_binary From c20a361287cf7e49387a0244783ddf088ef034a9 Mon Sep 17 00:00:00 2001
From: Akash Patel <akash3664@yahoo.com>
Date: Tue, 25 Mar 2014 17:30:24 -0700
Subject: [PATCH] added hash captcha in create account

---
 controllers/register_controller.php | 70 +++++++++++++++++++++++++------------
 locale/en-US/configure.ini          |  6 ++++
 views/register_view.php             | 15 ++++++++
 views/suggest_view.php              |  2 +-
 4 files changed, 70 insertions(+), 23 deletions(-)

diff --git a/controllers/register_controller.php b/controllers/register_controller.php
index 0291a50..03e31e2 100755
--- a/controllers/register_controller.php
+++ b/controllers/register_controller.php
@@ -758,24 +758,36 @@ class RegisterController extends Controller implements CrawlConstants
      */
     function setupQuestionViewData()
     {
+        $profile_model = $this->model("profile");
+        $profile = $profile_model->getProfile(WORK_DIRECTORY);
         $data = array();
         $fields = $this->register_fields;
         foreach($fields as $field) {
             $data[strtoupper($field)] = "";
         }
-        for($i = 0; $i < self::NUM_CAPTCHA_QUESTIONS +
-            self::NUM_CAPTCHA_CHOICES; $i++) {
-            $data["question_$i"] = "-1";
+        if($profile['CAPTCHA_MODE'] == HASH_CAPTCHA) {
+            $data['INCLUDE_SCRIPTS'] = array("hashcash");
+            $time = time();
+            $_SESSION["request_time"] = $time;
+            $_SESSION["level"] = self::HASH_CAPTCHA_LEVEL;
+            $_SESSION["random_string"] = md5( $time . AUTH_KEY );
         }
-        if(!isset($_SESSION['CAPTCHAS'])||!isset($_SESSION['CAPTCHA_ANSWERS'])){
-            list($captchas, $answers) = $this->selectQuestionsAnswers(
+        if($profile['CAPTCHA_MODE'] == TEXT_CAPTCHA) {
+            for($i = 0; $i < self::NUM_CAPTCHA_QUESTIONS +
+            self::NUM_CAPTCHA_CHOICES; $i++) {
+                $data["question_$i"] = "-1";
+            }
+            if(!isset($_SESSION['CAPTCHAS'])||
+                !isset($_SESSION['CAPTCHA_ANSWERS'])){
+                list($captchas, $answers) = $this->selectQuestionsAnswers(
                 $this->captchas_qa, self::NUM_CAPTCHA_QUESTIONS,
                 self::NUM_CAPTCHA_CHOICES);
-            $data['CAPTCHAS'] = $captchas;
-            $_SESSION['CAPTCHA_ANSWERS'] = $answers;
-            $_SESSION['CAPTCHAS'] = $data['CAPTCHAS'];
-        } else {
-            $data['CAPTCHAS'] = $_SESSION['CAPTCHAS'];
+                $data['CAPTCHAS'] = $captchas;
+                $_SESSION['CAPTCHA_ANSWERS'] = $answers;
+                $_SESSION['CAPTCHAS'] = $data['CAPTCHAS'];
+            } else {
+                $data['CAPTCHAS'] = $_SESSION['CAPTCHAS'];
+            }
         }
         if(!isset($_SESSION['RECOVERY'])) {
             list($data['RECOVERY'], ) = $this->selectQuestionsAnswers(
@@ -870,29 +882,43 @@ class RegisterController extends Controller implements CrawlConstants
     function preactivityPrerequisiteCheck(&$activity,
         $activity_success, $activity_fail, &$data)
     {
+        $profile_model = $this->model("profile");
+        $profile = $profile_model->getProfile(WORK_DIRECTORY);
         if($activity == $activity_success) {
             $this->dataIntegrityCheck($data);
             if(!$data["SUCCESS"]) {
                 $activity = $activity_fail;
             }
             if($activity == $activity_success) {
-                if(!isset($_SESSION['CAPTCHA_ANSWERS']) ) {
-                    $data['SCRIPT'] .= "doMessage('<h1 class=\"red\" >".
+                if($profile['CAPTCHA_MODE'] == TEXT_CAPTCHA) {
+                    if(!isset($_SESSION['CAPTCHA_ANSWERS']) ) {
+                        $data['SCRIPT'] .= "doMessage('<h1 class=\"red\" >".
                         tl('register_controller_need_cookies')."</h1>');";
-                    $activity = 'createAccount';
-                    $this->model("visitor")->updateVisitor(
+                        $activity = 'createAccount';
+                        $this->model("visitor")->updateVisitor(
                         $_SERVER['REMOTE_ADDR'], "captcha_time_out");
-                } else if(!$this->checkCaptchaAnswers()) {
-                    $data['SCRIPT'] .= "doMessage('<h1 class=\"red\" >".
+                    } else if(!$this->checkCaptchaAnswers()) {
+                        $data['SCRIPT'] .= "doMessage('<h1 class=\"red\" >".
                         tl('register_controller_failed_human')."</h1>');";
-                    for($i = 0; $i < self::NUM_CAPTCHA_QUESTIONS; $i++) {
-                        $data["question_$i"] = "-1";
+                        for($i = 0; $i < self::NUM_CAPTCHA_QUESTIONS; $i++) {
+                            $data["question_$i"] = "-1";
+                        }
+                        unset($_SESSION['CAPTCHAS']);
+                        unset($_SESSION['CAPTCHA_ANSWERS']);
+                        $this->model("visitor")->updateVisitor(
+                            $_SERVER['REMOTE_ADDR'], "captcha_time_out");
+                        $activity = $activity_fail;
                     }
-                    unset($_SESSION['CAPTCHAS']);
-                    unset($_SESSION['CAPTCHA_ANSWERS']);
-                    $this->model("visitor")->updateVisitor(
+                }
+                else
+                {
+                    if(!$this->validateHashCode()) {
+                        $data['SCRIPT'] = "doMessage('<h1 class=\"red\" >".
+                        tl('register_controller_failed_hashcode')."</h1>');";
+                        $this->model("visitor")->updateVisitor(
                         $_SERVER['REMOTE_ADDR'], "captcha_time_out");
-                    $activity = $activity_fail;
+                        $activity = $activity_fail;
+                    }
                 }
             }
         }
diff --git a/locale/en-US/configure.ini b/locale/en-US/configure.ini
index 70f55e2..9c1428e 100755
--- a/locale/en-US/configure.ini
+++ b/locale/en-US/configure.ini
@@ -1149,6 +1149,9 @@ register_controller_suggest_full = "Suggest URL buffer is full! Please try again
 ; register_controller.php line: 682
 register_controller_url_submitted = "Suggested URL saved!"
 ;
+; register_controller.php line: 709
+register_controller_failed_hashcode = "HashCode Validation Failed"
+;
 ; register_controller.php line: 833
 register_controller_need_cookies = "Cookies need to be enabled to register or log in to a Yioop!"
 ;
@@ -2612,6 +2615,9 @@ serversettings_element_proxy_servers = "Proxy Servers (One per line. Format: add
 ; serversettings_element.php line: 241
 serversettings_element_submit = "Submit"
 ;
+; serversettings_element.php line: 244
+serversettings_element_captcha_setting = "Captcha Mode"
+;
 ; signin_element.php line: 64
 signin_element_settings = "Settings"
 ;
diff --git a/views/register_view.php b/views/register_view.php
index 6d6abad..5180fa6 100755
--- a/views/register_view.php
+++ b/views/register_view.php
@@ -76,6 +76,14 @@ class RegisterView extends View
             <form method="post" action="#">
             <input type="hidden" name="c" value="register" />
             <input type="hidden" name="a" value="processAccountData" />
+            <input type='hidden' name='nonce_for_string'
+            id='nonce_for_string' />
+            <input type='hidden' name='random_string' id='random_string'
+            value='<?php e($_SESSION["random_string"]);?>' />
+            <input type='hidden' name='time' id='time'
+            value='<?php e($_SESSION["request_time"]);?>' />
+            <input type='hidden' name='level' id='level'
+            value='<?php e($_SESSION["level"]);?>' />
                 <div class="register">
                     <table>
                         <tr>
@@ -213,6 +221,13 @@ class RegisterView extends View
         </div>
         </div>
         <div class='tall-landing-spacer'></div>
+         <script>
+            document.addEventListener('DOMContentLoaded', function() {
+            var body = tag(body);
+            body.onload = findNonce('nonce_for_string', 'random_string',
+                'time', 'level');
+            }, false);
+        </script>
     <?php
         }
     }
diff --git a/views/suggest_view.php b/views/suggest_view.php
index 090f7ec..96f96cd 100644
--- a/views/suggest_view.php
+++ b/views/suggest_view.php
@@ -139,7 +139,7 @@ class SuggestView extends View
                         ?>
                         <tr>
                             <td></td>
-                            <?php if(isset($_SESSION["randomString"])) { ?>
+                            <?php if(isset($_SESSION["random_string"])) { ?>
                             <td class="table-input">
                             <?php } else { ?>
                                <td class="table-input border-top">
-- 
1.8.0.msysgit.0

