3 * Experimental captcha plugin framework.
4 * Not intended as a real production captcha system; derived classes
5 * can extend the base to produce their fancy images in place of the
6 * text-based test output here.
8 * Copyright (C) 2005, 2006 Brion Vibber <brion@pobox.com>
9 * http://www.mediawiki.org/
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License along
22 * with this program; if not, write to the Free Software Foundation, Inc.,
23 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
24 * http://www.gnu.org/copyleft/gpl.html
27 * @subpackage Extensions
30 if ( defined( 'MEDIAWIKI' ) ) {
32 global $wgExtensionFunctions, $wgGroupPermissions;
34 $wgExtensionFunctions[] = 'ceSetup';
37 * The 'skipcaptcha' permission key can be given out to
38 * let known-good users perform triggering actions without
39 * having to go through the captcha.
41 * By default, sysops and registered bot accounts will be
42 * able to skip, while others have to go through it.
44 $wgGroupPermissions['*' ]['skipcaptcha'] = false;
45 $wgGroupPermissions['user' ]['skipcaptcha'] = false;
46 $wgGroupPermissions['autoconfirmed']['skipcaptcha'] = false;
47 $wgGroupPermissions['bot' ]['skipcaptcha'] = true; // registered bots
48 $wgGroupPermissions['sysop' ]['skipcaptcha'] = true;
50 global $wgCaptcha, $wgCaptchaClass, $wgCaptchaTriggers;
52 $wgCaptchaClass = 'SimpleCaptcha';
55 * Currently the captcha works only for page edits.
57 * If the 'edit' trigger is on, *every* edit will trigger the captcha.
58 * This may be useful for protecting against vandalbot attacks.
60 * If using the default 'addurl' trigger, the captcha will trigger on
61 * edits that include URLs that aren't in the current version of the page.
62 * This should catch automated linkspammers without annoying people when
63 * they make more typical edits.
65 $wgCaptchaTriggers = array();
66 $wgCaptchaTriggers['edit'] = false; // Would check on every edit
67 $wgCaptchaTriggers['addurl'] = true; // Check on edits that add URLs
68 $wgCaptchaTriggers['createaccount'] = true; // Special:Userlogin&type=signup
72 * Allow users who have confirmed their e-mail addresses to post
73 * URL links without being harassed by the captcha.
75 global $ceAllowConfirmedEmail;
76 $ceAllowConfirmedEmail = false;
79 * Regex to whitelist URLs to known-good sites...
81 * $wgCaptchaWhitelist = '#^https?://([a-z0-9-]+\\.)?(wikimedia|wikipedia)\.org/#i';
82 * @fixme Use the 'spam-whitelist' thingy instead?
84 $wgCaptchaWhitelist = false;
87 * Additional regexes to check for. Use full regexes; can match things
88 * other than URLs such as junk edits.
90 * If the new version matches one and the old version doesn't,
91 * toss up the captcha screen.
93 * @fixme Add a message for local admins to add items as well.
95 $wgCaptchaRegexes = array();
97 /** Register special page */
98 global $wgSpecialPages;
99 $wgSpecialPages['Captcha'] = array( /*class*/ 'SpecialPage', /*name*/'Captcha', false,
100 /*listed*/ false, /*function*/ false, /*file*/ false );
103 * Set up message strings for captcha utilities.
106 global $wgMessageCache, $wgHooks, $wgCaptcha, $wgCaptchaClass, $wgSpecialPages;
107 $wgMessageCache->addMessages( array(
109 "Your edit includes new URL links; as a protection against automated " .
110 "spam, you'll need to type in the words that appear in this image:\n" .
111 "<br />([[Special:Captcha/help|What is this?]])",
112 'captchahelp-title' =>
114 'captchahelp-text' =>
115 "Web sites that accept postings from the public, like this wiki, " .
116 "are often abused by spammers who use automated tools to post their " .
117 "links to many sites. While these spam links can be removed, they " .
118 "are a significant nuisance." .
120 "Sometimes, especially when adding new web links to a page, " .
121 "the wiki may show you an image of colored or distorted text and " .
122 "ask you to type the words shown. Since this is a task that's hard " .
123 "to automate, it will allow most real humans to make their posts " .
124 "while stopping most spammers and other robotic attackers." .
126 "Unfortunately this may inconvenience users with limited vision or " .
127 "using text-based or speech-based browsers. At the moment we do not " .
128 "have an audio alternative available. Please contact the site " .
129 "administrators for assistance if this is unexpectedly preventing " .
130 "you from making legitimate posts." .
132 "Hit the 'back' button in your browser to return to the page editor.",
133 'captcha-createaccount' =>
134 "As a protection against automated spam, you'll need to type in the " .
135 "words that appear in this image to register an account:\n" .
136 "<br />([[Special:Captcha/help|What is this?]])",
137 'captcha-createaccount-fail' =>
138 "Incorrect or missing confirmation code." ) );
140 $wgCaptcha = new $wgCaptchaClass();
141 $wgHooks['EditFilter'][] = array( &$wgCaptcha, 'confirmEdit' );
143 $wgHooks['UserCreateForm'][] = array( &$wgCaptcha, 'injectUserCreate' );
144 $wgHooks['AbortNewAccount'][] = array( &$wgCaptcha, 'confirmUserCreate' );
148 * Entry point for Special:Captcha
150 function wfSpecialCaptcha( $par = null ) {
154 return $wgCaptcha->showImage();
157 return $wgCaptcha->showHelp();
161 class SimpleCaptcha {
163 * Insert a captcha prompt into the edit form.
164 * This sample implementation generates a simple arithmetic operation;
165 * it would be easy to defeat by machine.
169 * @return string HTML
172 $a = mt_rand(0, 100);
174 $op = mt_rand(0, 1) ? '+' : '-';
177 $answer = ($op == '+') ? ($a + $b) : ($a - $b);
179 $index = $this->storeCaptcha( array( 'answer' => $answer ) );
181 return "<p><label for=\"wpCaptchaWord\">$test</label> = " .
182 wfElement( 'input', array(
183 'name' => 'wpCaptchaWord',
184 'id' => 'wpCaptchaWord',
185 'tabindex' => 1 ) ) . // tab in before the edit textarea
187 wfElement( 'input', array(
189 'name' => 'wpCaptchaId',
190 'id' => 'wpCaptchaId',
191 'value' => $index ) );
195 * Insert the captcha prompt into an edit form.
196 * @param OutputPage $out
198 function editCallback( &$out ) {
199 $out->addWikiText( wfMsg( "captcha-short" ) );
200 $out->addHTML( $this->getForm() );
205 * @fixme if multiple thingies insert a header, could break
206 * @param SimpleTemplate $template
207 * @return bool true to keep running callbacks
209 function injectUserCreate( &$template ) {
210 global $wgCaptchaTriggers, $wgOut;
211 if( $wgCaptchaTriggers['createaccount'] ) {
212 $template->set( 'header',
213 "<div class='captcha'>" .
214 $wgOut->parse( wfMsg( 'captcha-createaccount' ) ) .
222 * Check if the submitted form matches the captcha session data provided
223 * by the plugin when the form was generated.
227 * @param WebRequest $request
231 function keyMatch( $request, $info ) {
232 return $request->getVal( 'wpCaptchaWord' ) == $info['answer'];
235 // ----------------------------------
238 * @param EditPage $editPage
239 * @param string $newtext
240 * @param string $section
241 * @return bool true if the captcha should run
243 function shouldCheck( &$editPage, $newtext, $section ) {
247 if( $wgUser->isAllowed( 'skipcaptcha' ) ) {
248 wfDebug( "ConfirmEdit: user group allows skipping captcha\n" );
252 global $wgEmailAuthentication, $ceAllowConfirmedEmail;
253 if( $wgEmailAuthentication && $ceAllowConfirmedEmail &&
254 $wgUser->isEmailConfirmed() ) {
255 wfDebug( "ConfirmEdit: user has confirmed mail, skipping captcha\n" );
259 global $wgCaptchaTriggers;
260 if( !empty( $wgCaptchaTriggers['edit'] ) ) {
261 // Check on all edits
262 global $wgUser, $wgTitle;
263 $this->trigger = sprintf( "edit trigger by '%s' at [[%s]]",
265 $wgTitle->getPrefixedText() );
266 wfDebug( "ConfirmEdit: checking all edits...\n" );
270 if( !empty( $wgCaptchaTriggers['addurl'] ) ) {
271 // Only check edits that add URLs
272 $oldtext = $this->loadText( $editPage, $section );
274 $oldLinks = $this->findLinks( $oldtext );
275 $newLinks = $this->findLinks( $newtext );
276 $unknownLinks = array_filter( $newLinks, array( &$this, 'filterLink' ) );
278 $addedLinks = array_diff( $unknownLinks, $oldLinks );
279 $numLinks = count( $addedLinks );
281 if( $numLinks > 0 ) {
282 global $wgUser, $wgTitle;
283 $this->trigger = sprintf( "%dx url trigger by '%s' at [[%s]]: %s",
286 $wgTitle->getPrefixedText(),
287 implode( ", ", $addedLinks ) );
292 global $wgCaptchaRegexes;
293 if( !empty( $wgCaptchaRegexes ) ) {
294 // Custom regex checks
295 $oldtext = $this->loadText( $editPage, $section );
297 foreach( $wgCaptchaRegexes as $regex ) {
298 $newMatches = array();
299 if( preg_match_all( $regex, $newtext, $newMatches ) ) {
300 $oldMatches = array();
301 preg_match_all( $regex, $oldtext, $oldMatches );
303 $addedMatches = array_diff( $newMatches[0], $oldMatches[0] );
305 $numHits = count( $addedMatches );
307 global $wgUser, $wgTitle;
308 $this->trigger = sprintf( "%dx %s at [[%s]]: %s",
312 $wgTitle->getPrefixedText(),
313 implode( ", ", $addedMatches ) );
324 * Filter callback function for URL whitelisting
325 * @return bool true if unknown, false if whitelisted
328 function filterLink( $url ) {
329 global $wgCaptchaWhitelist;
330 return !( $wgCaptchaWhitelist && preg_match( $wgCaptchaWhitelist, $url ) );
334 * The main callback run on edit attempts.
335 * @param EditPage $editPage
336 * @param string $newtext
337 * @param string $section
338 * @param bool true to continue saving, false to abort and show a captcha form
340 function confirmEdit( &$editPage, $newtext, $section ) {
341 if( $this->shouldCheck( $editPage, $newtext, $section ) ) {
342 if( $this->passCaptcha() ) {
345 $editPage->showEditForm( array( &$this, 'editCallback' ) );
349 wfDebug( "ConfirmEdit: no new links.\n" );
355 * Hook for user creation form submissions.
357 * @param string $message
358 * @return bool true to continue, false to abort user creation
360 function confirmUserCreate( $u, &$message ) {
361 global $wgCaptchaTriggers;
362 if( $wgCaptchaTriggers['createaccount'] ) {
363 $this->trigger = "new account '" . $u->getName() . "'";
364 if( !$this->passCaptcha() ) {
365 $message = wfMsg( 'captcha-createaccount-fail' );
373 * Given a required captcha run, test form input for correct
374 * input on the open session.
375 * @return bool if passed, false if failed or new session
377 function passCaptcha() {
378 $info = $this->retrieveCaptcha();
381 if( $this->keyMatch( $wgRequest, $info ) ) {
382 $this->log( "passed" );
383 $this->clearCaptcha( $info );
386 $this->clearCaptcha( $info );
387 $this->log( "bad form input" );
391 $this->log( "new captcha session" );
397 * Log the status and any triggering info for debugging or statistics
398 * @param string $message
400 function log( $message ) {
401 wfDebugLog( 'captcha', 'ConfirmEdit: ' . $message . '; ' . $this->trigger );
405 * Generate a captcha session ID and save the info in PHP's session storage.
406 * (Requires the user to have cookies enabled to get through the captcha.)
408 * A random ID is used so legit users can make edits in multiple tabs or
409 * windows without being unnecessarily hobbled by a serial order requirement.
410 * Pass the returned id value into the edit form as wpCaptchaId.
412 * @param array $info data to store
413 * @return string captcha ID key
415 function storeCaptcha( $info ) {
416 if( !isset( $info['index'] ) ) {
417 // Assign random index if we're not udpating
418 $info['index'] = strval( mt_rand() );
420 $_SESSION['captcha' . $info['index']] = $info;
421 return $info['index'];
425 * Fetch this session's captcha info.
426 * @return mixed array of info, or false if missing
428 function retrieveCaptcha() {
430 $index = $wgRequest->getVal( 'wpCaptchaId' );
431 if( isset( $_SESSION['captcha' . $index] ) ) {
432 return $_SESSION['captcha' . $index];
439 * Clear out existing captcha info from the session, to ensure
440 * it can't be reused.
442 function clearCaptcha( $info ) {
443 unset( $_SESSION['captcha' . $info['index']] );
447 * Retrieve the current version of the page or section being edited...
448 * @param EditPage $editPage
449 * @param string $section
453 function loadText( $editPage, $section ) {
454 $rev = Revision::newFromTitle( $editPage->mTitle );
455 if( is_null( $rev ) ) {
458 $text = $rev->getText();
459 if( $section != '' ) {
460 return Article::getSection( $text, $section );
468 * Extract a list of all recognized HTTP links in the text.
469 * @param string $text
470 * @return array of strings
472 function findLinks( $text ) {
473 $regex = '/((?:' . HTTP_PROTOCOLS . ')' . EXT_LINK_URL_CLASS . '+)/';
475 if( preg_match_all( $regex, $text, $matches, PREG_PATTERN_ORDER ) ) {
483 * Show a page explaining what this wacky thing is.
485 function showHelp() {
486 global $wgOut, $ceAllowConfirmedEmail;
487 $wgOut->setPageTitle( wfMsg( 'captchahelp-title' ) );
488 $wgOut->addWikiText( wfMsg( 'captchahelp-text' ) );
493 } # End invocation guard