HumanVerification.php 8.52 KB
Newer Older
Dominik Hebeler's avatar
Dominik Hebeler committed
1
2
3
4
<?php

namespace App\Http\Controllers;

5
6
7
use Captcha;
use Carbon;
use Illuminate\Hashing\BcryptHasher as Hasher;
Dominik Hebeler's avatar
Dominik Hebeler committed
8
use Illuminate\Http\Request;
9
use Illuminate\Support\Facades\Redis;
Dominik Hebeler's avatar
Dominik Hebeler committed
10
11
12
13
use Input;

class HumanVerification extends Controller
{
14
    const PREFIX = "humanverification";
15
16
    const EXPIRELONG = 60 * 60 * 24 * 14;
    const EXPIRESHORT = 60 * 60 * 72;
17

18
19
    public static function captcha(Request $request, Hasher $hasher, $id, $url = null)
    {
20
        $redis = Redis::connection('redisCache');
21

22
23
24
25
26
        if ($url != null) {
            $url = base64_decode(str_replace("<<SLASH>>", "/", $url));
        } else {
            $url = $request->input('url');
        }
Dominik Hebeler's avatar
Dominik Hebeler committed
27

28
        if ($request->getMethod() == 'POST') {
29
            $user = $redis->hgetall(HumanVerification::PREFIX . "." . $id);
30
31
32
33
34
35
36
37
38
            $user = ['uid' => $user["uid"],
                'id' => $user["id"],
                'unusedResultPages' => intval($user["unusedResultPages"]),
                'whitelist' => filter_var($user["whitelist"], FILTER_VALIDATE_BOOLEAN),
                'locked' => filter_var($user["locked"], FILTER_VALIDATE_BOOLEAN),
                "lockedKey" => $user["lockedKey"],
            ];

            $lockedKey = $user["lockedKey"];
39
40
            $key = $request->input('captcha');
            $key = strtolower($key);
41

42
            if (!$hasher->check($key, $lockedKey)) {
43
                $captcha = Captcha::create("default", true);
44
45
46
47
                $pipeline = $redis->pipeline();
                $pipeline->hset(HumanVerification::PREFIX . "." . $id, 'lockedKey', $captcha["key"]);
                $pipeline->expire(HumanVerification::PREFIX . "." . $id, $user["whitelist"] ? HumanVerification::EXPIRELONG : HumanVerification::EXPIRESHORT);
                $pipeline->execute();
48
                return view('humanverification.captcha')->with('title', 'Bestätigung notwendig')
49
50
51
                    ->with('id', $id)
                    ->with('url', $url)
                    ->with('image', $captcha["img"])
Dominik Hebeler's avatar
Dominik Hebeler committed
52
                    ->with('errorMessage', 'Fehler: Falsche Eingabe!');
53
54
            } else {
                # If we can unlock the Account of this user we will redirect him to the result page
55
                if ($user !== null && $user["locked"]) {
Dominik Hebeler's avatar
Dominik Hebeler committed
56
                    # The Captcha was correct. We can remove the key from the user
57
58
59
60
61
62
63
                    # If the sum of all users with that ip is too high we need to whitelist the user or they will receive a captcha again on the next request
                    $sum = 0;
                    $users = [];
                    $pipeline = $redis->pipeline();
                    $pipeline->hmset(HumanVerification::PREFIX . "." . $id, ['locked' => "0", 'lockedKey' => "", 'whitelist' => '1']);
                    $pipeline->expire(HumanVerification::PREFIX . "." . $id, $user["whitelist"] ? HumanVerification::EXPIRELONG : HumanVerification::EXPIRESHORT);
                    $pipeline->execute();
Dominik Hebeler's avatar
Dominik Hebeler committed
64
                    return redirect($url);
65
                } else {
Dominik Hebeler's avatar
Dominik Hebeler committed
66
67
68
69
                    return redirect('/');
                }
            }
        }
70
        $captcha = Captcha::create("default", true);
71
72
73
74
        $pipeline = $redis->pipeline();
        $pipeline->hset(HumanVerification::PREFIX . "." . $id, 'lockedKey', $captcha["key"]);
        $pipeline->expire(HumanVerification::PREFIX . "." . $id, $user["whitelist"] ? HumanVerification::EXPIRELONG : HumanVerification::EXPIRESHORT);
        $pipeline->execute();
75
        return view('humanverification.captcha')->with('title', 'Bestätigung notwendig')
76
77
78
            ->with('id', $id)
            ->with('url', $url)
            ->with('image', $captcha["img"]);
Dominik Hebeler's avatar
Dominik Hebeler committed
79

Dominik Hebeler's avatar
Dominik Hebeler committed
80
81
    }

82
83
84
    public static function remove(Request $request)
    {
        if (!$request->has('mm')) {
Dominik Hebeler's avatar
Dominik Hebeler committed
85
86
            abort(404, "Keine Katze gefunden.");
        }
87

88
        if (HumanVerification::checkId($request, $request->input('mm'))) {
89
            HumanVerification::removeUser($request, $request->input('mm'));
Dominik Hebeler's avatar
Dominik Hebeler committed
90
91
92
93
94
        }
        return response(hex2bin('89504e470d0a1a0a0000000d494844520000000100000001010300000025db56ca00000003504c5445000000a77a3dda0000000174524e530040e6d8660000000a4944415408d76360000000020001e221bc330000000049454e44ae426082'), 200)
            ->header('Content-Type', 'image/png');
    }

95
96
97
    public static function removeGet(Request $request, $mm, $password, $url)
    {
        $url = base64_decode(str_replace("<<SLASH>>", "/", $url));
Dominik Hebeler's avatar
Dominik Hebeler committed
98
99
100

        # If the user is correct and the password is we will delete any entry in the database
        $requiredPass = md5($mm . Carbon::NOW()->day . $url . env("PROXY_PASSWORD"));
101
        if (HumanVerification::checkId($request, $mm) && $requiredPass === $password) {
102
            HumanVerification::removeUser($request, $mm);
Dominik Hebeler's avatar
Dominik Hebeler committed
103
104
105
106
        }
        return redirect($url);
    }

107
108
    private static function removeUser($request, $uid)
    {
Dominik Hebeler's avatar
Dominik Hebeler committed
109
        $redis = Redis::connection('redisCache');
Dominik Hebeler's avatar
Dominik Hebeler committed
110
111
        $ip = $request->ip();
        $id = "";
Dominik Hebeler's avatar
Bugfix    
Dominik Hebeler committed
112
        if (HumanVerification::couldBeSpammer($ip)) {
Dominik Hebeler's avatar
Dominik Hebeler committed
113
114
115
116
            $id = hash("sha512", "999.999.999.999");
        } else {
            $id = hash("sha512", $ip);
        }
117

118
119
        $userList = $redis->smembers(HumanVerification::PREFIX . "." . $id);
        $pipe = $redis->pipeline();
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
        foreach ($userList as $userid) {
            $pipe->hgetall(HumanVerification::PREFIX . "." . $userid);
        }
        $usersData = $pipe->execute();

        $user = [];
        $users = [];
        $sum = 0;
        foreach ($usersData as $userTmp) {
            if (empty($userTmp)) {
                continue;
            }
            $userNew = ['uid' => $userTmp["uid"],
                'id' => $userTmp["id"],
                'unusedResultPages' => intval($userTmp["unusedResultPages"]),
                'whitelist' => filter_var($userTmp["whitelist"], FILTER_VALIDATE_BOOLEAN),
                'locked' => filter_var($userTmp["locked"], FILTER_VALIDATE_BOOLEAN),
                "lockedKey" => $userTmp["lockedKey"],
            ];

            if ($uid === $userTmp["uid"]) {
                $user = $userNew;
            } else {
                $users[] = $userNew;
            }
            if ($userNew["whitelist"]) {
                $sum += intval($userTmp["unusedResultPages"]);
            }

        }
150

151
        if (empty($user)) {
152
153
154
            return;
        }

155
        $pipeline = $redis->pipeline();
156
        # Check if we have to whitelist the user or if we can simply delete the data
157
        if ($user["unusedResultPages"] < $sum && !$user["whitelist"]) {
158
            # Whitelist
159
160
            $pipeline->hset(HumanVerification::PREFIX . "." . $uid, 'whitelist', "1");
            $user["whitelist"] = true;
161
162
        }

163
164
        if ($user["whitelist"]) {
            $pipeline->hset(HumanVerification::PREFIX . "." . $uid, 'unusedResultPages', "0");
165
        } else {
166
            $pipeline->del(HumanVerification::PREFIX . "." . $uid);
167
            $pipeline->srem(HumanVerification::PREFIX . "." . $id, $uid);
168
        }
169
170
        $pipeline->expire(HumanVerification::PREFIX . "." . $uid, $user["whitelist"] ? HumanVerification::EXPIRELONG : HumanVerification::EXPIRESHORT);
        $pipeline->expire(HumanVerification::PREFIX . "." . $id, HumanVerification::EXPIRELONG);
171
        $pipeline->execute();
172
173
    }

174
175
    private static function checkId($request, $id)
    {
Dominik Hebeler's avatar
Dominik Hebeler committed
176
177
        $uid = "";
        $ip = $request->ip();
Dominik Hebeler's avatar
Bugfix    
Dominik Hebeler committed
178
        if (HumanVerification::couldBeSpammer($ip)) {
Dominik Hebeler's avatar
Dominik Hebeler committed
179
180
181
182
183
184
            $uid = hash("sha512", "999.999.999.999" . $ip . $_SERVER["AGENT"] . "uid");
        } else {
            $uid = hash("sha512", $ip . $_SERVER["AGENT"] . "uid");
        }

        if ($uid === $id) {
Dominik Hebeler's avatar
Dominik Hebeler committed
185
            return true;
186
        } else {
Dominik Hebeler's avatar
Dominik Hebeler committed
187
188
189
            return false;
        }
    }
Dominik Hebeler's avatar
Dominik Hebeler committed
190

Dominik Hebeler's avatar
Bugfix    
Dominik Hebeler committed
191
    public static function couldBeSpammer($ip)
Dominik Hebeler's avatar
Dominik Hebeler committed
192
    {
193
194
195
        if (!env("REMOVE_SPAM_IN_TOR")) {
            return false;
        }
Dominik Hebeler's avatar
Dominik Hebeler committed
196
197
198
199
200
201
202
203
204
205
        $serverAddress = empty($_SERVER['SERVER_ADDR']) ? "144.76.88.77" : $_SERVER['SERVER_ADDR'];
        $queryUrl = "https://tor.metager.org?password=" . urlencode(env("TOR_PASSWORD")) . "&ra=" . urlencode($ip) . "&sa=" . urlencode($serverAddress) . "&sp=443";

        $ch = curl_init($queryUrl);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_TIMEOUT, 1);
        curl_exec($ch);
        $httpcode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);

Dominik Hebeler's avatar
Bugfix    
Dominik Hebeler committed
206
        $possibleSpammer = false;
Dominik Hebeler's avatar
Dominik Hebeler committed
207
        if ($httpcode === 200) {
Dominik Hebeler's avatar
Dominik Hebeler committed
208
            return true;
Dominik Hebeler's avatar
Dominik Hebeler committed
209
        }
Dominik Hebeler's avatar
Bugfix    
Dominik Hebeler committed
210
211
212
213
214
215
216
217
218

        # Check for recent Spams
        $eingabe = \Request::input('eingabe');
        if (\preg_match("/^susimail\s+-site:[^\s]+\s-site:/si", $eingabe)) {
            return true;
        }

        return $possibleSpammer;

Dominik Hebeler's avatar
Dominik Hebeler committed
219
    }
Dominik Hebeler's avatar
Dominik Hebeler committed
220
}