WordPress.org
Get WordPress

Plugin Directory

Changeset 536369


Ignore:
Timestamp:
04/25/2012 07:28:18 PM (14 years ago)
Author:
brandonfenning
Message:

Fixed a bug with mechanism that prevents wp-comments-post.php from being hijacked.

Location:
botblocker
Files:
5 added
2 edited

Legend:

Unmodified
Added
Removed

  • botblocker/trunk/botblocker.php

    r533682 r536369  
    44Plugin URI: http://www.lform.com/botblocker/
    55Description: Kills spam-bots, leaves humans standing. No CAPTCHAS, no math questions, no passwords, just spam blocking that stops comment spam-bots dead in their tracks.
    6 Version: 1.0.3
     6Version: 1.0.4
    77Author: Lform Design (Brandon Fenning)
    88Author URI: http://www.lform.com/botblocker/
    … …  
    1111
    1212/*
    13  * TODO: Test all the way back to IE 5.5
    14  * TODO: Test on WP 3.0
    1513 * TODO: add complete obscusfication
    1614 * TODO: add themeable error page hook option
    1715 * TODO: make honey pot togglable
    1816 * TODO: add unit tests
    19  * BUG: When logged in as admin & commenting, flagged as spam bot
     17 *
    2018 */
    2119
    … …  
    2725    protected $options;
    2826    protected $isSpam = FALSE;
     27    protected $disabled = FALSE;
    2928   
    3029    protected $debug = FALSE;
    … …  
    4544        add_filter('pre_comment_approved',array( &$this, 'commentApproval' ),  '99', 2 );
    4645        add_action('comment_form_top', array( &$this, 'printError' ));
     46        add_action('pre_comment_on_post', array( &$this, 'preventRawSubmit' ));
     47       
    4748       
    4849        $this->options = $this->getWpOptions();     
    4950        $this->msg = &$_SESSION['_spamMsg'];       
     51   
     52        // # Used to access user data
     53        //global $current_user;
     54        //get_currentuserinfo();                   
     55    }
     56   
     57    // # Prevents spammers from directly submitting comments to wp-comments-post.php
     58    function preventRawSubmit() {
     59        $fieldName = $this->getHoneyPotName();
     60        if (!$this->disabled && !isset($_POST[$fieldName])) {
     61            $this->isSpam = TRUE;
     62            wp_die(__('<strong>ERROR</strong>: '.$this->getErrorMsg()));
     63        }
     64       
    5065    }
    5166   
    … …  
    6580    }
    6681   
     82    function getErrorMsg() {
     83       
     84        $options = $this->getOptions();
     85
     86        if ($options['honeypot_reaction'] == 'Block') {
     87            $approved = '0';
     88            $errorMsg = $options['honeypot_error_msg_block'];
     89        }
     90        else if ($options['honeypot_reaction'] == 'Spam') {
     91            $approved = 'spam';
     92            $errorMsg = $options['honeypot_error_msg_flag'];
     93        }
     94        else if ($options['honeypot_reaction'] == 'Hold') {
     95            $approved = '0';
     96            $errorMsg = $options['honeypot_error_msg_hold'];
     97        }
     98
     99        return ($options['honeypot_error_msg'].' '.$errorMsg);
     100       
     101    }
     102   
    67103    function commentApproval($approved, $commentData) {
    68104       
    … …  
    70106           
    71107            $options = $this->getOptions();
    72 
     108            /*
    73109            if ($options['honeypot_reaction'] == 'Block') {
    74110                $approved = '0';
    … …  
    85121
    86122            $this->logError($options['honeypot_error_msg'].' '.$errorMsg);
     123            */
     124           
     125            $this->logError($this->getErrorMsg());
    87126           
    88127            if ($options['honeypot_error_type'] == 'Die') {
    … …  
    113152        return FALSE;
    114153    }
    115        
    116     function generateHoneypot($fields) {
    117         $options = $this->getOptions();
    118 
     154   
     155    function getHoneyPotName() {
     156        $options = $this->getOptions();
     157       
    119158        $additionalRandom = '';
    120159        if ($options['honeypot_random'] == 'Yes') {
    121160            $additionalRandom = $this->getAdditionalRandom();       
    122161        }
     162       
     163        if ($options['honeypot_method'] == 'Smart') {
     164            $todaysDecoy = $this->getTodaysDecoy($options['fields']);
     165            $honeypotName = $additionalRandom.$todaysDecoy;
     166        }
     167        else if ($options['honeypot_method'] == 'Static') {
     168            $honeypotName = $additionalRandom.$options['honeypot_field'];
     169        }
     170        else {
     171            $todaysRandom = $this->getTodaysRandom();
     172            $honeypotName = $additionalRandom.$todaysRandom;
     173        }
     174        return $honeypotName;
     175    }
     176   
     177    function generateHoneypot($fields) {
     178        $options = $this->getOptions();
     179
     180        // # Update field cache
     181        $fieldList = array_keys($fields);
     182        $fieldList = array_combine($fieldList, $fieldList);
     183        if ($fieldList != $options['fields']) {
     184            $options['fields'] = $fieldList;
     185            update_option("BotBlocker_options", $options);         
     186        }
     187
     188        $additionalRandom = '';
     189        if ($options['honeypot_random'] == 'Yes') {
     190            $additionalRandom = $this->getAdditionalRandom();       
     191        }
    123192
    124193        if ($options['obfuscation'] == 'Swap Email and Name') {
    … …  
    129198            // # Todo: Add ability to completely obfuscate the field names with random characters
    130199        }
    131 
     200       
     201        $honeypotName = $this->getHoneyPotName();
     202       
     203        /*
    132204        if ($options['honeypot_method'] == 'Smart') {
    133205            $todaysDecoy = $this->getTodaysDecoy($fields);
    … …  
    141213            $honeypotName = $additionalRandom.$todaysRandom;
    142214        }
     215         */
     216       
    143217
    144218        $honeyClass = '';
    … …  
    164238   
    165239    function preprocessComment() {
     240        //# Disable plugin for logged in users so theyre not flagged as spam.
     241        if (is_user_logged_in()) {
     242            $this->disabled = TRUE;
     243        }
     244       
    166245        $additionalRandom = '';
    167246        $options = $this->getOptions();
    … …  
    216295
    217296        if ($isSpam) {
    218             $this->isSpam = TRUE;           
     297            $this->isSpam = TRUE;
     298        }
     299       
     300        if ($this->disabled == TRUE) {
     301            $this->isSpam = FALSE;  // # Logged in users not flagged as spam.
    219302        }
    220303
    … …  
    223306        //get_currentuserinfo();
    224307       
    225         if (is_user_logged_in()) { // # Logged in users not flagged as spam.
    226             $this->isSpam = FALSE;         
    227         }
     308        //if (is_user_logged_in()) {
     309        //  $this->isSpam = FALSE;         
     310        //}
    228311       
    229312        return $comment;
    … …  
    330413                'honeypot_reaction'=>'Block',
    331414                'obfuscation'=>'Swap Email and Name',
    332                 'seed'=>rand(0,99999),
     415                'seed'=>rand(0,99999999),
     416                'fields'=>array(), // # Caches fields for smart system
    333417            );
    334418            add_option("BotBlocker_options",$options);

  • botblocker/trunk/readme.txt

    r533682 r536369  
    22Contributors: brandonfenning
    33Donate link: http://www.lform.com/
    4 Tags: comments, spam, akismet, captcha, bot, comment spam, anti-spam, block, blocker, botblocker, bot blocker, reduce spam
     4Tags: comments, spam, akismet, captcha, bot, comment spam, anti-spam, block, blocker, botblocker, bot blocker, reduce spam, plugin
    55Requires at least: 3.0
    66Tested up to: 3.3.1
    7 Stable tag: 1.0.3
     7Stable tag: 1.0.4
    88
    99Kills spam-bots, leaves humans standing. No CAPTCHAS, no math questions, no passwords, just spam blocking that stops spam-bots dead in their tracks.
    … …  
    5252== Changelog ==
    5353
     54= 1.0.4 =
     55* Fixed bug with mechanism that prevents comments from directly being submitted to wp-comments-post.php.
     56
    5457= 1.0.3 =
    5558* Fixed bug that caused logged in users & admins to be flagged as spam bots. Registered users & admins will no longer be filtered by the spam bot system.
Note: See TracChangeset for help on using the changeset viewer.