d13forme/infinity-squared
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Superior antispam protection. Instead of duplicating code by checking what method is being used in both index.php and result.php, now the check is performed in index.php and a POST variable is passed to the result.php page. Furthermore, antispam protection is ommitted if the user is logged into YOURLS.

Browse Source
This commit is contained in:
Tom Slominski
2015-03-22 18:36:25 +00:00
parent 222e7a3b8c
commit 3998b6c1a6
2 changed files with 43 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
index.php
View File

@@ -32,21 +32,28 @@ $title = isset( $_REQUEST['title'] ) ? yourls_sanitize_title( $_REQUEST['title
</div>
<?php
if ( !empty(ISQ::$recaptcha['sitekey']) && !empty(ISQ::$recaptcha['secret']) ) {
if ( yourls_is_valid_user() == 1 ) {
echo '<input type="hidden" name="antispam_method" value="user_login" class="hidden">';
} else if ( !empty(ISQ::$recaptcha['sitekey']) && !empty(ISQ::$recaptcha['secret']) ) {
$dependencies[] = 'reCAPTCHA';
?>
<div class="form-item recaptcha-container">
<p><label class="primary" title=""><?php yourls_e( 'Verification', 'isq_translation'); ?></label></p>
<p><label class="secondary"><?php yourls_e( 'reCAPTCHA verification used to ensure you are not a bot.', 'isq_translation'); ?></label></p>
<div class="g-recaptcha" data-sitekey="<?php echo ISQ::$recaptcha['sitekey']; ?>"></div>
</div>
<?php
echo '<input type="hidden" name="antispam_method" value="recaptcha" class="hidden">';
?>
<div class="form-item recaptcha-container">
<p><label class="primary" title=""><?php yourls_e( 'Verification', 'isq_translation'); ?></label></p>
<p><label class="secondary"><?php yourls_e( 'reCAPTCHA verification used to ensure you are not a bot.', 'isq_translation'); ?></label></p>
<div class="g-recaptcha" data-sitekey="<?php echo ISQ::$recaptcha['sitekey']; ?>"></div>
</div>
<?php
} else {
?>
<div class="hidden">
<input type="hidden" name="basic_antispam">
</div>
<?php
echo '<input type="hidden" name="antispam_method" value="basic" class="hidden">';
echo '<input type="hidden" name="basic_antispam" class="hidden">';
}
?>

27
result.php
View File

@@ -17,19 +17,38 @@ if ( empty( $_REQUEST['url'] ) ) {
display_error( yourls__( 'You haven\'t entered a URL to shorten. Please go back and try again.', 'isq_translation' ) );
};
if ( !empty(ISQ::$recaptcha['sitekey']) && !empty(ISQ::$recaptcha['secret']) ) {
// Check what CAPTCHA method was used
$antispam_method = $_REQUEST['antispam_method'];
if ( $antispam_method == 'user_login' ) {
// User is logged into YOURLS
} else if ( $antispam_method == 'recaptcha' ) {
// Google reCAPTCHA is enabled
$recaptcha_data = file_get_contents('https://www.google.com/recaptcha/api/siteverify?secret=' . ISQ::$recaptcha['secret'] . '&response=' . $_REQUEST['g-recaptcha-response']);
$recaptcha_json = json_decode($recaptcha_data, TRUE);
// What happens when the CAPTCHA was completed incorrectly
// What happens when the reCAPTCHA was completed incorrectly
if ( $recaptcha_json['success'] != 'true' ) {
display_error( yourls__( 'Are you a bot? Google certainly thinks you are. Please go back and try again.', 'isq_translation' ) );
}
} else {
} else if ( $antispam_method == 'basic' ) {
// Basic antispam protection fallback
// What happens when it was not completed correctly
if ( $_REQUEST['basic_antispam'] != "" ) {
display_error( yourls__( 'Are you a bot? The verification was not completed successfully. Please go back and try again.', 'isq_translation' ) );
}
};
} else {
// No antispam protection was detected
display_error( yourls__( 'Are you a bot? No antispam protection was completed successfully. Please go back and try again.', 'isq_translation' ) );
}
// Get parameters -- they will all be sanitized in yourls_add_new_link()
$url = $_REQUEST['url'];