1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
|
<?php
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);
include($_SERVER['DOCUMENT_ROOT'] . '/common.php');
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$bansfp = '/var/www/data/ipbans.json';
$ipbans = json_decode(file_get_contents($bansfp), $assoc = true);
$sourceip = $_SERVER['REMOTE_ADDR'];
$returnCode = "success";
if(isset($ipbans[$sourceip]) and $ipbans[$sourceip]["bannedmanually"]) {
$returnCode = "banned";
header("Location: https://www.youtube.com/watch?v=dQw4w9WgXcQ");
die();
} else if($_POST["botcheck"] != "isopod" or $_POST['msg']) {
$returnCode = "botcheckfailed";
$bf = 1;
if(isset($ipbans[$sourceip])) {
$bf = $ipbans[$sourceip]["botfails"] + 1;
}
$ipbans[$sourceip] = array( "botfails" => $bf, "bannedmanually" => false );
file_put_contents($bansfp, json_encode($ipbans, JSON_PRETTY_PRINT));
} else if(!$_POST["name"]) {
$returnCode = "noname";
} else if(!$_POST["message"]) {
$returnCode = "nomessage";
} else if(
$_POST["website"] and !preg_match("/\b(?:(?:https?|ftp):\/\/|www\.)[-a-z0-9+&@#\/%?=~_|!:,.;]*[-a-z0-9+&@#\/%=~_|]/i", $_POST["website"])
or $_POST["cool"] and !preg_match("/\b(?:(?:https?|ftp):\/\/|www\.)[-a-z0-9+&@#\/%?=~_|!:,.;]*[-a-z0-9+&@#\/%=~_|]/i", $_POST["cool"])
) {
$returnCode = "invalidlink";
} else {
date_default_timezone_set("America/Edmonton");
$modstatus = $defaultmodstatus;
$bannedwords = json_decode(file_get_contents($datadir."bannedwords.json"));
$bwspotted = false;
foreach($bannedwords as $word) {
if(preg_grep($word, $_POST)) {
$modstatus = 0;
}
}
if(isset($ipbans[$sourceip]) and $ipbans[$sourceip]["botfails"] >= 5) {
$modstatus = 0;
}
if($modstatus < 1) {
$returnCode = "review";
}
$button = ""; // URL for the submitter's .well-known/button.json
if($_POST["website"]) {
$buttonjson = "";
$buttonjsonurl = 'https://'.parse_url($_POST["website"], PHP_URL_HOST).'/.well-known/button.json';
$ch = curl_init($buttonjsonurl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, 0);
$buttonjson = curl_exec($ch);
if(curl_error($ch)) {
//echo curl_error($ch);
$buttonjson = "";
}
curl_close($ch);
if($buttonjson) {
$buttonobj = json_decode($buttonjson);
if($buttonobj->default) {
foreach ($buttonobj->buttons as $btn) {
if($btn->id === $buttonobj->default) {
$button = $btn->uri;
break;
}
}
} else {
$button = $buttonobj->buttons[0]->uri;
}
}
}
$currentPost = array(
"entry" => $_POST["entry"],
"sourceip" => $sourceip,
"date" => time(),
"name" => $_POST["name"],
"message" => $_POST["message"],
"found" => $_POST["found"],
"website" => $_POST["website"],
"button" => $button,
"cool" => $_POST["cool"],
"reply" => "",
"modstatus" => $modstatus
);
$filename = $datadir."posts.json";
$extantPosts = json_decode(file_get_contents($filename));
array_push($extantPosts, $currentPost);
file_put_contents($filename, json_encode($extantPosts, JSON_PRETTY_PRINT));
}
}
$referrer = preg_replace("/\?.*/", "", $_SERVER['HTTP_REFERER']);
header("Location: $referrer?return=$returnCode");
?>
<!DOCTYPE html>
<html lang="en">
<head>
<?php include($_SERVER['DOCUMENT_ROOT'] . '/boilerplate.php'); ?>
<title>Guestbook</title>
<style type="text/css">
body {
display: flex;
flex-direction: column;
justify-content: center;
align-items: center;
}
</style>
</head>
<body>
<p>Your post has been submitted! It's weird that you're seeing this page though. Maybe your browser can't process location headers? At any rate, click <?php echo "<a href='./?return=$returnCode'>here</a>"; ?> to get where you're supposed to be right now.</p>
</body>
</html>
|
