WordPress.org
Get WordPress

Plugin Directory

Changeset 655941


Ignore:
Timestamp:
01/20/2013 09:42:40 PM (13 years ago)
Author:
edwardw
Message:

0.1.3

Location:
wp-no-bot-question/trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • wp-no-bot-question/trunk/readme.txt

    r646559 r655941  
    3838
    3939== Changelog ==
     40= 0.1.3 =
     41* 883ed15 Add a basic hashing mechanism to the question
     42* 9214d36 Support questions/answers with quotation marks
     43* 3b35ca3 Escape HTML special characters in admin
     44* 787b294 Validate the existance of the wp_nobot_answer_question field
     45
    4046= 0.1.2 =
    4147* c911cc4 Update fr-FR translation

  • wp-no-bot-question/trunk/wp_nobot_question.php

    r646559 r655941  
    44Plugin URI: http://www.compdigitec.com/apps/wpnobot/
    55Description: Simple question that blocks most spambots (and paid robots) by making them answer a common sense question
    6 Version: 0.1.2
     6Version: 0.1.3
    77Author: Compdigitec
    88Author URI: http://www.compdigitec.com/
    … …  
    1010Text Domain: wp_nobot_question
    1111*/
    12 define('wp_nobot_question_version','0.1.2');
     12define('wp_nobot_question_version','0.1.3');
    1313/*
    1414 *      Redistribution and use in source and binary forms, with or without
    … …  
    109109    <?php
    110110    $questions = wp_nobot_question_get_option('questions');
     111    $answers = wp_nobot_question_get_option('answers');
    111112    $selected_id = rand(0,count($questions)-1);
    112113    ?>
    … …  
    121122    />
    122123    <input type="hidden" name="wp_nobot_answer_question" value="<?php echo $selected_id; ?>" />
     124    <input type="hidden" name="wp_nobot_answer_question_hash" value="<?php echo wp_nobot_question_security_hash($selected_id, $questions[$selected_id], $answers[$selected_id]); ?>" />
    123125    </p>
    124126<?php
    … …  
    132134        return $x;
    133135    }
    134     if(!array_key_exists('wp_nobot_answer',$_POST) || trim($_POST['wp_nobot_answer']) == '') {
     136    if(!array_key_exists('wp_nobot_answer',$_POST) || !array_key_exists('wp_nobot_answer_question',$_POST) || trim($_POST['wp_nobot_answer']) == '') {
    135137        wp_die(__('Error: Please fill in the required question.','wp_nobot_question'));
    136138    }
    137139    $question_id = intval($_POST['wp_nobot_answer_question']);
     140    $questions_all = wp_nobot_question_get_option('questions');
    138141    $answers_all = wp_nobot_question_get_option('answers');
     142    // Hash verification to make sure the bot isn't picking on one answer.
     143    // This does not mean that they got the question right.
     144    if(trim($_POST['wp_nobot_answer_question_hash']) != wp_nobot_question_security_hash($question_id,$questions_all[$question_id],$answers_all[$question_id])) {
     145        wp_die(__('Error: Please fill in the correct answer to the question.','wp_nobot_question'));
     146    }
     147    // Verify the answer.
    139148    if($question_id < count($answers_all)) {
    140149        $answers = $answers_all[$question_id];
    … …  
    169178}
    170179
     180function wp_nobot_question_security_hash($id,$question,$answer) {
     181    /*
     182     * Hash format: SHA256( Question ID + Question Title + serialize( Question Answers ) )
     183     */
     184    $hash_string = strval($id) . strval($question) . serialize($answer);
     185    return hash('sha256',$hash_string);
     186}
     187
    171188function wp_nobot_question_template($id_,$question,$answers) {
    172189    $id = intval($id_);
    … …  
    175192    <th scope="row"><?php _e('Question to present to bot','wp_nobot_question'); ?></th>
    176193    <td>
    177         <input type="input" name="wp_nobot_question_question_<?php echo $id; ?>" size="70" value="<?php echo $question; ?>" placeholder="<?php _e('Type here to add a new question','wp_nobot_question'); ?>" /><a href="javascript:void(0)" onclick="wp_nobot_question_delete_entire_question(&quot;<?php echo $id ?>&quot;)"><?php echo __('Delete Question'); ?></a>
     194        <input type="input" name="wp_nobot_question_question_<?php echo $id; ?>" size="70" value="<?php echo htmlspecialchars($question); ?>" placeholder="<?php _e('Type here to add a new question','wp_nobot_question'); ?>" /><a href="javascript:void(0)" onclick="wp_nobot_question_delete_entire_question(&quot;<?php echo $id ?>&quot;)"><?php echo __('Delete Question'); ?></a>
    178195    </td>
    179196    </tr>
    … …  
    185202foreach($answers as $value) {
    186203    echo "<span id=\"wp_nobot_question_line_{$id}_$i\">";
    187     printf('<input type="input" id="wp_nobot_question_answer_%1$d_%2$d" name="wp_nobot_question_answers_%1$d[]" size="70" value="%3$s" />', $id, $i, $value);
     204    printf('<input type="input" id="wp_nobot_question_answer_%1$d_%2$d" name="wp_nobot_question_answers_%1$d[]" size="70" value="%3$s" />', $id, $i, htmlspecialchars($value));
    188205    echo "<a href=\"javascript:void(0)\" onclick=\"wp_nobot_question_delete(&quot;$id&quot;, &quot;$i&quot;)\">" . __('Delete') . "</a>";
    189206    echo "<br /></span>\n";
    … …  
    208225                $q_id = str_replace('wp_nobot_question_question_','',$key);
    209226                if(trim(strval($value)) != '') { // if not empty
    210                     $questions[] = trim(strval($value));
    211                     $answers[] = array_filter($_POST['wp_nobot_question_answers_' . $q_id]);
     227                    $question_slashed = trim(strval($value));
     228                    // WordPress seems to add quotes by default, see:
     229                    // http://stackoverflow.com/questions/1746078/wordpress-2-8-6-foobars-my-theme-options-with-escape-slashes#answers-header
     230                    // http://core.trac.wordpress.org/ticket/18322
     231                    $questions[] = stripslashes($question_slashed);
     232                    $answers_slashed = array_filter($_POST['wp_nobot_question_answers_' . $q_id]);
     233                    foreach($answers_slashed as $key => $value) {
     234                        $answers_slashed[$key] = stripslashes($value);
     235                    }
     236                    $answers[] = $answers_slashed;
    212237                }
    213238            }
Note: See TracChangeset for help on using the changeset viewer.