From 09360cd4a64885b31df792e94906e364037af484 Mon Sep 17 00:00:00 2001
From: Mason James <mtj@kohaaloha.com>
Date: Wed, 28 May 2014 10:52:09 +1200
Subject: [PATCH] Bug 3144 - anti-spam for opac-suggestions
Content-Type: text/plain; charset="utf-8"

this patch adds a negative-captcha feature to the purchase suggestions form

some info for the curious...
 http://nedbatchelder.com/text/stopbots.html
 https://github.com/subwindow/negative-captcha
 http://www.rubydoc.info/github/subwindow/negative-captcha/frames

to test this patch...

1/ apply patch

2/ enable 'suggestion' and 'AnonSuggestions' sysprefs

3/ attempt to add a 'purchase suggestion' in OPAC
   adding the suggestion should succeed

4/ edit the opac-suggestions.tt file, to reveal the secret field

   replace line 130, from...
     <li id="negcap" style="position: absolute; left: -2000px;">
   to ...
     <li id="negcap">

5/ attempt to add another suggestion, and populate the 'negcap' field
   adding the suggestion should fail
---
 koha-tmpl/opac-tmpl/prog/en/modules/opac-suggestions.tt |    7 +++++++
 opac/opac-suggestions.pl                                |    8 ++++++++
 2 files changed, 15 insertions(+)

diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-suggestions.tt b/koha-tmpl/opac-tmpl/prog/en/modules/opac-suggestions.tt
index 5e52d84..7db842c 100644
--- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-suggestions.tt
+++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-suggestions.tt
@@ -21,6 +21,7 @@
 }[% END %]
 
        $(function() {
+
             $("#suggestt").dataTable($.extend(true, {}, dataTablesDefaults, {
                 "aaSorting": [[ 1, "asc" ]],
                 "aoColumnDefs": [
@@ -124,6 +125,12 @@
            <option value="[% patron_reason_loo.authorised_value %]">[% patron_reason_loo.lib %]</option>
     [% END %]</select></li>[% END %]
     <li><label for="note">Notes:</label><textarea name="note" id="note" rows="5" cols="40"></textarea></li>
+
+    <!--  BZ 3144, add a hidden 'negcap' field -->
+    <li id="negcap" style="position: absolute; left: -2000px;">
+        negcap <input type="text" name="negcap"/>
+    </li>
+
     </ol></fieldset>
         <fieldset class="action"><input type="hidden" name="suggestedby" value="[% suggestedbyme %]" /><input type="hidden" name="op" value="add_confirm" /><input type="submit" onclick="Check(this.form); return false;" value="Submit your suggestion" /> <a class="action" href="/cgi-bin/koha/opac-suggestions.pl">Cancel</a></fieldset>
     </form>
diff --git a/opac/opac-suggestions.pl b/opac/opac-suggestions.pl
index 72383eb..fadf1ea 100755
--- a/opac/opac-suggestions.pl
+++ b/opac/opac-suggestions.pl
@@ -33,6 +33,14 @@ my $input           = new CGI;
 my $allsuggestions  = $input->param('showall');
 my $op              = $input->param('op');
 my $suggestion      = $input->Vars;
+my $negcaptcha       = $input->param('negcap');
+
+# BZ 3144 - if a spambot accidentally populates the 'negcap' field in the sugesstions form, then silently skip and return.
+if ($negcaptcha ) {
+    print $input->redirect("/cgi-bin/koha/opac-suggestions.pl");
+    exit;
+}
+
 delete $$suggestion{$_} foreach qw<op suggestedbyme>;
 $op = 'else' unless $op;
 
-- 
1.7.10.4