Add some spam protection measures, aimed at stopping spam from new users

Should fix #145 for the time being.

src/Helpers/Utils.php

@@ -50,7 +50,7 @@ class Utils
                 $warning .= "Since cgit might be self-hosted, we can't be sure that \"$repo_url\" is a valid cgit URL. $light_warning_suffix\n";
                 return "$repo_url/snapshot/$commit.zip";
             case 'Custom':
-                if (sizeof(preg_grep('/^https?:\/\/.+?.zip$/', [$commit])) == 0) {
+                if (sizeof(preg_grep('/^https?:\/\/.+?\.zip$/', [$commit])) == 0) {
                     $warning .= "\"$commit\" doesn't look correct; it should be similar to \"http<s>://<url>.zip\". $warning_suffix\n";
                 }
                 return "$commit";

src/constants.php

@@ -33,6 +33,7 @@ return $constants = [
     ]),
     'user_type' => double_map([
         'normal' => 0,
+        'verified' => 5,
         'editor' => 25,
         'moderator' => 50,
         'admin' => 100,

src/queries.php

@@ -11,6 +11,8 @@ return [
         'set_reset_token' => 'UPDATE `as_users` SET reset_token = :reset_token WHERE user_id = :id',
         'set_password_and_nullify_session' => 'UPDATE `as_users` SET password_hash = :password_hash, session_token = null WHERE user_id = :id',
         'register' => 'INSERT INTO `as_users` SET username = :username, email = :email, password_hash = :password_hash',
+        'promote' => 'UPDATE `as_users` SET type = :type WHERE user_id = :id AND type < :type',
+        // 'demote' => 'UPDATE `as_users` SET type = :type WHERE user_id = :id AND type > :type',
         'list_edit_events' => 'SELECT edit_id, asset_id, COALESCE(`as_asset_edits`.title, `as_assets`.title) AS title, category, COALESCE(`as_asset_edits`.version_string, `as_assets`.version_string) AS version_string, COALESCE(`as_asset_edits`.icon_url, `as_assets`.icon_url) AS icon_url, status, reason FROM `as_asset_edits`
             LEFT JOIN `as_assets` USING (asset_id)
             LEFT JOIN `as_categories` ON `as_categories`.category_id = COALESCE(`as_asset_edits`.category_id, `as_assets`.category_id)

src/routes/asset_edit.php

@@ -88,6 +88,33 @@ function _insert_asset_edit_fields($c, $error, &$response, $query, $body, $requi
         }
     }
 
+    $warning = '';
+    if (isset($body['browse_url'])) {
+        if ((isset($body['download_provider']) && isset($body['download_commit'])) || $bare_asset !== null) {
+            $default_issues_url = $c->utils->getComputedDownloadUrl(
+                $body['browse_url'] ?: $bare_asset['browse_url'],
+                intval($body['download_provider'] ?: $bare_asset['download_provider']),
+                $body['download_commit'] ?: $bare_asset['download_commit'],
+                $warning
+            );
+        }
+    }
+    if (isset($body['icon_url'])) {
+        $icon_url = $body['icon_url'];
+        if (sizeof(preg_grep('/^https?:\/\/.+?\.(png|jpg|jpeg)$/', [$icon_url])) == 0) {
+            $warning .= "\"$icon_url\" doesn't look correct; it should be similar to \"http<s>://<url>.<png/jpg>\". Make sure the icon URL is correct.\n";
+        }
+    }
+
+    if ($warning != '') {
+        $entity = $bare_asset == null ? 'asset' : 'edit';
+        $error = $c->utils->ensureLoggedIn($error, $response, $body, $user);
+        $error = $c->utils->errorResponseIfNotUserHasLevel($error, $response, $user, 'verified', "Due to spam problems, we have to reject your $entity because it uses invalid repository URL: \n$warning \nPlease contact the community administrators if this is not spam.");
+        if ($error) {
+            return $response;
+        }
+    }
+
 
     if (isset($body['issues_url'])) {
         $default_issues_url = null;
@@ -810,6 +837,18 @@ $app->post('/asset/edit/{id:[0-9]+}/accept', function ($request, $response, $arg
         }
     }
 
+    // Mark the user submitting the asset as "verified"
+    $query_verify = $this->queries['user']['promote'];
+
+    $query_verify->bindValue(':id', (int) $asset_edit['user_id'], PDO::PARAM_INT);
+    $query_verify->bindValue(':type', (int) $this->constants['user_type']['verified'], PDO::PARAM_INT);
+
+    $query_verify->execute();
+    $error = $this->utils->errorResponseIfQueryBad(false, $response, $query_verify);
+    if ($error) {
+        return $response;
+    }
+
     return $response->withJson([
         'id' => $asset_edit['asset_id'],
         'url' => 'asset/' . $asset_edit['asset_id'],

templates/asset_edit.phtml

@@ -21,7 +21,7 @@ $preview_field_names = [
 
 <?php function output_field($data, $name, $categories = []) { ?>
     <?php if (strpos($name, 'url') !== false || strpos($name, 'link') !== false || strpos($name, 'thumbnail') !== false) { ?>
-        <a href="<?php echo esc($data) ?>"><?php echo esc($data) ?></a>
+        <a href="<?php echo esc($data) ?>" rel="nofollow"><?php echo esc($data) ?></a>
         <?php if ($name == 'icon_url') { ?>
             <br><img src="<?php echo esc($data) ?>" width="80" height="80"></a>
         <?php }?>

templates/error.phtml

@@ -1,5 +1,5 @@
 <?php include("_header.phtml") ?>
 <div class="alert alert-danger">
-    <strong>Error:</strong> <?php echo esc($data['error']) ?>
+    <strong>Error:</strong> <?php echo nl2br(esc($data['error'])) ?>
 </div>
 <?php include("_footer.phtml") ?>