1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
|
<?php
/**
* ConfirmEdit MediaWiki extension.
*
* This is a framework that holds a variety of CAPTCHA tools. The
* default one, 'SimpleCaptcha', is not intended as a production-
* level CAPTCHA system, and another one of the options provided
* should be used in its place for any real usages.
*
* Copyright (C) 2005-2007 Brion Vibber <brion@wikimedia.org>
* http://www.mediawiki.org/
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License along
* with this program; if not, write to the Free Software Foundation, Inc.,
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
* http://www.gnu.org/copyleft/gpl.html
*
* @file
* @ingroup Extensions
*/
if ( !defined( 'MEDIAWIKI' ) ) {
exit;
}
$wgExtensionFunctions[] = 'confirmEditSetup';
$wgExtensionCredits['antispam'][] = array(
'path' => __FILE__,
'name' => 'ConfirmEdit',
'author' => array( 'Brion Vibber', '...' ),
'url' => 'https://www.mediawiki.org/wiki/Extension:ConfirmEdit',
'version' => '1.1',
'descriptionmsg' => 'captcha-desc',
);
/**
* The 'skipcaptcha' permission key can be given out to
* let known-good users perform triggering actions without
* having to go through the captcha.
*
* By default, sysops and registered bot accounts will be
* able to skip, while others have to go through it.
*/
$wgGroupPermissions['*' ]['skipcaptcha'] = false;
$wgGroupPermissions['user' ]['skipcaptcha'] = false;
$wgGroupPermissions['autoconfirmed']['skipcaptcha'] = false;
$wgGroupPermissions['bot' ]['skipcaptcha'] = true; // registered bots
$wgGroupPermissions['sysop' ]['skipcaptcha'] = true;
$wgAvailableRights[] = 'skipcaptcha';
/**
* List of IP ranges to allow to skip the captcha, similar to the group setting:
* "$wgGroupPermission[...]['skipcaptcha'] = true"
*
* Specific IP addresses or CIDR-style ranges may be used,
* for instance:
* $wgCaptchaWhitelistIP = array('192.168.1.0/24', '10.1.0.0/16');
*/
$wgCaptchaWhitelistIP = false;
$wgCaptcha = null;
$wgCaptchaClass = 'SimpleCaptcha';
/**
* Actions which can trigger a captcha
*
* If the 'edit' trigger is on, *every* edit will trigger the captcha.
* This may be useful for protecting against vandalbot attacks.
*
* If using the default 'addurl' trigger, the captcha will trigger on
* edits that include URLs that aren't in the current version of the page.
* This should catch automated linkspammers without annoying people when
* they make more typical edits.
*
* The captcha code should not use $wgCaptchaTriggers, but CaptchaTriggers()
* which also takes into account per namespace triggering.
*/
$wgCaptchaTriggers = array();
$wgCaptchaTriggers['edit'] = false; // Would check on every edit
$wgCaptchaTriggers['create'] = false; // Check on page creation.
$wgCaptchaTriggers['sendemail'] = false; // Special:Emailuser
$wgCaptchaTriggers['addurl'] = true; // Check on edits that add URLs
$wgCaptchaTriggers['createaccount'] = true; // Special:Userlogin&type=signup
$wgCaptchaTriggers['badlogin'] = true; // Special:Userlogin after failure
/**
* You may wish to apply special rules for captcha triggering on some namespaces.
* $wgCaptchaTriggersOnNamespace[<namespace id>][<trigger>] forces an always on /
* always off configuration with that trigger for the given namespace.
* Leave unset to use the global options ($wgCaptchaTriggers).
*
* Shall not be used with 'createaccount' (it is not checked).
*/
$wgCaptchaTriggersOnNamespace = array();
# Example:
# $wgCaptchaTriggersOnNamespace[NS_TALK]['create'] = false; //Allow creation of talk pages without captchas.
# $wgCaptchaTriggersOnNamespace[NS_PROJECT]['edit'] = true; //Show captcha whenever editing Project pages.
/**
* Indicate how to store per-session data required to match up the
* internal captcha data with the editor.
*
* 'CaptchaSessionStore' uses PHP's session storage, which is cookie-based
* and may fail for anons with cookies disabled.
*
* 'CaptchaCacheStore' uses $wgMemc, which avoids the cookie dependency
* but may be fragile depending on cache configuration.
*/
$wgCaptchaStorageClass = 'CaptchaSessionStore';
/**
* Number of seconds a captcha session should last in the data cache
* before expiring when managing through CaptchaCacheStore class.
*
* Default is a half hour.
*/
$wgCaptchaSessionExpiration = 30 * 60;
/**
* Number of seconds after a bad login that a captcha will be shown to
* that client on the login form to slow down password-guessing bots.
*
* Has no effect if 'badlogin' is disabled in $wgCaptchaTriggers or
* if there is not a caching engine enabled.
*
* Default is five minutes.
*/
$wgCaptchaBadLoginExpiration = 5 * 60;
/**
* Allow users who have confirmed their e-mail addresses to post
* URL links without being harassed by the captcha.
*/
$ceAllowConfirmedEmail = false;
/**
* Number of bad login attempts before triggering the captcha. 0 means the
* captcha is presented on the first login.
*/
$wgCaptchaBadLoginAttempts = 3;
/**
* Regex to whitelist URLs to known-good sites...
* For instance:
* $wgCaptchaWhitelist = '#^https?://([a-z0-9-]+\\.)?(wikimedia|wikipedia)\.org/#i';
* Local admins can define a whitelist under [[MediaWiki:captcha-addurl-whitelist]]
*/
$wgCaptchaWhitelist = false;
/**
* Additional regexes to check for. Use full regexes; can match things
* other than URLs such as junk edits.
*
* If the new version matches one and the old version doesn't,
* toss up the captcha screen.
*
* @fixme Add a message for local admins to add items as well.
*/
$wgCaptchaRegexes = array();
/** Register special page */
$wgSpecialPages['Captcha'] = 'CaptchaSpecialPage';
$wgConfirmEditIP = dirname( __FILE__ );
$wgExtensionMessagesFiles['ConfirmEdit'] = "$wgConfirmEditIP/ConfirmEdit.i18n.php";
$wgExtensionMessagesFiles['ConfirmEditAlias'] = "$wgConfirmEditIP/ConfirmEdit.alias.php";
$wgHooks['EditFilterMerged'][] = 'ConfirmEditHooks::confirmEditMerged';
$wgHooks['UserCreateForm'][] = 'ConfirmEditHooks::injectUserCreate';
$wgHooks['AbortNewAccount'][] = 'ConfirmEditHooks::confirmUserCreate';
$wgHooks['LoginAuthenticateAudit'][] = 'ConfirmEditHooks::triggerUserLogin';
$wgHooks['UserLoginForm'][] = 'ConfirmEditHooks::injectUserLogin';
$wgHooks['AbortLogin'][] = 'ConfirmEditHooks::confirmUserLogin';
$wgHooks['EmailUserForm'][] = 'ConfirmEditHooks::injectEmailUser';
$wgHooks['EmailUser'][] = 'ConfirmEditHooks::confirmEmailUser';
# Register API hook
$wgHooks['APIEditBeforeSave'][] = 'ConfirmEditHooks::confirmEditAPI';
$wgHooks['APIGetAllowedParams'][] = 'ConfirmEditHooks::APIGetAllowedParams';
$wgHooks['APIGetParamDescription'][] = 'ConfirmEditHooks::APIGetParamDescription';
$wgAutoloadClasses['ConfirmEditHooks'] = "$wgConfirmEditIP/ConfirmEditHooks.php";
$wgAutoloadClasses['SimpleCaptcha'] = "$wgConfirmEditIP/Captcha.php";
$wgAutoloadClasses['CaptchaStore'] = "$wgConfirmEditIP/CaptchaStore.php";
$wgAutoloadClasses['CaptchaSessionStore'] = "$wgConfirmEditIP/CaptchaStore.php";
$wgAutoloadClasses['CaptchaCacheStore'] = "$wgConfirmEditIP/CaptchaStore.php";
$wgAutoloadClasses['CaptchaSpecialPage'] = "$wgConfirmEditIP/ConfirmEditHooks.php";
$wgAutoloadClasses['HTMLCaptchaField'] = "$wgConfirmEditIP/HTMLCaptchaField.php";
/**
* Set up $wgWhitelistRead
*/
function confirmEditSetup() {
global $wgGroupPermissions, $wgCaptchaTriggers;
if ( !$wgGroupPermissions['*']['read'] && $wgCaptchaTriggers['badlogin'] ) {
// We need to ensure that the captcha interface is accessible
// so that unauthenticated users can actually get in after a
// mistaken password typing.
global $wgWhitelistRead;
$image = SpecialPage::getTitleFor( 'Captcha', 'image' );
$help = SpecialPage::getTitleFor( 'Captcha', 'help' );
$wgWhitelistRead[] = $image->getPrefixedText();
$wgWhitelistRead[] = $help->getPrefixedText();
}
}
|
