4get-mirror/lib/bot_protection.php

<?php

class bot_protection{
	
	public function __construct($frontend, $get, $filters, $page, $output){
		
		if(config::RATELIMIT_BURST !== 0){
			
			// ratelimit requests per IP
			if(config::RATELIMIT_IP_SOURCE === false){
				
				$source = $_SERVER["REMOTE_ADDR"];
			}else{
				
				$source = $_SERVER["HTTP_" . explode(";", strtoupper(str_replace("-", "_", config::RATELIMIT_IP_SOURCE)))[0]];
			}
			
			// check if its not a local IP. Probably local tor bridge, dont ratelimit
			if(
				filter_var(
					$source,
					FILTER_VALIDATE_IP,
					FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE
				) !== false
			){
				
				$source = "r." . $source;
				
				// counter
				// resets on every req
				$counter = apcu_fetch($source);
				$counter = (int)$counter + 1;
				
				if(
					(
						CONFIG::RATELIMIT_PUNISH !== 0 &&
						$counter > config::RATELIMIT_BURST + 1
					) &&
					(
						(
							$output === false &&
							CONFIG::RATELIMIT_PUNISH_API === true
						) ||
						$output === true
					)
				){
					
					$block_time = config::RATELIMIT_TIME + (($counter - 1) * config::RATELIMIT_PUNISH);
				}else{
					
					$block_time = config::RATELIMIT_TIME;
				}
				
				apcu_store($source, $counter, $block_time);
				
				if($counter > config::RATELIMIT_BURST){
					
					apcu_inc(intdiv(time(), 3600) . ".bot_requests", 1, $s, 262800);
					
					if($output === false){
						
						http_response_code(429);
						echo json_encode([
							"status" => "You love 4get too much. Try again in " . $this->format_time($block_time) . "."
						]);
						die();
					}
					
					$payload = [
						"timetaken" => microtime(true),
						"class" => "",
						"right-left" => "",
						"right-right" => "",
						"left" =>
							'<div class="infobox">' .
								'<h1>You\'re damaging my calm</h1>' .
								'You love 4get too much. Try again in <b>' . $this->format_time($block_time) . '</b>.' .
							'</div>'
					];
					
					$frontend->loadheader(
						$get,
						$filters,
						$page,
						false
					);
					
					echo $frontend->load("search.html", $payload);
					die();
				}
			}
		}
				
		// check if we want captcha
		if(config::BOT_PROTECTION !== 1){
			
			if($output === true){
				$frontend->loadheader(
					$get,
					$filters,
					$page
				);
			}
			return;
		}
		
		/*
			Validate cookie, if it exists
		*/
		if(isset($_COOKIE["pass"])){
			
			if(
				// check if key is not malformed
				preg_match(
					'/^k[0-9]+\.[A-Za-z0-9_]{20}$/',
					$_COOKIE["pass"]
				) &&
				// does key exist
				apcu_exists($_COOKIE["pass"])
			){
				
				// exists, increment counter
				$inc = apcu_inc($_COOKIE["pass"]);
				
				// we start counting from 1
				// when it has been incremented to 102, it has reached
				// 100 reqs
				if($inc >= config::MAX_SEARCHES + 2){
					
					// reached limit, delete and give captcha
					apcu_delete($_COOKIE["pass"]);
				}else{
					
					// the cookie is OK! dont die() and give results
					if($output === true){
						$frontend->loadheader(
							$get,
							$filters,
							$page
						);
					}
					return;
				}
			}
		}
		
		if($output === false){
			
			http_response_code(401); // forbidden
			echo json_encode([
				"status" => "The \"pass\" token in your cookies is missing or has expired!!"
			]);
			die();
		}
		
		/*
			Validate form data
		*/
		$lines =
			explode(
				"\r\n",
				file_get_contents("php://input")
			);

		$invalid = false;
		$answers = [];
		$key = false;
		$error = "";

		foreach($lines as $line){
			
			$line = explode("=", $line, 2);
			
			if(count($line) !== 2){
				
				$invalid = true;
				break;
			}
			
			preg_match(
				'/^c\[([0-9]+)\]$/',
				$line[0],
				$regex
			);
			
			if(
				$line[1] != "on" ||
				!isset($regex[0][1])
			){
				
				// check if its the v key
				if(
					$line[0] == "v" &&
					preg_match(
						'/^c[0-9]+\.[A-Za-z0-9_]{20}$/',
						$line[1]
					)
				){
					
					$key = apcu_fetch($line[1]);
					apcu_delete($line[1]);
				}
				break;
			}
			
			$regex = (int)$regex[1];
			
			if(
				$regex >= 16 ||
				$regex <= -1
			){
				
				$invalid = true;
				break;
			}
			
			$answers[] = $regex;
		}
		
		// dedup
		$answers = array_unique($answers);
		
		if(
			!$invalid &&
			$key !== false // has captcha been gen'd?
		){
			$check = count($key);
			
			// validate answer
			for($i=0; $i<count($answers); $i++){
				
				if(in_array($answers[$i], $key)){
					
					$check--;
				}else{
					
					$check = -1;
					break;
				}
			}
			
			if($check === 0){
				
				// we passed the captcha
				// set cookie
				$inc = apcu_inc("cookie");
				
				$key = "k" . $inc . "." . $this->randomchars();
				
				apcu_inc($key, 1, $stupid, 86400);
				apcu_dec(intdiv(time(), 3600) . ".bot_requests", 1, $s, 262800);
				
				setcookie(
					"pass",
					$key,
					[
						"expires" => time() + 86400, // expires in 24 hours
						"samesite" => "Lax",
						"path" => "/"
					]
				);
				
				$frontend->loadheader(
					$get,
					$filters,
					$page
				);
				return;
				
			}else{
				
				$error = "<div class=\"quote\">You were <a href=\"https://www.youtube.com/watch?v=e1d7fkQx2rk\" target=\"_BLANK\" rel=\"noreferrer nofollow\">kicked out of Mensa.</a> Please try again.</div>";
			}
		}
		
		apcu_inc(intdiv(time(), 3600) . ".bot_requests", 1, $s, 262800);
		$key = "c" . apcu_inc("captcha_gen", 1) . "." . $this->randomchars();
		
		$payload = [
			"timetaken" => microtime(true),
			"class" => "",
			"right-left" => "",
			"right-right" => "",
			"left" =>
				'<div class="infobox">' .
					'<h1>IQ test</h1>' .
					'IQ test has been enabled due to bot abuse on the network.<br>' .
					'Solving this IQ test will let you make 100 searches today. I will add an invite system to bypass this soon...' .
					$error .
					'<form method="POST" enctype="text/plain" autocomplete="off">' .
						'<div class="captcha-wrapper">' .
							'<div class="captcha">' .
								'<img src="captcha?v=' . $key . '" alt="Captcha image">' .
								'<div class="captcha-controls">' .
									'<input type="checkbox" name="c[0]" id="c0">' .
									'<label for="c0"></label>' .
									'<input type="checkbox" name="c[1]" id="c1">' .
									'<label for="c1"></label>' .
									'<input type="checkbox" name="c[2]" id="c2">' .
									'<label for="c2"></label>' .
									'<input type="checkbox" name="c[3]" id="c3">' .
									'<label for="c3"></label>' .
									'<input type="checkbox" name="c[4]" id="c4">' .
									'<label for="c4"></label>' .
									'<input type="checkbox" name="c[5]" id="c5">' .
									'<label for="c5"></label>' .
									'<input type="checkbox" name="c[6]" id="c6">' .
									'<label for="c6"></label>' .
									'<input type="checkbox" name="c[7]" id="c7">' .
									'<label for="c7"></label>' .
									'<input type="checkbox" name="c[8]" id="c8">' .
									'<label for="c8"></label>' .
									'<input type="checkbox" name="c[9]" id="c9">' .
									'<label for="c9"></label>' .
									'<input type="checkbox" name="c[10]" id="c10">' .
									'<label for="c10"></label>' .
									'<input type="checkbox" name="c[11]" id="c11">' .
									'<label for="c11"></label>' .
									'<input type="checkbox" name="c[12]" id="c12">' .
									'<label for="c12"></label>' .
									'<input type="checkbox" name="c[13]" id="c13">' .
									'<label for="c13"></label>' .
									'<input type="checkbox" name="c[14]" id="c14">' .
									'<label for="c14"></label>' .
									'<input type="checkbox" name="c[15]" id="c15">' .
									'<label for="c15"></label>' .
								'</div>' .
							'</div>' .
						'</div>' .
						'<input type="hidden" name="v" value="' . $key . '">' .
						'<input type="submit" value="Check IQ" class="captcha-submit">' .
					'</form>' .
				'</div>'
		];
		
		$frontend->loadheader(
			$get,
			$filters,
			$page,
			false
		);
		
		echo $frontend->load("search.html", $payload);
		die();
	}
	
	private function format_time($seconds){
		
		$hours = floor($seconds / 3600);
		$minutes = floor(($seconds % 3600) / 60);
		$secs = $seconds % 60;
		
		if($hours > 0){
			
			return sprintf('%dh%02dm%02ds', $hours, $minutes, $secs);
		}
		
		return sprintf('%dm%02ds', $minutes, $secs);
	}
	
	private function randomchars(){
		
		$chars =
			array_merge(
				range("A", "Z"),
				range("a", "z"),
				range(0, 9)
			);
		
		$chars[] = "_";
		
		$c = count($chars) - 1;
		
		$key = "";
		
		for($i=0; $i<20; $i++){
			
			$key .= $chars[random_int(0, $c)];
		}
		
		return $key;
	}
}