From de347f03875f083e5ab44787387f0507fd453a8c Mon Sep 17 00:00:00 2001 From: Michael Save Date: Thu, 19 Apr 2012 01:32:02 +1000 Subject: don't use CRC32 --- inc/anti-bot.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'inc/anti-bot.php') diff --git a/inc/anti-bot.php b/inc/anti-bot.php index b5fcf2a1..4509505e 100644 --- a/inc/anti-bot.php +++ b/inc/anti-bot.php @@ -190,7 +190,7 @@ function _create_antibot($board, $thread) { $query->bindValue(':expires', $config['spam']['hidden_inputs_expire']); $query->execute() or error(db_error($query)); - $query = prepare('INSERT INTO `antispam` VALUES (:board, :thread, CRC32(:hash), UNIX_TIMESTAMP(), NULL, 0)'); + $query = prepare('INSERT INTO `antispam` VALUES (:board, :thread, :hash, UNIX_TIMESTAMP(), NULL, 0)'); $query->bindValue(':board', $board); $query->bindValue(':thread', $thread); $query->bindValue(':hash', $antibot->hash()); -- cgit v1.3 From a84c948074ef6693fb356a7b3441053859629372 Mon Sep 17 00:00:00 2001 From: Michael Save Date: Thu, 19 Apr 2012 01:38:35 +1000 Subject: Bugfix: s/CRC32// --- inc/anti-bot.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'inc/anti-bot.php') diff --git a/inc/anti-bot.php b/inc/anti-bot.php index 4509505e..3959b054 100644 --- a/inc/anti-bot.php +++ b/inc/anti-bot.php @@ -248,7 +248,7 @@ function checkSpam(array $extra_salt = array()) { if ($hash != $_hash) return true; - $query = prepare('UPDATE `antispam` SET `passed` = `passed` + 1 WHERE `hash` = CRC32(:hash)'); + $query = prepare('UPDATE `antispam` SET `passed` = `passed` + 1 WHERE `hash` = :hash'); $query->bindValue(':hash', $hash); $query->execute() or error(db_error($query)); if ($query->rowCount() == 0) { @@ -256,7 +256,7 @@ function checkSpam(array $extra_salt = array()) { return true; } - $query = prepare('SELECT `passed` FROM `antispam` WHERE `hash` = CRC32(:hash)'); + $query = prepare('SELECT `passed` FROM `antispam` WHERE `hash` = :hash'); $query->bindValue(':hash', $hash); $query->execute() or error(db_error($query)); $passed = $query->fetchColumn(0); -- cgit v1.3 From 64f7e70d29dc177f10106d4e6ac9f90725d95133 Mon Sep 17 00:00:00 2001 From: Michael Save Date: Sat, 21 Apr 2012 12:42:21 +1000 Subject: What? --- inc/anti-bot.php | 5 ----- 1 file changed, 5 deletions(-) (limited to 'inc/anti-bot.php') diff --git a/inc/anti-bot.php b/inc/anti-bot.php index 3959b054..9260b237 100644 --- a/inc/anti-bot.php +++ b/inc/anti-bot.php @@ -196,11 +196,6 @@ function _create_antibot($board, $thread) { $query->bindValue(':hash', $antibot->hash()); $query->execute() or error(db_error($query)); - if ($query->rowCount() == 0) { - // there was no database entry for this hash. most likely expired. - return true; - } - return $antibot; } -- cgit v1.3 From d76c79cea6232ab1a98be11a684229ab2e586acb Mon Sep 17 00:00:00 2001 From: Michael Save Date: Sun, 15 Apr 2012 15:13:06 +1000 Subject: Bugfix: was not correctly purging old anti-bot hashes --- inc/anti-bot.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'inc/anti-bot.php') diff --git a/inc/anti-bot.php b/inc/anti-bot.php index 9260b237..9e3ffeb2 100644 --- a/inc/anti-bot.php +++ b/inc/anti-bot.php @@ -180,9 +180,9 @@ function _create_antibot($board, $thread) { query('DELETE FROM `antispam` WHERE `expires` < UNIX_TIMESTAMP()') or error(db_error()); if ($thread) - $query = prepare('UPDATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE `board` = :board AND `thread` = :thread'); + $query = prepare('UPDATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE `board` = :board AND `thread` = :thread AND `expires` IS NULL'); else - $query = prepare('UPDATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE `board` = :board AND `thread` IS NULL'); + $query = prepare('UPDATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE `board` = :board AND `thread` IS NULL AND `expires` IS NULL'); $query->bindValue(':board', $board); if ($thread) -- cgit v1.3 From 9058d202ed15133d40936a1e43bf34e4049c1be1 Mon Sep 17 00:00:00 2001 From: Michael Save Date: Mon, 7 May 2012 23:51:15 +1000 Subject: Bugfix: the number of successful passes for an anti-spam "hash" was often incorrectly incremented --- inc/anti-bot.php | 18 ++++++++++-------- post.php | 11 +++++++++-- 2 files changed, 19 insertions(+), 10 deletions(-) (limited to 'inc/anti-bot.php') diff --git a/inc/anti-bot.php b/inc/anti-bot.php index 9e3ffeb2..81afca1b 100644 --- a/inc/anti-bot.php +++ b/inc/anti-bot.php @@ -243,22 +243,24 @@ function checkSpam(array $extra_salt = array()) { if ($hash != $_hash) return true; - $query = prepare('UPDATE `antispam` SET `passed` = `passed` + 1 WHERE `hash` = :hash'); + $query = prepare('SELECT `passed` FROM `antispam` WHERE `hash` = :hash'); $query->bindValue(':hash', $hash); $query->execute() or error(db_error($query)); - if ($query->rowCount() == 0) { + if (($passed = $query->fetchColumn(0)) === false) { // there was no database entry for this hash. most likely expired. return true; } - $query = prepare('SELECT `passed` FROM `antispam` WHERE `hash` = :hash'); - $query->bindValue(':hash', $hash); - $query->execute() or error(db_error($query)); - $passed = $query->fetchColumn(0); - if ($passed > $config['spam']['hidden_inputs_max_pass']) return true; - return false; + return $hash; } +function incrementSpamHash($hash) { + $query = prepare('UPDATE `antispam` SET `passed` = `passed` + 1 WHERE `hash` = :hash'); + $query->bindValue(':hash', $hash); + $query->execute() or error(db_error($query)); +} + + diff --git a/post.php b/post.php index 11465a6e..2cbe5235 100644 --- a/post.php +++ b/post.php @@ -212,8 +212,11 @@ if (isset($_POST['delete'])) { error($config['error']['noaccess']); } - if (!$post['mod'] && checkSpam(array($board['uri'], isset($post['thread']) && !($config['quick_reply'] && isset($_POST['quick-reply'])) ? $post['thread'] : null))) - error($config['error']['spam']); + if (!$post['mod']) { + $post['antispam_hash'] = checkSpam(array($board['uri'], isset($post['thread']) && !($config['quick_reply'] && isset($_POST['quick-reply'])) ? $post['thread'] : null)); + if ($post['antispam_hash'] === true) + error($config['error']['spam']); + } if ($config['robot_enable'] && $config['robot_mute']) { checkMute(); @@ -536,6 +539,10 @@ if (isset($_POST['delete'])) { $id = post($post); + if (isset($post['antispam_hash'])) { + incrementSpamHash($post['antispam_hash']); + } + if (isset($post['tracked_cites'])) { foreach ($post['tracked_cites'] as $cite) { $query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)'); -- cgit v1.3 From 318a9554c2f9a9663c5b5fd0deb19906663159be Mon Sep 17 00:00:00 2001 From: Sebastian Stal Date: Sun, 29 Jul 2012 15:59:42 -0700 Subject: Remove the double-quote (") from characters used for random inputs --- inc/anti-bot.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'inc/anti-bot.php') diff --git a/inc/anti-bot.php b/inc/anti-bot.php index 81afca1b..ed09f8ac 100644 --- a/inc/anti-bot.php +++ b/inc/anti-bot.php @@ -19,7 +19,7 @@ class AntiBot { if ($uppercase) $chars .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'; if ($special_chars) - $chars .= ' ~!@#$%^&*()_+,./;\'[]\\{}|:"<>?=-` '; + $chars .= ' ~!@#$%^&*()_+,./;\'[]\\{}|:<>?=-` '; $chars = str_split($chars); -- cgit v1.3 From bec9f21787c7fa183078d3c1defbc795b2e930e5 Mon Sep 17 00:00:00 2001 From: Macil Tech Date: Sat, 25 Aug 2012 07:52:37 -0600 Subject: Antibot make_confusing fix --- inc/anti-bot.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'inc/anti-bot.php') diff --git a/inc/anti-bot.php b/inc/anti-bot.php index ed09f8ac..716e301c 100644 --- a/inc/anti-bot.php +++ b/inc/anti-bot.php @@ -48,8 +48,9 @@ class AntiBot { foreach ($chars as &$c) { if (rand(0, 2) != 0) - continue; - $c = mb_encode_numericentity($c, array(0, 0xffff, 0, 0xffff), 'UTF-8'); + $c = utf8tohtml($c); + else + $c = mb_encode_numericentity($c, array(0, 0xffff, 0, 0xffff), 'UTF-8'); } return implode('', $chars); -- cgit v1.3