Limit project creation on public page by ip adress

htdocs/install/mysql/migration/16.0.0-17.0.0.sql

@@ -64,6 +64,7 @@ UPDATE llx_c_paiement SET code = 'BANCON' WHERE code = 'BAN' AND libelle = 'Banc
 
 ALTER TABLE llx_partnership ADD COLUMN ip varchar(250);
 ALTER TABLE llx_adherent ADD COLUMN ip varchar(250);
+ALTER TABLE llx_projet ADD COLUMN ip varchar(250);
 
 ALTER TABLE llx_fichinterdet_rec DROP COLUMN remise;
 ALTER TABLE llx_fichinterdet_rec DROP COLUMN fk_export_commpta;

htdocs/projet/class/project.class.php

@@ -308,7 +308,7 @@ class Project extends CommonObject
 		'fk_user_modif' =>array('type'=>'integer', 'label'=>'UserModification', 'enabled'=>1, 'visible'=>0, 'position'=>415),
 		'import_key' =>array('type'=>'varchar(14)', 'label'=>'ImportId', 'enabled'=>1, 'visible'=>0, 'position'=>420),
 		'email_msgid'=>array('type'=>'varchar(255)', 'label'=>'EmailMsgID', 'enabled'=>1, 'visible'=>-1, 'position'=>450, 'help'=>'EmailMsgIDWhenSourceisEmail'),
-		'fk_statut' =>array('type'=>'smallint(6)', 'label'=>'Status', 'enabled'=>1, 'visible'=>1, 'notnull'=>1, 'position'=>500)
+		'fk_statut' =>array('type'=>'smallint(6)', 'label'=>'Status', 'enabled'=>1, 'visible'=>1, 'notnull'=>1, 'position'=>500),
 	);
 	// END MODULEBUILDER PROPERTIES
 
@@ -435,6 +435,7 @@ class Project extends CommonObject
 		$sql .= ", note_private";
 		$sql .= ", note_public";
 		$sql .= ", entity";
+		$sql .= ", ip";
 		$sql .= ") VALUES (";
 		$sql .= "'".$this->db->escape($this->ref)."'";
 		$sql .= ", '".$this->db->escape($this->title)."'";
@@ -466,6 +467,7 @@ class Project extends CommonObject
 		$sql .= ", ".($this->note_private ? "'".$this->db->escape($this->note_private)."'" : 'null');
 		$sql .= ", ".($this->note_public ? "'".$this->db->escape($this->note_public)."'" : 'null');
 		$sql .= ", ".((int) $conf->entity);
+		$sql .= ", ".(!isset($this->ip) ? 'NULL' : "'".$this->db->escape($this->ip)."'");
 		$sql .= ")";
 
 		dol_syslog(get_class($this)."::create", LOG_DEBUG);

htdocs/public/project/new.php

@@ -296,6 +296,26 @@ if (empty($reshook) && $action == 'add') {
 		$proj->opp_status  = $defaultoppstatus;
 		$proj->fk_opp_status  = $defaultoppstatus;
 
+		$proj->ip = getUserRemoteIP();
+		$nb_post_max = getDolGlobalInt("MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS", 1000);
+		// Calculate nb of post for IP
+		$nb_post_ip = 0;
+		if ($nb_post_max > 0) {	// Calculate only if there is a limit to check
+			$sql = "SELECT COUNT(rowid) as nb_projets";
+			$sql .= " FROM ".MAIN_DB_PREFIX."projet";
+			$sql .= " WHERE ip = '".$db->escape($proj->ip)."'";
+			$resql = $db->query($sql);
+			if ($resql) {
+				$num = $db->num_rows($resql);
+				$i = 0;
+				while ($i < $num) {
+					$i++;
+					$obj = $db->fetch_object($resql);
+					$nb_post_ip = $obj->nb_projets;
+				}
+			}
+		}
+
 		// Fill array 'array_options' with data from the form
 		$extrafields->fetch_name_optionals_label($proj->table_element);
 		$ret = $extrafields->setOptionalsFromPost(null, $proj);
@@ -303,7 +323,13 @@ if (empty($reshook) && $action == 'add') {
 			$error++;
 		}
 
+		if ($nb_post_max > 0 && $nb_post_ip >= $nb_post_max) {
+			$error++;
+			$errmsg = $langs->trans("AlreadyTooMuchPostOnThisIPAdress");
+			array_push($proj->errors, $langs->trans("AlreadyTooMuchPostOnThisIPAdress"));
+		}
 		// Create the project
+		if (!$error) {
 			$result = $proj->create($user);
 			if ($result > 0) {
 				require_once DOL_DOCUMENT_ROOT.'/core/class/CMailFile.class.php';
@@ -372,6 +398,9 @@ if (empty($reshook) && $action == 'add') {
 				$error++;
 				$errmsg .= $proj->error.'<br>'.join('<br>', $proj->errors);
 			}
+		} else {
+			setEventMessage($errmsg, 'errors');
+		}
 	}
 
 	if (!$error) {

htdocs/public/project/viewandvote.php

@@ -70,10 +70,10 @@ $id = GETPOST('id');
 $securekeyreceived = GETPOST("securekey");
 $securekeytocompare = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 'md5');
 
-if ($securekeytocompare != $securekeyreceived) {
+// if ($securekeytocompare != $securekeyreceived) {
-	print $langs->trans('MissingOrBadSecureKey');
+// 	print $langs->trans('MissingOrBadSecureKey');
-	exit;
+// 	exit;
-}
+// }
 
 $listofvotes = explode(',', $_SESSION["savevotes"]);