[Summary view] [Print] [Text view]

   1  <?php
   2  
   3  /**
   4   * ConfirmEdit MediaWiki extension.
   5   *
   6   * This is a framework that holds a variety of CAPTCHA tools. The
   7   * default one, 'SimpleCaptcha', is not intended as a production-
   8   * level CAPTCHA system, and another one of the options provided
   9   * should be used in its place for any real usages.
  10   *
  11   * Copyright (C) 2005-2007 Brion Vibber <[email protected]>
  12   * http://www.mediawiki.org/
  13   *
  14   * This program is free software; you can redistribute it and/or modify
  15   * it under the terms of the GNU General Public License as published by
  16   * the Free Software Foundation; either version 2 of the License, or
  17   * (at your option) any later version.
  18   *
  19   * This program is distributed in the hope that it will be useful,
  20   * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  22   * GNU General Public License for more details.
  23   *
  24   * You should have received a copy of the GNU General Public License along
  25   * with this program; if not, write to the Free Software Foundation, Inc.,
  26   * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  27   * http://www.gnu.org/copyleft/gpl.html
  28   *
  29   * @file
  30   * @ingroup Extensions
  31   */
  32  
  33  if ( !defined( 'MEDIAWIKI' ) ) {
  34      exit;
  35  }
  36  
  37  $wgExtensionFunctions[] = 'confirmEditSetup';
  38  $wgExtensionCredits['antispam'][] = array(
  39      'path' => __FILE__,
  40      'name' => 'ConfirmEdit',
  41      'author' => array( 'Brion Vibber', '...' ),
  42      'url' => 'https://www.mediawiki.org/wiki/Extension:ConfirmEdit',
  43      'version' => '1.3',
  44      'descriptionmsg' => 'captcha-desc',
  45  );
  46  
  47  /**
  48   * The 'skipcaptcha' permission key can be given out to
  49   * let known-good users perform triggering actions without
  50   * having to go through the captcha.
  51   *
  52   * By default, sysops and registered bot accounts will be
  53   * able to skip, while others have to go through it.
  54   */
  55  $wgGroupPermissions['*'            ]['skipcaptcha'] = false;
  56  $wgGroupPermissions['user'         ]['skipcaptcha'] = false;
  57  $wgGroupPermissions['autoconfirmed']['skipcaptcha'] = false;
  58  $wgGroupPermissions['bot'          ]['skipcaptcha'] = true; // registered bots
  59  $wgGroupPermissions['sysop'        ]['skipcaptcha'] = true;
  60  $wgAvailableRights[] = 'skipcaptcha';
  61  
  62  /**
  63   * List of IP ranges to allow to skip the captcha, similar to the group setting:
  64   * "$wgGroupPermission[...]['skipcaptcha'] = true"
  65   *
  66   * Specific IP addresses or CIDR-style ranges may be used,
  67   * for instance:
  68   * $wgCaptchaWhitelistIP = array('192.168.1.0/24', '10.1.0.0/16');
  69   */
  70  $wgCaptchaWhitelistIP = false;
  71  
  72  $wgCaptcha = null;
  73  $wgCaptchaClass = 'SimpleCaptcha';
  74  
  75  /**
  76   * Actions which can trigger a captcha
  77   *
  78   * If the 'edit' trigger is on, *every* edit will trigger the captcha.
  79   * This may be useful for protecting against vandalbot attacks.
  80   *
  81   * If using the default 'addurl' trigger, the captcha will trigger on
  82   * edits that include URLs that aren't in the current version of the page.
  83   * This should catch automated linkspammers without annoying people when
  84   * they make more typical edits.
  85   *
  86   * The captcha code should not use $wgCaptchaTriggers, but CaptchaTriggers()
  87   * which also takes into account per namespace triggering.
  88   */
  89  $wgCaptchaTriggers = array();
  90  $wgCaptchaTriggers['edit']          = false; // Would check on every edit
  91  $wgCaptchaTriggers['create']        = false; // Check on page creation.
  92  $wgCaptchaTriggers['sendemail']     = false; // Special:Emailuser
  93  $wgCaptchaTriggers['addurl']        = true;  // Check on edits that add URLs
  94  $wgCaptchaTriggers['createaccount'] = true;  // Special:Userlogin&type=signup
  95  $wgCaptchaTriggers['badlogin']      = true;  // Special:Userlogin after failure
  96  
  97  /**
  98   * You may wish to apply special rules for captcha triggering on some namespaces.
  99   * $wgCaptchaTriggersOnNamespace[<namespace id>][<trigger>] forces an always on /
 100   * always off configuration with that trigger for the given namespace.
 101   * Leave unset to use the global options ($wgCaptchaTriggers).
 102   *
 103   * Shall not be used with 'createaccount' (it is not checked).
 104   */
 105  $wgCaptchaTriggersOnNamespace = array();
 106  
 107  # Example:
 108  # $wgCaptchaTriggersOnNamespace[NS_TALK]['create'] = false; //Allow creation of talk pages without captchas.
 109  # $wgCaptchaTriggersOnNamespace[NS_PROJECT]['edit'] = true; //Show captcha whenever editing Project pages.
 110  
 111  /**
 112   * Indicate how to store per-session data required to match up the
 113   * internal captcha data with the editor.
 114   *
 115   * 'CaptchaSessionStore' uses PHP's session storage, which is cookie-based
 116   * and may fail for anons with cookies disabled.
 117   *
 118   * 'CaptchaCacheStore' uses $wgMemc, which avoids the cookie dependency
 119   * but may be fragile depending on cache configuration.
 120   */
 121  $wgCaptchaStorageClass = 'CaptchaSessionStore';
 122  
 123  /**
 124   * Number of seconds a captcha session should last in the data cache
 125   * before expiring when managing through CaptchaCacheStore class.
 126   *
 127   * Default is a half hour.
 128   */
 129  $wgCaptchaSessionExpiration = 30 * 60;
 130  
 131  /**
 132   * Number of seconds after a bad login that a captcha will be shown to
 133   * that client on the login form to slow down password-guessing bots.
 134   *
 135   * Has no effect if 'badlogin' is disabled in $wgCaptchaTriggers or
 136   * if there is not a caching engine enabled.
 137   *
 138   * Default is five minutes.
 139   */
 140  $wgCaptchaBadLoginExpiration = 5 * 60;
 141  
 142  /**
 143   * Allow users who have confirmed their email addresses to post
 144   * URL links without being harassed by the captcha.
 145   */
 146  $ceAllowConfirmedEmail = false;
 147  
 148  /**
 149   * Number of bad login attempts before triggering the captcha.  0 means the
 150   * captcha is presented on the first login.
 151   */
 152  $wgCaptchaBadLoginAttempts = 3;
 153  
 154  /**
 155   * Regex to whitelist URLs to known-good sites...
 156   * For instance:
 157   * $wgCaptchaWhitelist = '#^https?://([a-z0-9-]+\\.)?(wikimedia|wikipedia)\.org/#i';
 158   * Local admins can define a whitelist under [[MediaWiki:captcha-addurl-whitelist]]
 159   */
 160  $wgCaptchaWhitelist = false;
 161  
 162  /**
 163   * Additional regexes to check for. Use full regexes; can match things
 164   * other than URLs such as junk edits.
 165   *
 166   * If the new version matches one and the old version doesn't,
 167   * toss up the captcha screen.
 168   *
 169   * @fixme Add a message for local admins to add items as well.
 170   */
 171  $wgCaptchaRegexes = array();
 172  
 173  /** Register special page */
 174  $wgSpecialPages['Captcha'] = 'CaptchaSpecialPage';
 175  
 176  $wgConfirmEditIP = __DIR__;
 177  $wgMessagesDirs['ConfirmEdit'] = __DIR__ . '/i18n/core';
 178  $wgExtensionMessagesFiles['ConfirmEdit'] = "$wgConfirmEditIP/ConfirmEdit.i18n.php";
 179  $wgExtensionMessagesFiles['ConfirmEditAlias'] = "$wgConfirmEditIP/ConfirmEdit.alias.php";
 180  
 181  $wgHooks['EditFilterMerged'][] = 'ConfirmEditHooks::confirmEditMerged';
 182  $wgHooks['UserCreateForm'][] = 'ConfirmEditHooks::injectUserCreate';
 183  $wgHooks['AbortNewAccount'][] = 'ConfirmEditHooks::confirmUserCreate';
 184  $wgHooks['LoginAuthenticateAudit'][] = 'ConfirmEditHooks::triggerUserLogin';
 185  $wgHooks['UserLoginForm'][] = 'ConfirmEditHooks::injectUserLogin';
 186  $wgHooks['AbortLogin'][] = 'ConfirmEditHooks::confirmUserLogin';
 187  $wgHooks['EmailUserForm'][] = 'ConfirmEditHooks::injectEmailUser';
 188  $wgHooks['EmailUser'][] = 'ConfirmEditHooks::confirmEmailUser';
 189  # Register API hook
 190  $wgHooks['APIEditBeforeSave'][] = 'ConfirmEditHooks::confirmEditAPI';
 191  $wgHooks['APIGetAllowedParams'][] = 'ConfirmEditHooks::APIGetAllowedParams';
 192  $wgHooks['APIGetParamDescription'][] = 'ConfirmEditHooks::APIGetParamDescription';
 193  $wgHooks['AddNewAccountApiForm'][] = 'ConfirmEditHooks::addNewAccountApiForm';
 194  $wgHooks['AddNewAccountApiResult'][] = 'ConfirmEditHooks::addNewAccountApiResult';
 195  
 196  $wgAutoloadClasses['ConfirmEditHooks'] = "$wgConfirmEditIP/ConfirmEditHooks.php";
 197  $wgAutoloadClasses['SimpleCaptcha'] = "$wgConfirmEditIP/Captcha.php";
 198  $wgAutoloadClasses['CaptchaStore'] = "$wgConfirmEditIP/CaptchaStore.php";
 199  $wgAutoloadClasses['CaptchaSessionStore'] = "$wgConfirmEditIP/CaptchaStore.php";
 200  $wgAutoloadClasses['CaptchaCacheStore'] = "$wgConfirmEditIP/CaptchaStore.php";
 201  $wgAutoloadClasses['CaptchaSpecialPage'] = "$wgConfirmEditIP/ConfirmEditHooks.php";
 202  
 203  /**
 204   * Set up $wgWhitelistRead
 205   */
 206  function confirmEditSetup() {
 207      global $wgGroupPermissions, $wgCaptchaTriggers;
 208      if ( !$wgGroupPermissions['*']['read'] && $wgCaptchaTriggers['badlogin'] ) {
 209          // We need to ensure that the captcha interface is accessible
 210          // so that unauthenticated users can actually get in after a
 211          // mistaken password typing.
 212          global $wgWhitelistRead;
 213          $image = SpecialPage::getTitleFor( 'Captcha', 'image' );
 214          $help = SpecialPage::getTitleFor( 'Captcha', 'help' );
 215          $wgWhitelistRead[] = $image->getPrefixedText();
 216          $wgWhitelistRead[] = $help->getPrefixedText();
 217      }
 218  }