Fix several security concerns (#1471)

* Use REMOTE_ADDR field

The other ones are not used at all. This would allow someone to spoof
the configured IP address and bypass any rate limit.

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

* Add basic ratelimiting class

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

* Remove Mautic submission form

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

* Replace captcha with ratelimiter

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

* Space + tabs

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

* Dont check if no REDIS is defined in config

Signed-off-by: Lukas Reschke <lukas@statuscode.ch>

1 files changed, 6 insertions, 38 deletions

diff --git a/page-ionossubmit.php b/page-ionossubmit.php
index 132550e3..6fcfc430 100644
--- a/page-ionossubmit.php
+++ b/page-ionossubmit.php
@@ -19,6 +19,11 @@
 </section>
 <div class="container">
 <?php
+require_once realpath(dirname(__FILE__)) . '/lib/ratelimiter.php';
+
+if(!canPerformLimitedAction("ionos-submit-action", 10)) {
+  die("Too many requests. Please try again later.");
+}
 
 class ValidationException extends Exception {};
 
@@ -47,9 +52,7 @@ if(isset($_POST['email'])) {
         !isset($_POST['email']) ||
         !isset($_POST['organization']) ||
         !isset($_POST['phone']) ||
-        !isset($_POST['address']) ||
-        !isset($_POST['checksum']) ||
-        !isset($_POST['captcha'])) {
+        !isset($_POST['address'])) {
 
         died('<li>Not all required fields are set (name, email, organization, phone number and address are required).</li>');
     }
@@ -77,22 +80,8 @@ if(isset($_POST['email'])) {
     //$branding = $_POST['branding'];
     $dollars = $_POST['dollars'];
     $terms = $_POST['terms'] === 'terms' ? 'yes' : 'no';
-    $checksum = $_POST['checksum']; // required
-    $captcha = $_POST['captcha'];
     $error_message = "";
 
-
-    if (strlen($checksum) !== 75 || !strpos($checksum, ':')) {
-        $error_message .= 'The checksum is not valid.<br />';
-    } else {
-        list($salt, $expectedHash) = explode(':', $checksum, 2);
-        $hash = hash('sha256', $salt . $captcha);
-
-        if ($hash !== $expectedHash) {
-            $error_message .= 'The captcha result you entered does not appear to be correct.<br />';
-        }
-    }
-
     $email_exp = '/^[A-Za-z0-9._%-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,10}$/';
     if(!preg_match($email_exp,$email_from)) {
         $error_message .= '<li>The email address you entered does not appear to be valid.</li>';
@@ -108,27 +97,6 @@ if(isset($_POST['email'])) {
     //   if(strlen($comments) < 8) {
     //     $error_message .= 'Your input is pretty short! <br />';
     //   }
-//       if(RECAPTCHA_SECRET !== '' && isset($_POST['g-recaptcha-response'])) {
-//         $url = 'https://www.google.com/recaptcha/api/siteverify';
-//         $ch = curl_init();
-//
-//         curl_setopt($ch, CURLOPT_URL, $url);
-//         curl_setopt($ch, CURLOPT_POST, 1);
-//         curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array('secret' => RECAPTCHA_SECRET, 'response' => $_POST['g-recaptcha-response'])));
-//         curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-//
-//         $server_output = curl_exec($ch);
-//
-//         $server_output = json_decode($server_output, true);
-//
-//         curl_close($ch);
-//
-//         if (!isset($server_output['success']) || $server_output['success'] !== true) {
-//           $error_message .= 'The captcha result was invalid.<br />';
-//         }
-//       } else {
-//         $error_message .= 'Captcha code is missing.<br />';
-//       }
 
     if ($terms !== 'yes') {
         $error_message .= '<li>Terms need to be signed.</li>';