Options saved.
\n\n"; ?>SpamKit Configuration
* */ function spamkit_badge( $return = false ) { $count = spamkit_get_count(); $baseurl = ""; if ( function_exists("get_bloginfo") ) $baseurl = get_bloginfo('siteurl'); $title = "SpamKit Plugin for Wordpress: Caught " . $count . " Spam Comments!"; $html = "
";
if ( $return ) {
return $html;
} else {
echo $html;
}
}
/**
*
* @return count from file
*/
function spamkit_get_count( ) {
$count = 0;
$name = sprintf('%08X', crc32($_SERVER['SERVER_NAME']));
if ( file_exists("/tmp/spamkit-" . $name) ) {
$handle = fopen( "/tmp/spamkit-" . $name, "r" );
if ( $handle ) {
$content = '';
while ( !feof($handle) ) {
$content .= fread( $handle, 1024 );
}
fclose( $handle );
$content = preg_replace( "/[\D]/", "", $content );
$count = intval( $content );
}
}
return $count;
}
// Hook only direct calls to this script
if ( basename($_SERVER['SCRIPT_NAME']) == "spamkit-plugin.php" ) {
$now = time();
// Test the If-Modified-Since header (if set)
if ( $_SERVER['HTTP_IF_MODIFIED_SINCE'] ) {
$if_modified_since = strtotime($_SERVER['HTTP_IF_MODIFIED_SINCE']);
if ( $if_modified_since > ($now - 60) ) {
header( "HTTP/1.0 304 Not Modified" );
exit;
}
}
$count = spamkit_get_count();
// Create image of the default badge dimensions (80x15px)
$im = imagecreate( 80, 15 );
// Sanity check, read the width & height back from the image
$width = imagesx($im);
$height = imagesy($im);
// Prepare colours
$textcolor = imagecolorallocate($im, 0, 0, 0);
$textcolor2 = imagecolorallocate($im, 255, 255, 255);
$fillcolor1 = imagecolorallocate($im, 255, 255, 255);
$fillcolor2 = imagecolorallocate($im, 255, 85, 0);
$black = imagecolorallocate($im, 0, 0, 0);
$white = imagecolorallocate($im, 255, 255, 255);
$grey = imagecolorallocate($im, 0xe0, 0xe0, 0xe0);
$metercolor = imagecolorallocate($im, 0, 240, 0);
$bordercolor = imagecolorallocate($im, 0, 0, 0);
$bordercolor2 = imagecolorallocate($im, 40, 40, 40);
// Calculate font width's
$font = 1;
$textWidth = imagefontwidth($font);
$textHeight = imagefontheight($font);
// Fill the entire image with black
imagefilledrectangle ( $im, 0, 0, $width, $height, $black );
// Fill the inner area with white leaving an outer black 'border'
imagefilledrectangle ( $im, 1, 1, $width - 2, $height - 2, $white );
// Fill the title box
imagefilledrectangle ( $im, 2, 2, 40, 12, $fillcolor2 );
// Fill the info box
imagefilledrectangle ( $im, 42, 2, $width - 3, 12, $grey );
// Draw title text
imagestring($im, $font, 4, 3, "SPAMKIT", $textcolor2);
// Draw info text
imagestring($im, $font, 43, 3, $count, $textcolor);
// Set headers
header("Expires: " . gmdate("D, d M Y H:i:s", $now + 60 ) . " GMT"); // expires in 1 minute
header("Last-Modified: " . gmdate("D, d M Y H:i:s", $now) . " GMT");
// Output image to browser
if ( function_exists('imagegif') ) {
header("Content-type: image/gif");
imagegif($im);
} else if ( function_exists('imagepng') ) {
header("Content-type: image/png");
imagepng($im);
} else if ( function_exists('imagejpeg') ) {
header("Content-type: image/jpeg");
imagejpeg($im);
}
// Destroy the image
imagedestroy($im);
exit;
}
}
/* spamkit-badge.php :: bottom */
?>
* Michael Cutler (m@cotdp.com)
*
* CHANGE LOG:
* -----------
* 2006-02-05 Gerry Added source IP to TBT to stop "zombie nets" getting
* through. Some weird tricks are afoot. Michael spotted
* these this week, expect a blog entry soon with some
* analysis at http://blog.lobstertechnology.com [v1.2]
* 2006-02-28 Gerry Changed to a class. Got rid of the DEFINEs you had to
* add to your application and shoved the neccessary state
* into the constructor. Removed mcrypt since a LOT of
* sysadmins seems to build PHP without it. Stubbed out
* implementation of RC4.
* 2006-03-01 Gerry Added proper RC4 implementation by Michael. [v1.3]
*
*/
class TimeBasedToken {
var $last_token = "";
var $last_stamp = 0;
var $last_crc = 0;
var $last_ip = "";
var $key = "";
/**
* Construct a TBT object.
* @param $key is the password to encrypt with.
*/
function TimeBasedToken( $key ) {
// In the case of the the SpamKit wordpress plugin the password
// used is derived from wordpress DB password. It makes sense
// to run this through sha1 to protect against uncovering the
// password using known-plaintext.
// Perhaps I'm being a little over-cautious :D
$this->key = sha1( $key );
}
/**
* Generate a Time Token which can be used to control access to a specific
* area of functionality etc.
* @param $offset is an offset in seconds (+ve or -ve) for the token you generate. [Optional]
* @return string token value used to limit access to a given time.
*/
function generateToken( $offset = 0 )
{
$this->last_stamp = time( ) + $offset;
$t = dechex( $this->last_stamp );
$this->last_ip = $_SERVER['REMOTE_ADDR'];
$this->last_crc = crc32($t . $this->last_ip);
$c = dechex( $this->last_crc );
$this->last_token = urlencode(base64_encode($this->rc4($this->key, $t . "|" . $this->last_ip . "|" . $c )));
return $this->last_token;
}
/**
* Get the TBT string for the current token.
* @return string version of the current TBT.
*/
function getToken( ) {
return $this->last_token;
}
/**
* Change the current TBT value we are working with for this
* TimeBasedToken object.
* @param $token is the new TBT value
*/
function setToken( $token ) {
$this->token_parse( $token );
}
/**
* Checks to see if the supplied Time Token is of the correct format and that its
* internal checksum computes to the expected value.
* @param $token is the token you want to validate
* @return boolean the result of the validation
*/
function isValid( )
{
if ( crc32( dechex($this->last_stamp) . $this->last_ip ) !=$this->last_crc ) return FALSE;
if ( strcmp( $this->last_ip, $_SERVER['REMOTE_ADDR'] ) ) return FALSE;
return TRUE;
}
/**
* Check whether a Time Token is older than the given number of seconds.
* @param $tmo_secs the Time Out (seconds) you want to check the token against.
* @return boolean result indicating if the token has timed out.
*/
function checkTimeout( $tmo_secs )
{
return (($this->last_stamp + intval($tmo_secs) <= time() )===TRUE);
}
/**
* Read the unix timestamp out of the supplied token.
* @return int of unix timestamp from token
*/
function getStamp( )
{
return $this->last_stamp;
}
/**
* Read the security hash from the supplied token
* @return string with the Hash/Security variable from token.
*/
function getHash( )
{
return $this->last_crc;
}
/**
* IP of the request is now part of the token to get around
* what seems to be distributed attacks. Will add a link to
* Michael's blog if he ever writes up an article about this.
* @return string with the IP address of the original request
*
*/
function getIP( )
{
return $this->last_ip;
}
/**
* Decrypt and parse out a TBT value into it's component parts and update
* out local globals with the values. This makes the accessor methods for
* the TBTs a little faster as we're not constantly decrypting and parsing em.
* @param $token is the TBT value to decrypt and parse out.
*/
function token_parse( $token ) {
if ( strcmp( $token, $this->last_token) == 0 ) return;
$this->last_token = $token;
$data = $this->rc4( $this->key, base64_decode(urldecode($token)) );
$data = split( "\|", $data );
$this->last_stamp = intval( hexdec( @$data[0] ));
$this->last_ip = @$data[1];
$this->last_crc = intval(hexdec( @$data[2] ));
}
/**
* A PHP implementation of RC4 based on the original C code from
* the 1994 usenet post:
*
* http://groups.google.com/groups?selm=sternCvKL4B.Hyy@netcom.com
*
* @param key_str the key as a binary string
* @param data_str the data to decrypt/encrypt as a binary string
* @return the result of the RC4 as a binary string
* @author Michael Cutler