You do not have to verify this CAPTCHA.
'; exit; } } } // --- end whitelist early-return --- // ---------------- ENV / SESSIONS ---------------- $secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'); $remote_addr = $_SERVER['REMOTE_ADDR'] ?? ''; // Get client IP taking trusted proxies into account (first non-empty entry in X-Forwarded-For) function get_client_ip(string $remote_addr, array $trusted_proxies): string { if (!empty($trusted_proxies) && in_array($remote_addr, $trusted_proxies, true) && !empty($_SERVER['HTTP_X_FORWARDED_FOR'])) { $xff = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']); foreach ($xff as $ip) { $ip = trim($ip); if ($ip !== '') return $ip; } } return $remote_addr; } $client_ip = get_client_ip($remote_addr, $TRUSTED_PROXIES); if (!$secure && !empty($TRUSTED_PROXIES) && in_array($remote_addr, $TRUSTED_PROXIES, true)) { if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') $secure = true; } session_name('vichan_sess'); session_set_cookie_params([ 'lifetime' => 0, 'path' => '/', 'domain' => '', 'secure' => $secure, 'httponly' => true, 'samesite' => 'Lax', ]); session_start(); if (!isset($_SESSION['captcha_meta'])) $_SESSION['captcha_meta'] = ['failures' => 0, 'last_failure' => 0, 'last_generated' => 0]; $meta =& $_SESSION['captcha_meta']; if (!isset($_SESSION['ip_meta'])) $_SESSION['ip_meta'] = ['addr' => $client_ip, 'failures' => 0, 'last_failure' => 0]; $ip_meta =& $_SESSION['ip_meta']; if (!isset($_SESSION['csrf_token'])) $_SESSION['csrf_token'] = bin2hex(random_bytes(16)); // If client is whitelisted, mark session as whitelisted function is_whitelisted(string $client_ip, array $whitelist): bool { if (empty($whitelist)) return false; foreach ($whitelist as $w) { if ($w === $client_ip) return true; } return false; } $client_is_whitelisted = is_whitelisted($client_ip, $WHITELISTED_IPS); if ($client_is_whitelisted) { // set a deterministic-but-random-looking token to indicate verified if (empty($_SESSION['captcha_verified_token'])) { $_SESSION['captcha_verified_token'] = 'whitelist:' . bin2hex(hash('sha256', $client_ip . ($_SESSION['csrf_token'] ?? ''))); } } // ---------------- HELPERS ---------------- function json_out($arr) { header('Content-Type: application/json; charset=utf-8'); echo json_encode($arr); exit; } function safe($s){ return htmlspecialchars((string)$s, ENT_QUOTES, 'UTF-8'); } function is_cooldown($meta, $max, $cooldown) { return ($meta['failures'] >= $max) && ((time() - $meta['last_failure']) < $cooldown); } function is_ip_cooldown($ip_meta, $max, $cooldown) { return ($ip_meta['failures'] >= $max) && ((time() - $ip_meta['last_failure']) < $cooldown); } function captcha_is_expired(array $meta, int $ttl): bool { if (empty($meta['last_generated'])) return true; return (time() - (int)$meta['last_generated']) > $ttl; } // ---------------- ROUTING ---------------- $method = $_SERVER['REQUEST_METHOD'] ?? 'GET'; // ---------- IMAGE GENERATION ---------- if (isset($_GET['img'])) { // If whitelisted, we can either serve no image or still serve one; here we serve a tiny transparent image to avoid wasted generation if ($client_is_whitelisted) { while (ob_get_level()) ob_end_clean(); header('Content-Type: image/png'); $tmp = imagecreatetruecolor(1, 1); imagesavealpha($tmp, true); $transparent = imagecolorallocatealpha($tmp, 0, 0, 0, 127); imagefilledrectangle($tmp, 0, 0, 1, 1, $transparent); imagepng($tmp); imagedestroy($tmp); exit; } if (is_cooldown($meta, $MAX_FAILURES_BLOCK, $COOLDOWN_SECONDS) || is_ip_cooldown($ip_meta, $MAX_FAILURES_BLOCK * 2, $COOLDOWN_SECONDS)) { while (ob_get_level()) ob_end_clean(); header('Content-Type: image/png'); $tmp = imagecreatetruecolor($width, $height); imagesavealpha($tmp, true); $transparent = imagecolorallocatealpha($tmp, 0, 0, 0, 127); imagefilledrectangle($tmp, 0, 0, $width, $height, $transparent); imagepng($tmp); imagedestroy($tmp); exit; } // generate code and persist $code = ''; $maxc = strlen($chars) - 1; for ($i = 0; $i < $length; $i++) $code .= $chars[random_int(0, $maxc)]; $_SESSION['vichan_captcha'] = strtolower($code); $_SESSION['captcha_meta']['last_generated'] = time(); unset($_SESSION['captcha_verified_token']); session_write_close(); // base image $image = imagecreatetruecolor($width, $height); imagesavealpha($image, true); imagealphablending($image, true); $bg = imagecolorallocate($image, 240, 240, 240); $fg = imagecolorallocate($image, 30, 30, 30); $noise1 = imagecolorallocate($image, 180, 180, 180); $noise2 = imagecolorallocate($image, 200, 200, 255); imagefilledrectangle($image, 0, 0, $width, $height, $bg); for ($i = 0; $i < 150; $i++) imagesetpixel($image, random_int(0, $width - 1), random_int(0, $height - 1), $noise1); for ($i = 0; $i < 6; $i++) imageline($image, random_int(0, $width - 1), random_int(0, $height - 1), random_int(0, $width - 1), random_int(0, $height - 1), $noise2); $boxSize = (int)($width / $length); for ($i = 0; $i < $length; $i++) { $angle = random_int(-25, 25); $size = random_int(20, 28); $x = 8 + $i * $boxSize + random_int(-3, 3); $y = (int)(($height / 2) + random_int(8, 12)); if (file_exists($font)) { imagettftext($image, $size, $angle, $x, $y, $fg, $font, $code[$i]); } else { $ys = $y - 18; $ys = max(0, min($height - imagefontheight(5), $ys)); imagestring($image, 5, $x, $ys, $code[$i], $fg); } } // distorted destination with preserved alpha and cached allocations $distorted = imagecreatetruecolor($width, $height); imagesavealpha($distorted, true); imagealphablending($distorted, false); $bg2 = imagecolorallocatealpha($distorted, 240, 240, 240, 0); imagefilledrectangle($distorted, 0, 0, $width, $height, $bg2); $t = microtime(true); $colorCache = []; for ($x = 0; $x < $width; $x++) { for ($y = 0; $y < $height; $y++) { $offsetX = (int)(sin($y / 8 + $t) * 2); $offsetY = (int)(cos($x / 8 + $t) * 2); $sx = $x + $offsetX; $sy = $y + $offsetY; if ($sx >= 0 && $sx < $width && $sy >= 0 && $sy < $height) { $colIndex = imagecolorat($image, $sx, $sy); if (!isset($colorCache[$colIndex])) { $r = ($colIndex >> 16) & 0xFF; $g = ($colIndex >> 8) & 0xFF; $b = $colIndex & 0xFF; $colorCache[$colIndex] = imagecolorallocate($distorted, $r, $g, $b); } imagesetpixel($distorted, $x, $y, $colorCache[$colIndex]); } } } while (ob_get_level()) ob_end_clean(); header('Content-Type: image/png'); header('Cache-Control: no-cache, no-store, must-revalidate'); header('Pragma: no-cache'); header('Expires: 0'); imagepng($distorted); imagedestroy($image); imagedestroy($distorted); exit; } // ---------- AJAX VERIFY ---------- if ($method === 'POST' && isset($_POST['action']) && $_POST['action'] === 'verify') { $csrf = $_POST['csrf_token'] ?? ''; if (!hash_equals((string)($_SESSION['csrf_token'] ?? ''), (string)$csrf)) json_out(['ok' => false, 'reason' => 'csrf']); // If whitelisted, short-circuit with ok and existing verified token if ($client_is_whitelisted && !empty($_SESSION['captcha_verified_token'])) { json_out(['ok' => true, 'token' => $_SESSION['captcha_verified_token']]); } if (is_cooldown($meta, $MAX_FAILURES_BLOCK, $COOLDOWN_SECONDS) || is_ip_cooldown($ip_meta, $MAX_FAILURES_BLOCK * 2, $COOLDOWN_SECONDS)) json_out(['ok' => false, 'reason' => 'cooldown']); $provided = isset($_POST['captcha']) ? strtolower(trim((string)$_POST['captcha'])) : ''; $expected = isset($_SESSION['vichan_captcha']) ? (string)$_SESSION['vichan_captcha'] : ''; if ($expected === '' || strlen($expected) !== $length || captcha_is_expired($_SESSION['captcha_meta'], $CAPTCHA_TTL)) { $meta['failures']++; $meta['last_failure'] = time(); $ip_meta['failures']++; $ip_meta['last_failure'] = time(); json_out(['ok' => false, 'reason' => 'expired']); } $ok = ($provided !== '' && strlen($provided) === $length && hash_equals($expected, $provided)); if ($ok) { $token = bin2hex(random_bytes(16)); $_SESSION['captcha_verified_token'] = $token; unset($_SESSION['vichan_captcha']); json_out(['ok' => true, 'token' => $token]); } $meta['failures']++; $meta['last_failure'] = time(); $ip_meta['failures']++; $ip_meta['last_failure'] = time(); json_out(['ok' => false]); } // ---------- FINAL POST ---------- $err = ''; $success = ''; if ($method === 'POST' && (!isset($_POST['action']) || $_POST['action'] !== 'verify')) { $csrf = $_POST['csrf_token'] ?? ''; if (!hash_equals((string)($_SESSION['csrf_token'] ?? ''), (string)$csrf)) { http_response_code(400); $err = 'Bad request.'; } elseif (is_cooldown($meta, $MAX_FAILURES_BLOCK, $COOLDOWN_SECONDS) || is_ip_cooldown($ip_meta, $MAX_FAILURES_BLOCK * 2, $COOLDOWN_SECONDS)) { http_response_code(429); $err = 'Too many attempts. Try again later.'; } else { $posted_token = $_POST['captcha_token'] ?? ''; $session_token = $_SESSION['captcha_verified_token'] ?? ''; $provided = isset($_POST['captcha']) ? strtolower(trim((string)$_POST['captcha'])) : ''; $expected = isset($_SESSION['vichan_captcha']) ? (string)$_SESSION['vichan_captcha'] : null; // If client is whitelisted, treat as verified regardless of provided captcha if ($client_is_whitelisted && !empty($session_token)) { // clear ephemeral captcha state but keep success unset($_SESSION['vichan_captcha']); $meta['failures'] = 0; $meta['last_failure'] = 0; $ip_meta['failures'] = 0; $ip_meta['last_failure'] = 0; session_regenerate_id(true); $success = 'Post created (simulated).'; } else { // short/long immediate reject if ($provided === '' || strlen($provided) !== $length) { $meta['failures']++; $meta['last_failure'] = time(); $ip_meta['failures']++; $ip_meta['last_failure'] = time(); error_log("CAPTCHA debug: provided=\"{$provided}\" len=" . strlen($provided) . " expected=\"" . ($expected ?? 'null') . "\" last_gen=" . ($_SESSION['captcha_meta']['last_generated'] ?? 'none')); $err = 'Captcha did not match.'; } else { $verified_ok = ($posted_token !== '' && $session_token !== '' && hash_equals($session_token, $posted_token)); $direct_ok = false; if (!$verified_ok) { if (is_string($expected) && $expected !== '' && strlen($expected) === $length && !captcha_is_expired($_SESSION['captcha_meta'], $CAPTCHA_TTL)) { if (hash_equals($expected, $provided)) $direct_ok = true; } } if (!$verified_ok && !$direct_ok) { $meta['failures']++; $meta['last_failure'] = time(); $ip_meta['failures']++; $ip_meta['last_failure'] = time(); $err = 'Captcha did not match.'; } else { if ($verified_ok) unset($_SESSION['captcha_verified_token']); unset($_SESSION['vichan_captcha']); $meta['failures'] = 0; $meta['last_failure'] = 0; $ip_meta['failures'] = 0; $ip_meta['last_failure'] = 0; session_regenerate_id(true); // TODO: actual post creation logic goes here. $success = 'Post created (simulated).'; } } } } } ?>