1 |
11987c58
|
Florent Torregrosa
|
<?php
|
2 |
|
|
|
3 |
|
|
/**
|
4 |
|
|
* @file
|
5 |
|
|
* Honeypot module, for deterring spam bots from completing Drupal forms.
|
6 |
|
|
*/
|
7 |
|
|
|
8 |
|
|
/**
|
9 |
|
|
* Implements hook_menu().
|
10 |
|
|
*/
|
11 |
|
|
function honeypot_menu() {
|
12 |
|
|
$items['admin/config/content/honeypot'] = array(
|
13 |
|
|
'title' => 'Honeypot configuration',
|
14 |
|
|
'description' => 'Configure Honeypot spam prevention and the forms on which Honeypot will be used.',
|
15 |
|
|
'page callback' => 'drupal_get_form',
|
16 |
|
|
'page arguments' => array('honeypot_admin_form'),
|
17 |
|
|
'access arguments' => array('administer honeypot'),
|
18 |
|
|
'file' => 'honeypot.admin.inc',
|
19 |
|
|
);
|
20 |
|
|
|
21 |
|
|
return $items;
|
22 |
|
|
}
|
23 |
|
|
|
24 |
|
|
/**
|
25 |
|
|
* Implements hook_permission().
|
26 |
|
|
*/
|
27 |
|
|
function honeypot_permission() {
|
28 |
|
|
return array(
|
29 |
|
|
'administer honeypot' => array(
|
30 |
|
|
'title' => t('Administer Honeypot'),
|
31 |
|
|
'description' => t('Administer Honeypot-protected forms and settings'),
|
32 |
|
|
),
|
33 |
|
|
'bypass honeypot protection' => array(
|
34 |
|
|
'title' => t('Bypass Honeypot protection'),
|
35 |
|
|
'description' => t('Bypass Honeypot form protection.'),
|
36 |
|
|
),
|
37 |
|
|
);
|
38 |
|
|
}
|
39 |
|
|
|
40 |
|
|
/**
|
41 |
ca92d645
|
Assos Assos
|
* Implements hook_cron().
|
42 |
11987c58
|
Florent Torregrosa
|
*/
|
43 |
|
|
function honeypot_cron() {
|
44 |
|
|
// Delete {honeypot_user} entries older than the value of honeypot_expire.
|
45 |
|
|
db_delete('honeypot_user')
|
46 |
ca92d645
|
Assos Assos
|
->condition('timestamp', REQUEST_TIME - variable_get('honeypot_expire', 300), '<')
|
47 |
11987c58
|
Florent Torregrosa
|
->execute();
|
48 |
0ef18d70
|
Assos Assos
|
|
49 |
ca92d645
|
Assos Assos
|
// Regenerate the honeypot css file if it does not exist or is outdated.
|
50 |
0ef18d70
|
Assos Assos
|
$honeypot_css = honeypot_get_css_file_path();
|
51 |
ca92d645
|
Assos Assos
|
$honeypot_element_name = variable_get('honeypot_element_name', 'url');
|
52 |
|
|
if (!file_exists($honeypot_css) || !honeypot_check_css($honeypot_element_name)) {
|
53 |
|
|
honeypot_create_css($honeypot_element_name);
|
54 |
0ef18d70
|
Assos Assos
|
}
|
55 |
11987c58
|
Florent Torregrosa
|
}
|
56 |
|
|
|
57 |
|
|
/**
|
58 |
|
|
* Implements hook_form_alter().
|
59 |
|
|
*
|
60 |
|
|
* Add Honeypot features to forms enabled in the Honeypot admin interface.
|
61 |
|
|
*/
|
62 |
|
|
function honeypot_form_alter(&$form, &$form_state, $form_id) {
|
63 |
|
|
// Don't use for maintenance mode forms (install, update, etc.).
|
64 |
|
|
if (defined('MAINTENANCE_MODE')) {
|
65 |
|
|
return;
|
66 |
|
|
}
|
67 |
|
|
|
68 |
|
|
$unprotected_forms = array(
|
69 |
|
|
'user_login',
|
70 |
|
|
'user_login_block',
|
71 |
|
|
'search_form',
|
72 |
|
|
'search_block_form',
|
73 |
|
|
'views_exposed_form',
|
74 |
|
|
'honeypot_admin_form',
|
75 |
|
|
);
|
76 |
|
|
|
77 |
|
|
// If configured to protect all forms, add protection to every form.
|
78 |
|
|
if (variable_get('honeypot_protect_all_forms', 0) && !in_array($form_id, $unprotected_forms)) {
|
79 |
|
|
// Don't protect system forms - only admins should have access, and system
|
80 |
|
|
// forms may be programmatically submitted by drush and other modules.
|
81 |
bc175c27
|
Assos Assos
|
if (preg_match('/[^a-zA-Z]system_/', $form_id) === 0 && preg_match('/[^a-zA-Z]search_/', $form_id) === 0 && preg_match('/[^a-zA-Z]views_exposed_form_/', $form_id) === 0) {
|
82 |
11987c58
|
Florent Torregrosa
|
honeypot_add_form_protection($form, $form_state, array('honeypot', 'time_restriction'));
|
83 |
|
|
}
|
84 |
|
|
}
|
85 |
|
|
|
86 |
|
|
// Otherwise add form protection to admin-configured forms.
|
87 |
|
|
elseif ($forms_to_protect = honeypot_get_protected_forms()) {
|
88 |
|
|
foreach ($forms_to_protect as $protect_form_id) {
|
89 |
|
|
// For most forms, do a straight check on the form ID.
|
90 |
|
|
if ($form_id == $protect_form_id) {
|
91 |
|
|
honeypot_add_form_protection($form, $form_state, array('honeypot', 'time_restriction'));
|
92 |
|
|
}
|
93 |
|
|
// For webforms use a special check for variable form ID.
|
94 |
|
|
elseif ($protect_form_id == 'webforms' && (strpos($form_id, 'webform_client_form') !== FALSE)) {
|
95 |
|
|
honeypot_add_form_protection($form, $form_state, array('honeypot', 'time_restriction'));
|
96 |
|
|
}
|
97 |
|
|
}
|
98 |
|
|
}
|
99 |
|
|
}
|
100 |
|
|
|
101 |
55670b15
|
Assos Assos
|
/**
|
102 |
|
|
* Implements hook_trigger_info().
|
103 |
|
|
*/
|
104 |
|
|
function honeypot_trigger_info() {
|
105 |
|
|
return array(
|
106 |
|
|
'honeypot' => array(
|
107 |
|
|
'honeypot_reject' => array(
|
108 |
|
|
'label' => t('Honeypot rejection'),
|
109 |
|
|
),
|
110 |
|
|
),
|
111 |
|
|
);
|
112 |
|
|
}
|
113 |
|
|
|
114 |
|
|
/**
|
115 |
ca92d645
|
Assos Assos
|
* Implements hook_rules_event_info().
|
116 |
55670b15
|
Assos Assos
|
*/
|
117 |
|
|
function honeypot_rules_event_info() {
|
118 |
|
|
return array(
|
119 |
|
|
'honeypot_reject' => array(
|
120 |
|
|
'label' => t('Honeypot rejection'),
|
121 |
|
|
'group' => t('Honeypot'),
|
122 |
|
|
'variables' => array(
|
123 |
|
|
'form_id' => array(
|
124 |
|
|
'type' => 'text',
|
125 |
|
|
'label' => t('Form ID of the form the user was disallowed from submitting.'),
|
126 |
|
|
),
|
127 |
|
|
// Don't provide 'uid' in context because it is available as
|
128 |
|
|
// site:current-user:uid.
|
129 |
|
|
'type' => array(
|
130 |
|
|
'type' => 'text',
|
131 |
|
|
'label' => t('String indicating the reason the submission was blocked.'),
|
132 |
|
|
),
|
133 |
|
|
),
|
134 |
|
|
),
|
135 |
|
|
);
|
136 |
|
|
}
|
137 |
|
|
|
138 |
9525582e
|
Assos Assos
|
/**
|
139 |
|
|
* Implements hook_library().
|
140 |
|
|
*/
|
141 |
|
|
function honeypot_library() {
|
142 |
|
|
$info = system_get_info('module', 'honeypot');
|
143 |
|
|
$version = $info['version'];
|
144 |
|
|
|
145 |
|
|
// Library for Honeypot JS.
|
146 |
c304a780
|
Assos Assos
|
$libraries['timestamp.js'] = array(
|
147 |
9525582e
|
Assos Assos
|
'title' => 'Javascript to support timelimit on cached pages.',
|
148 |
|
|
'version' => $version,
|
149 |
c304a780
|
Assos Assos
|
'js' => array(
|
150 |
|
|
array(
|
151 |
9525582e
|
Assos Assos
|
'type' => 'setting',
|
152 |
c304a780
|
Assos Assos
|
'data' => array(
|
153 |
|
|
'honeypot' => array(
|
154 |
9525582e
|
Assos Assos
|
'jsToken' => honeypot_get_signed_timestamp('js_token:' . mt_rand(0, 2147483647)),
|
155 |
c304a780
|
Assos Assos
|
),
|
156 |
|
|
),
|
157 |
|
|
),
|
158 |
|
|
drupal_get_path('module', 'honeypot') . '/js/honeypot.js' => array(
|
159 |
9525582e
|
Assos Assos
|
'group' => JS_LIBRARY,
|
160 |
|
|
'weight' => 3,
|
161 |
c304a780
|
Assos Assos
|
),
|
162 |
|
|
),
|
163 |
|
|
);
|
164 |
9525582e
|
Assos Assos
|
|
165 |
|
|
return $libraries;
|
166 |
|
|
}
|
167 |
|
|
|
168 |
11987c58
|
Florent Torregrosa
|
/**
|
169 |
|
|
* Build an array of all the protected forms on the site, by form_id.
|
170 |
|
|
*
|
171 |
|
|
* @todo - Add in API call/hook to allow modules to add to this array.
|
172 |
|
|
*/
|
173 |
|
|
function honeypot_get_protected_forms() {
|
174 |
|
|
$forms = &drupal_static(__FUNCTION__);
|
175 |
|
|
|
176 |
|
|
// If the data isn't already in memory, get from cache or look it up fresh.
|
177 |
|
|
if (!isset($forms)) {
|
178 |
|
|
if ($cache = cache_get('honeypot_protected_forms')) {
|
179 |
|
|
$forms = $cache->data;
|
180 |
|
|
}
|
181 |
|
|
else {
|
182 |
2c8c2b87
|
Assos Assos
|
$forms = array();
|
183 |
11987c58
|
Florent Torregrosa
|
// Look up all the honeypot forms in the variables table.
|
184 |
|
|
$result = db_query("SELECT name FROM {variable} WHERE name LIKE 'honeypot_form_%'")->fetchCol();
|
185 |
|
|
// Add each form that's enabled to the $forms array.
|
186 |
|
|
foreach ($result as $variable) {
|
187 |
|
|
if (variable_get($variable, 0)) {
|
188 |
|
|
$forms[] = substr($variable, 14);
|
189 |
|
|
}
|
190 |
|
|
}
|
191 |
|
|
|
192 |
|
|
// Save the cached data.
|
193 |
|
|
cache_set('honeypot_protected_forms', $forms, 'cache');
|
194 |
|
|
}
|
195 |
|
|
}
|
196 |
|
|
|
197 |
|
|
return $forms;
|
198 |
|
|
}
|
199 |
|
|
|
200 |
|
|
/**
|
201 |
|
|
* Form builder function to add different types of protection to forms.
|
202 |
|
|
*
|
203 |
|
|
* @param array $options
|
204 |
|
|
* Array of options to be added to form. Currently accepts 'honeypot' and
|
205 |
|
|
* 'time_restriction'.
|
206 |
|
|
*
|
207 |
|
|
* @return array
|
208 |
|
|
* Returns elements to be placed in a form's elements array to prevent spam.
|
209 |
|
|
*/
|
210 |
|
|
function honeypot_add_form_protection(&$form, &$form_state, $options = array()) {
|
211 |
|
|
global $user;
|
212 |
|
|
|
213 |
|
|
// Allow other modules to alter the protections applied to this form.
|
214 |
|
|
drupal_alter('honeypot_form_protections', $options, $form);
|
215 |
|
|
|
216 |
|
|
// Don't add any protections if the user can bypass the Honeypot.
|
217 |
|
|
if (user_access('bypass honeypot protection')) {
|
218 |
|
|
return;
|
219 |
|
|
}
|
220 |
|
|
|
221 |
|
|
// Build the honeypot element.
|
222 |
|
|
if (in_array('honeypot', $options)) {
|
223 |
|
|
// Get the element name (default is generic 'url').
|
224 |
|
|
$honeypot_element = variable_get('honeypot_element_name', 'url');
|
225 |
|
|
|
226 |
2c8c2b87
|
Assos Assos
|
// Add 'autocomplete="off"' if configured.
|
227 |
|
|
$attributes = array();
|
228 |
|
|
if (variable_get('honeypot_autocomplete_attribute', 1)) {
|
229 |
|
|
$attributes = array('autocomplete' => 'off');
|
230 |
|
|
}
|
231 |
|
|
|
232 |
0ef18d70
|
Assos Assos
|
// Get the path to the honeypot css file.
|
233 |
|
|
$honeypot_css = honeypot_get_css_file_path();
|
234 |
|
|
|
235 |
11987c58
|
Florent Torregrosa
|
// Build the honeypot element.
|
236 |
|
|
$honeypot_class = $honeypot_element . '-textfield';
|
237 |
|
|
$form[$honeypot_element] = array(
|
238 |
|
|
'#type' => 'textfield',
|
239 |
|
|
'#title' => t('Leave this field blank'),
|
240 |
|
|
'#size' => 20,
|
241 |
|
|
'#weight' => 100,
|
242 |
2c8c2b87
|
Assos Assos
|
'#attributes' => $attributes,
|
243 |
11987c58
|
Florent Torregrosa
|
'#element_validate' => array('_honeypot_honeypot_validate'),
|
244 |
|
|
'#prefix' => '<div class="' . $honeypot_class . '">',
|
245 |
|
|
'#suffix' => '</div>',
|
246 |
2c8c2b87
|
Assos Assos
|
// Hide honeypot using CSS.
|
247 |
11987c58
|
Florent Torregrosa
|
'#attached' => array(
|
248 |
|
|
'css' => array(
|
249 |
0ef18d70
|
Assos Assos
|
'data' => $honeypot_css,
|
250 |
11987c58
|
Florent Torregrosa
|
),
|
251 |
|
|
),
|
252 |
|
|
);
|
253 |
|
|
}
|
254 |
|
|
|
255 |
|
|
// Build the time restriction element (if it's not disabled).
|
256 |
|
|
if (in_array('time_restriction', $options) && variable_get('honeypot_time_limit', 5) != 0) {
|
257 |
|
|
// Set the current time in a hidden value to be checked later.
|
258 |
|
|
$form['honeypot_time'] = array(
|
259 |
|
|
'#type' => 'hidden',
|
260 |
|
|
'#title' => t('Timestamp'),
|
261 |
ca92d645
|
Assos Assos
|
'#default_value' => honeypot_get_signed_timestamp(REQUEST_TIME),
|
262 |
11987c58
|
Florent Torregrosa
|
'#element_validate' => array('_honeypot_time_restriction_validate'),
|
263 |
|
|
);
|
264 |
|
|
|
265 |
|
|
// Disable page caching to make sure timestamp isn't cached.
|
266 |
9525582e
|
Assos Assos
|
if (user_is_anonymous() && drupal_page_is_cacheable()) {
|
267 |
|
|
// Use javascript implementation if this page should be cached.
|
268 |
|
|
if (variable_get('honeypot_use_js_for_cached_pages', FALSE)) {
|
269 |
|
|
$form['honeypot_time']['#default_value'] = 'no_js_available';
|
270 |
|
|
$form['honeypot_time']['#attached']['library'][] = array('honeypot', 'timestamp.js');
|
271 |
|
|
$form['#attributes']['class'][] = 'honeypot-timestamp-js';
|
272 |
|
|
}
|
273 |
|
|
else {
|
274 |
|
|
drupal_page_is_cacheable(FALSE);
|
275 |
|
|
}
|
276 |
11987c58
|
Florent Torregrosa
|
}
|
277 |
|
|
}
|
278 |
|
|
|
279 |
|
|
// Allow other modules to react to addition of form protection.
|
280 |
|
|
if (!empty($options)) {
|
281 |
|
|
module_invoke_all('honeypot_add_form_protection', $options, $form);
|
282 |
|
|
}
|
283 |
|
|
}
|
284 |
|
|
|
285 |
|
|
/**
|
286 |
|
|
* Validate honeypot field.
|
287 |
|
|
*/
|
288 |
|
|
function _honeypot_honeypot_validate($element, &$form_state) {
|
289 |
|
|
// Get the honeypot field value.
|
290 |
|
|
$honeypot_value = $element['#value'];
|
291 |
|
|
|
292 |
|
|
// Make sure it's empty.
|
293 |
4019484b
|
Assos Assos
|
if (!empty($honeypot_value) || $honeypot_value == '0') {
|
294 |
11987c58
|
Florent Torregrosa
|
_honeypot_log($form_state['values']['form_id'], 'honeypot');
|
295 |
|
|
form_set_error('', t('There was a problem with your form submission. Please refresh the page and try again.'));
|
296 |
|
|
}
|
297 |
|
|
}
|
298 |
|
|
|
299 |
|
|
/**
|
300 |
|
|
* Validate honeypot's time restriction field.
|
301 |
|
|
*/
|
302 |
9525582e
|
Assos Assos
|
function _honeypot_time_restriction_validate(&$element, &$form_state) {
|
303 |
ca92d645
|
Assos Assos
|
if (!empty($form_state['programmed'])) {
|
304 |
|
|
// Don't do anything if the form was submitted programmatically.
|
305 |
|
|
return;
|
306 |
|
|
}
|
307 |
|
|
|
308 |
11987c58
|
Florent Torregrosa
|
// Don't do anything if the triggering element is a preview button.
|
309 |
|
|
if ($form_state['triggering_element']['#value'] == t('Preview')) {
|
310 |
|
|
return;
|
311 |
|
|
}
|
312 |
|
|
|
313 |
9525582e
|
Assos Assos
|
if ($form_state['values']['honeypot_time'] == 'no_js_available') {
|
314 |
|
|
// Set an error, but do not penalize the user as it might be a legitimate
|
315 |
|
|
// attempt.
|
316 |
|
|
form_set_error('', t('You seem to have javascript disabled. Please confirm your form submission.'));
|
317 |
|
|
|
318 |
|
|
if (variable_get('honeypot_log', 0)) {
|
319 |
|
|
$variables = array(
|
320 |
|
|
'%form' => $form_state['values']['form_id'],
|
321 |
|
|
);
|
322 |
|
|
watchdog('honeypot', 'User tried to submit form %form without javascript enabled.', $variables);
|
323 |
|
|
}
|
324 |
|
|
|
325 |
|
|
// Update the value in $form_state and $element.
|
326 |
|
|
$form_state['values']['honeypot_time'] = honeypot_get_signed_timestamp(REQUEST_TIME);
|
327 |
|
|
$element['#value'] = $form_state['values']['honeypot_time'];
|
328 |
|
|
return;
|
329 |
|
|
}
|
330 |
|
|
|
331 |
|
|
$honeypot_time = FALSE;
|
332 |
|
|
|
333 |
|
|
// Update the honeypot_time for JS requests and get the $honeypot_time value.
|
334 |
|
|
if (strpos($form_state['values']['honeypot_time'], 'js_token:') === 0) {
|
335 |
|
|
$interval = _honeypot_get_interval_from_signed_js_value($form_state['values']['honeypot_time']);
|
336 |
|
|
if ($interval) {
|
337 |
|
|
// Set correct value for timestamp validation.
|
338 |
|
|
$honeypot_time = REQUEST_TIME - $interval;
|
339 |
|
|
|
340 |
|
|
// Update form_state and element values so they're correct.
|
341 |
|
|
$form_state['values']['honeypot_time'] = honeypot_get_signed_timestamp($honeypot_time);
|
342 |
|
|
$element['#value'] = $form_state['values']['honeypot_time'];
|
343 |
|
|
}
|
344 |
|
|
}
|
345 |
|
|
// Otherwise just get the $honeypot_time value.
|
346 |
|
|
else {
|
347 |
|
|
// Get the time value.
|
348 |
|
|
$honeypot_time = honeypot_get_time_from_signed_timestamp($form_state['values']['honeypot_time']);
|
349 |
|
|
}
|
350 |
11987c58
|
Florent Torregrosa
|
|
351 |
|
|
// Get the honeypot_time_limit.
|
352 |
|
|
$time_limit = honeypot_get_time_limit($form_state['values']);
|
353 |
|
|
|
354 |
|
|
// Make sure current time - (time_limit + form time value) is greater than 0.
|
355 |
|
|
// If not, throw an error.
|
356 |
ca92d645
|
Assos Assos
|
if (!$honeypot_time || REQUEST_TIME < ($honeypot_time + $time_limit)) {
|
357 |
11987c58
|
Florent Torregrosa
|
_honeypot_log($form_state['values']['form_id'], 'honeypot_time');
|
358 |
55670b15
|
Assos Assos
|
// Get the time limit again, since it increases after first failure.
|
359 |
|
|
$time_limit = honeypot_get_time_limit($form_state['values']);
|
360 |
9525582e
|
Assos Assos
|
// Update the honeypot_time value in the form state and element.
|
361 |
ca92d645
|
Assos Assos
|
$form_state['values']['honeypot_time'] = honeypot_get_signed_timestamp(REQUEST_TIME);
|
362 |
9525582e
|
Assos Assos
|
$element['#value'] = $form_state['values']['honeypot_time'];
|
363 |
11987c58
|
Florent Torregrosa
|
form_set_error('', t('There was a problem with your form submission. Please wait @limit seconds and try again.', array('@limit' => $time_limit)));
|
364 |
|
|
}
|
365 |
|
|
}
|
366 |
|
|
|
367 |
9525582e
|
Assos Assos
|
/**
|
368 |
|
|
* Returns an interval if the given javascript submitted value is valid.
|
369 |
|
|
*
|
370 |
|
|
* @param string $honeypot_time
|
371 |
|
|
* The signed interval as submitted via javascript.
|
372 |
|
|
*
|
373 |
|
|
* @return int|FALSE
|
374 |
|
|
* The interval in seconds if the token is valid, FALSE otherwise.
|
375 |
|
|
*/
|
376 |
|
|
function _honeypot_get_interval_from_signed_js_value($honeypot_time) {
|
377 |
|
|
$t = explode('|', $honeypot_time);
|
378 |
|
|
|
379 |
|
|
if (count($t) != 3) {
|
380 |
|
|
return FALSE;
|
381 |
|
|
}
|
382 |
|
|
|
383 |
|
|
$js_token = $t[0] . '|' . $t[1];
|
384 |
|
|
$token_check = honeypot_get_time_from_signed_timestamp($js_token);
|
385 |
|
|
if (!$token_check) {
|
386 |
|
|
return FALSE;
|
387 |
|
|
}
|
388 |
|
|
|
389 |
|
|
$interval = (int) $t[2];
|
390 |
|
|
if ($interval == 0) {
|
391 |
|
|
return FALSE;
|
392 |
|
|
}
|
393 |
|
|
|
394 |
|
|
return $interval;
|
395 |
|
|
}
|
396 |
|
|
|
397 |
11987c58
|
Florent Torregrosa
|
/**
|
398 |
|
|
* Log blocked form submissions.
|
399 |
|
|
*
|
400 |
|
|
* @param string $form_id
|
401 |
|
|
* Form ID for the form on which submission was blocked.
|
402 |
|
|
* @param string $type
|
403 |
|
|
* String indicating the reason the submission was blocked. Allowed values:
|
404 |
|
|
* - honeypot: If honeypot field was filled in.
|
405 |
|
|
* - honeypot_time: If form was completed before the configured time limit.
|
406 |
|
|
*/
|
407 |
|
|
function _honeypot_log($form_id, $type) {
|
408 |
|
|
honeypot_log_failure($form_id, $type);
|
409 |
|
|
if (variable_get('honeypot_log', 0)) {
|
410 |
|
|
$variables = array(
|
411 |
|
|
'%form' => $form_id,
|
412 |
|
|
'@cause' => ($type == 'honeypot') ? t('submission of a value in the honeypot field') : t('submission of the form in less than minimum required time'),
|
413 |
|
|
);
|
414 |
|
|
watchdog('honeypot', 'Blocked submission of %form due to @cause.', $variables);
|
415 |
|
|
}
|
416 |
|
|
}
|
417 |
|
|
|
418 |
|
|
/**
|
419 |
|
|
* Look up the time limit for the current user.
|
420 |
|
|
*
|
421 |
|
|
* @param array $form_values
|
422 |
|
|
* Array of form values (optional).
|
423 |
|
|
*/
|
424 |
|
|
function honeypot_get_time_limit($form_values = array()) {
|
425 |
|
|
global $user;
|
426 |
|
|
$honeypot_time_limit = variable_get('honeypot_time_limit', 5);
|
427 |
|
|
|
428 |
|
|
// Only calculate time limit if honeypot_time_limit has a value > 0.
|
429 |
|
|
if ($honeypot_time_limit) {
|
430 |
0ef18d70
|
Assos Assos
|
$expire_time = variable_get('honeypot_expire', 300);
|
431 |
ca92d645
|
Assos Assos
|
// Query the {honeypot_user} table to determine the number of failed
|
432 |
|
|
// submissions for the current user.
|
433 |
|
|
$query = db_select('honeypot_user', 'hs')
|
434 |
|
|
->condition('uid', $user->uid)
|
435 |
|
|
->condition('timestamp', REQUEST_TIME - $expire_time, '>');
|
436 |
|
|
|
437 |
|
|
// For anonymous users, take the hostname into account.
|
438 |
|
|
if ($user->uid === 0) {
|
439 |
|
|
$query->condition('hostname', ip_address());
|
440 |
11987c58
|
Florent Torregrosa
|
}
|
441 |
ca92d645
|
Assos Assos
|
$number = $query->countQuery()->execute()->fetchField();
|
442 |
|
|
|
443 |
4019484b
|
Assos Assos
|
// Don't add more time than the expiration window.
|
444 |
|
|
$honeypot_time_limit = (int) min($honeypot_time_limit + exp($number) - 1, $expire_time);
|
445 |
11987c58
|
Florent Torregrosa
|
$additions = module_invoke_all('honeypot_time_limit', $honeypot_time_limit, $form_values, $number);
|
446 |
|
|
if (count($additions)) {
|
447 |
|
|
$honeypot_time_limit += array_sum($additions);
|
448 |
|
|
}
|
449 |
|
|
}
|
450 |
ca92d645
|
Assos Assos
|
|
451 |
11987c58
|
Florent Torregrosa
|
return $honeypot_time_limit;
|
452 |
|
|
}
|
453 |
|
|
|
454 |
|
|
/**
|
455 |
ca92d645
|
Assos Assos
|
* Log the failed submision with timestamp and hostname.
|
456 |
11987c58
|
Florent Torregrosa
|
*
|
457 |
|
|
* @param string $form_id
|
458 |
|
|
* Form ID for the rejected form submission.
|
459 |
|
|
* @param string $type
|
460 |
|
|
* String indicating the reason the submission was blocked. Allowed values:
|
461 |
|
|
* - honeypot: If honeypot field was filled in.
|
462 |
|
|
* - honeypot_time: If form was completed before the configured time limit.
|
463 |
|
|
*/
|
464 |
|
|
function honeypot_log_failure($form_id, $type) {
|
465 |
|
|
global $user;
|
466 |
|
|
|
467 |
ca92d645
|
Assos Assos
|
db_insert('honeypot_user')
|
468 |
|
|
->fields(array(
|
469 |
|
|
'uid' => $user->uid,
|
470 |
|
|
'hostname' => ip_address(),
|
471 |
|
|
'timestamp' => REQUEST_TIME,
|
472 |
|
|
))
|
473 |
|
|
->execute();
|
474 |
11987c58
|
Florent Torregrosa
|
|
475 |
|
|
// Allow other modules to react to honeypot rejections.
|
476 |
|
|
module_invoke_all('honeypot_reject', $form_id, $user->uid, $type);
|
477 |
55670b15
|
Assos Assos
|
|
478 |
|
|
// Trigger honeypot_reject action.
|
479 |
|
|
if (module_exists('trigger')) {
|
480 |
|
|
$aids = trigger_get_assigned_actions('honeypot_reject');
|
481 |
|
|
$context = array(
|
482 |
|
|
'group' => 'honeypot',
|
483 |
|
|
'hook' => 'honeypot_reject',
|
484 |
|
|
'form_id' => $form_id,
|
485 |
|
|
// Do not provide $user in context because it is available as a global.
|
486 |
|
|
'type' => $type,
|
487 |
|
|
);
|
488 |
|
|
// Honeypot does not act on any specific object.
|
489 |
|
|
$object = NULL;
|
490 |
|
|
actions_do(array_keys($aids), $object, $context);
|
491 |
|
|
}
|
492 |
|
|
|
493 |
|
|
// Trigger rules honeypot_reject event.
|
494 |
|
|
if (module_exists('rules')) {
|
495 |
|
|
rules_invoke_event('honeypot_reject', $form_id, $type);
|
496 |
|
|
}
|
497 |
11987c58
|
Florent Torregrosa
|
}
|
498 |
2c8c2b87
|
Assos Assos
|
|
499 |
|
|
/**
|
500 |
0ef18d70
|
Assos Assos
|
* Retrieve the location of the Honeypot CSS file.
|
501 |
|
|
*
|
502 |
|
|
* @return string
|
503 |
|
|
* The path to the honeypot.css file.
|
504 |
|
|
*/
|
505 |
|
|
function honeypot_get_css_file_path() {
|
506 |
bc175c27
|
Assos Assos
|
return honeypot_file_default_scheme() . '://honeypot/honeypot.css';
|
507 |
0ef18d70
|
Assos Assos
|
}
|
508 |
|
|
|
509 |
|
|
/**
|
510 |
|
|
* Create CSS file to hide the Honeypot field.
|
511 |
|
|
*
|
512 |
|
|
* @param string $element_name
|
513 |
|
|
* The honeypot element class name (e.g. 'url').
|
514 |
2c8c2b87
|
Assos Assos
|
*/
|
515 |
|
|
function honeypot_create_css($element_name) {
|
516 |
bc175c27
|
Assos Assos
|
$path = honeypot_file_default_scheme() . '://honeypot';
|
517 |
2c8c2b87
|
Assos Assos
|
|
518 |
|
|
if (!file_prepare_directory($path, FILE_CREATE_DIRECTORY)) {
|
519 |
|
|
drupal_set_message(t('Unable to create Honeypot CSS directory, %path. Check the permissions on your files directory.', array('%path' => file_uri_target($path))), 'error');
|
520 |
|
|
}
|
521 |
|
|
else {
|
522 |
|
|
$filename = $path . '/honeypot.css';
|
523 |
|
|
$data = '.' . $element_name . '-textfield { display: none !important; }';
|
524 |
|
|
file_unmanaged_save_data($data, $filename, FILE_EXISTS_REPLACE);
|
525 |
|
|
}
|
526 |
|
|
}
|
527 |
0ef18d70
|
Assos Assos
|
|
528 |
ca92d645
|
Assos Assos
|
/**
|
529 |
|
|
* Check Honeypot's CSS file for a given Honeypot element name.
|
530 |
|
|
*
|
531 |
|
|
* This function assumes the Honeypot CSS file already exists.
|
532 |
|
|
*
|
533 |
|
|
* @param string $element_name
|
534 |
|
|
* The honeypot element class name (e.g. 'url').
|
535 |
|
|
*
|
536 |
|
|
* @return bool
|
537 |
|
|
* TRUE if CSS is has element class name, FALSE if not.
|
538 |
|
|
*/
|
539 |
|
|
function honeypot_check_css($element_name) {
|
540 |
|
|
$path = honeypot_get_css_file_path();
|
541 |
|
|
$handle = fopen($path, 'r');
|
542 |
|
|
$contents = fread($handle, filesize($path));
|
543 |
|
|
fclose($handle);
|
544 |
|
|
|
545 |
|
|
if (strpos($contents, $element_name) === 1) {
|
546 |
|
|
return TRUE;
|
547 |
|
|
}
|
548 |
|
|
|
549 |
|
|
return FALSE;
|
550 |
|
|
}
|
551 |
|
|
|
552 |
0ef18d70
|
Assos Assos
|
/**
|
553 |
|
|
* Sign the timestamp $time.
|
554 |
|
|
*
|
555 |
|
|
* @param mixed $time
|
556 |
|
|
* The timestamp to sign.
|
557 |
|
|
*
|
558 |
|
|
* @return string
|
559 |
|
|
* A signed timestamp in the form timestamp|HMAC.
|
560 |
|
|
*/
|
561 |
|
|
function honeypot_get_signed_timestamp($time) {
|
562 |
|
|
return $time . '|' . drupal_hmac_base64($time, drupal_get_private_key());
|
563 |
|
|
}
|
564 |
|
|
|
565 |
|
|
/**
|
566 |
|
|
* Validate a signed timestamp.
|
567 |
|
|
*
|
568 |
|
|
* @param string $signed_timestamp
|
569 |
|
|
* A timestamp concateneted with the signature
|
570 |
|
|
*
|
571 |
|
|
* @return int
|
572 |
|
|
* The timestamp if the signature is correct, 0 otherwise.
|
573 |
|
|
*/
|
574 |
|
|
function honeypot_get_time_from_signed_timestamp($signed_timestamp) {
|
575 |
|
|
$honeypot_time = 0;
|
576 |
|
|
|
577 |
b720ea3e
|
Assos Assos
|
// Fail fast if timestamp was forged or saved with an older Honeypot version.
|
578 |
|
|
if (strpos($signed_timestamp, '|') === FALSE) {
|
579 |
|
|
return $honeypot_time;
|
580 |
|
|
}
|
581 |
|
|
|
582 |
0ef18d70
|
Assos Assos
|
list($timestamp, $received_hmac) = explode('|', $signed_timestamp);
|
583 |
|
|
|
584 |
|
|
if ($timestamp && $received_hmac) {
|
585 |
|
|
$calculated_hmac = drupal_hmac_base64($timestamp, drupal_get_private_key());
|
586 |
|
|
// Prevent leaking timing information, compare second order hmacs.
|
587 |
|
|
$random_key = drupal_random_bytes(32);
|
588 |
|
|
if (drupal_hmac_base64($calculated_hmac, $random_key) === drupal_hmac_base64($received_hmac, $random_key)) {
|
589 |
|
|
$honeypot_time = $timestamp;
|
590 |
|
|
}
|
591 |
|
|
}
|
592 |
|
|
|
593 |
|
|
return $honeypot_time;
|
594 |
|
|
}
|
595 |
bc175c27
|
Assos Assos
|
|
596 |
|
|
/**
|
597 |
|
|
* Gets the default file stream for honeypot.
|
598 |
|
|
*
|
599 |
|
|
* @return
|
600 |
|
|
* 'public', 'private' or any other file scheme defined as the default.
|
601 |
|
|
*
|
602 |
|
|
* @see file_default_scheme()
|
603 |
|
|
*/
|
604 |
|
|
function honeypot_file_default_scheme() {
|
605 |
|
|
return variable_get('honeypot_file_default_scheme', file_default_scheme());
|
606 |
|
|
} |