prohibit using same anti-bot hashes across different boards/threads

2 files changed, 20 insertions, 7 deletions

diff --git a/inc/contrib/Twig/Extensions/Extension/Tinyboard.php b/inc/contrib/Twig/Extensions/Extension/Tinyboard.php
index 5748c0d3..5c6621f6 100644
--- a/inc/contrib/Twig/Extensions/Extension/Tinyboard.php
+++ b/inc/contrib/Twig/Extensions/Extension/Tinyboard.php
@@ -33,7 +33,8 @@ class Twig_Extensions_Extension_Tinyboard extends Twig_Extension
 	public function getFunctions()
 	{
 		return Array(
-			'time' => new Twig_Filter_Function('time', array('needs_environment' => false))
+			'time' => new Twig_Filter_Function('time', array('needs_environment' => false)),
+			'createHiddenInputs' => new Twig_Filter_Function('createHiddenInputs', array('needs_environment' => false))
 		);
 	}
 	
diff --git a/inc/functions.php b/inc/functions.php
index 7412f49f..c968ff69 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -1048,9 +1048,16 @@
 		}
 	}
 	
-	function createHiddenInputs() {
+	function createHiddenInputs($extra_salt = Array()) {
 		global $config;
 		
+		if(!empty($extra_salt)) {
+			// create a salted hash of the "extra salt"
+			$extra_salt = implode(':', $extra_salt);
+		} else { 
+			$extra_salt = '';
+		}
+		
 		$inputs = Array();
 		
 		shuffle($config['spam']['hidden_input_names']);
@@ -1139,7 +1146,7 @@
 		$hash .= $config['cookies']['salt'];
 		
 		// Use SHA1 for the hash
-		$hash = sha1($hash);
+		$hash = sha1($hash . $extra_salt);
 		
 		// Append it to the HTML
 		$content .= '<input type="hidden" name="hash" value="' . $hash . '" />';
@@ -1147,7 +1154,7 @@
 		return $content;
 	}
 	
-	function checkSpam() {
+	function checkSpam($extra_salt = Array()) {
 		global $config;
 		
 		if(!isset($_POST['hash']))
@@ -1155,6 +1162,13 @@
 		
 		$hash = $_POST['hash'];
 		
+		if(!empty($extra_salt)) {
+			// create a salted hash of the "extra salt"
+			$extra_salt = implode(':', $extra_salt);
+		} else { 
+			$extra_salt = '';
+		}
+		
 		// Reconsturct the $inputs array
 		$inputs = Array();
 		
@@ -1179,7 +1193,7 @@
 		$_hash .= $config['cookies']['salt'];
 		
 		// Use SHA1 for the hash
-		$_hash = sha1($_hash);
+		$_hash = sha1($_hash . $extra_salt);
 		
 		return $hash != $_hash;
 	}
@@ -1197,7 +1211,6 @@
 			$content['pages'] = $pages;
 			$content['pages'][$page-1]['selected'] = true;
 			$content['btn'] = getPageButtons($content['pages']);
-			$content['hidden_inputs'] = createHiddenInputs();
 			file_write($filename, Element('index.html', $content));
 			
 			if(isset($md5) && $md5 == md5_file($filename)) {
@@ -1460,7 +1473,6 @@
 			'id' => $id,
 			'mod' => $mod,
 			'boardlist' => createBoardlist($mod),
-			'hidden_inputs' => $content['hidden_inputs'] = createHiddenInputs(),
 			'return' => ($mod ? '?' . $board['url'] . $config['file_index'] : $config['root'] . $board['uri'] . '/' . $config['file_index'])
 		));