Skip to content

GitLab

Commit 45a4db0e authored by Dominik Hebeler's avatar Dominik Hebeler
Browse files

Merge branch 'development' into 1142-include-key-for-paypal-donations

parents 1398d1d9 dfa2d931
Hide whitespace changes
Inline Side-by-side
app/Http/Controllers/HumanVerification.php
View file @ 45a4db0e
...@@ -16,6 +16,7 @@ class HumanVerification extends Controller ...@@ -16,6 +16,7 @@ class HumanVerification extends Controller
const PREFIX = "humanverification"; const PREFIX = "humanverification";
const EXPIRELONG = 60 * 60 * 24 * 14; const EXPIRELONG = 60 * 60 * 24 * 14;
const EXPIRESHORT = 60 * 60 * 72; const EXPIRESHORT = 60 * 60 * 72;
const TOKEN_PREFIX = "humanverificationtoken.";
public static function captcha(Request $request, Hasher $hasher, $id, $uid, $url = null) public static function captcha(Request $request, Hasher $hasher, $id, $uid, $url = null)
{ {
...@@ -46,30 +47,49 @@ class HumanVerification extends Controller ...@@ -46,30 +47,49 @@ class HumanVerification extends Controller
if ($request->getMethod() == 'POST') { if ($request->getMethod() == 'POST') {
\App\PrometheusExporter::CaptchaAnswered(); \App\PrometheusExporter::CaptchaAnswered();
$lockedKey = $user["lockedKey"]; $lockedKey = $request->input("c", "");
$rules = ['captcha' => 'required|captcha_api:' . $lockedKey . ',math']; $rules = ['captcha' => 'required|captcha_api:' . $lockedKey . ',math'];
$validator = validator()->make(request()->all(), $rules); $validator = validator()->make(request()->all(), $rules);
if($validator->fails()) { if (empty($lockedKey) || $validator->fails()) {
$captcha = Captcha::create("default", true); $captcha = Captcha::create("default", true);
$user["lockedKey"] = $captcha["key"];
HumanVerification::saveUser($user);
\App\PrometheusExporter::CaptchaShown(); \App\PrometheusExporter::CaptchaShown();
return view('humanverification.captcha')->with('title', 'Bestätigung notwendig') return view('humanverification.captcha')->with('title', 'Bestätigung notwendig')
->with('uid', $user["uid"]) ->with('uid', $user["uid"])
->with('id', $id) ->with('id', $id)
->with('url', $url) ->with('url', $url)
->with('correct', $captcha["key"])
->with('image', $captcha["img"]) ->with('image', $captcha["img"])
->with('errorMessage', 'Fehler: Falsche Eingabe!'); ->with('errorMessage', 'Fehler: Falsche Eingabe!');
} else { } else {
\App\PrometheusExporter::CaptchaCorrect(); \App\PrometheusExporter::CaptchaCorrect();
# Generate a token that makes the user skip Humanverification
# There are some special cases where a user that entered a correct Captcha
# might see a captcha again on his next request
$token = md5(microtime(true));
Cache::put(self::TOKEN_PREFIX . $token, 5, 3600);
$url_parts = parse_url($url);
// If URL doesn't have a query string.
if (isset($url_parts['query'])) { // Avoid 'Undefined index: query'
parse_str($url_parts['query'], $params);
} else {
$params = array();
}
$params['token'] = $token; // Overwrite if exists
// Note that this will url_encode all values
$url_parts['query'] = http_build_query($params);
// If not
$url = $url_parts['scheme'] . '://' . $url_parts['host'] . (!empty($url_parts["port"]) ? ":" . $url_parts["port"] : "") . $url_parts['path'] . '?' . $url_parts['query'];
# If we can unlock the Account of this user we will redirect him to the result page # If we can unlock the Account of this user we will redirect him to the result page
if ($user !== null && $user["locked"]) { if ($user !== null && $user["locked"]) {
# The Captcha was correct. We can remove the key from the user # The Captcha was correct. We can remove the key from the user
# Additionally we will whitelist him so he is not counted towards botnetwork # Additionally we will whitelist him so he is not counted towards botnetwork
$user["locked"] = false; $user["locked"] = false;
$user["lockedKey"] = "";
$user["whitelist"] = true; $user["whitelist"] = true;
HumanVerification::saveUser($user); HumanVerification::saveUser($user);
return redirect($url); return redirect($url);
...@@ -80,39 +100,37 @@ class HumanVerification extends Controller ...@@ -80,39 +100,37 @@ class HumanVerification extends Controller
} }
$captcha = Captcha::create("default", true); $captcha = Captcha::create("default", true);
$user["lockedKey"] = $captcha["key"];
HumanVerification::saveUser($user);
\App\PrometheusExporter::CaptchaShown(); \App\PrometheusExporter::CaptchaShown();
return view('humanverification.captcha')->with('title', 'Bestätigung notwendig') return view('humanverification.captcha')->with('title', 'Bestätigung notwendig')
->with('uid', $user["uid"]) ->with('uid', $user["uid"])
->with('id', $id) ->with('id', $id)
->with('url', $url) ->with('url', $url)
->with('correct', $captcha["key"])
->with('image', $captcha["img"]); ->with('image', $captcha["img"]);
} }
public static function logCaptcha(Request $request){ public static function logCaptcha(Request $request)
{
$fail2banEnabled = config("metager.metager.fail2ban.enabled"); $fail2banEnabled = config("metager.metager.fail2ban.enabled");
if(empty($fail2banEnabled) || !$fail2banEnabled || !config("metager.metager.fail2ban.url") || !config("metager.metager.fail2ban.user") || !config("metager.metager.fail2ban.password")){ if (empty($fail2banEnabled) || !$fail2banEnabled || !config("metager.metager.fail2ban.url") || !config("metager.metager.fail2ban.user") || !config("metager.metager.fail2ban.password")) {
return; return;
} }
// Submit fetch job to worker // Submit fetch job to worker
$mission = [ $mission = [
"resulthash" => "captcha", "resulthash" => "captcha",
"url" => config("metager.metager.fail2ban.url") . "/captcha/", "url" => config("metager.metager.fail2ban.url") . "/captcha/",
"useragent" => "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:81.0) Gecko/20100101 Firefox/81.0", "useragent" => "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:81.0) Gecko/20100101 Firefox/81.0",
"username" => config("metager.metager.fail2ban.user"), "username" => config("metager.metager.fail2ban.user"),
"password" => config("metager.metager.fail2ban.password"), "password" => config("metager.metager.fail2ban.password"),
"headers" => [ "headers" => [
"ip" => $request->ip() "ip" => $request->ip()
], ],
"cacheDuration" => 0, "cacheDuration" => 0,
"name" => "Captcha", "name" => "Captcha",
]; ];
$mission = json_encode($mission); $mission = json_encode($mission);
Redis::rpush(\App\MetaGer::FETCHQUEUE_KEY, $mission); Redis::rpush(\App\MetaGer::FETCHQUEUE_KEY, $mission);
} }
public static function remove(Request $request) public static function remove(Request $request)
...@@ -237,13 +255,13 @@ class HumanVerification extends Controller ...@@ -237,13 +255,13 @@ class HumanVerification extends Controller
# Check for recent Spams # Check for recent Spams
$eingabe = \Request::input('eingabe'); $eingabe = \Request::input('eingabe');
$spams = Redis::lrange("spam", 0, -1); $spams = Redis::lrange("spam", 0, -1);
foreach ($spams as $spam) { foreach ($spams as $index => $spam) {
if (\preg_match($spam, $eingabe)) { if (\preg_match($spam, $eingabe)) {
return true; return "999.999.999.999" . $index;
} }
} }
return false; return null;
} }
public function botOverview(Request $request) public function botOverview(Request $request)
......
app/Http/Controllers/MailController.php
View file @ 45a4db0e
...@@ -136,6 +136,16 @@ class MailController extends Controller ...@@ -136,6 +136,16 @@ class MailController extends Controller
public function donation(Request $request) public function donation(Request $request)
{ {
# Wir benötigen 3 Felder von dem Benutzer wenn diese nicht übermittelt wurden, oder nicht korrekt sind geben wir einen Error zurück
$input_data = $request->all();
$validator = Validator::make(
$input_data,
[
'pcsrf' => ['required', 'string', new \App\Rules\PCSRF],
]
);
$firstname = ""; $firstname = "";
$lastname = ""; $lastname = "";
$company = ""; $company = "";
...@@ -198,7 +208,11 @@ class MailController extends Controller ...@@ -198,7 +208,11 @@ class MailController extends Controller
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) { if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
$email = ""; $email = "";
} }
if (($private && (empty($firstname) || empty($lastname))) || (!$private && empty($company))) {
if ($validator->fails()) {
$messageToUser = trans('spende.error.robot');
$messageType = "error";
} elseif (($private && (empty($firstname) || empty($lastname))) || (!$private && empty($company))) {
$messageToUser = trans('spende.error.name'); $messageToUser = trans('spende.error.name');
$messageType = "error"; $messageType = "error";
} elseif (!$iban->Verify()) { } elseif (!$iban->Verify()) {
......
app/Http/Middleware/HumanVerification.php
View file @ 45a4db0e
...@@ -23,6 +23,27 @@ class HumanVerification ...@@ -23,6 +23,27 @@ class HumanVerification
return $next($request); return $next($request);
} }
// Check for a valid Skip Token
if ($request->filled("token")) {
$prefix = \App\Http\Controllers\HumanVerification::TOKEN_PREFIX;
$token = $prefix . $request->input("token");
if (Cache::has($token)) {
$value = Cache::get($token);
if (!empty($value) && intval($value) > 0) {
Cache::decrement($token);
return $next($request);
} else {
// Token is not valid. Remove it
Cache::forget($token);
return redirect()->to(url()->current() . '?' . http_build_query($request->except(["token", "headerPrinted", "jskey"])));
}
} else {
return redirect()->to(url()->current() . '?' . http_build_query($request->except(["token", "headerPrinted", "jskey"])));
}
}
// The specific user // The specific user
$user = null; $user = null;
$update = true; $update = true;
...@@ -31,9 +52,11 @@ class HumanVerification ...@@ -31,9 +52,11 @@ class HumanVerification
$ip = $request->ip(); $ip = $request->ip();
$id = ""; $id = "";
$uid = ""; $uid = "";
if (\App\Http\Controllers\HumanVerification::couldBeSpammer($ip)) {
$id = hash("sha1", "999.999.999.999"); $spamID = \App\Http\Controllers\HumanVerification::couldBeSpammer($ip);
$uid = hash("sha1", "999.999.999.999uid"); if (!empty($spamID)) {
$id = hash("sha1", $spamID);
$uid = hash("sha1", $spamID . $ip . $_SERVER["AGENT"] . "uid");
} else { } else {
$id = hash("sha1", $ip); $id = hash("sha1", $ip);
$uid = hash("sha1", $ip . $_SERVER["AGENT"] . "uid"); $uid = hash("sha1", $ip . $_SERVER["AGENT"] . "uid");
...@@ -96,7 +119,6 @@ class HumanVerification ...@@ -96,7 +119,6 @@ class HumanVerification
if (preg_match("/http[s]{0,1}:\/\/metager\.de\/meta\/meta.ger3\?.*?eingabe=([\w\d]+\.){1,2}[\w\d]+/si", $referer) === 1) { if (preg_match("/http[s]{0,1}:\/\/metager\.de\/meta\/meta.ger3\?.*?eingabe=([\w\d]+\.){1,2}[\w\d]+/si", $referer) === 1) {
$refererLock = true; $refererLock = true;
} }
} }
if ((!$alone && $sum >= 50 && !$user["whitelist"]) || $refererLock) { if ((!$alone && $sum >= 50 && !$user["whitelist"]) || $refererLock) {
...@@ -143,7 +165,6 @@ class HumanVerification ...@@ -143,7 +165,6 @@ class HumanVerification
$request->request->add(['verification_id' => $user["uid"], 'verification_count' => $user["unusedResultPages"]]); $request->request->add(['verification_id' => $user["uid"], 'verification_count' => $user["unusedResultPages"]]);
return $next($request); return $next($request);
} }
public function setUser($prefix, $user) public function setUser($prefix, $user)
......
app/MetaGer.php
View file @ 45a4db0e
...@@ -1094,6 +1094,19 @@ class MetaGer ...@@ -1094,6 +1094,19 @@ class MetaGer
$from = $tmp; $from = $tmp;
$changed = true; $changed = true;
} }
# Bing only allows a maximum of 1 year in the past
# Verify the parameters
$yearAgo = Carbon::now()->subYear();
if ($from < $yearAgo) {
$from = clone $yearAgo;
$changed = true;
}
if ($to < $yearAgo) {
$to = clone $yearAgo;
$changed = true;
}
if ($changed) { if ($changed) {
$oldParameters = $this->request->all(); $oldParameters = $this->request->all();
$oldParameters["ff"] = $from->format("Y-m-d"); $oldParameters["ff"] = $from->format("Y-m-d");
......
index.html deleted 100644 → 0
View file @ 1398d1d9
<!DOCTYPE html>
<html lang="de">
<head>
<meta charset="utf-8" />
<title>MetaGer - Mehr als eine Suchmaschine</title>
<meta name="description"
content="Sicher suchen und finden unter Wahrung der Privatsphäre. Das digitale Wissen der Welt muss ohne Bevormundung durch Staaten oder Konzerne frei zugänglich sein und bleiben." />
<meta name="keywords"
content="Internetsuche, privatsphäre, privacy, Suchmaschine, Datenschutz, Anonproxy, anonym suchen, Bildersuche, Suchmaschine, anonym, MetaGer, metager, metager.de" />
<meta name="page-topic" content="Dienstleistung" />
<meta name="robots" content="index,follow" />
<meta name="revisit-after" content="7 days" />
<meta name="audience" content="all" />
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" />
<link href="/favicon.ico" rel="icon" type="image/x-icon" />
<link href="/favicon.ico" rel="shortcut icon" type="image/x-icon" />
<link rel="search" type="application/opensearchdescription+xml"
title="MetaGer: Sicher suchen &amp; finden" href="https://metager.de/plugins/opensearch.xml">
<link type="text/css" rel="stylesheet" href="/css/bootstrap.css?id=b803963ec1e03b9de08e" />
<link type="text/css" rel="stylesheet" href="/css/themes/metager.css?id=35b998573f409cb5260f" />
<link type="text/css" rel="stylesheet" href="/css/utility.css?id=119a7732fcac8ee992c0" />
<link href="/fonts/liberationsans/stylesheet.css" rel="stylesheet">
<link type="text/css" rel="stylesheet" href="/css/fontawesome.css?id=b9dfacd52a93d4406a21" />
<link type="text/css" rel="stylesheet" href="/css/fontawesome-solid.css?id=ef93547e15423c41f724" />
<script src="/js/lib.js?id=8794dbf6d3b10d784319"></script>
<script src="/js/utility.js?id=7fab2dc6a328a13d19a0"></script>
</head>
<body>
<header>
</header>
<div class="wrapper startpage">
<main id="main-content">
<h1 id="startpage-logo">
<a href="https://metager.de/">
<img src="/img/metager.svg" alt="MetaGer" />
</a>
</h1>
<fieldset>
<form id="searchForm" method=GET action="https://metager.de/meta/meta.ger3 " accept-charset="UTF-8">
<div class="searchbar startpage-searchbar">
<div class="search-input-submit">
<div id="search-key">
<a id="key-link" class="unauthorized"
href="https://metager.de/meta/key?redirUrl=https%3A%2F%2Fmetager.de"
data-tooltip="Schlüssel für werbefreie Suche eingeben" tabindex="0">
<i class="fa fa-key" aria-hidden="true"></i>
</a>
</div>
<div class="search-input">
<input type="search" name="eingabe" value="" required="" autofocus autocomplete="off"
class="form-control" placeholder="MetaGer: Sicher suchen &amp; finden"
tabindex="0">
<button id="search-delete-btn" name="delete-search-input" type="button" tabindex="-1">
&#xd7;
</button>
</div>
<div class="search-submit" id="submit-inputgroup">
<button type="submit" tabindex="-1" name="submit-query" title="MetaGer-Suche"
aria-label="MetaGer-Suche">
<i class="fa fa-search" aria-hidden="true"></i>
</button>
</div>
</div>
<div class="search-hidden">
<input type="hidden" name="focus" value=web>
</div>
<div class="search-custom-hidden"></div>
</div>
</form>
</fieldset>
<div id="plugin-btn-div">
<a id="plugin-btn" href="https://metager.de/plugin" title="MetaGer zu Ihrem Browser hinzufügen"><i
class="fa fa-plug" aria-hidden="true"></i> MetaGer-Plugin hinzufügen</a>
</div>
<div id="about-us">
<div class="m-row">
<a href="https://metager.de/about">
<img alt="lock" src="/img/metager-schloss.svg">
<span>Garantierte Privatsphäre</span>
<div class="teaser">Mit uns behalten Sie die volle Kontrolle über Ihre Daten. Wir speichern nicht und der
Quellcode ist frei.</div>
</a>
<a href="https://suma-ev.de" target="_blank">
<img alt="rainbow" src="/img/rainbow.svg">
<span>Vielfältig & Frei</span>
<div class="teaser">MetaGer schützt gegen Zensur, indem es Ergebnisse vieler Suchmaschinen kombiniert.</div>
</a>
</div>
<div class="m-row">
<a href="https://www.hetzner.de/unternehmen/umweltschutz/" target="_blank">
<i class="fas fa-leaf" id="green-leaf"></i>
<span>100% Ökostrom</span>
<div class="teaser">Alle unsere Dienste sind mit Strom aus regenerativen Energiequellen betrieben.
Nachhaltig und sauber.</div>
</a>
<a href="https://metager.de/spende">
<i class="fas fa-heart" id="gradient"></i>
<span>Gemeinnütziger Verein</span>
<div class="teaser">Unterstützen Sie MetaGer, indem Sie spenden oder Mitglied im gemeinnützigen Trägerverein
werden.</div>
</a>
</div>
</div>
<a id="scroll-helper" href="#about-us">
<i class="fas fa-angle-double-down"></i>
</a>
</main>
</div>
<input id="sidebarToggle" class="hidden" type="checkbox">
<div class="sidebar">
<a class="sidebar-logo" href="https://metager.de/">
<span>
<img src="/img/metager.svg" alt="MetaGer"></img>
</span>
</a>
<ul class="sidebar-list">
<li>
<a href="https://metager.de/" id="navigationSuche">
<i class="fa fa-search" aria-hidden="true"></i>
<span>Suche</span>
</a>
</li>
<hr>
<li>
<a href="https://metager.de/datenschutz" id="navigationPrivacy">
<i class="fa fa-user-secret" aria-hidden="true"></i>
<span>Datenschutz</span>
</a>
</li>
<li>
<a href="https://metager.de/hilfe">
<i class="fa fa-info" aria-hidden="true"></i>
<span>Hilfe</span>
</a>
</li>
<hr>
<li>
<a href="https://metager.de/spende">
<i class="fa fa-donate" aria-hidden="true"></i>
<span>Spenden</span>
</a>
</li>
<li>
<a href="https://metager.de/beitritt">
<i class="fa fa-users" aria-hidden="true"></i>
<span>Mitglied werden</span>
</a>
</li>
<hr>
<li>
<a href="https://metager.de/app">
<i class="fa fa-mobile-alt" aria-hidden="true"></i>
<span>MetaGer App</span>
</a>
</li>
<li>
<a class="inlink" href="https://maps.metager.de" target="_blank">
<i class="fa fa-map" aria-hidden="true"></i>
<span>Maps.MetaGer.de</span>
</a>
</li>
<hr>
<li class="metager-dropdown">
<input id="contactToggle" class="sidebarCheckbox" type="checkbox">
<label for="contactToggle" class="metager-dropdown-toggle navigation-element" aria-haspopup="true"
id="navigationKontakt" tabindex=0>
<i class="fa fa-comments" aria-hidden="true"></i>
<span>Kontakt</span>
<span class="caret"></span>
</label>
<ul class="metager-dropdown-content">
<li>
<a href="https://metager.de/kontakt">Kontakt</a>
</li>
<li>
<a href="https://metager.de/team">Team</a>
</li>
<li>
<a href="https://metager.de/about">Über uns</a>
</li>
<li>
<a href="https://metager.de/impressum">Impressum</a>
</li>
</ul>
</li>
<li class="metager-dropdown">
<input id="servicesToggle" class="sidebarCheckbox" type="checkbox">
<label for="servicesToggle" class="metager-dropdown-toggle navigation-element" aria-haspopup="true" tabindex=0>
<i class="fa fa-wrench" aria-hidden="true"></i>
<span>Dienste</span>
<span class="caret"></span>
</label>
<ul class="metager-dropdown-content">
<li>
<a href="https://metager.de/plugin">MetaGer Plugin</a>
</li>
<li>
<a href="https://metager.de/widget">Widget</a>
</li>
<li>
<a href="https://metager.de/zitat-suche">Zitatsuche</a>
</li>
<li>
<a href="https://metager.de/asso">Assoziator</a>
</li>
<li>
<a href="https://metager.de/tips">Tips</a>
</li>
<li>
<a class="outlink" href="https://gitlab.metager.de/open-source/MetaGer">MetaGer Quellcode</a>
</li>
<li>
<a class="outlink" href="https://metager.de/tor">TOR-Hidden-Service</a>
</li>
<li>
<a class="outlink" href="https://shop.spreadshirt.de/metager/" rel="noopener"
target="_blank">MetaGer-Fanshop</a>
</li>
<li>
<a class="outlink" href="https://www.wecanhelp.de/430159004">MetaGer-Fördershops</a>
</li>
</ul>
</li>
<li class="metager-dropdown">
<input id="languagesToggle" class="sidebarCheckbox" type="checkbox">
<label for="languagesToggle" class="metager-dropdown-toggle navigation-element" aria-haspopup="true"
id="navigationSprache" tabindex=0>
<i class="fa fa-globe" aria-hidden="true"></i>
<span>Sprache (Deutsch)</span>
<span class="caret"></span>
</label>
<ul class="metager-dropdown-content">
<li>
<a rel="alternate" hreflang="de" href="https://metager.de/">Deutsch</a>
</li>
<li>
<a rel="alternate" hreflang="en" href="https://metager.de/en">English</a>
</li>
<li>
<a rel="alternate" hreflang="es" href="https://metager.de/es">Español</a>
</li>
</ul>
</li>
</ul>
</div>
<label class="sidebar-opener navigation-element fixed" for="sidebarToggle"></label>
<footer class="startPageFooter noprint">
<div>
<a href="https://metager.de/kontakt">Kontakt</a>
<a href="https://metager.de/impressum">Impressum</a>
<a href="https://metager.de/datenschutz">Datenschutz</a>
</div>
</footer>
</body>
</html>
\ No newline at end of file
resources/lang/de/spende.php
View file @ 45a4db0e
...@@ -86,4 +86,5 @@ return [ ...@@ -86,4 +86,5 @@ return [
'error.bic' => 'Die eingegebene IBAN gehört nicht zu einem Land aus dem SEPA Raum. Für einen Bankeinzug benötigen wir eine BIC von Ihnen.', 'error.bic' => 'Die eingegebene IBAN gehört nicht zu einem Land aus dem SEPA Raum. Für einen Bankeinzug benötigen wir eine BIC von Ihnen.',
'error.amount' => 'Der eingegebene Spendenbetrag ist ungültig. Bitte korrigieren Sie Ihre Eingabe und versuchen es erneut.', 'error.amount' => 'Der eingegebene Spendenbetrag ist ungültig. Bitte korrigieren Sie Ihre Eingabe und versuchen es erneut.',
'error.frequency' => 'Die eingegebene Häufigkeit für Ihre Spende ist ungültig.', 'error.frequency' => 'Die eingegebene Häufigkeit für Ihre Spende ist ungültig.',
'error.robot' => 'Die Eingabe war nicht korrekt',
]; ];
resources/less/metager/general/cards.less
View file @ 45a4db0e
...@@ -16,4 +16,8 @@ ...@@ -16,4 +16,8 @@
@media(min-width: @screen-small) { @media(min-width: @screen-small) {
padding: 1rem; padding: 1rem;
} }
} }
\ No newline at end of file
.result-hoster>.card {
background-color: @background-color;
}
resources/views/humanverification/captcha.blade.php
View file @ 45a4db0e
...@@ -3,19 +3,22 @@ ...@@ -3,19 +3,22 @@
@section('title', $title ) @section('title', $title )