Révision 0ef18d70
Ajouté par Assos Assos il y a environ 9 ans
drupal7/sites/all/modules/honeypot/honeypot.module | ||
---|---|---|
45 | 45 |
db_delete('honeypot_user') |
46 | 46 |
->condition('timestamp', time() - variable_get('honeypot_expire', 300), '<') |
47 | 47 |
->execute(); |
48 |
|
|
49 |
// Regenerate the honeypot css file if it does not exist. |
|
50 |
$honeypot_css = honeypot_get_css_file_path(); |
|
51 |
if (!file_exists($honeypot_css)) { |
|
52 |
honeypot_create_css(variable_get('honeypot_element_name', 'url')); |
|
53 |
} |
|
48 | 54 |
} |
49 | 55 |
|
50 | 56 |
/** |
... | ... | |
192 | 198 |
$attributes = array('autocomplete' => 'off'); |
193 | 199 |
} |
194 | 200 |
|
201 |
// Get the path to the honeypot css file. |
|
202 |
$honeypot_css = honeypot_get_css_file_path(); |
|
203 |
|
|
195 | 204 |
// Build the honeypot element. |
196 | 205 |
$honeypot_class = $honeypot_element . '-textfield'; |
197 | 206 |
$form[$honeypot_element] = array( |
... | ... | |
206 | 215 |
// Hide honeypot using CSS. |
207 | 216 |
'#attached' => array( |
208 | 217 |
'css' => array( |
209 |
'data' => variable_get('file_public_path', conf_path() . '/files') . '/honeypot/honeypot.css',
|
|
218 |
'data' => $honeypot_css,
|
|
210 | 219 |
), |
211 | 220 |
), |
212 | 221 |
); |
... | ... | |
218 | 227 |
$form['honeypot_time'] = array( |
219 | 228 |
'#type' => 'hidden', |
220 | 229 |
'#title' => t('Timestamp'), |
221 |
'#default_value' => time(),
|
|
230 |
'#default_value' => honeypot_get_signed_timestamp(time()),
|
|
222 | 231 |
'#element_validate' => array('_honeypot_time_restriction_validate'), |
223 | 232 |
); |
224 | 233 |
|
... | ... | |
258 | 267 |
} |
259 | 268 |
|
260 | 269 |
// Get the time value. |
261 |
$honeypot_time = $form_state['values']['honeypot_time'];
|
|
270 |
$honeypot_time = honeypot_get_time_from_signed_timestamp($form_state['values']['honeypot_time']);
|
|
262 | 271 |
|
263 | 272 |
// Get the honeypot_time_limit. |
264 | 273 |
$time_limit = honeypot_get_time_limit($form_state['values']); |
265 | 274 |
|
266 | 275 |
// Make sure current time - (time_limit + form time value) is greater than 0. |
267 | 276 |
// If not, throw an error. |
268 |
if (time() < ($honeypot_time + $time_limit)) { |
|
277 |
if (!$honeypot_time || time() < ($honeypot_time + $time_limit)) {
|
|
269 | 278 |
_honeypot_log($form_state['values']['form_id'], 'honeypot_time'); |
270 | 279 |
// Get the time limit again, since it increases after first failure. |
271 | 280 |
$time_limit = honeypot_get_time_limit($form_state['values']); |
272 |
$form_state['values']['honeypot_time'] = time();
|
|
281 |
$form_state['values']['honeypot_time'] = honeypot_get_signed_timestamp(time());
|
|
273 | 282 |
form_set_error('', t('There was a problem with your form submission. Please wait @limit seconds and try again.', array('@limit' => $time_limit))); |
274 | 283 |
} |
275 | 284 |
} |
... | ... | |
307 | 316 |
|
308 | 317 |
// Only calculate time limit if honeypot_time_limit has a value > 0. |
309 | 318 |
if ($honeypot_time_limit) { |
319 |
$expire_time = variable_get('honeypot_expire', 300); |
|
310 | 320 |
// Get value from {honeypot_user} table for authenticated users. |
311 | 321 |
if ($user->uid) { |
312 |
$number = db_query("SELECT COUNT(*) FROM {honeypot_user} WHERE uid = :uid", array(':uid' => $user->uid))->fetchField(); |
|
322 |
$number = db_query("SELECT COUNT(*) FROM {honeypot_user} WHERE uid = :uid AND timestamp > :time", array( |
|
323 |
':uid' => $user->uid, |
|
324 |
':time' => time() - $expire_time, |
|
325 |
))->fetchField(); |
|
313 | 326 |
} |
314 | 327 |
// Get value from {flood} table for anonymous users. |
315 | 328 |
else { |
316 | 329 |
$number = db_query("SELECT COUNT(*) FROM {flood} WHERE event = :event AND identifier = :hostname AND timestamp > :time", array( |
317 | 330 |
':event' => 'honeypot', |
318 | 331 |
':hostname' => ip_address(), |
319 |
':time' => time() - variable_get('honeypot_expire', 300),
|
|
332 |
':time' => time() - $expire_time,
|
|
320 | 333 |
))->fetchField(); |
321 | 334 |
} |
322 | 335 |
// Don't add more than 30 days' worth of extra time. |
... | ... | |
381 | 394 |
} |
382 | 395 |
|
383 | 396 |
/** |
384 |
* Create CSS file for Honeypot. |
|
397 |
* Retrieve the location of the Honeypot CSS file. |
|
398 |
* |
|
399 |
* @return string |
|
400 |
* The path to the honeypot.css file. |
|
401 |
*/ |
|
402 |
function honeypot_get_css_file_path() { |
|
403 |
return variable_get('file_public_path', conf_path() . '/files') . '/honeypot/honeypot.css'; |
|
404 |
} |
|
405 |
|
|
406 |
/** |
|
407 |
* Create CSS file to hide the Honeypot field. |
|
408 |
* |
|
409 |
* @param string $element_name |
|
410 |
* The honeypot element class name (e.g. 'url'). |
|
385 | 411 |
*/ |
386 | 412 |
function honeypot_create_css($element_name) { |
387 | 413 |
$path = 'public://honeypot'; |
... | ... | |
395 | 421 |
file_unmanaged_save_data($data, $filename, FILE_EXISTS_REPLACE); |
396 | 422 |
} |
397 | 423 |
} |
424 |
|
|
425 |
/** |
|
426 |
* Sign the timestamp $time. |
|
427 |
* |
|
428 |
* @param mixed $time |
|
429 |
* The timestamp to sign. |
|
430 |
* |
|
431 |
* @return string |
|
432 |
* A signed timestamp in the form timestamp|HMAC. |
|
433 |
*/ |
|
434 |
function honeypot_get_signed_timestamp($time) { |
|
435 |
return $time . '|' . drupal_hmac_base64($time, drupal_get_private_key()); |
|
436 |
} |
|
437 |
|
|
438 |
/** |
|
439 |
* Validate a signed timestamp. |
|
440 |
* |
|
441 |
* @param string $signed_timestamp |
|
442 |
* A timestamp concateneted with the signature |
|
443 |
* |
|
444 |
* @return int |
|
445 |
* The timestamp if the signature is correct, 0 otherwise. |
|
446 |
*/ |
|
447 |
function honeypot_get_time_from_signed_timestamp($signed_timestamp) { |
|
448 |
$honeypot_time = 0; |
|
449 |
|
|
450 |
list($timestamp, $received_hmac) = explode('|', $signed_timestamp); |
|
451 |
|
|
452 |
if ($timestamp && $received_hmac) { |
|
453 |
$calculated_hmac = drupal_hmac_base64($timestamp, drupal_get_private_key()); |
|
454 |
// Prevent leaking timing information, compare second order hmacs. |
|
455 |
$random_key = drupal_random_bytes(32); |
|
456 |
if (drupal_hmac_base64($calculated_hmac, $random_key) === drupal_hmac_base64($received_hmac, $random_key)) { |
|
457 |
$honeypot_time = $timestamp; |
|
458 |
} |
|
459 |
} |
|
460 |
|
|
461 |
return $honeypot_time; |
|
462 |
} |
Formats disponibles : Unified diff
Weekly update of contrib modules