pguzman/Rosary
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Block bot registrations and add cron cleanup for unconfirmed accounts

Browse Source 
register.php was a fully open signup form with no bot defenses — the
likely source of the unconfirmed accounts piling up in admin/users.php.

- Add an always-on honeypot field + timing trap to register.php: either
  tripping silently pretends success without creating an account, so a
  bot doesn't learn it was caught. No configuration needed.

- Add optional Google reCAPTCHA v3 support (includes/recaptcha.php,
  recaptcha_enabled()/verify_recaptcha(), no Composer dependency — a
  raw file_get_contents() POST like mailer.php's SMTP socket approach).
  A failed check here shows a real, visible error instead of the silent
  honeypot path, since a legitimate low-score user deserves a retry.

- Configure it through admin/settings.php's new "Bot Protection" section,
  mirroring the existing SMTP pattern exactly: recaptcha_enabled/
  recaptcha_site_key/recaptcha_secret_key in site_settings, secret key
  masked the same way smtp_pass now is (blank submission keeps it
  unchanged). install.php seeds sane defaults so the feature stays off
  until explicitly configured — fully backward compatible.

- Add cron/cleanup_unconfirmed.php: deletes accounts still unconfirmed
  after 3 days. CLI-only (refuses to run over HTTP, and cron/.htaccess
  denies web access to the directory as a second layer) since it's an
  unattended, irreversible deletion. Safe by construction — login.php
  already refuses login to unconfirmed accounts, so these rows can never
  own a session/novena_group/custom_prayer row. Not wired up
  automatically; README documents the Hostinger cron job to schedule it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Philip Guzman III
2026-09-15 10:11:29 -07:00
parent 9622f9aeca
commit c7f1bdd630
7 changed files with 301 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/settings.php
+67 -4
View File
@@ -6,6 +6,7 @@ require_once __DIR__ . '/../config/db.php';
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/mailer.php';
require_once __DIR__ . '/../includes/csrf.php';
require_once __DIR__ . '/../includes/recaptcha.php';
require_role('superadmin');
@@ -20,19 +21,27 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$action = $_POST['action'] ?? 'save';
if ($action === 'save') {
// smtp_pass is handled separately: the form always renders it blank
// (see below), so a blank submission means "leave it unchanged",
// not "clear it".
// smtp_pass and recaptcha_secret_key are handled separately below:
// the form always renders them blank, so a blank submission means
// "leave it unchanged", not "clear it".
$keys = ['site_name','site_url','smtp_host','smtp_port','smtp_user','smtp_from','smtp_from_name',
'donate_enabled','donate_type','donate_handle','donate_label'];
'donate_enabled','donate_type','donate_handle','donate_label',
'recaptcha_enabled','recaptcha_site_key'];
// Checkboxes are absent from $_POST entirely when unchecked.
$checkbox_keys = ['donate_enabled', 'recaptcha_enabled'];
foreach ($keys as $k) {
if (isset($_POST[$k])) {
set_setting($k, trim($_POST[$k]));
} elseif (in_array($k, $checkbox_keys, true)) {
set_setting($k, '0');
}
}
if (!empty($_POST['smtp_pass'])) {
set_setting('smtp_pass', trim($_POST['smtp_pass']));
}
if (!empty($_POST['recaptcha_secret_key'])) {
set_setting('recaptcha_secret_key', trim($_POST['recaptcha_secret_key']));
}
$message = 'Settings saved.';
$site_name = get_setting('site_name', APP_NAME); // refresh
}
@@ -68,6 +77,9 @@ $settings = [
'donate_type' => get_setting('donate_type', 'custom'),
'donate_handle' => get_setting('donate_handle', ''),
'donate_label' => get_setting('donate_label', ''),
'recaptcha_enabled' => get_setting('recaptcha_enabled', '0'),
'recaptcha_site_key' => get_setting('recaptcha_site_key', ''),
'recaptcha_secret_key_set' => get_setting('recaptcha_secret_key') !== '',
];
?>
<!DOCTYPE html>
@@ -226,6 +238,45 @@ $settings = [
</div>
</div>
<div class="settings-section">
<h3>Bot Protection (reCAPTCHA)</h3>
<p class="help-text" style="margin-top:0;margin-bottom:20px">
Adds invisible Google reCAPTCHA v3 to the registration form, on top of the built-in
honeypot/timing checks. Register your domain at
<a href="https://www.google.com/recaptcha/admin" target="_blank" rel="noopener">google.com/recaptcha</a>
(choose reCAPTCHA v3) to get a Site Key and Secret Key.
</p>
<div class="form-group">
<label style="display:flex;align-items:center;gap:10px;cursor:pointer">
<input type="checkbox" name="recaptcha_enabled" value="1"
id="recaptcha_enabled"
<?= $settings['recaptcha_enabled'] === '1' ? 'checked' : '' ?>
style="width:18px;height:18px">
<span>Enable reCAPTCHA on registration</span>
</label>
</div>
<div class="form-grid">
<div class="form-group">
<label for="recaptcha_site_key">Site Key</label>
<input type="text" id="recaptcha_site_key" name="recaptcha_site_key"
autocomplete="off"
value="<?= htmlspecialchars($settings['recaptcha_site_key']) ?>">
</div>
<div class="form-group">
<label for="recaptcha_secret_key">Secret Key</label>
<div class="pass-wrap">
<input type="password" id="recaptcha_secret_key" name="recaptcha_secret_key"
autocomplete="new-password"
placeholder="<?= $settings['recaptcha_secret_key_set'] ? '•••••••• (leave blank to keep current)' : '' ?>">
<button type="button" class="pass-toggle" onclick="toggleRecaptchaSecret()">Show</button>
</div>
<p class="help-text">
<?= $settings['recaptcha_secret_key_set'] ? '&#x2713; A secret key is currently set. Leave blank to keep it.' : 'No secret key set.' ?>
</p>
</div>
</div>
</div>
<div class="form-actions">
<button type="submit" class="btn btn-primary">Save Settings</button>
</div>
@@ -270,6 +321,18 @@ function togglePass() {
btn.textContent = 'Show';
}
}
function toggleRecaptchaSecret() {
var inp = document.getElementById('recaptcha_secret_key');
var btn = inp.nextElementSibling;
if (inp.type === 'password') {
inp.type = 'text';
btn.textContent = 'Hide';
} else {
inp.type = 'password';
btn.textContent = 'Show';
}
}
</script>
</body>
</html>