summaryrefslogtreecommitdiff
path: root/inc/filters.php
diff options
context:
space:
mode:
Diffstat (limited to 'inc/filters.php')
-rw-r--r--inc/filters.php176
1 files changed, 125 insertions, 51 deletions
diff --git a/inc/filters.php b/inc/filters.php
index cd512821..f06154ba 100644
--- a/inc/filters.php
+++ b/inc/filters.php
@@ -4,12 +4,10 @@
* Copyright (c) 2010-2013 Tinyboard Development Group
*/
-if (realpath($_SERVER['SCRIPT_FILENAME']) == str_replace('\\', '/', __FILE__)) {
- // You cannot request this file directly.
- exit;
-}
+defined('TINYBOARD') or exit;
class Filter {
+ public $flood_check;
private $condition;
public function __construct(array $arr) {
@@ -25,6 +23,64 @@ class Filter {
if (!is_callable($match))
error('Custom condition for filter is not callable!');
return $match($post);
+ case 'flood-match':
+ if (!is_array($match))
+ error('Filter condition "flood-match" must be an array.');
+
+ // Filter out "flood" table entries which do not match this filter.
+
+ $flood_check_matched = array();
+
+ foreach ($this->flood_check as $flood_post) {
+ foreach ($match as $flood_match_arg) {
+ switch ($flood_match_arg) {
+ case 'ip':
+ if ($flood_post['ip'] != $_SERVER['REMOTE_ADDR'])
+ continue 3;
+ break;
+ case 'body':
+ if ($flood_post['posthash'] != make_comment_hex($post['body_nomarkup']))
+ continue 3;
+ break;
+ case 'file':
+ if (!isset($post['filehash']))
+ return false;
+ if ($flood_post['filehash'] != $post['filehash'])
+ continue 3;
+ break;
+ case 'board':
+ if ($flood_post['board'] != $post['board'])
+ continue 3;
+ break;
+ case 'isreply':
+ if ($flood_post['isreply'] == $post['op'])
+ continue 3;
+ break;
+ default:
+ error('Invalid filter flood condition: ' . $flood_match_arg);
+ }
+ }
+ $flood_check_matched[] = $flood_post;
+ }
+
+ $this->flood_check = $flood_check_matched;
+
+ return !empty($this->flood_check);
+ case 'flood-time':
+ foreach ($this->flood_check as $flood_post) {
+ if (time() - $flood_post['time'] <= $match) {
+ return true;
+ }
+ }
+ return false;
+ case 'flood-count':
+ $count = 0;
+ foreach ($this->flood_check as $flood_post) {
+ if (time() - $flood_post['time'] <= $this->condition['flood-time']) {
+ ++$count;
+ }
+ }
+ return $count >= $match;
case 'name':
return preg_match($match, $post['name']);
case 'trip':
@@ -34,7 +90,7 @@ class Filter {
case 'subject':
return preg_match($match, $post['subject']);
case 'body':
- return preg_match($match, $post['body']);
+ return preg_match($match, $post['body_nomarkup']);
case 'filename':
if (!$post['has_file'])
return false;
@@ -59,52 +115,18 @@ class Filter {
switch($this->action) {
case 'reject':
- error(isset($this->message) ? $this->message : 'Posting throttled by flood filter.');
+ error(isset($this->message) ? $this->message : 'Posting throttled by filter.');
case 'ban':
if (!isset($this->reason))
error('The ban action requires a reason.');
- $reason = $this->reason;
-
- if (isset($this->expires))
- $expires = time() + $this->expires;
- else
- $expires = 0; // Ban indefinitely
-
- if (isset($this->reject))
- $reject = $this->reject;
- else
- $reject = true;
-
- if (isset($this->all_boards))
- $all_boards = $this->all_boards;
- else
- $all_boards = false;
-
- $query = prepare("INSERT INTO ``bans`` VALUES (NULL, :ip, :mod, :set, :expires, :reason, :board, 0)");
- $query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
- $query->bindValue(':mod', -1);
- $query->bindValue(':set', time());
-
- if ($expires)
- $query->bindValue(':expires', $expires);
- else
- $query->bindValue(':expires', null, PDO::PARAM_NULL);
-
- if ($reason)
- $query->bindValue(':reason', $reason);
- else
- $query->bindValue(':reason', null, PDO::PARAM_NULL);
-
-
- if ($all_boards)
- $query->bindValue(':board', null, PDO::PARAM_NULL);
- else
- $query->bindValue(':board', $board['uri']);
+ $this->expires = isset($this->expires) ? $this->expires : false;
+ $this->reject = isset($this->reject) ? $this->reject : true;
+ $this->all_boards = isset($this->all_boards) ? $this->all_boards : false;
- $query->execute() or error(db_error($query));
+ Bans::new_ban($_SERVER['REMOTE_ADDR'], $this->reason, $this->expires, $this->all_boards ? false : $board['uri'], -1);
- if ($reject) {
+ if ($this->reject) {
if (isset($this->message))
error($message);
@@ -120,25 +142,77 @@ class Filter {
public function check(array $post) {
foreach ($this->condition as $condition => $value) {
- if (!$this->match($post, $condition, $value))
+ if ($condition[0] == '!') {
+ $NOT = true;
+ $condition = substr($condition, 1);
+ } else $NOT = false;
+
+ if ($this->match($post, $condition, $value) == $NOT)
return false;
}
-
- /* match */
return true;
}
}
+function purge_flood_table() {
+ global $config;
+
+ // Determine how long we need to keep a cache of posts for flood prevention. Unfortunately, it is not
+ // aware of flood filters in other board configurations. You can solve this problem by settings the
+ // config variable $config['flood_cache'] (seconds).
+
+ if (isset($config['flood_cache'])) {
+ $max_time = &$config['flood_cache'];
+ } else {
+ $max_time = 0;
+ foreach ($config['filters'] as $filter) {
+ if (isset($filter['condition']['flood-time']))
+ $max_time = max($max_time, $filter['condition']['flood-time']);
+ }
+ }
+
+ $time = time() - $max_time;
+
+ query("DELETE FROM ``flood`` WHERE `time` < $time") or error(db_error());
+}
+
function do_filters(array $post) {
global $config;
- if (!isset($config['filters']))
+ if (!isset($config['filters']) || empty($config['filters']))
return;
- foreach ($config['filters'] as $arr) {
- $filter = new Filter($arr);
+ foreach ($config['filters'] as $filter) {
+ if (isset($filter['condition']['flood-match'])) {
+ $has_flood = true;
+ break;
+ }
+ }
+
+ if (isset($has_flood)) {
+ if ($post['has_file']) {
+ $query = prepare("SELECT * FROM ``flood`` WHERE `ip` = :ip OR `posthash` = :posthash OR `filehash` = :filehash");
+ $query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
+ $query->bindValue(':posthash', make_comment_hex($post['body_nomarkup']));
+ $query->bindValue(':filehash', $post['filehash']);
+ } else {
+ $query = prepare("SELECT * FROM ``flood`` WHERE `ip` = :ip OR `posthash` = :posthash");
+ $query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
+ $query->bindValue(':posthash', make_comment_hex($post['body_nomarkup']));
+ }
+ $query->execute() or error(db_error($query));
+ $flood_check = $query->fetchAll(PDO::FETCH_ASSOC);
+ } else {
+ $flood_check = false;
+ }
+
+ foreach ($config['filters'] as $filter_array) {
+ $filter = new Filter($filter_array);
+ $filter->flood_check = $flood_check;
if ($filter->check($post))
$filter->action();
}
+
+ purge_flood_table();
}
generated by cgit v1.3 (git 2.53.0) at 2026-10-25 19:05:26 +0000