Project

General

Profile

Paste
Download (18.9 KB) Statistics
| Branch: | Revision:

root / drupal7 / sites / all / modules / honeypot / honeypot.module @ 4019484b

1
<?php
2

    
3
/**
4
 * @file
5
 * Honeypot module, for deterring spam bots from completing Drupal forms.
6
 */
7

    
8
/**
9
 * Implements hook_menu().
10
 */
11
function honeypot_menu() {
12
  $items['admin/config/content/honeypot'] = array(
13
    'title' => 'Honeypot configuration',
14
    'description' => 'Configure Honeypot spam prevention and the forms on which Honeypot will be used.',
15
    'page callback' => 'drupal_get_form',
16
    'page arguments' => array('honeypot_admin_form'),
17
    'access arguments' => array('administer honeypot'),
18
    'file' => 'honeypot.admin.inc',
19
  );
20

    
21
  return $items;
22
}
23

    
24
/**
25
 * Implements hook_permission().
26
 */
27
function honeypot_permission() {
28
  return array(
29
    'administer honeypot' => array(
30
      'title' => t('Administer Honeypot'),
31
      'description' => t('Administer Honeypot-protected forms and settings'),
32
    ),
33
    'bypass honeypot protection' => array(
34
      'title' => t('Bypass Honeypot protection'),
35
      'description' => t('Bypass Honeypot form protection.'),
36
    ),
37
  );
38
}
39

    
40
/**
41
 * Implements hook_cron().
42
 */
43
function honeypot_cron() {
44
  // Delete {honeypot_user} entries older than the value of honeypot_expire.
45
  db_delete('honeypot_user')
46
    ->condition('timestamp', REQUEST_TIME - variable_get('honeypot_expire', 300), '<')
47
    ->execute();
48

    
49
  // Regenerate the honeypot css file if it does not exist or is outdated.
50
  $honeypot_css = honeypot_get_css_file_path();
51
  $honeypot_element_name = variable_get('honeypot_element_name', 'url');
52
  if (!file_exists($honeypot_css) || !honeypot_check_css($honeypot_element_name)) {
53
    honeypot_create_css($honeypot_element_name);
54
  }
55
}
56

    
57
/**
58
 * Implements hook_form_alter().
59
 *
60
 * Add Honeypot features to forms enabled in the Honeypot admin interface.
61
 */
62
function honeypot_form_alter(&$form, &$form_state, $form_id) {
63
  // Don't use for maintenance mode forms (install, update, etc.).
64
  if (defined('MAINTENANCE_MODE')) {
65
    return;
66
  }
67

    
68
  $unprotected_forms = array(
69
    'user_login',
70
    'user_login_block',
71
    'search_form',
72
    'search_block_form',
73
    'views_exposed_form',
74
    'honeypot_admin_form',
75
  );
76

    
77
  // If configured to protect all forms, add protection to every form.
78
  if (variable_get('honeypot_protect_all_forms', 0) && !in_array($form_id, $unprotected_forms)) {
79
    // Don't protect system forms - only admins should have access, and system
80
    // forms may be programmatically submitted by drush and other modules.
81
    if (preg_match('/[^a-zA-Z]system_/', $form_id) === 0 && preg_match('/[^a-zA-Z]search_/', $form_id) === 0 && preg_match('/[^a-zA-Z]views_exposed_form_/', $form_id) === 0) {
82
      honeypot_add_form_protection($form, $form_state, array('honeypot', 'time_restriction'));
83
    }
84
  }
85

    
86
  // Otherwise add form protection to admin-configured forms.
87
  elseif ($forms_to_protect = honeypot_get_protected_forms()) {
88
    foreach ($forms_to_protect as $protect_form_id) {
89
      // For most forms, do a straight check on the form ID.
90
      if ($form_id == $protect_form_id) {
91
        honeypot_add_form_protection($form, $form_state, array('honeypot', 'time_restriction'));
92
      }
93
      // For webforms use a special check for variable form ID.
94
      elseif ($protect_form_id == 'webforms' && (strpos($form_id, 'webform_client_form') !== FALSE)) {
95
        honeypot_add_form_protection($form, $form_state, array('honeypot', 'time_restriction'));
96
      }
97
    }
98
  }
99
}
100

    
101
/**
102
 * Implements hook_trigger_info().
103
 */
104
function honeypot_trigger_info() {
105
  return array(
106
    'honeypot' => array(
107
      'honeypot_reject' => array(
108
        'label' => t('Honeypot rejection'),
109
      ),
110
    ),
111
  );
112
}
113

    
114
/**
115
 * Implements hook_rules_event_info().
116
 */
117
function honeypot_rules_event_info() {
118
  return array(
119
    'honeypot_reject' => array(
120
      'label' => t('Honeypot rejection'),
121
      'group' => t('Honeypot'),
122
      'variables' => array(
123
        'form_id' => array(
124
          'type' => 'text',
125
          'label' => t('Form ID of the form the user was disallowed from submitting.'),
126
        ),
127
        // Don't provide 'uid' in context because it is available as
128
        // site:current-user:uid.
129
        'type' => array(
130
          'type' => 'text',
131
          'label' => t('String indicating the reason the submission was blocked.'),
132
        ),
133
      ),
134
    ),
135
  );
136
}
137

    
138
/**
139
 * Implements hook_library().
140
 */
141
function honeypot_library() {
142
  $info = system_get_info('module', 'honeypot');
143
  $version = $info['version'];
144

    
145
  // Library for Honeypot JS.
146
  $libraries['timestamp.js'] = array(
147
    'title' => 'Javascript to support timelimit on cached pages.',
148
    'version' => $version,
149
    'js' => array(
150
      array(
151
        'type' => 'setting',
152
        'data' => array(
153
          'honeypot' => array(
154
            'jsToken' => honeypot_get_signed_timestamp('js_token:' . mt_rand(0, 2147483647)),
155
           ),
156
         ),
157
      ),
158
      drupal_get_path('module', 'honeypot') . '/js/honeypot.js' => array(
159
        'group' => JS_LIBRARY,
160
        'weight' => 3,
161
      ),
162
    ),
163
  );
164

    
165
  return $libraries;
166
}
167

    
168
/**
169
 * Build an array of all the protected forms on the site, by form_id.
170
 *
171
 * @todo - Add in API call/hook to allow modules to add to this array.
172
 */
173
function honeypot_get_protected_forms() {
174
  $forms = &drupal_static(__FUNCTION__);
175

    
176
  // If the data isn't already in memory, get from cache or look it up fresh.
177
  if (!isset($forms)) {
178
    if ($cache = cache_get('honeypot_protected_forms')) {
179
      $forms = $cache->data;
180
    }
181
    else {
182
      $forms = array();
183
      // Look up all the honeypot forms in the variables table.
184
      $result = db_query("SELECT name FROM {variable} WHERE name LIKE 'honeypot_form_%'")->fetchCol();
185
      // Add each form that's enabled to the $forms array.
186
      foreach ($result as $variable) {
187
        if (variable_get($variable, 0)) {
188
          $forms[] = substr($variable, 14);
189
        }
190
      }
191

    
192
      // Save the cached data.
193
      cache_set('honeypot_protected_forms', $forms, 'cache');
194
    }
195
  }
196

    
197
  return $forms;
198
}
199

    
200
/**
201
 * Form builder function to add different types of protection to forms.
202
 *
203
 * @param array $options
204
 *   Array of options to be added to form. Currently accepts 'honeypot' and
205
 *   'time_restriction'.
206
 *
207
 * @return array
208
 *   Returns elements to be placed in a form's elements array to prevent spam.
209
 */
210
function honeypot_add_form_protection(&$form, &$form_state, $options = array()) {
211
  global $user;
212

    
213
  // Allow other modules to alter the protections applied to this form.
214
  drupal_alter('honeypot_form_protections', $options, $form);
215

    
216
  // Don't add any protections if the user can bypass the Honeypot.
217
  if (user_access('bypass honeypot protection')) {
218
    return;
219
  }
220

    
221
  // Build the honeypot element.
222
  if (in_array('honeypot', $options)) {
223
    // Get the element name (default is generic 'url').
224
    $honeypot_element = variable_get('honeypot_element_name', 'url');
225

    
226
    // Add 'autocomplete="off"' if configured.
227
    $attributes = array();
228
    if (variable_get('honeypot_autocomplete_attribute', 1)) {
229
      $attributes = array('autocomplete' => 'off');
230
    }
231

    
232
    // Get the path to the honeypot css file.
233
    $honeypot_css = honeypot_get_css_file_path();
234

    
235
    // Build the honeypot element.
236
    $honeypot_class = $honeypot_element . '-textfield';
237
    $form[$honeypot_element] = array(
238
      '#type' => 'textfield',
239
      '#title' => t('Leave this field blank'),
240
      '#size' => 20,
241
      '#weight' => 100,
242
      '#attributes' => $attributes,
243
      '#element_validate' => array('_honeypot_honeypot_validate'),
244
      '#prefix' => '<div class="' . $honeypot_class . '">',
245
      '#suffix' => '</div>',
246
      // Hide honeypot using CSS.
247
      '#attached' => array(
248
        'css' => array(
249
          'data' => $honeypot_css,
250
        ),
251
      ),
252
    );
253
  }
254

    
255
  // Build the time restriction element (if it's not disabled).
256
  if (in_array('time_restriction', $options) && variable_get('honeypot_time_limit', 5) != 0) {
257
    // Set the current time in a hidden value to be checked later.
258
    $form['honeypot_time'] = array(
259
      '#type' => 'hidden',
260
      '#title' => t('Timestamp'),
261
      '#default_value' => honeypot_get_signed_timestamp(REQUEST_TIME),
262
      '#element_validate' => array('_honeypot_time_restriction_validate'),
263
    );
264

    
265
    // Disable page caching to make sure timestamp isn't cached.
266
    if (user_is_anonymous() && drupal_page_is_cacheable()) {
267
      // Use javascript implementation if this page should be cached.
268
      if (variable_get('honeypot_use_js_for_cached_pages', FALSE)) {
269
        $form['honeypot_time']['#default_value'] = 'no_js_available';
270
        $form['honeypot_time']['#attached']['library'][] = array('honeypot', 'timestamp.js');
271
        $form['#attributes']['class'][] = 'honeypot-timestamp-js';
272
      }
273
      else {
274
        drupal_page_is_cacheable(FALSE);
275
      }
276
    }
277
  }
278

    
279
  // Allow other modules to react to addition of form protection.
280
  if (!empty($options)) {
281
    module_invoke_all('honeypot_add_form_protection', $options, $form);
282
  }
283
}
284

    
285
/**
286
 * Validate honeypot field.
287
 */
288
function _honeypot_honeypot_validate($element, &$form_state) {
289
  // Get the honeypot field value.
290
  $honeypot_value = $element['#value'];
291

    
292
  // Make sure it's empty.
293
  if (!empty($honeypot_value) || $honeypot_value == '0') {
294
    _honeypot_log($form_state['values']['form_id'], 'honeypot');
295
    form_set_error('', t('There was a problem with your form submission. Please refresh the page and try again.'));
296
  }
297
}
298

    
299
/**
300
 * Validate honeypot's time restriction field.
301
 */
302
function _honeypot_time_restriction_validate(&$element, &$form_state) {
303
  if (!empty($form_state['programmed'])) {
304
    // Don't do anything if the form was submitted programmatically.
305
    return;
306
  }
307

    
308
  // Don't do anything if the triggering element is a preview button.
309
  if ($form_state['triggering_element']['#value'] == t('Preview')) {
310
    return;
311
  }
312

    
313
  if ($form_state['values']['honeypot_time'] == 'no_js_available') {
314
    // Set an error, but do not penalize the user as it might be a legitimate
315
    // attempt.
316
    form_set_error('', t('You seem to have javascript disabled. Please confirm your form submission.'));
317

    
318
    if (variable_get('honeypot_log', 0)) {
319
      $variables = array(
320
        '%form'  => $form_state['values']['form_id'],
321
      );
322
      watchdog('honeypot', 'User tried to submit form %form without javascript enabled.', $variables);
323
    }
324

    
325
    // Update the value in $form_state and $element.
326
    $form_state['values']['honeypot_time'] = honeypot_get_signed_timestamp(REQUEST_TIME);
327
    $element['#value'] = $form_state['values']['honeypot_time'];
328
    return;
329
  }
330

    
331
  $honeypot_time = FALSE;
332

    
333
  // Update the honeypot_time for JS requests and get the $honeypot_time value.
334
  if (strpos($form_state['values']['honeypot_time'], 'js_token:') === 0) {
335
    $interval = _honeypot_get_interval_from_signed_js_value($form_state['values']['honeypot_time']);
336
    if ($interval) {
337
      // Set correct value for timestamp validation.
338
      $honeypot_time = REQUEST_TIME - $interval;
339

    
340
      // Update form_state and element values so they're correct.
341
      $form_state['values']['honeypot_time'] = honeypot_get_signed_timestamp($honeypot_time);
342
      $element['#value'] = $form_state['values']['honeypot_time'];
343
    }
344
  }
345
  // Otherwise just get the $honeypot_time value.
346
  else {
347
    // Get the time value.
348
    $honeypot_time = honeypot_get_time_from_signed_timestamp($form_state['values']['honeypot_time']);
349
  }
350

    
351
  // Get the honeypot_time_limit.
352
  $time_limit = honeypot_get_time_limit($form_state['values']);
353

    
354
  // Make sure current time - (time_limit + form time value) is greater than 0.
355
  // If not, throw an error.
356
  if (!$honeypot_time || REQUEST_TIME < ($honeypot_time + $time_limit)) {
357
    _honeypot_log($form_state['values']['form_id'], 'honeypot_time');
358
    // Get the time limit again, since it increases after first failure.
359
    $time_limit = honeypot_get_time_limit($form_state['values']);
360
    // Update the honeypot_time value in the form state and element.
361
    $form_state['values']['honeypot_time'] = honeypot_get_signed_timestamp(REQUEST_TIME);
362
    $element['#value'] = $form_state['values']['honeypot_time'];
363
    form_set_error('', t('There was a problem with your form submission. Please wait @limit seconds and try again.', array('@limit' => $time_limit)));
364
  }
365
}
366

    
367
/**
368
 * Returns an interval if the given javascript submitted value is valid.
369
 *
370
 * @param string $honeypot_time
371
 *   The signed interval as submitted via javascript.
372
 *
373
 * @return int|FALSE
374
 *   The interval in seconds if the token is valid, FALSE otherwise.
375
 */
376
function _honeypot_get_interval_from_signed_js_value($honeypot_time) {
377
  $t = explode('|', $honeypot_time);
378

    
379
  if (count($t) != 3) {
380
    return FALSE;
381
  }
382

    
383
  $js_token = $t[0] . '|' . $t[1];
384
  $token_check = honeypot_get_time_from_signed_timestamp($js_token);
385
  if (!$token_check) {
386
    return FALSE;
387
  }
388

    
389
  $interval = (int) $t[2];
390
  if ($interval == 0) {
391
    return FALSE;
392
  }
393

    
394
  return $interval;
395
}
396

    
397
/**
398
 * Log blocked form submissions.
399
 *
400
 * @param string $form_id
401
 *   Form ID for the form on which submission was blocked.
402
 * @param string $type
403
 *   String indicating the reason the submission was blocked. Allowed values:
404
 *     - honeypot: If honeypot field was filled in.
405
 *     - honeypot_time: If form was completed before the configured time limit.
406
 */
407
function _honeypot_log($form_id, $type) {
408
  honeypot_log_failure($form_id, $type);
409
  if (variable_get('honeypot_log', 0)) {
410
    $variables = array(
411
      '%form'  => $form_id,
412
      '@cause' => ($type == 'honeypot') ? t('submission of a value in the honeypot field') : t('submission of the form in less than minimum required time'),
413
    );
414
    watchdog('honeypot', 'Blocked submission of %form due to @cause.', $variables);
415
  }
416
}
417

    
418
/**
419
 * Look up the time limit for the current user.
420
 *
421
 * @param array $form_values
422
 *   Array of form values (optional).
423
 */
424
function honeypot_get_time_limit($form_values = array()) {
425
  global $user;
426
  $honeypot_time_limit = variable_get('honeypot_time_limit', 5);
427

    
428
  // Only calculate time limit if honeypot_time_limit has a value > 0.
429
  if ($honeypot_time_limit) {
430
    $expire_time = variable_get('honeypot_expire', 300);
431
    // Query the {honeypot_user} table to determine the number of failed
432
    // submissions for the current user.
433
    $query = db_select('honeypot_user', 'hs')
434
      ->condition('uid', $user->uid)
435
      ->condition('timestamp', REQUEST_TIME - $expire_time, '>');
436

    
437
    // For anonymous users, take the hostname into account.
438
    if ($user->uid === 0) {
439
      $query->condition('hostname', ip_address());
440
    }
441
    $number = $query->countQuery()->execute()->fetchField();
442

    
443
    // Don't add more time than the expiration window.
444
    $honeypot_time_limit = (int) min($honeypot_time_limit + exp($number) - 1, $expire_time);
445
    $additions = module_invoke_all('honeypot_time_limit', $honeypot_time_limit, $form_values, $number);
446
    if (count($additions)) {
447
      $honeypot_time_limit += array_sum($additions);
448
    }
449
  }
450

    
451
  return $honeypot_time_limit;
452
}
453

    
454
/**
455
 * Log the failed submision with timestamp and hostname.
456
 *
457
 * @param string $form_id
458
 *   Form ID for the rejected form submission.
459
 * @param string $type
460
 *   String indicating the reason the submission was blocked. Allowed values:
461
 *     - honeypot: If honeypot field was filled in.
462
 *     - honeypot_time: If form was completed before the configured time limit.
463
 */
464
function honeypot_log_failure($form_id, $type) {
465
  global $user;
466

    
467
  db_insert('honeypot_user')
468
    ->fields(array(
469
      'uid' => $user->uid,
470
      'hostname' => ip_address(),
471
      'timestamp' => REQUEST_TIME,
472
    ))
473
    ->execute();
474

    
475
  // Allow other modules to react to honeypot rejections.
476
  module_invoke_all('honeypot_reject', $form_id, $user->uid, $type);
477

    
478
  // Trigger honeypot_reject action.
479
  if (module_exists('trigger')) {
480
    $aids = trigger_get_assigned_actions('honeypot_reject');
481
    $context = array(
482
      'group' => 'honeypot',
483
      'hook' => 'honeypot_reject',
484
      'form_id' => $form_id,
485
      // Do not provide $user in context because it is available as a global.
486
      'type' => $type,
487
    );
488
    // Honeypot does not act on any specific object.
489
    $object = NULL;
490
    actions_do(array_keys($aids), $object, $context);
491
  }
492

    
493
  // Trigger rules honeypot_reject event.
494
  if (module_exists('rules')) {
495
    rules_invoke_event('honeypot_reject', $form_id, $type);
496
  }
497
}
498

    
499
/**
500
 * Retrieve the location of the Honeypot CSS file.
501
 *
502
 * @return string
503
 *   The path to the honeypot.css file.
504
 */
505
function honeypot_get_css_file_path() {
506
  return honeypot_file_default_scheme() . '://honeypot/honeypot.css';
507
}
508

    
509
/**
510
 * Create CSS file to hide the Honeypot field.
511
 *
512
 * @param string $element_name
513
 *   The honeypot element class name (e.g. 'url').
514
 */
515
function honeypot_create_css($element_name) {
516
  $path = honeypot_file_default_scheme() . '://honeypot';
517

    
518
  if (!file_prepare_directory($path, FILE_CREATE_DIRECTORY)) {
519
    drupal_set_message(t('Unable to create Honeypot CSS directory, %path. Check the permissions on your files directory.', array('%path' => file_uri_target($path))), 'error');
520
  }
521
  else {
522
    $filename = $path . '/honeypot.css';
523
    $data = '.' . $element_name . '-textfield { display: none !important; }';
524
    file_unmanaged_save_data($data, $filename, FILE_EXISTS_REPLACE);
525
  }
526
}
527

    
528
/**
529
 * Check Honeypot's CSS file for a given Honeypot element name.
530
 *
531
 * This function assumes the Honeypot CSS file already exists.
532
 *
533
 * @param string $element_name
534
 *   The honeypot element class name (e.g. 'url').
535
 *
536
 * @return bool
537
 *   TRUE if CSS is has element class name, FALSE if not.
538
 */
539
function honeypot_check_css($element_name) {
540
  $path = honeypot_get_css_file_path();
541
  $handle = fopen($path, 'r');
542
  $contents = fread($handle, filesize($path));
543
  fclose($handle);
544

    
545
  if (strpos($contents, $element_name) === 1) {
546
    return TRUE;
547
  }
548

    
549
  return FALSE;
550
}
551

    
552
/**
553
 * Sign the timestamp $time.
554
 *
555
 * @param mixed $time
556
 *   The timestamp to sign.
557
 *
558
 * @return string
559
 *   A signed timestamp in the form timestamp|HMAC.
560
 */
561
function honeypot_get_signed_timestamp($time) {
562
  return $time . '|' . drupal_hmac_base64($time, drupal_get_private_key());
563
}
564

    
565
/**
566
 * Validate a signed timestamp.
567
 *
568
 * @param string $signed_timestamp
569
 *   A timestamp concateneted with the signature
570
 *
571
 * @return int
572
 *   The timestamp if the signature is correct, 0 otherwise.
573
 */
574
function honeypot_get_time_from_signed_timestamp($signed_timestamp) {
575
  $honeypot_time = 0;
576

    
577
  // Fail fast if timestamp was forged or saved with an older Honeypot version.
578
  if (strpos($signed_timestamp, '|') === FALSE) {
579
    return $honeypot_time;
580
  }
581

    
582
  list($timestamp, $received_hmac) = explode('|', $signed_timestamp);
583

    
584
  if ($timestamp && $received_hmac) {
585
    $calculated_hmac = drupal_hmac_base64($timestamp, drupal_get_private_key());
586
    // Prevent leaking timing information, compare second order hmacs.
587
    $random_key = drupal_random_bytes(32);
588
    if (drupal_hmac_base64($calculated_hmac, $random_key) === drupal_hmac_base64($received_hmac, $random_key)) {
589
      $honeypot_time = $timestamp;
590
    }
591
  }
592

    
593
  return $honeypot_time;
594
}
595

    
596
/**
597
 * Gets the default file stream for honeypot.
598
 *
599
 * @return
600
 *   'public', 'private' or any other file scheme defined as the default.
601
 *
602
 * @see file_default_scheme()
603
 */
604
function honeypot_file_default_scheme() {
605
  return variable_get('honeypot_file_default_scheme', file_default_scheme());
606
}