diff options
| -rw-r--r-- | include/picture_comment.inc.php | 47 | ||||
| -rw-r--r-- | install/config.sql | 1 | ||||
| -rw-r--r-- | install/db/43-database.php | 51 | ||||
| -rw-r--r-- | template/yoga/picture.tpl | 3 |
4 files changed, 98 insertions, 4 deletions
diff --git a/include/picture_comment.inc.php b/include/picture_comment.inc.php index 38c91c167..fbbe80d50 100644 --- a/include/picture_comment.inc.php +++ b/include/picture_comment.inc.php @@ -2,10 +2,10 @@ // +-----------------------------------------------------------------------+ // | PhpWebGallery - a PHP based picture gallery | // | Copyright (C) 2002-2003 Pierrick LE GALL - pierrick@phpwebgallery.net | -// | Copyright (C) 2003-2005 PhpWebGallery Team - http://phpwebgallery.net | +// | Copyright (C) 2003-2007 PhpWebGallery Team - http://phpwebgallery.net | // +-----------------------------------------------------------------------+ // | branch : BSF (Best So Far) -// | file : $RCSfile$ +// | file : $Id$ // | last update : $Date$ // | last modifier : $Author$ // | revision : $Revision$ @@ -29,6 +29,33 @@ * This file is included by the picture page to manage user comments * */ + +if (!function_exists('hash_hmac')) +{ +function hash_hmac($algo, $data, $key, $raw_output=false) +{ + /* md5 and sha1 only */ + $algo=strtolower($algo); + $p=array('md5'=>'H32','sha1'=>'H40'); + if ( !isset($p[$algo]) or !function_exists($algo) ) + { + $algo = 'md5'; + } + if(strlen($key)>64) $key=pack($p[$algo],$algo($key)); + if(strlen($key)<64) $key=str_pad($key,64,chr(0)); + + $ipad=substr($key,0,64) ^ str_repeat(chr(0x36),64); + $opad=substr($key,0,64) ^ str_repeat(chr(0x5C),64); + + $ret = $algo($opad.pack($p[$algo],$algo($ipad.$data))); + if ($raw_output) + { + $ret = pack('H*', $ret); + } + return $ret; +} +} + //returns string action to perform on a new comment: validate, moderate, reject function user_comment_check($action, $comment, $picture) { @@ -137,6 +164,15 @@ if ( $page['show_comments'] and isset( $_POST['content'] ) ) $comment_action='reject'; } + $key = explode(':', @$_POST['key']); + if ( count($key)!=2 + or $key[0]>time() or $key[0]<time()-1800 // 30 minutes expiration + or hash_hmac('md5', $key[0], $conf['secret_key'])!=$key[1] + ) + { + $comment_action='reject'; + } + if ($comment_action!='reject' and $conf['anti-flood_time']>0 ) { // anti-flood system $reference_date = time() - $conf['anti-flood_time']; @@ -316,7 +352,12 @@ SELECT id,author,date,image_id,content if (!$user['is_the_guest'] or ($user['is_the_guest'] and $conf['comments_forall'])) { - $template->assign_block_vars('comments.add_comment', array()); + $key = time(); + $key .= ':'.hash_hmac('md5', $key, $conf['secret_key']); + $template->assign_block_vars('comments.add_comment', + array( + 'key' => $key + )); // display author field if the user is not logged in if ($user['is_the_guest']) { diff --git a/install/config.sql b/install/config.sql index 53753a8d4..9c4dbc743 100644 --- a/install/config.sql +++ b/install/config.sql @@ -23,6 +23,7 @@ INSERT INTO phpwebgallery_config (param,value,comment) VALUES ('history_admin',' INSERT INTO phpwebgallery_config (param,value,comment) VALUES ('history_guest','true','keep a history of guest visits on your website'); INSERT INTO phpwebgallery_config (param,value,comment) VALUES ('login_history','true','keep a history of user logins on your website'); INSERT INTO phpwebgallery_config (param,value,comment) VALUES ('allow_user_registration','true','allow visitors to register?'); +INSERT INTO phpwebgallery_config (param,value,comment) VALUES ('secret_key', MD5(RAND()), 'a secret key specific to the gallery for internal use'); -- Notification by mail INSERT INTO phpwebgallery_config (param,value,comment) VALUES ('nbm_send_mail_as','','Send mail as param value for notification by mail'); INSERT INTO phpwebgallery_config (param,value,comment) VALUES ('nbm_send_detailed_content','true','Send detailed content for notification by mail'); diff --git a/install/db/43-database.php b/install/db/43-database.php new file mode 100644 index 000000000..1e51bb99e --- /dev/null +++ b/install/db/43-database.php @@ -0,0 +1,51 @@ +<?php +// +-----------------------------------------------------------------------+ +// | PhpWebGallery - a PHP based picture gallery | +// | Copyright (C) 2002-2003 Pierrick LE GALL - pierrick@phpwebgallery.net | +// | Copyright (C) 2003-2005 PhpWebGallery Team - http://phpwebgallery.net | +// +-----------------------------------------------------------------------+ +// | branch : BSF (Best So Far) +// | file : $Id$ +// | last update : $Date$ +// | last modifier : $Author$ +// | revision : $Revision$ +// +-----------------------------------------------------------------------+ +// | This program is free software; you can redistribute it and/or modify | +// | it under the terms of the GNU General Public License as published by | +// | the Free Software Foundation | +// | | +// | This program is distributed in the hope that it will be useful, but | +// | WITHOUT ANY WARRANTY; without even the implied warranty of | +// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | +// | General Public License for more details. | +// | | +// | You should have received a copy of the GNU General Public License | +// | along with this program; if not, write to the Free Software | +// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, | +// | USA. | +// +-----------------------------------------------------------------------+ + +if (!defined('PHPWG_ROOT_PATH')) +{ + die('Hacking attempt!'); +} + +$upgrade_description = 'Insert secret_key into #config'; + +include_once(PHPWG_ROOT_PATH.'include/constants.php'); + +// +-----------------------------------------------------------------------+ +// | Upgrade content | +// +-----------------------------------------------------------------------+ + +$query = ' +INSERT INTO '.PREFIX_TABLE."config (param,value,comment) VALUES ('secret_key', MD5(RAND()), 'a secret key specific to the gallery for internal use');"; +pwg_query($query); + +echo +"\n" +. $upgrade_description +."\n" +; + +?> diff --git a/template/yoga/picture.tpl b/template/yoga/picture.tpl index 02453e9af..f42fc83ae 100644 --- a/template/yoga/picture.tpl +++ b/template/yoga/picture.tpl @@ -190,7 +190,8 @@ <!-- BEGIN author_field --> <label>{lang:upload_author}<input type="text" name="author"></label> <!-- END author_field --> - <label>{lang:comment}<textarea name="content" rows="10" cols="80"></textarea></label> + <label>{lang:comment}<textarea name="content" rows="5" cols="80"></textarea></label> + <input type="hidden" name="key" value="{comments.add_comment.key}" /> <input type="submit" value="{lang:submit}"> </fieldset> </form> |