('Invalid filetype.')); + } $tpl_page .= '

'. _gettext('Edit filetypes') . '


'; if (isset($_GET['do'])) { if ($_GET['do'] == 'addfiletype') { @@ -3049,7 +3051,7 @@ class Manage {
- + ' . $this->MakeBoardListDropdown('boarddir', $this->BoardList($_SESSION['manageusername'])) . '
diff --git a/inc/classes/posting.class.php b/inc/classes/posting.class.php index 2616339..74e0b52 100644 --- a/inc/classes/posting.class.php +++ b/inc/classes/posting.class.php @@ -128,10 +128,27 @@ class Posting { /* If the board has captcha's enabled... */ if ($board_class->board['enablecaptcha'] == 1) { - /* Check if they entered the correct code. If not... */ - if ($_SESSION['security_code'] != strtolower($_POST['captcha']) || empty($_SESSION['security_code'])) { - /* Kill the script, stopping the posting process */ - exitWithErrorPage(_gettext('Incorrect captcha entered.')); + if ($board_class->board['type'] == 1 && $_POST['replythread']) { + /* Check if they entered the correct code. If not... */ + if ($_SESSION['security_code'] != strtolower($_POST['captcha']) || empty($_SESSION['security_code'])) { + /* Kill the script, stopping the posting process */ + exitWithErrorPage(_gettext('Incorrect captcha entered.')); + } + } + else { + require_once(KU_ROOTDIR.'recaptchalib.php'); + $privatekey = "6LdVg8YSAAAAALayugP2r148EEQAogHPfQOSYow-"; + + // was there a reCAPTCHA response? + $resp = recaptcha_check_answer ($privatekey, + $_SERVER["REMOTE_ADDR"], + $_POST["recaptcha_challenge_field"], + $_POST["recaptcha_response_field"] + ); + if (!$resp->is_valid) { + // Show error and give user opportunity to try again. + exitWithErrorPage(_gettext('Incorrect captcha entered.')); + } } } } diff --git a/recaptchalib.php b/recaptchalib.php new file mode 100644 index 0000000..32c4f4d --- /dev/null +++ b/recaptchalib.php @@ -0,0 +1,277 @@ + $value ) + $req .= $key . '=' . urlencode( stripslashes($value) ) . '&'; + + // Cut the last '&' + $req=substr($req,0,strlen($req)-1); + return $req; +} + + + +/** + * Submits an HTTP POST to a reCAPTCHA server + * @param string $host + * @param string $path + * @param array $data + * @param int port + * @return array response + */ +function _recaptcha_http_post($host, $path, $data, $port = 80) { + + $req = _recaptcha_qsencode ($data); + + $http_request = "POST $path HTTP/1.0\r\n"; + $http_request .= "Host: $host\r\n"; + $http_request .= "Content-Type: application/x-www-form-urlencoded;\r\n"; + $http_request .= "Content-Length: " . strlen($req) . "\r\n"; + $http_request .= "User-Agent: reCAPTCHA/PHP\r\n"; + $http_request .= "\r\n"; + $http_request .= $req; + + $response = ''; + if( false == ( $fs = @fsockopen($host, $port, $errno, $errstr, 10) ) ) { + die ('Could not open socket'); + } + + fwrite($fs, $http_request); + + while ( !feof($fs) ) + $response .= fgets($fs, 1160); // One TCP-IP packet + fclose($fs); + $response = explode("\r\n\r\n", $response, 2); + + return $response; +} + + + +/** + * Gets the challenge HTML (javascript and non-javascript version). + * This is called from the browser, and the resulting reCAPTCHA HTML widget + * is embedded within the HTML form it was called from. + * @param string $pubkey A public key for reCAPTCHA + * @param string $error The error given by reCAPTCHA (optional, default is null) + * @param boolean $use_ssl Should the request be made over ssl? (optional, default is false) + + * @return string - The HTML to be embedded in the user's form. + */ +function recaptcha_get_html ($pubkey, $error = null, $use_ssl = false) +{ + if ($pubkey == null || $pubkey == '') { + die ("To use reCAPTCHA you must get an API key from https://www.google.com/recaptcha/admin/create"); + } + + if ($use_ssl) { + $server = RECAPTCHA_API_SECURE_SERVER; + } else { + $server = RECAPTCHA_API_SERVER; + } + + $errorpart = ""; + if ($error) { + $errorpart = "&error=" . $error; + } + return ' + + '; +} + + + + +/** + * A ReCaptchaResponse is returned from recaptcha_check_answer() + */ +class ReCaptchaResponse { + var $is_valid; + var $error; +} + + +/** + * Calls an HTTP POST function to verify if the user's guess was correct + * @param string $privkey + * @param string $remoteip + * @param string $challenge + * @param string $response + * @param array $extra_params an array of extra variables to post to the server + * @return ReCaptchaResponse + */ +function recaptcha_check_answer ($privkey, $remoteip, $challenge, $response, $extra_params = array()) +{ + if ($privkey == null || $privkey == '') { + die ("To use reCAPTCHA you must get an API key from https://www.google.com/recaptcha/admin/create"); + } + + if ($remoteip == null || $remoteip == '') { + die ("For security reasons, you must pass the remote ip to reCAPTCHA"); + } + + + + //discard spam submissions + if ($challenge == null || strlen($challenge) == 0 || $response == null || strlen($response) == 0) { + $recaptcha_response = new ReCaptchaResponse(); + $recaptcha_response->is_valid = false; + $recaptcha_response->error = 'incorrect-captcha-sol'; + return $recaptcha_response; + } + + $response = _recaptcha_http_post (RECAPTCHA_VERIFY_SERVER, "/recaptcha/api/verify", + array ( + 'privatekey' => $privkey, + 'remoteip' => $remoteip, + 'challenge' => $challenge, + 'response' => $response + ) + $extra_params + ); + + $answers = explode ("\n", $response [1]); + $recaptcha_response = new ReCaptchaResponse(); + + if (trim ($answers [0]) == 'true') { + $recaptcha_response->is_valid = true; + } + else { + $recaptcha_response->is_valid = false; + $recaptcha_response->error = $answers [1]; + } + return $recaptcha_response; + +} + +/** + * gets a URL where the user can sign up for reCAPTCHA. If your application + * has a configuration page where you enter a key, you should provide a link + * using this function. + * @param string $domain The domain where the page is hosted + * @param string $appname The name of your application + */ +function recaptcha_get_signup_url ($domain = null, $appname = null) { + return "https://www.google.com/recaptcha/admin/create?" . _recaptcha_qsencode (array ('domains' => $domain, 'app' => $appname)); +} + +function _recaptcha_aes_pad($val) { + $block_size = 16; + $numpad = $block_size - (strlen ($val) % $block_size); + return str_pad($val, strlen ($val) + $numpad, chr($numpad)); +} + +/* Mailhide related code */ + +function _recaptcha_aes_encrypt($val,$ky) { + if (! function_exists ("mcrypt_encrypt")) { + die ("To use reCAPTCHA Mailhide, you need to have the mcrypt php module installed."); + } + $mode=MCRYPT_MODE_CBC; + $enc=MCRYPT_RIJNDAEL_128; + $val=_recaptcha_aes_pad($val); + return mcrypt_encrypt($enc, $ky, $val, $mode, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"); +} + + +function _recaptcha_mailhide_urlbase64 ($x) { + return strtr(base64_encode ($x), '+/', '-_'); +} + +/* gets the reCAPTCHA Mailhide url for a given email, public key and private key */ +function recaptcha_mailhide_url($pubkey, $privkey, $email) { + if ($pubkey == '' || $pubkey == null || $privkey == "" || $privkey == null) { + die ("To use reCAPTCHA Mailhide, you have to sign up for a public and private key, " . + "you can do so at http://www.google.com/recaptcha/mailhide/apikey"); + } + + + $ky = pack('H*', $privkey); + $cryptmail = _recaptcha_aes_encrypt ($email, $ky); + + return "http://www.google.com/recaptcha/mailhide/d?k=" . $pubkey . "&c=" . _recaptcha_mailhide_urlbase64 ($cryptmail); +} + +/** + * gets the parts of the email to expose to the user. + * eg, given johndoe@example,com return ["john", "example.com"]. + * the email is then displayed as john...@example.com + */ +function _recaptcha_mailhide_email_parts ($email) { + $arr = preg_split("/@/", $email ); + + if (strlen ($arr[0]) <= 4) { + $arr[0] = substr ($arr[0], 0, 1); + } else if (strlen ($arr[0]) <= 6) { + $arr[0] = substr ($arr[0], 0, 3); + } else { + $arr[0] = substr ($arr[0], 0, 4); + } + return $arr; +} + +/** + * Gets html to display an email address given a public an private key. + * to get a key, go to: + * + * http://www.google.com/recaptcha/mailhide/apikey + */ +function recaptcha_mailhide_html($pubkey, $privkey, $email) { + $emailparts = _recaptcha_mailhide_email_parts ($email); + $url = recaptcha_mailhide_url ($pubkey, $privkey, $email); + + return htmlentities($emailparts[0]) . "...@" . htmlentities ($emailparts [1]); + +} + + +?>