pguzman/Rosary
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Block bot registrations and add cron cleanup for unconfirmed accounts

Browse Source 
register.php was a fully open signup form with no bot defenses — the
likely source of the unconfirmed accounts piling up in admin/users.php.

- Add an always-on honeypot field + timing trap to register.php: either
  tripping silently pretends success without creating an account, so a
  bot doesn't learn it was caught. No configuration needed.

- Add optional Google reCAPTCHA v3 support (includes/recaptcha.php,
  recaptcha_enabled()/verify_recaptcha(), no Composer dependency — a
  raw file_get_contents() POST like mailer.php's SMTP socket approach).
  A failed check here shows a real, visible error instead of the silent
  honeypot path, since a legitimate low-score user deserves a retry.

- Configure it through admin/settings.php's new "Bot Protection" section,
  mirroring the existing SMTP pattern exactly: recaptcha_enabled/
  recaptcha_site_key/recaptcha_secret_key in site_settings, secret key
  masked the same way smtp_pass now is (blank submission keeps it
  unchanged). install.php seeds sane defaults so the feature stays off
  until explicitly configured — fully backward compatible.

- Add cron/cleanup_unconfirmed.php: deletes accounts still unconfirmed
  after 3 days. CLI-only (refuses to run over HTTP, and cron/.htaccess
  denies web access to the directory as a second layer) since it's an
  unattended, irreversible deletion. Safe by construction — login.php
  already refuses login to unconfirmed accounts, so these rows can never
  own a session/novena_group/custom_prayer row. Not wired up
  automatically; README documents the Hostinger cron job to schedule it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Philip Guzman III
2026-09-15 10:11:29 -07:00
parent 9622f9aeca
commit c7f1bdd630
7 changed files with 301 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
register.php
+120 -69
View File
@@ -3,6 +3,7 @@ require_once __DIR__ . '/config/db.php';
require_once __DIR__ . '/includes/auth.php';
require_once __DIR__ . '/includes/mailer.php';
require_once __DIR__ . '/includes/csrf.php';
require_once __DIR__ . '/includes/recaptcha.php';
_auth_start();
@@ -18,6 +19,16 @@ $fields = ['username' => '', 'display_name' => '', 'email' => ''];
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
csrf_verify();
// Honeypot + timing trap: a decoy field real users never see/fill, and a
// minimum time between the form being shown and submitted. Either one
// tripping means this almost certainly isn't a human — pretend success
// without creating an account, so a bot doesn't learn it was caught and
// adapt its script.
$honeypot = trim($_POST['website'] ?? '');
$shown_at = (int)($_SESSION['reg_form_shown_at'] ?? 0);
$bot_detected = ($honeypot !== '') || (time() - $shown_at < 3);
$username = trim($_POST['username'] ?? '');
$display_name = trim($_POST['display_name'] ?? '');
$email = trim($_POST['email'] ?? '');
@@ -26,78 +37,92 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$fields = compact('username', 'display_name', 'email');
// Validate username
if (!preg_match('/^[a-zA-Z0-9_]{3,30}$/', $username)) {
$errors[] = 'Username must be 3-30 characters and contain only letters, numbers, and underscores.';
}
// Validate email
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
$errors[] = 'Please enter a valid email address.';
}
// Validate password
if (strlen($password) < 8) {
$errors[] = 'Password must be at least 8 characters.';
}
if ($password !== $password_confirm) {
$errors[] = 'Passwords do not match.';
}
if (empty($errors)) {
$pdo = get_pdo();
// Check uniqueness
$chk = $pdo->prepare('SELECT id FROM users WHERE username = ? OR email = ?');
$chk->execute([$username, $email]);
$existing = $chk->fetchAll();
foreach ($existing as $row) {
// Re-check which field conflicts
}
if (!empty($existing)) {
$chk_u = $pdo->prepare('SELECT id FROM users WHERE username = ?');
$chk_u->execute([$username]);
if ($chk_u->fetch()) $errors[] = 'That username is already taken.';
$chk_e = $pdo->prepare('SELECT id FROM users WHERE email = ?');
$chk_e->execute([$email]);
if ($chk_e->fetch()) $errors[] = 'That email address is already registered.';
}
}
if (empty($errors)) {
$pdo = get_pdo();
$smtp_host = get_setting('smtp_host');
$auto_confirm = ($smtp_host === ''); // No SMTP = skip email confirmation
$hash = password_hash($password, PASSWORD_BCRYPT);
$token = $auto_confirm ? null : bin2hex(random_bytes(32));
$pdo->prepare("
INSERT INTO users (username, email, password_hash, display_name, role, rosary_limit, email_confirmed, confirm_token)
VALUES (?, ?, ?, ?, 'user', 1, ?, ?)
")->execute([$username, $email, $hash, $display_name ?: $username, $auto_confirm ? 1 : 0, $token]);
if (!$auto_confirm && $token) {
$site_url = rtrim(get_setting('site_url'), '/');
$link = $site_url . '/confirm?token=' . urlencode($token);
$site_name = get_setting('site_name', APP_NAME);
$body_html = "
<h2 style='margin-top:0;color:#1e3a5f'>Confirm your email</h2>
<p>Hello, <strong>" . htmlspecialchars($display_name ?: $username) . "</strong>!</p>
<p>Thank you for registering with {$site_name}. Click the button below to confirm your email address:</p>
<p style='text-align:center;margin:28px 0'>
<a href='" . htmlspecialchars($link) . "' style='display:inline-block;background:#1e3a5f;color:#fff;padding:12px 28px;border-radius:6px;text-decoration:none;font-weight:600'>Confirm Email</a>
</p>
<p style='color:#6b7280;font-size:13px'>Or copy this link: " . htmlspecialchars($link) . "</p>
<p style='color:#6b7280;font-size:13px'>If you did not register, ignore this email.</p>
";
$html = email_template('Confirm your email — ' . $site_name, $body_html);
send_email($email, $display_name ?: $username, 'Confirm your email — ' . $site_name, $html);
if ($bot_detected) {
$success = true;
$auto_confirmed = false;
} else {
// reCAPTCHA v3: unlike the honeypot/timing trap above, a failure here
// gets a real, visible error — a legitimate low-score user deserves
// an explicit retry rather than a silently-discarded submission.
if (recaptcha_enabled() && !verify_recaptcha($_POST['recaptcha_token'] ?? '')) {
$errors[] = 'We could not verify your submission. Please try again.';
}
$success = true;
$auto_confirmed = $auto_confirm;
// Validate username
if (!preg_match('/^[a-zA-Z0-9_]{3,30}$/', $username)) {
$errors[] = 'Username must be 3-30 characters and contain only letters, numbers, and underscores.';
}
// Validate email
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
$errors[] = 'Please enter a valid email address.';
}
// Validate password
if (strlen($password) < 8) {
$errors[] = 'Password must be at least 8 characters.';
}
if ($password !== $password_confirm) {
$errors[] = 'Passwords do not match.';
}
if (empty($errors)) {
$pdo = get_pdo();
// Check uniqueness
$chk = $pdo->prepare('SELECT id FROM users WHERE username = ? OR email = ?');
$chk->execute([$username, $email]);
$existing = $chk->fetchAll();
if (!empty($existing)) {
$chk_u = $pdo->prepare('SELECT id FROM users WHERE username = ?');
$chk_u->execute([$username]);
if ($chk_u->fetch()) $errors[] = 'That username is already taken.';
$chk_e = $pdo->prepare('SELECT id FROM users WHERE email = ?');
$chk_e->execute([$email]);
if ($chk_e->fetch()) $errors[] = 'That email address is already registered.';
}
}
if (empty($errors)) {
$pdo = get_pdo();
$smtp_host = get_setting('smtp_host');
$auto_confirm = ($smtp_host === ''); // No SMTP = skip email confirmation
$hash = password_hash($password, PASSWORD_BCRYPT);
$token = $auto_confirm ? null : bin2hex(random_bytes(32));
$pdo->prepare("
INSERT INTO users (username, email, password_hash, display_name, role, rosary_limit, email_confirmed, confirm_token)
VALUES (?, ?, ?, ?, 'user', 1, ?, ?)
")->execute([$username, $email, $hash, $display_name ?: $username, $auto_confirm ? 1 : 0, $token]);
if (!$auto_confirm && $token) {
$site_url = rtrim(get_setting('site_url'), '/');
$link = $site_url . '/confirm?token=' . urlencode($token);
$site_name = get_setting('site_name', APP_NAME);
$body_html = "
<h2 style='margin-top:0;color:#1e3a5f'>Confirm your email</h2>
<p>Hello, <strong>" . htmlspecialchars($display_name ?: $username) . "</strong>!</p>
<p>Thank you for registering with {$site_name}. Click the button below to confirm your email address:</p>
<p style='text-align:center;margin:28px 0'>
<a href='" . htmlspecialchars($link) . "' style='display:inline-block;background:#1e3a5f;color:#fff;padding:12px 28px;border-radius:6px;text-decoration:none;font-weight:600'>Confirm Email</a>
</p>
<p style='color:#6b7280;font-size:13px'>Or copy this link: " . htmlspecialchars($link) . "</p>
<p style='color:#6b7280;font-size:13px'>If you did not register, ignore this email.</p>
";
$html = email_template('Confirm your email — ' . $site_name, $body_html);
send_email($email, $display_name ?: $username, 'Confirm your email — ' . $site_name, $html);
}
$success = true;
$auto_confirmed = $auto_confirm;
}
}
}
// Refresh the timing-trap timestamp whenever the form is about to be (re)shown.
if (!$success) {
$_SESSION['reg_form_shown_at'] = time();
}
?>
<!DOCTYPE html>
<html lang="en">
@@ -107,6 +132,9 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
<link rel="icon" type="image/svg+xml" href="<?= BASE_URL ?>/favicon.svg">
<title>Register — <?= htmlspecialchars(get_setting('site_name', APP_NAME)) ?></title>
<link rel="stylesheet" href="<?= BASE_URL ?>/assets/css/setup.css">
<?php if (recaptcha_enabled()): ?>
<script src="https://www.google.com/recaptcha/api.js?render=<?= urlencode(get_setting('recaptcha_site_key')) ?>"></script>
<?php endif; ?>
</head>
<body class="login-page">
<div class="login-box" style="max-width:460px">
@@ -133,8 +161,15 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
</div>
<?php endif; ?>
<form method="post" action="<?= BASE_URL ?>/register">
<form method="post" action="<?= BASE_URL ?>/register" id="register-form">
<?= csrf_field() ?>
<?php if (recaptcha_enabled()): ?>
<input type="hidden" name="recaptcha_token" id="recaptcha_token">
<?php endif; ?>
<div style="position:absolute;left:-9999px;top:-9999px" aria-hidden="true">
<label for="website">Website</label>
<input type="text" id="website" name="website" tabindex="-1" autocomplete="off">
</div>
<div class="form-group">
<label for="username">Username <span class="required">*</span></label>
<input type="text" id="username" name="username"
@@ -176,5 +211,21 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
<?php endif; ?>
</div>
<?php if (recaptcha_enabled()): ?>
<script>
document.getElementById('register-form').addEventListener('submit', function (e) {
e.preventDefault();
var form = this;
grecaptcha.ready(function () {
grecaptcha.execute('<?= htmlspecialchars(get_setting('recaptcha_site_key')) ?>', { action: 'register' })
.then(function (token) {
document.getElementById('recaptcha_token').value = token;
form.submit();
});
});
});
</script>
<?php endif; ?>
</body>
</html>