|
1
|
<?php
|
|
2
|
|
|
3
|
/**
|
|
4
|
* @file
|
|
5
|
* Honeypot module, for deterring spam bots from completing Drupal forms.
|
|
6
|
*/
|
|
7
|
|
|
8
|
/**
|
|
9
|
* Implements hook_menu().
|
|
10
|
*/
|
|
11
|
function honeypot_menu() {
|
|
12
|
$items['admin/config/content/honeypot'] = array(
|
|
13
|
'title' => 'Honeypot configuration',
|
|
14
|
'description' => 'Configure Honeypot spam prevention and the forms on which Honeypot will be used.',
|
|
15
|
'page callback' => 'drupal_get_form',
|
|
16
|
'page arguments' => array('honeypot_admin_form'),
|
|
17
|
'access arguments' => array('administer honeypot'),
|
|
18
|
'file' => 'honeypot.admin.inc',
|
|
19
|
);
|
|
20
|
|
|
21
|
return $items;
|
|
22
|
}
|
|
23
|
|
|
24
|
/**
|
|
25
|
* Implements hook_permission().
|
|
26
|
*/
|
|
27
|
function honeypot_permission() {
|
|
28
|
return array(
|
|
29
|
'administer honeypot' => array(
|
|
30
|
'title' => t('Administer Honeypot'),
|
|
31
|
'description' => t('Administer Honeypot-protected forms and settings'),
|
|
32
|
),
|
|
33
|
'bypass honeypot protection' => array(
|
|
34
|
'title' => t('Bypass Honeypot protection'),
|
|
35
|
'description' => t('Bypass Honeypot form protection.'),
|
|
36
|
),
|
|
37
|
);
|
|
38
|
}
|
|
39
|
|
|
40
|
/**
|
|
41
|
* Implements of hook_cron().
|
|
42
|
*/
|
|
43
|
function honeypot_cron() {
|
|
44
|
// Delete {honeypot_user} entries older than the value of honeypot_expire.
|
|
45
|
db_delete('honeypot_user')
|
|
46
|
->condition('timestamp', time() - variable_get('honeypot_expire', 300), '<')
|
|
47
|
->execute();
|
|
48
|
|
|
49
|
// Regenerate the honeypot css file if it does not exist.
|
|
50
|
$honeypot_css = honeypot_get_css_file_path();
|
|
51
|
if (!file_exists($honeypot_css)) {
|
|
52
|
honeypot_create_css(variable_get('honeypot_element_name', 'url'));
|
|
53
|
}
|
|
54
|
}
|
|
55
|
|
|
56
|
/**
|
|
57
|
* Implements hook_form_alter().
|
|
58
|
*
|
|
59
|
* Add Honeypot features to forms enabled in the Honeypot admin interface.
|
|
60
|
*/
|
|
61
|
function honeypot_form_alter(&$form, &$form_state, $form_id) {
|
|
62
|
// Don't use for maintenance mode forms (install, update, etc.).
|
|
63
|
if (defined('MAINTENANCE_MODE')) {
|
|
64
|
return;
|
|
65
|
}
|
|
66
|
|
|
67
|
$unprotected_forms = array(
|
|
68
|
'user_login',
|
|
69
|
'user_login_block',
|
|
70
|
'search_form',
|
|
71
|
'search_block_form',
|
|
72
|
'views_exposed_form',
|
|
73
|
'honeypot_admin_form',
|
|
74
|
);
|
|
75
|
|
|
76
|
// If configured to protect all forms, add protection to every form.
|
|
77
|
if (variable_get('honeypot_protect_all_forms', 0) && !in_array($form_id, $unprotected_forms)) {
|
|
78
|
// Don't protect system forms - only admins should have access, and system
|
|
79
|
// forms may be programmatically submitted by drush and other modules.
|
|
80
|
if (strpos($form_id, 'system_') === FALSE && strpos($form_id, 'search_') === FALSE && strpos($form_id, 'views_exposed_form_') === FALSE) {
|
|
81
|
honeypot_add_form_protection($form, $form_state, array('honeypot', 'time_restriction'));
|
|
82
|
}
|
|
83
|
}
|
|
84
|
|
|
85
|
// Otherwise add form protection to admin-configured forms.
|
|
86
|
elseif ($forms_to_protect = honeypot_get_protected_forms()) {
|
|
87
|
foreach ($forms_to_protect as $protect_form_id) {
|
|
88
|
// For most forms, do a straight check on the form ID.
|
|
89
|
if ($form_id == $protect_form_id) {
|
|
90
|
honeypot_add_form_protection($form, $form_state, array('honeypot', 'time_restriction'));
|
|
91
|
}
|
|
92
|
// For webforms use a special check for variable form ID.
|
|
93
|
elseif ($protect_form_id == 'webforms' && (strpos($form_id, 'webform_client_form') !== FALSE)) {
|
|
94
|
honeypot_add_form_protection($form, $form_state, array('honeypot', 'time_restriction'));
|
|
95
|
}
|
|
96
|
}
|
|
97
|
}
|
|
98
|
}
|
|
99
|
|
|
100
|
/**
|
|
101
|
* Implements hook_trigger_info().
|
|
102
|
*/
|
|
103
|
function honeypot_trigger_info() {
|
|
104
|
return array(
|
|
105
|
'honeypot' => array(
|
|
106
|
'honeypot_reject' => array(
|
|
107
|
'label' => t('Honeypot rejection'),
|
|
108
|
),
|
|
109
|
),
|
|
110
|
);
|
|
111
|
}
|
|
112
|
|
|
113
|
/**
|
|
114
|
* Implements hook_rules_event_info()
|
|
115
|
*/
|
|
116
|
function honeypot_rules_event_info() {
|
|
117
|
return array(
|
|
118
|
'honeypot_reject' => array(
|
|
119
|
'label' => t('Honeypot rejection'),
|
|
120
|
'group' => t('Honeypot'),
|
|
121
|
'variables' => array(
|
|
122
|
'form_id' => array(
|
|
123
|
'type' => 'text',
|
|
124
|
'label' => t('Form ID of the form the user was disallowed from submitting.'),
|
|
125
|
),
|
|
126
|
// Don't provide 'uid' in context because it is available as
|
|
127
|
// site:current-user:uid.
|
|
128
|
'type' => array(
|
|
129
|
'type' => 'text',
|
|
130
|
'label' => t('String indicating the reason the submission was blocked.'),
|
|
131
|
),
|
|
132
|
),
|
|
133
|
),
|
|
134
|
);
|
|
135
|
}
|
|
136
|
|
|
137
|
/**
|
|
138
|
* Build an array of all the protected forms on the site, by form_id.
|
|
139
|
*
|
|
140
|
* @todo - Add in API call/hook to allow modules to add to this array.
|
|
141
|
*/
|
|
142
|
function honeypot_get_protected_forms() {
|
|
143
|
$forms = &drupal_static(__FUNCTION__);
|
|
144
|
|
|
145
|
// If the data isn't already in memory, get from cache or look it up fresh.
|
|
146
|
if (!isset($forms)) {
|
|
147
|
if ($cache = cache_get('honeypot_protected_forms')) {
|
|
148
|
$forms = $cache->data;
|
|
149
|
}
|
|
150
|
else {
|
|
151
|
$forms = array();
|
|
152
|
// Look up all the honeypot forms in the variables table.
|
|
153
|
$result = db_query("SELECT name FROM {variable} WHERE name LIKE 'honeypot_form_%'")->fetchCol();
|
|
154
|
// Add each form that's enabled to the $forms array.
|
|
155
|
foreach ($result as $variable) {
|
|
156
|
if (variable_get($variable, 0)) {
|
|
157
|
$forms[] = substr($variable, 14);
|
|
158
|
}
|
|
159
|
}
|
|
160
|
|
|
161
|
// Save the cached data.
|
|
162
|
cache_set('honeypot_protected_forms', $forms, 'cache');
|
|
163
|
}
|
|
164
|
}
|
|
165
|
|
|
166
|
return $forms;
|
|
167
|
}
|
|
168
|
|
|
169
|
/**
|
|
170
|
* Form builder function to add different types of protection to forms.
|
|
171
|
*
|
|
172
|
* @param array $options
|
|
173
|
* Array of options to be added to form. Currently accepts 'honeypot' and
|
|
174
|
* 'time_restriction'.
|
|
175
|
*
|
|
176
|
* @return array
|
|
177
|
* Returns elements to be placed in a form's elements array to prevent spam.
|
|
178
|
*/
|
|
179
|
function honeypot_add_form_protection(&$form, &$form_state, $options = array()) {
|
|
180
|
global $user;
|
|
181
|
|
|
182
|
// Allow other modules to alter the protections applied to this form.
|
|
183
|
drupal_alter('honeypot_form_protections', $options, $form);
|
|
184
|
|
|
185
|
// Don't add any protections if the user can bypass the Honeypot.
|
|
186
|
if (user_access('bypass honeypot protection')) {
|
|
187
|
return;
|
|
188
|
}
|
|
189
|
|
|
190
|
// Build the honeypot element.
|
|
191
|
if (in_array('honeypot', $options)) {
|
|
192
|
// Get the element name (default is generic 'url').
|
|
193
|
$honeypot_element = variable_get('honeypot_element_name', 'url');
|
|
194
|
|
|
195
|
// Add 'autocomplete="off"' if configured.
|
|
196
|
$attributes = array();
|
|
197
|
if (variable_get('honeypot_autocomplete_attribute', 1)) {
|
|
198
|
$attributes = array('autocomplete' => 'off');
|
|
199
|
}
|
|
200
|
|
|
201
|
// Get the path to the honeypot css file.
|
|
202
|
$honeypot_css = honeypot_get_css_file_path();
|
|
203
|
|
|
204
|
// Build the honeypot element.
|
|
205
|
$honeypot_class = $honeypot_element . '-textfield';
|
|
206
|
$form[$honeypot_element] = array(
|
|
207
|
'#type' => 'textfield',
|
|
208
|
'#title' => t('Leave this field blank'),
|
|
209
|
'#size' => 20,
|
|
210
|
'#weight' => 100,
|
|
211
|
'#attributes' => $attributes,
|
|
212
|
'#element_validate' => array('_honeypot_honeypot_validate'),
|
|
213
|
'#prefix' => '<div class="' . $honeypot_class . '">',
|
|
214
|
'#suffix' => '</div>',
|
|
215
|
// Hide honeypot using CSS.
|
|
216
|
'#attached' => array(
|
|
217
|
'css' => array(
|
|
218
|
'data' => $honeypot_css,
|
|
219
|
),
|
|
220
|
),
|
|
221
|
);
|
|
222
|
}
|
|
223
|
|
|
224
|
// Build the time restriction element (if it's not disabled).
|
|
225
|
if (in_array('time_restriction', $options) && variable_get('honeypot_time_limit', 5) != 0) {
|
|
226
|
// Set the current time in a hidden value to be checked later.
|
|
227
|
$form['honeypot_time'] = array(
|
|
228
|
'#type' => 'hidden',
|
|
229
|
'#title' => t('Timestamp'),
|
|
230
|
'#default_value' => honeypot_get_signed_timestamp(time()),
|
|
231
|
'#element_validate' => array('_honeypot_time_restriction_validate'),
|
|
232
|
);
|
|
233
|
|
|
234
|
// Disable page caching to make sure timestamp isn't cached.
|
|
235
|
if (user_is_anonymous()) {
|
|
236
|
drupal_page_is_cacheable(FALSE);
|
|
237
|
}
|
|
238
|
}
|
|
239
|
|
|
240
|
// Allow other modules to react to addition of form protection.
|
|
241
|
if (!empty($options)) {
|
|
242
|
module_invoke_all('honeypot_add_form_protection', $options, $form);
|
|
243
|
}
|
|
244
|
}
|
|
245
|
|
|
246
|
/**
|
|
247
|
* Validate honeypot field.
|
|
248
|
*/
|
|
249
|
function _honeypot_honeypot_validate($element, &$form_state) {
|
|
250
|
// Get the honeypot field value.
|
|
251
|
$honeypot_value = $element['#value'];
|
|
252
|
|
|
253
|
// Make sure it's empty.
|
|
254
|
if (!empty($honeypot_value)) {
|
|
255
|
_honeypot_log($form_state['values']['form_id'], 'honeypot');
|
|
256
|
form_set_error('', t('There was a problem with your form submission. Please refresh the page and try again.'));
|
|
257
|
}
|
|
258
|
}
|
|
259
|
|
|
260
|
/**
|
|
261
|
* Validate honeypot's time restriction field.
|
|
262
|
*/
|
|
263
|
function _honeypot_time_restriction_validate($element, &$form_state) {
|
|
264
|
// Don't do anything if the triggering element is a preview button.
|
|
265
|
if ($form_state['triggering_element']['#value'] == t('Preview')) {
|
|
266
|
return;
|
|
267
|
}
|
|
268
|
|
|
269
|
// Get the time value.
|
|
270
|
$honeypot_time = honeypot_get_time_from_signed_timestamp($form_state['values']['honeypot_time']);
|
|
271
|
|
|
272
|
// Get the honeypot_time_limit.
|
|
273
|
$time_limit = honeypot_get_time_limit($form_state['values']);
|
|
274
|
|
|
275
|
// Make sure current time - (time_limit + form time value) is greater than 0.
|
|
276
|
// If not, throw an error.
|
|
277
|
if (!$honeypot_time || time() < ($honeypot_time + $time_limit)) {
|
|
278
|
_honeypot_log($form_state['values']['form_id'], 'honeypot_time');
|
|
279
|
// Get the time limit again, since it increases after first failure.
|
|
280
|
$time_limit = honeypot_get_time_limit($form_state['values']);
|
|
281
|
$form_state['values']['honeypot_time'] = honeypot_get_signed_timestamp(time());
|
|
282
|
form_set_error('', t('There was a problem with your form submission. Please wait @limit seconds and try again.', array('@limit' => $time_limit)));
|
|
283
|
}
|
|
284
|
}
|
|
285
|
|
|
286
|
/**
|
|
287
|
* Log blocked form submissions.
|
|
288
|
*
|
|
289
|
* @param string $form_id
|
|
290
|
* Form ID for the form on which submission was blocked.
|
|
291
|
* @param string $type
|
|
292
|
* String indicating the reason the submission was blocked. Allowed values:
|
|
293
|
* - honeypot: If honeypot field was filled in.
|
|
294
|
* - honeypot_time: If form was completed before the configured time limit.
|
|
295
|
*/
|
|
296
|
function _honeypot_log($form_id, $type) {
|
|
297
|
honeypot_log_failure($form_id, $type);
|
|
298
|
if (variable_get('honeypot_log', 0)) {
|
|
299
|
$variables = array(
|
|
300
|
'%form' => $form_id,
|
|
301
|
'@cause' => ($type == 'honeypot') ? t('submission of a value in the honeypot field') : t('submission of the form in less than minimum required time'),
|
|
302
|
);
|
|
303
|
watchdog('honeypot', 'Blocked submission of %form due to @cause.', $variables);
|
|
304
|
}
|
|
305
|
}
|
|
306
|
|
|
307
|
/**
|
|
308
|
* Look up the time limit for the current user.
|
|
309
|
*
|
|
310
|
* @param array $form_values
|
|
311
|
* Array of form values (optional).
|
|
312
|
*/
|
|
313
|
function honeypot_get_time_limit($form_values = array()) {
|
|
314
|
global $user;
|
|
315
|
$honeypot_time_limit = variable_get('honeypot_time_limit', 5);
|
|
316
|
|
|
317
|
// Only calculate time limit if honeypot_time_limit has a value > 0.
|
|
318
|
if ($honeypot_time_limit) {
|
|
319
|
$expire_time = variable_get('honeypot_expire', 300);
|
|
320
|
// Get value from {honeypot_user} table for authenticated users.
|
|
321
|
if ($user->uid) {
|
|
322
|
$number = db_query("SELECT COUNT(*) FROM {honeypot_user} WHERE uid = :uid AND timestamp > :time", array(
|
|
323
|
':uid' => $user->uid,
|
|
324
|
':time' => time() - $expire_time,
|
|
325
|
))->fetchField();
|
|
326
|
}
|
|
327
|
// Get value from {flood} table for anonymous users.
|
|
328
|
else {
|
|
329
|
$number = db_query("SELECT COUNT(*) FROM {flood} WHERE event = :event AND identifier = :hostname AND timestamp > :time", array(
|
|
330
|
':event' => 'honeypot',
|
|
331
|
':hostname' => ip_address(),
|
|
332
|
':time' => time() - $expire_time,
|
|
333
|
))->fetchField();
|
|
334
|
}
|
|
335
|
// Don't add more than 30 days' worth of extra time.
|
|
336
|
$honeypot_time_limit = (int) min($honeypot_time_limit + exp($number) - 1, 2592000);
|
|
337
|
$additions = module_invoke_all('honeypot_time_limit', $honeypot_time_limit, $form_values, $number);
|
|
338
|
if (count($additions)) {
|
|
339
|
$honeypot_time_limit += array_sum($additions);
|
|
340
|
}
|
|
341
|
}
|
|
342
|
return $honeypot_time_limit;
|
|
343
|
}
|
|
344
|
|
|
345
|
/**
|
|
346
|
* Log the failed submision with timestamp.
|
|
347
|
*
|
|
348
|
* @param string $form_id
|
|
349
|
* Form ID for the rejected form submission.
|
|
350
|
* @param string $type
|
|
351
|
* String indicating the reason the submission was blocked. Allowed values:
|
|
352
|
* - honeypot: If honeypot field was filled in.
|
|
353
|
* - honeypot_time: If form was completed before the configured time limit.
|
|
354
|
*/
|
|
355
|
function honeypot_log_failure($form_id, $type) {
|
|
356
|
global $user;
|
|
357
|
|
|
358
|
// Log failed submissions for authenticated users.
|
|
359
|
if ($user->uid) {
|
|
360
|
db_insert('honeypot_user')
|
|
361
|
->fields(array(
|
|
362
|
'uid' => $user->uid,
|
|
363
|
'timestamp' => time(),
|
|
364
|
))
|
|
365
|
->execute();
|
|
366
|
}
|
|
367
|
// Register flood event for anonymous users.
|
|
368
|
else {
|
|
369
|
flood_register_event('honeypot');
|
|
370
|
}
|
|
371
|
|
|
372
|
// Allow other modules to react to honeypot rejections.
|
|
373
|
module_invoke_all('honeypot_reject', $form_id, $user->uid, $type);
|
|
374
|
|
|
375
|
// Trigger honeypot_reject action.
|
|
376
|
if (module_exists('trigger')) {
|
|
377
|
$aids = trigger_get_assigned_actions('honeypot_reject');
|
|
378
|
$context = array(
|
|
379
|
'group' => 'honeypot',
|
|
380
|
'hook' => 'honeypot_reject',
|
|
381
|
'form_id' => $form_id,
|
|
382
|
// Do not provide $user in context because it is available as a global.
|
|
383
|
'type' => $type,
|
|
384
|
);
|
|
385
|
// Honeypot does not act on any specific object.
|
|
386
|
$object = NULL;
|
|
387
|
actions_do(array_keys($aids), $object, $context);
|
|
388
|
}
|
|
389
|
|
|
390
|
// Trigger rules honeypot_reject event.
|
|
391
|
if (module_exists('rules')) {
|
|
392
|
rules_invoke_event('honeypot_reject', $form_id, $type);
|
|
393
|
}
|
|
394
|
}
|
|
395
|
|
|
396
|
/**
|
|
397
|
* Retrieve the location of the Honeypot CSS file.
|
|
398
|
*
|
|
399
|
* @return string
|
|
400
|
* The path to the honeypot.css file.
|
|
401
|
*/
|
|
402
|
function honeypot_get_css_file_path() {
|
|
403
|
return variable_get('file_public_path', conf_path() . '/files') . '/honeypot/honeypot.css';
|
|
404
|
}
|
|
405
|
|
|
406
|
/**
|
|
407
|
* Create CSS file to hide the Honeypot field.
|
|
408
|
*
|
|
409
|
* @param string $element_name
|
|
410
|
* The honeypot element class name (e.g. 'url').
|
|
411
|
*/
|
|
412
|
function honeypot_create_css($element_name) {
|
|
413
|
$path = 'public://honeypot';
|
|
414
|
|
|
415
|
if (!file_prepare_directory($path, FILE_CREATE_DIRECTORY)) {
|
|
416
|
drupal_set_message(t('Unable to create Honeypot CSS directory, %path. Check the permissions on your files directory.', array('%path' => file_uri_target($path))), 'error');
|
|
417
|
}
|
|
418
|
else {
|
|
419
|
$filename = $path . '/honeypot.css';
|
|
420
|
$data = '.' . $element_name . '-textfield { display: none !important; }';
|
|
421
|
file_unmanaged_save_data($data, $filename, FILE_EXISTS_REPLACE);
|
|
422
|
}
|
|
423
|
}
|
|
424
|
|
|
425
|
/**
|
|
426
|
* Sign the timestamp $time.
|
|
427
|
*
|
|
428
|
* @param mixed $time
|
|
429
|
* The timestamp to sign.
|
|
430
|
*
|
|
431
|
* @return string
|
|
432
|
* A signed timestamp in the form timestamp|HMAC.
|
|
433
|
*/
|
|
434
|
function honeypot_get_signed_timestamp($time) {
|
|
435
|
return $time . '|' . drupal_hmac_base64($time, drupal_get_private_key());
|
|
436
|
}
|
|
437
|
|
|
438
|
/**
|
|
439
|
* Validate a signed timestamp.
|
|
440
|
*
|
|
441
|
* @param string $signed_timestamp
|
|
442
|
* A timestamp concateneted with the signature
|
|
443
|
*
|
|
444
|
* @return int
|
|
445
|
* The timestamp if the signature is correct, 0 otherwise.
|
|
446
|
*/
|
|
447
|
function honeypot_get_time_from_signed_timestamp($signed_timestamp) {
|
|
448
|
$honeypot_time = 0;
|
|
449
|
|
|
450
|
// Fail fast if timestamp was forged or saved with an older Honeypot version.
|
|
451
|
if (strpos($signed_timestamp, '|') === FALSE) {
|
|
452
|
return $honeypot_time;
|
|
453
|
}
|
|
454
|
|
|
455
|
list($timestamp, $received_hmac) = explode('|', $signed_timestamp);
|
|
456
|
|
|
457
|
if ($timestamp && $received_hmac) {
|
|
458
|
$calculated_hmac = drupal_hmac_base64($timestamp, drupal_get_private_key());
|
|
459
|
// Prevent leaking timing information, compare second order hmacs.
|
|
460
|
$random_key = drupal_random_bytes(32);
|
|
461
|
if (drupal_hmac_base64($calculated_hmac, $random_key) === drupal_hmac_base64($received_hmac, $random_key)) {
|
|
462
|
$honeypot_time = $timestamp;
|
|
463
|
}
|
|
464
|
}
|
|
465
|
|
|
466
|
return $honeypot_time;
|
|
467
|
}
|
