<?php
/**
 * @author     Thomas Meyer
 * @licence    http://creativecommons.org/licenses/by-nc-sa/2.5/
 * @package    yana
 * @subpackage plugins
 */

/**
 * @access     public
 * @package    yana
 * @subpackage plugins
 */
class plugin_antispam extends plugin
{

    /**
     * Default event handler
     *
     * returns bool(true) on success and bool(false) on error
     *
     * {@internal
     *
     * The corresponding form fields are created in DisplayUtility::htmlPostProcessor();
     *
     * }}
     *
     * @access  public
     * @return  bool
     * @name    plugin_spamprotect::_default()
     * @param   string  $event  name of the called event in lower-case
     * @param   array   $ARGS   array of arguments passed to the function
     */
    function _default($event, $ARGS)
    {
        /* check input data */
        assert('is_string($event);');
        assert('is_array($ARGS);');
        settype($event, "string");
        settype($ARGS, "array");
        $event = strtolower($event);

        /* global variables */
        global $YANA;
        $permission = $YANA->getVar('PERMISSION');
        $type       = strtolower($YANA->plugins->getEventType($event));
        if (is_int($permission) && $permission > 0 || $type !== 'write') {
            /*   Let's say: a robot would'nt have been able to log in,
                 because it would have had to defeat the login form
                 which is also protected by this implementation.
                 In addition if it DID conquer the login form already,
                 then it is quite obvious it would conquer them all.
             */
        } else {
            /* 1 check the time the user required to fill out the form */
            $time =& $_SESSION['transaction_isolation_created'];
            /* assume a user would need at least 5 seconds and at most 30 minutes to fill the form */
            /* if the time is not set or = 0, then we assume the form has never been displayed and we just encountered a direct request */
            if (empty($time)) {
                $YANA->report(new log('SPAM: blocked entry because no timestamp present (possibly the form was never displayed).'));
                $YANA->message("alert", "SPAMPROTECT", $event);
                return false;
            } else if (time() - $time < 5) {
                $YANA->report(new log('SPAM: blocked entry because a previous entry has been issued within the last 5 seconds.'));
                $YANA->message("alert", "SPAMPROTECT_TIME", $event);
                return false;
            } else if (time() - $time > 1800) {
                $YANA->report(new log('SPAM: blocked entry because maximum time of life (30 minutes) for the form has been exceeded.'));
                $YANA->message("alert", "SPAMPROTECT_TIMEOUT", $event);
                return false;
            }
            if (!empty($ARGS['yana_url'])) {
                $YANA->report(new log('SPAM: blocked entry because a field that is not visible to human visitors has been filled.'));
                $YANA->message("alert", "SPAMPROTECT", $event);
                return false;
            }
        }     
        /* check if input has a valid form id */
        if ($type === 'write' && $YANA->getVar('DISABLE_FORM_ID') !== true) {
            if (!isset($_SESSION['yana_form_id']) || $_SESSION['yana_form_id'] === 'expired' || empty($ARGS['yana_form_id']) || strcasecmp($ARGS['yana_form_id'],$_SESSION['yana_form_id']) !== 0) {
                $YANA->report(new log('SPAM: blocked entry because no valid form Id has been found.'));
                if ($_SESSION['yana_form_id'] === 'expired') {
                    $YANA->message("alert", "NOSPAM", $event);
                } else {
                    $YANA->message("alert", "UNGUELTIGE_EINGABE", $event);
                }
                $_SESSION['yana_form_id'] = 'expired';
                return false;
            } else {
                $_SESSION['yana_form_id'] = 'expired';
            }
        } else {
            $_SESSION['yana_form_id'] = 'expired';
        }
        return true;
    }

}

// © 2006, Thomas Meyer www.All-Community.de
// Copyright Hinweis nicht entfernen!
?>