honeypot.module in Honeypot 6

Honeypot module, for deterring spam bots from completing Drupal forms.

File

honeypot.module

<?php

/**
 * @file
 * Honeypot module, for deterring spam bots from completing Drupal forms.
 */

/**
 * Implementation of hook_menu().
 */
function honeypot_menu() {
  $items['admin/settings/honeypot'] = array(
    'title' => 'Honeypot configuration',
    'description' => 'Configure Honeypot spam prevention and the forms on which Honeypot will be used.',
    'page callback' => 'drupal_get_form',
    'page arguments' => array(
      'honeypot_admin_form',
    ),
    'access arguments' => array(
      'administer honeypot',
    ),
    'file' => 'honeypot.admin.inc',
  );
  return $items;
}

/**
 * Implementation of hook_perm().
 */
function honeypot_perm() {
  return array(
    'administer honeypot',
    'bypass honeypot protection',
  );
}

/**
 * Implementation of hook_form_alter().
 *
 * Add Honeypot features to forms enabled in the Honeypot admin interface.
 */
function honeypot_form_alter(&$form, &$form_state, $form_id) {

  // Don't use for maintenance mode forms (install, update, etc.).
  if (defined('MAINTENANCE_MODE')) {
    return;
  }
  $unprotected_forms = array(
    'user_login',
    'user_login_block',
    'search_form',
    'search_theme_form',
    'views_exposed_form',
    'honeypot_admin_form',
  );

  // If configured to protect all forms, add protection to every form.
  if (variable_get('honeypot_protect_all_forms', 0) && !in_array($form_id, $unprotected_forms)) {

    // Don't protect system forms - only admins should have access, and system
    // forms may be programmatically submitted by drush and other modules.
    if (strpos($form_id, 'system_') === FALSE && strpos($form_id, 'search_') === FALSE && strpos($form_id, 'views_exposed_form_') === FALSE) {
      honeypot_add_form_protection($form, $form_state, array(
        'honeypot',
        'time_restriction',
      ));
    }
  }
  elseif ($forms_to_protect = honeypot_get_protected_forms()) {
    foreach ($forms_to_protect as $protect_form_id) {

      // For most forms, do a straight check on the form ID.
      if ($form_id == $protect_form_id) {
        honeypot_add_form_protection($form, $form_state, array(
          'honeypot',
          'time_restriction',
        ));
      }
      elseif ($protect_form_id == 'webforms' && strpos($form_id, 'webform_client_form') !== FALSE) {
        honeypot_add_form_protection($form, $form_state, array(
          'honeypot',
          'time_restriction',
        ));
      }
    }
  }
}

/**
 * Implementation of hook_cron().
 */
function honeypot_cron() {

  // Delete {honeypot_user} entries older than the value of honeypot_expire.
  db_query('DELETE FROM {honeypot_user} WHERE timestamp < %d', time() - variable_get('honeypot_expire', 300));
}

/**
 * Build an array of all the protected forms on the site, by form_id.
 *
 * @todo - Add in API call/hook to allow modules to add to this array.
 */
function honeypot_get_protected_forms() {
  static $forms;

  // If the data isn't already in memory, get from cache or look it up fresh.
  if (!isset($forms)) {
    if (($cache = cache_get('honeypot_protected_forms')) && !empty($cache->data)) {
      $forms = unserialize($cache->data);
    }
    else {
      $forms = array();

      // Look up all the honeypot forms in the variables table.
      $result = db_query("SELECT name FROM {variable} WHERE name LIKE 'honeypot_form_%'");

      // Add each form that's enabled to the $forms array.
      while ($variable = db_fetch_array($result)) {
        if (variable_get($variable['name'], 0)) {
          $forms[] = substr($variable['name'], 14);
        }
      }

      // Save the cached data.
      cache_set('honeypot_protected_forms', serialize($forms), 'cache');
    }
  }
  return $forms;
}

/**
 * Form builder function to add different types of protection to forms.
 *
 * @param array $options
 *   Array of options to be added to form. Currently accepts 'honeypot' and
 *   'time_restriction'.
 */
function honeypot_add_form_protection(&$form, &$form_state, $options = array()) {
  global $user;

  // Allow other modules to alter the protections applied to this form.
  drupal_alter('honeypot_form_protections', $options, $form);

  // Don't add any protections if the user can bypass the Honeypot.
  if (user_access('bypass honeypot protection')) {
    return;
  }

  // Build the honeypot element.
  if (in_array('honeypot', $options)) {

    // Get the element name (default is generic 'url').
    $honeypot_element = variable_get('honeypot_element_name', 'url');

    // Build the honeypot element.
    $form[$honeypot_element] = array(
      '#type' => 'textfield',
      '#title' => t('Leave this field blank'),
      '#size' => 20,
      '#weight' => 100,
      '#element_validate' => array(
        '_honeypot_honeypot_validate',
      ),
      '#prefix' => '<div class="honeypot-textfield">',
      '#suffix' => '</div>',
    );
    $form['#pre_render'][] = '_honeypot_form_add_css';
  }

  // Build the time restriction element (if it's not disabled).
  if (in_array('time_restriction', $options) && variable_get('honeypot_time_limit', 5) != 0) {

    // Set the current time in a hidden value to be checked later.
    $form['honeypot_time'] = array(
      '#type' => 'hidden',
      '#title' => t('Timestamp'),
      '#default_value' => time(),
      '#element_validate' => array(
        '_honeypot_time_restriction_validate',
      ),
    );

    // Disable page caching to make sure timestamp isn't cached.
    if (user_is_anonymous()) {
      $GLOBALS['conf']['cache'] = CACHE_DISABLED;

      // Pressflow in CACHE_EXTERNAL caching mode additionally requires marking
      // this request as non-cacheable to bypass external caches (like Varnish).
      if (function_exists('drupal_page_is_cacheable')) {
        drupal_set_header('Cache-Control', 'no-cache, must-revalidate, post-check=0, pre-check=0', FALSE);
      }
    }
  }

  // Allow other modules to react to addition of form protection.
  if (!empty($options)) {
    module_invoke_all('honeypot_add_form_protection', $options, $form);
  }
}

/**
 * Form pre_render callback to add CSS.
 *
 * Using this callback rather than adding the CSS inline helps the added CSS
 * apply even in case of a failed form validation.
 */
function _honeypot_form_add_css($form) {

  // Hide honeypot.
  drupal_add_css(drupal_get_path('module', 'honeypot') . '/css/honeypot.css', 'module');
  return $form;
}

/**
 * Validate honeypot field.
 */
function _honeypot_honeypot_validate($element, &$form_state) {

  // Get the honeypot field value.
  $honeypot_value = $element['#value'];

  // Make sure it's empty.
  if (!empty($honeypot_value)) {
    _honeypot_log($form_state['values']['form_id'], 'honeypot');
    form_set_error('', t('There was a problem with your form submission. Please refresh the page and try again.'));
  }
}

/**
 * Validate honeypot's time restriction field.
 */
function _honeypot_time_restriction_validate($element, &$form_state) {

  // Don't do anything if the triggering element is a preview button.
  if ($form_state['triggering_element']['#value'] == t('Preview')) {
    return;
  }

  // Get the time value.
  $honeypot_time = $form_state['values']['honeypot_time'];

  // Get the honeypot_time_limit.
  $time_limit = honeypot_get_time_limit($form_state['values']);

  // Make sure current time - (time_limit + form time value) is greater than 0.
  // If not, throw an error.
  if (time() < $honeypot_time + $time_limit) {
    _honeypot_log($form_state['values']['form_id'], 'honeypot_time');

    // Get the time limit again, since it increases after first failure.
    $time_limit = honeypot_get_time_limit($form_state['values']);
    $form_state['values']['honeypot_time'] = time();
    form_set_error('', t('There was a problem with your form submission. Please wait @limit seconds and try again.', array(
      '@limit' => $time_limit,
    )));
  }
}

/**
 * Log blocked form submissions.
 *
 * @param string $form_id
 *   Form ID for the form on which submission was blocked.
 * @param string $type
 *   String indicating the reason the submission was blocked. Allowed values:
 *     - 'honeypot'
 *     - 'honeypot_time'
 */
function _honeypot_log($form_id, $type) {
  honeypot_log_failure($form_id, $type);
  if (variable_get('honeypot_log', 0)) {
    $variables = array(
      '%form' => $form_id,
      '@cause' => $type == 'honeypot' ? t('submission of a value in the honeypot field') : t('submission of the form in less than minimum required time'),
    );
    watchdog('honeypot', 'Blocked submission of %form due to @cause.', $variables);
  }
}

/**
 * Look up the time limit for the current user.
 *
 * @param array $form_values
 *   Array of form values (optional).
 */
function honeypot_get_time_limit($form_values = array()) {
  global $user;
  $honeypot_time_limit = variable_get('honeypot_time_limit', 5);

  // Only calculate time limit if honeypot_time_limit has a value > 0.
  if ($honeypot_time_limit) {
    $expire_time = variable_get('honeypot_expire', 300);

    // Get value from {honeypot_user} table for authenticated users.
    if ($user->uid) {
      $number = db_result(db_query("SELECT COUNT(*) FROM {honeypot_user} WHERE uid = %d AND timestamp > %d", $user->uid, time() - $expire_time));
    }
    else {
      $number = db_result(db_query("SELECT COUNT(*) FROM {flood} WHERE event = '%s' AND hostname = '%s' AND timestamp > %d", 'honeypot', ip_address(), time() - $expire_time));
    }

    // Don't add more than 30 days' worth of extra time.
    $honeypot_time_limit = (int) min($honeypot_time_limit + exp($number) - 1, 2592000);
    $additions = module_invoke_all('honeypot_time_limit', $honeypot_time_limit, $form_values, $number);
    if (count($additions)) {
      $honeypot_time_limit += array_sum($additions);
    }
  }
  return $honeypot_time_limit;
}

/**
 * Log the failed submision with timestamp.
 *
 * @param string $form_id
 *   Form ID for the rejected form submission.
 * @param string $type
 *   String indicating the reason the submission was blocked. Allowed values:
 *     - honeypot: If honeypot field was filled in.
 *     - honeypot_time: If form was completed before the configured time limit.
 */
function honeypot_log_failure($form_id, $type) {
  global $user;

  // Log failed submissions for authenticated users.
  if ($user->uid) {
    db_query('INSERT INTO {honeypot_user} (uid, timestamp) VALUES (%d, %d)', $user->uid, time());
  }
  else {
    flood_register_event('honeypot');
  }

  // Allow other modules to react to honeypot rejections.
  module_invoke_all('honeypot_reject', $form_id, $user->uid, $type);
}

Functions

Name	Description
honeypot_add_form_protection	Form builder function to add different types of protection to forms.
honeypot_cron	Implementation of hook_cron().
honeypot_form_alter	Implementation of hook_form_alter().
honeypot_get_protected_forms	Build an array of all the protected forms on the site, by form_id.
honeypot_get_time_limit	Look up the time limit for the current user.
honeypot_log_failure	Log the failed submision with timestamp.
honeypot_menu	Implementation of hook_menu().
honeypot_perm	Implementation of hook_perm().
_honeypot_form_add_css	Form pre_render callback to add CSS.
_honeypot_honeypot_validate	Validate honeypot field.
_honeypot_log	Log blocked form submissions.
_honeypot_time_restriction_validate	Validate honeypot's time restriction field.