source: extensions/Comments_on_Albums/include/functions_comment.inc.php @ 15995

Revision 15995, 11.0 KB checked in by mistic100, 8 years ago (diff)

improve anti-spam system (Piwigo 2.5 feature)

Line 
1<?php
2/* This is a copy of include/functions_comment.inc.php but adapted for Comments On Albums */
3
4//returns string action to perform on a new comment: validate, moderate, reject
5function user_comment_check_albums($action, $comment)
6{
7  global $conf,$user;
8
9  if ($action=='reject')
10  return $action;
11
12  $my_action = $conf['comment_spam_reject'] ? 'reject':'moderate';
13
14  if ($action==$my_action)
15  return $action;
16
17  // we do here only BASIC spam check (plugins can do more)
18  if ( !is_a_guest() )
19  return $action;
20
21  $link_count = preg_match_all( '/https?:\/\//',
22  $comment['content'], $matches);
23
24  if ( strpos($comment['author'], 'http://')!==false )
25  {
26  $link_count++;
27  }
28
29  if ( $link_count>$conf['comment_spam_max_links'] )
30  return $my_action;
31
32  return $action;
33}
34
35add_event_handler('user_comment_check_albums', 'user_comment_check_albums',
36  EVENT_HANDLER_PRIORITY_NEUTRAL, 2);
37
38/**
39 * Tries to insert a user comment in the database and returns one of :
40 * validate, moderate, reject
41 * @param array comm contains author, content, category_id
42 * @param string key secret key sent back to the browser
43 * @param array infos out array of messages
44 */
45function insert_user_comment_albums( &$comm, $key, &$infos )
46{
47  global $conf, $user;
48
49  $comm = array_merge( $comm,
50    array(
51      'ip' => $_SERVER['REMOTE_ADDR'],
52      'agent' => $_SERVER['HTTP_USER_AGENT']
53    )
54   );
55
56  $infos = array();
57  if (!$conf['comments_validation'] or is_admin())
58  {
59    $comment_action='validate'; //one of validate, moderate, reject
60  }
61  else
62  {
63    $comment_action='moderate'; //one of validate, moderate, reject
64  }
65
66  // display author field if the user status is guest or generic
67  if (!is_classic_user())
68  {
69    if ( empty($comm['author']) )
70    {
71      $comm['author'] = 'guest';
72    }
73    $comm['author_id'] = $conf['guest_id'];
74    // if a guest try to use the name of an already existing user, he must be
75    // rejected
76    if ( $comm['author'] != 'guest' )
77    {
78      $query = '
79SELECT COUNT(*) AS user_exists
80  FROM '.USERS_TABLE.'
81  WHERE '.$conf['user_fields']['username']." = '".addslashes($comm['author'])."'";
82      $row = pwg_db_fetch_assoc( pwg_query( $query ) );
83      if ( $row['user_exists'] == 1 )
84      {
85        array_push($infos, l10n('This login is already used by another user') );
86        $comment_action='reject';
87      }
88    }
89  }
90  else
91  {
92    $comm['author'] = addslashes($user['username']);
93    $comm['author_id'] = $user['id'];
94  }
95
96  if ( empty($comm['content']) )
97  { // empty comment content
98    $comment_action='reject';
99  }
100
101  if ( !verify_ephemeral_key(@$key, $comm['category_id']) )
102  {
103    $comment_action='reject';
104    $_POST['cr'][] = 'key';
105  }
106 
107  // anonymous id = ip address
108  $ip_components = explode('.', $comm['ip']);
109  if (count($ip_components) > 3)
110  {
111    array_pop($ip_components);
112  }
113  $comm['anonymous_id'] = implode('.', $ip_components);
114
115  if ($comment_action!='reject' and $conf['anti-flood_time']>0 and !is_admin())
116  { // anti-flood system
117    $reference_date = pwg_db_get_flood_period_expression($conf['anti-flood_time']);
118
119    $query = '
120SELECT count(1) FROM '.COA_TABLE.'
121  WHERE date > '.$reference_date.'
122    AND author_id = '.$comm['author_id'];
123    if (!is_classic_user())
124    {
125      $query.= '
126      AND anonymous_id = "'.$comm['anonymous_id'].'"';
127    }
128    $query.= '
129;';
130
131    list($counter) = pwg_db_fetch_row(pwg_query($query));
132    if ( $counter > 0 )
133    {
134      array_push( $infos, l10n('Anti-flood system : please wait for a moment before trying to post another comment') );
135      $comment_action='reject';
136    }
137  }
138
139  // perform more spam check
140  $comment_action = trigger_event('user_comment_check_albums',
141      $comment_action, $comm
142    );
143
144  if ( $comment_action!='reject' )
145  {
146    $query = '
147INSERT INTO '.COA_TABLE.'
148  (author, author_id, content, date, validated, validation_date, category_id)
149  VALUES (
150    \''.$comm['author'].'\',
151    '.$comm['author_id'].',
152    \''.$comm['content'].'\',
153    NOW(),
154    \''.($comment_action=='validate' ? 'true':'false').'\',
155    '.($comment_action=='validate' ? 'NOW()':'NULL').',
156    '.$comm['category_id'].'
157  )
158';
159
160    pwg_query($query);
161
162    $comm['id'] = pwg_db_insert_id(COA_TABLE);
163
164    if ( ($conf['email_admin_on_comment'] && 'validate' == $comment_action)
165        or ($conf['email_admin_on_comment_validation'] and 'moderate' == $comment_action))
166    {
167      include_once(PHPWG_ROOT_PATH.'include/functions_mail.inc.php');
168
169      $comment_url = get_absolute_root_url().'comments.php?display_mode=albums&comment_id='.$comm['id'];
170
171      $keyargs_content = array
172      (
173        get_l10n_args('Author: %s', stripslashes($comm['author']) ),
174        get_l10n_args('Comment: %s', stripslashes($comm['content']) ),
175        get_l10n_args('', ''),
176        get_l10n_args('Manage this user comment: %s', $comment_url)
177      );
178
179      if ('moderate' == $comment_action)
180      {
181        $keyargs_content[] = get_l10n_args('', '');
182        $keyargs_content[] = get_l10n_args('(!) This comment requires validation', '');
183      }
184
185      pwg_mail_notification_admins
186      (
187        get_l10n_args('Comment by %s', stripslashes($comm['author']) ),
188        $keyargs_content
189      );
190    }
191  }
192  return $comment_action;
193}
194
195/**
196 * Tries to delete a user comment in the database
197 * only admin can delete all comments
198 * other users can delete their own comments
199 * so to avoid a new sql request we add author in where clause
200 *
201 * @param comment_id
202 */
203function delete_user_comment_albums($comment_id) 
204{
205  $user_where_clause = '';
206  if (!is_admin())
207  {
208    $user_where_clause = '   AND author_id = \''.$GLOBALS['user']['id'].'\'';
209  }
210 
211  if (is_array($comment_id))
212    $where_clause = 'id IN('.implode(',', $comment_id).')';
213  else
214    $where_clause = 'id = '.$comment_id;
215 
216  $query = '
217DELETE FROM '.COA_TABLE.'
218  WHERE '.$where_clause.
219$user_where_clause.'
220;';
221  $result = pwg_query($query);
222 
223  if ($result) 
224  {
225    email_admin('delete', 
226                array('author' => $GLOBALS['user']['username'],
227                      'comment_id' => $comment_id
228                  ));
229  }
230 
231  trigger_action('user_comment_deletion', $comment_id, 'category');
232}
233
234/**
235 * Tries to update a user comment in the database
236 * only admin can update all comments
237 * users can edit their own comments if admin allow them
238 * so to avoid a new sql request we add author in where clause
239 *
240 * @param comment_id
241 * @param post_key
242 * @param content
243 */
244function update_user_comment_albums($comment, $post_key)
245{
246  global $conf;
247
248  $comment_action = 'validate';
249
250  if ( !verify_ephemeral_key($post_key, $comment['category_id']) )
251  {
252    $comment_action='reject';
253  }
254  elseif (!$conf['comments_validation'] or is_admin()) // should the updated comment must be validated
255  {
256    $comment_action='validate'; //one of validate, moderate, reject
257  }
258  else
259  {
260    $comment_action='moderate'; //one of validate, moderate, reject
261  }
262
263  // perform more spam check
264  $comment_action =
265    trigger_event('user_comment_check_albums',
266      $comment_action,
267      array_merge($comment,
268            array('author' => $GLOBALS['user']['username'])
269            )
270      );
271
272  if ( $comment_action!='reject' )
273  {
274    $user_where_clause = '';
275    if (!is_admin())
276    {
277      $user_where_clause = '   AND author_id = \''.
278  $GLOBALS['user']['id'].'\'';
279    }
280
281    $query = '
282UPDATE '.COA_TABLE.'
283  SET content = \''.$comment['content'].'\',
284      validated = \''.($comment_action=='validate' ? 'true':'false').'\',
285      validation_date = '.($comment_action=='validate' ? 'NOW()':'NULL').'
286  WHERE id = '.$comment['comment_id'].
287$user_where_clause.'
288;';
289    $result = pwg_query($query);
290   
291    // mail admin and ask to validate the comment
292    if ($result and $conf['email_admin_on_comment_validation'] and 'moderate' == $comment_action) 
293    {
294      include_once(PHPWG_ROOT_PATH.'include/functions_mail.inc.php');
295
296      $comment_url = get_absolute_root_url().'comments.php?display_mode=albums&amp;comment_id='.$comment['comment_id'];
297
298      $keyargs_content = array
299      (
300        get_l10n_args('Author: %s', stripslashes($GLOBALS['user']['username']) ),
301        get_l10n_args('Comment: %s', stripslashes($comment['content']) ),
302        get_l10n_args('', ''),
303        get_l10n_args('Manage this user comment: %s', $comment_url),
304        get_l10n_args('', ''),
305        get_l10n_args('(!) This comment requires validation', ''),
306      );
307
308      pwg_mail_notification_admins
309      (
310        get_l10n_args('Comment by %s', stripslashes($GLOBALS['user']['username']) ),
311        $keyargs_content
312      );
313    }
314    // just mail admin
315    else if ($result)
316    {
317      email_admin('edit', array('author' => $GLOBALS['user']['username'],
318        'content' => stripslashes($comment['content'])) );
319    }
320  }
321 
322  return $comment_action;
323}
324
325if (!function_exists('email_admin')) 
326{
327  function email_admin($action, $comment)
328  {
329    global $conf;
330
331    if (!in_array($action, array('edit', 'delete'))
332      or (($action=='edit') and !$conf['email_admin_on_comment_edition'])
333      or (($action=='delete') and !$conf['email_admin_on_comment_deletion']))
334    {
335    return;
336    }
337
338    include_once(PHPWG_ROOT_PATH.'include/functions_mail.inc.php');
339
340    $keyargs_content = array();
341    $keyargs_content[] = get_l10n_args('Author: %s', $comment['author']);
342    if ($action=='delete')
343    {
344    $keyargs_content[] = get_l10n_args('This author removed the comment with id %d',
345               $comment['comment_id']
346               );
347    }
348    else
349    {
350    $keyargs_content[] = get_l10n_args('This author modified following comment:', '');
351    $keyargs_content[] = get_l10n_args('Comment: %s', $comment['content']);
352    }
353
354    pwg_mail_notification_admins(get_l10n_args('Comment by %s',
355               $comment['author']),
356             $keyargs_content
357             );
358  }
359}
360
361function get_comment_author_id_albums($comment_id, $die_on_error=true)
362{
363  $query = '
364SELECT
365    author_id
366  FROM '.COA_TABLE.'
367  WHERE id = '.$comment_id.'
368;';
369  $result = pwg_query($query);
370  if (pwg_db_num_rows($result) == 0)
371  {
372    if ($die_on_error)
373    {
374      fatal_error('Unknown comment identifier');
375    }
376    else
377    {
378      return false;
379    }
380  }
381 
382  list($author_id) = pwg_db_fetch_row($result);
383
384  return $author_id;
385}
386
387/**
388 * Tries to validate a user comment in the database
389 * @param int or array of int comment_id
390 */
391function validate_user_comment_albums($comment_id)
392{
393  if (is_array($comment_id))
394    $where_clause = 'id IN('.implode(',', $comment_id).')';
395  else
396    $where_clause = 'id = '.$comment_id;
397   
398  $query = '
399UPDATE '.COA_TABLE.'
400  SET validated = \'true\'
401    , validation_date = NOW()
402  WHERE '.$where_clause.'
403;';
404  pwg_query($query);
405 
406  trigger_action('user_comment_validation', $comment_id, 'category');
407}
408?>
Note: See TracBrowser for help on using the repository browser.