Projet

Général

Profil

Révision 0ef18d70

Ajouté par Assos Assos il y a environ 9 ans

Weekly update of contrib modules

Voir les différences:

drupal7/sites/all/modules/honeypot/honeypot.module
45 45
  db_delete('honeypot_user')
46 46
    ->condition('timestamp', time() - variable_get('honeypot_expire', 300), '<')
47 47
    ->execute();
48

  
49
  // Regenerate the honeypot css file if it does not exist.
50
  $honeypot_css = honeypot_get_css_file_path();
51
  if (!file_exists($honeypot_css)) {
52
    honeypot_create_css(variable_get('honeypot_element_name', 'url'));
53
  }
48 54
}
49 55

  
50 56
/**
......
192 198
      $attributes = array('autocomplete' => 'off');
193 199
    }
194 200

  
201
    // Get the path to the honeypot css file.
202
    $honeypot_css = honeypot_get_css_file_path();
203

  
195 204
    // Build the honeypot element.
196 205
    $honeypot_class = $honeypot_element . '-textfield';
197 206
    $form[$honeypot_element] = array(
......
206 215
      // Hide honeypot using CSS.
207 216
      '#attached' => array(
208 217
        'css' => array(
209
          'data' => variable_get('file_public_path', conf_path() . '/files') . '/honeypot/honeypot.css',
218
          'data' => $honeypot_css,
210 219
        ),
211 220
      ),
212 221
    );
......
218 227
    $form['honeypot_time'] = array(
219 228
      '#type' => 'hidden',
220 229
      '#title' => t('Timestamp'),
221
      '#default_value' => time(),
230
      '#default_value' => honeypot_get_signed_timestamp(time()),
222 231
      '#element_validate' => array('_honeypot_time_restriction_validate'),
223 232
    );
224 233

  
......
258 267
  }
259 268

  
260 269
  // Get the time value.
261
  $honeypot_time = $form_state['values']['honeypot_time'];
270
  $honeypot_time = honeypot_get_time_from_signed_timestamp($form_state['values']['honeypot_time']);
262 271

  
263 272
  // Get the honeypot_time_limit.
264 273
  $time_limit = honeypot_get_time_limit($form_state['values']);
265 274

  
266 275
  // Make sure current time - (time_limit + form time value) is greater than 0.
267 276
  // If not, throw an error.
268
  if (time() < ($honeypot_time + $time_limit)) {
277
  if (!$honeypot_time || time() < ($honeypot_time + $time_limit)) {
269 278
    _honeypot_log($form_state['values']['form_id'], 'honeypot_time');
270 279
    // Get the time limit again, since it increases after first failure.
271 280
    $time_limit = honeypot_get_time_limit($form_state['values']);
272
    $form_state['values']['honeypot_time'] = time();
281
    $form_state['values']['honeypot_time'] = honeypot_get_signed_timestamp(time());
273 282
    form_set_error('', t('There was a problem with your form submission. Please wait @limit seconds and try again.', array('@limit' => $time_limit)));
274 283
  }
275 284
}
......
307 316

  
308 317
  // Only calculate time limit if honeypot_time_limit has a value > 0.
309 318
  if ($honeypot_time_limit) {
319
    $expire_time = variable_get('honeypot_expire', 300);
310 320
    // Get value from {honeypot_user} table for authenticated users.
311 321
    if ($user->uid) {
312
      $number = db_query("SELECT COUNT(*) FROM {honeypot_user} WHERE uid = :uid", array(':uid' => $user->uid))->fetchField();
322
      $number = db_query("SELECT COUNT(*) FROM {honeypot_user} WHERE uid = :uid AND timestamp > :time", array(
323
        ':uid' => $user->uid,
324
        ':time' => time() - $expire_time,
325
      ))->fetchField();
313 326
    }
314 327
    // Get value from {flood} table for anonymous users.
315 328
    else {
316 329
      $number = db_query("SELECT COUNT(*) FROM {flood} WHERE event = :event AND identifier = :hostname AND timestamp > :time", array(
317 330
        ':event' => 'honeypot',
318 331
        ':hostname' => ip_address(),
319
        ':time' => time() - variable_get('honeypot_expire', 300),
332
        ':time' => time() - $expire_time,
320 333
      ))->fetchField();
321 334
    }
322 335
    // Don't add more than 30 days' worth of extra time.
......
381 394
}
382 395

  
383 396
/**
384
 * Create CSS file for Honeypot.
397
 * Retrieve the location of the Honeypot CSS file.
398
 *
399
 * @return string
400
 *   The path to the honeypot.css file.
401
 */
402
function honeypot_get_css_file_path() {
403
  return variable_get('file_public_path', conf_path() . '/files') . '/honeypot/honeypot.css';
404
}
405

  
406
/**
407
 * Create CSS file to hide the Honeypot field.
408
 *
409
 * @param string $element_name
410
 *   The honeypot element class name (e.g. 'url').
385 411
 */
386 412
function honeypot_create_css($element_name) {
387 413
  $path = 'public://honeypot';
......
395 421
    file_unmanaged_save_data($data, $filename, FILE_EXISTS_REPLACE);
396 422
  }
397 423
}
424

  
425
/**
426
 * Sign the timestamp $time.
427
 *
428
 * @param mixed $time
429
 *   The timestamp to sign.
430
 *
431
 * @return string
432
 *   A signed timestamp in the form timestamp|HMAC.
433
 */
434
function honeypot_get_signed_timestamp($time) {
435
  return $time . '|' . drupal_hmac_base64($time, drupal_get_private_key());
436
}
437

  
438
/**
439
 * Validate a signed timestamp.
440
 *
441
 * @param string $signed_timestamp
442
 *   A timestamp concateneted with the signature
443
 *
444
 * @return int
445
 *   The timestamp if the signature is correct, 0 otherwise.
446
 */
447
function honeypot_get_time_from_signed_timestamp($signed_timestamp) {
448
  $honeypot_time = 0;
449

  
450
  list($timestamp, $received_hmac) = explode('|', $signed_timestamp);
451

  
452
  if ($timestamp && $received_hmac) {
453
    $calculated_hmac = drupal_hmac_base64($timestamp, drupal_get_private_key());
454
    // Prevent leaking timing information, compare second order hmacs.
455
    $random_key = drupal_random_bytes(32);
456
    if (drupal_hmac_base64($calculated_hmac, $random_key) === drupal_hmac_base64($received_hmac, $random_key)) {
457
      $honeypot_time = $timestamp;
458
    }
459
  }
460

  
461
  return $honeypot_time;
462
}

Formats disponibles : Unified diff