From 09360cd4a64885b31df792e94906e364037af484 Mon Sep 17 00:00:00 2001 From: Mason James <mtj@kohaaloha.com> Date: Wed, 28 May 2014 10:52:09 +1200 Subject: [PATCH] Bug 3144 - anti-spam for opac-suggestions Content-Type: text/plain; charset="utf-8" this patch adds a negative-captcha feature to the purchase suggestions form some info for the curious... http://nedbatchelder.com/text/stopbots.html https://github.com/subwindow/negative-captcha http://www.rubydoc.info/github/subwindow/negative-captcha/frames to test this patch... 1/ apply patch 2/ enable 'suggestion' and 'AnonSuggestions' sysprefs 3/ attempt to add a 'purchase suggestion' in OPAC adding the suggestion should succeed 4/ edit the opac-suggestions.tt file, to reveal the secret field replace line 130, from... <li id="negcap" style="position: absolute; left: -2000px;"> to ... <li id="negcap"> 5/ attempt to add another suggestion, and populate the 'negcap' field adding the suggestion should fail --- koha-tmpl/opac-tmpl/prog/en/modules/opac-suggestions.tt | 7 +++++++ opac/opac-suggestions.pl | 8 ++++++++ 2 files changed, 15 insertions(+) diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-suggestions.tt b/koha-tmpl/opac-tmpl/prog/en/modules/opac-suggestions.tt index 5e52d84..7db842c 100644 --- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-suggestions.tt +++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-suggestions.tt @@ -21,6 +21,7 @@ }[% END %] $(function() { + $("#suggestt").dataTable($.extend(true, {}, dataTablesDefaults, { "aaSorting": [[ 1, "asc" ]], "aoColumnDefs": [ @@ -124,6 +125,12 @@ <option value="[% patron_reason_loo.authorised_value %]">[% patron_reason_loo.lib %]</option> [% END %]</select></li>[% END %] <li><label for="note">Notes:</label><textarea name="note" id="note" rows="5" cols="40"></textarea></li> + + <!-- BZ 3144, add a hidden 'negcap' field --> + <li id="negcap" style="position: absolute; left: -2000px;"> + negcap <input type="text" name="negcap"/> + </li> + </ol></fieldset> <fieldset class="action"><input type="hidden" name="suggestedby" value="[% suggestedbyme %]" /><input type="hidden" name="op" value="add_confirm" /><input type="submit" onclick="Check(this.form); return false;" value="Submit your suggestion" /> <a class="action" href="/cgi-bin/koha/opac-suggestions.pl">Cancel</a></fieldset> </form> diff --git a/opac/opac-suggestions.pl b/opac/opac-suggestions.pl index 72383eb..fadf1ea 100755 --- a/opac/opac-suggestions.pl +++ b/opac/opac-suggestions.pl @@ -33,6 +33,14 @@ my $input = new CGI; my $allsuggestions = $input->param('showall'); my $op = $input->param('op'); my $suggestion = $input->Vars; +my $negcaptcha = $input->param('negcap'); + +# BZ 3144 - if a spambot accidentally populates the 'negcap' field in the sugesstions form, then silently skip and return. +if ($negcaptcha ) { + print $input->redirect("/cgi-bin/koha/opac-suggestions.pl"); + exit; +} + delete $$suggestion{$_} foreach qw<op suggestedbyme>; $op = 'else' unless $op; -- 1.7.10.4