1
Chit Chat / Re: Tips for Bots
Last post by Steeley -First thing you need is a directory-privacy feature (htaccess, in Apache, for example). C-Panel makes it easy to manage. However, that's not something ElkArte can do.. you create the protected directory on your server, and then tuck ElkArte behind it.. It's the directory-privacy feature that keeps the bots out and away from ElkArte (and anything else you don't want the unwashed masses to access). It's not the most secure way, but I've not yet had anyone try to "hack in" (except valid users that couldn't remember their credentials.. eventually they send me an email or another access request..)
Then you need some software routines to support your validation of people that will have access to the protected area..
email-code.php (located in cgi-bin)
Code: [Select]
<?php
if(!isset($_POST['submit']))
{
//This page should not be accessed directly. Need to submit the form.
echo "error; you need to submit the form!";
}
$visitor_email = $_POST['email'];
$message = rand(100000, 999999);
//Validate first
if(empty($visitor_email))
{
echo "Email address is mandatory!";
exit;
}
if (!strstr($visitor_email, '@'))
{
echo "EMail Format is Incorrect - missing @ - press back button and try again";
exit;
}
if (strpos($visitor_email, ','))
{
echo "EMail Format is Incorrect - contains a comma - press back button and try again";
exit;
}
if(IsInjected($visitor_email))
{
echo "Bad email value!";
exit;
}
$email_from = 'no-reply@domain.url';
$email_subject = "Validation Code";
$email_body =
"Copy the following validation code into the request form. \n".
"(If you did not request a code, someone entered an incorrect email address,\n". "please accept our apologies and delete this email.) \n".
"Validation Code: $message. \n".
"Submitter address: \n".
$to = "$visitor_email \r\n";
$headers = "From: no_reply@domain.url \r\n";
$headers .= "Reply-To: no_reply@domain.url \r\n";
$headers .= "Bcc: access@domain.url \r\n"; //(goes to admin to match with later applicant form)
//Send the email!
mail($to,$email_subject,$email_body,$headers);
//done. redirect to code-pending page.
header('Location: ../pending.html');
form-to-email.php (located in cgi-bin)
Code: [Select]
<?php
if(!isset($_POST['submit']))
{
//This page should not be accessed directly. Need to submit the form.
echo "error; you need to submit the form!";
}
$Fname = $_POST['First'];
$Lname = $_POST['Last'];
$visitor_email = $_POST['email'];
$code = $_POST['code'];
$username = $_POST['Nick'];
//{other fields you want here}
$message = $_POST['Narrative'];
//Validate first
if(empty($Fname))
{
echo "First name is required! Please press back button and correct";
exit;
}
if(strpos($Fname, '_'))
{
echo "Valid first and last name is required! Please press back button and correct";
exit;
}
if(empty($Lname))
{
echo "Last name is required! Please press back button and correct";
exit;
}
if(strpos($Lname, '_'))
{
echo "Valid last name is required! Please press back button and correct";
exit;
}
if(empty($visitor_email))
{
echo "Email is required! Please press back button and correct";
exit;
}
if(IsInjected($visitor_email))
{
echo "Bad email value!";
exit;
}
if(empty($code))
{
echo "Verification Code is required. Please press back button and correct";
exit;
}
if(empty($username))
{
echo "If you do not provide a nickname/username, you might not like what we assign. Please press back button and correct";
exit;
}
if(strpos($username, '/'))
{
echo "If you do not provide a nickname/username, you might not like what we assign. Please press back button and correct";
exit;
}
//if(empty{otherfields}))
//{
// echo "Tthis data is required! Please press back button and correct";
// exit;
//}
$email_from = 'no-reply@domain.url';
$email_subject = "Access Request";
$email_body = "$Fname $Lname has submitted the following information for access: \n".
"EMail Address: $visitor_email \n".
"Validation code: $code \n".
"Username: $username \n".
//etc.. for additional fields
"$username says: \n $message \n".
$to = "access@domain.msg \r\n";
$headers = "From: $email_from \r\n";
$headers .= "Reply-To: $visitor_email \r\n";
//Send the email!
mail($to,$email_subject,$email_body,$headers);
//done. redirect to submitted page.
header('Location: ../submitted.html');
// Function to validate against any email injection attempts
function IsInjected($str)
{
$injections = array('(\n+)',
'(\r+)',
'(\t+)',
'(%0A+)',
'(%0D+)',
'(%08+)',
'(%09+)'
);
$inject = join('|', $injections);
$inject = "/$inject/i";
if(preg_match($inject,$str))
{
return true;
}
else
{
return false;
}
}
?>
gen_validatorv31.js is located in cgi-bin/scripts for form validation
And of course, html pages
web form for email addy that will drive the above
gets email addy, assign code and send email..
working guts are:
Code: [Select]
(snip)
<SCRIPT language=JavaScript type=text/javascript
src="scripts/gen_validatorv31.js"></SCRIPT>
</HEAD>
<BODY >
(your instructions and formatting here..)
<TBODY>
<TR>
<TD><!-- Start code for the form-->
<DIV align=center>
<FORM method=post name="EMail Address Verification"
action=../cgi-bin/email-code.php>
<P>STEP 1</P>
<P><LABEL for=email>Enter Your Email Address
(carefully)</LABEL><BR><INPUT style="HEIGHT: 22px; WIDTH: 338px"
size=21 name=email> </P>
<P></P><INPUT type=submit value=submit name=submit> </FORM></DIV>
<SCRIPT language=JavaScript>
var frmvalidator = new Validator("EMail Address Verification");
frmvalidator.addValidation("email","req","Please provide your email");
frmvalidator.addValidation("email","email","Please enter a valid email address");
</SCRIPT>
Submit brings up a "pending" webpage, tells submitter to get the email sent, and then click on "I have the code".
When they click on that, it brings up the authorization-data html form.
That form contains the same form structure as the form above, but with different fields, and calls a different form-email routine
Code: [Select]
snip
<TD><!-- Start code for the form-->
<DIV align=center>
<FORM method=post name="Access Data"
action=../cgi-bin/form-to-email.php>
but with other fields (first name, last name, nickname/username, and any other pertinent information you desire to validate the applicant. Upon submit, it calls form-to-email.php, instead of email-code.php, and sends the applicant to a "success" page, informing them to wait for another email with their authorization data. and what to do with it to get into the "restricted section" behind the htaccess-directory check..
Of course, you would want to customize your authorization webpages to your needs, but the crux of the code is above.. it's simple stuff, really.. for example, I tell users to let their webbrowser remember the authorization data so it's just one extra mouse click to get into the restricted area. (HOWEVER - the ducklduckgo webbrowser - and maybe others - doesn't know wtf a directory-access prompts looks like so it doesn't bring up the username password like it does for other account-access prompts). Edge, Chrome, Firefox etc. does.
EDIT: OH, and you have have to configure mail.php to send smtp mail through your mail server, simple in concept, but your actual mileage may vary..
