Merge pull request #21667 from Hystepik/develop#3

Fix : Spam db public page yogosha report 11813

htdocs/admin/security_other.php

@@ -62,7 +62,7 @@ if (preg_match('/set_([a-z0-9_\-]+)/i', $action, $reg)) {
 		dol_print_error($db);
 	}
 } elseif ($action == 'updateform') {
-	$res1 = 1; $res2 = 1; $res3 = 1;
+	$res1 = 1; $res2 = 1; $res3 = 1; $res4 = 1;
 	if (GETPOSTISSET('MAIN_APPLICATION_TITLE')) {
 		$res1 = dolibarr_set_const($db, "MAIN_APPLICATION_TITLE", GETPOST("MAIN_APPLICATION_TITLE", 'alphanohtml'), 'chaine', 0, '', $conf->entity);
 	}
@@ -72,7 +72,10 @@ if (preg_match('/set_([a-z0-9_\-]+)/i', $action, $reg)) {
 	if (GETPOSTISSET('MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT')) {
 		$res3 = dolibarr_set_const($db, "MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT", GETPOST("MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT", 'alphanohtml'), 'int', 0, '', $conf->entity);
 	}
-	if ($res1 && $res2 && $res3) {
+	if (GETPOSTISSET('MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS')) {
+		$res4 = dolibarr_set_const($db, "MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS", GETPOST("MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS", 'alphanohtml'), 'int', 0, '', $conf->entity);
+	}
+	if ($res1 && $res2 && $res3 && $res4) {
 		setEventMessages($langs->trans("RecordModifiedSuccessfully"), null, 'mesgs');
 	}
 }
@@ -186,6 +189,14 @@ print '<input class="flat right width50" name="MAIN_SECURITY_MAX_IMG_IN_HTML_CON
 print '</td>';
 print '</tr>';
 
+print '<tr class="oddeven">';
+print '<td>'.$langs->trans("MaxNumberOfPostOnPublicPagesByIP").'</td><td class="right">';
+print '</td>';
+print '<td class="nowrap">';
+print '<input class="flat right width50" name="MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS" type="text" value="'.getDolGlobalInt("MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS", 1000).'"> '.strtolower($langs->trans("Posts"));
+print '</td>';
+print '</tr>';
+
 /*
 if (empty($conf->global->MAIN_APPLICATION_TITLE)) {
 	$conf->global->MAIN_APPLICATION_TITLE = "";

htdocs/langs/en_US/admin.lang

@@ -2307,7 +2307,10 @@ MAIN_MAIL_SMTPS_AUTH_TYPE=Authentification method
 UsePassword=Use a password
 UseOauth=Use a OAUTH token
 Images=Images
+Posts=Posts
 MaxNumberOfImagesInGetPost=Max number of images allowed in a HTML field submitted in a form
+MaxNumberOfPostOnPublicPagesByIP=Max number of posts on public pages with an IP Address
+CIDLookupURL=The module brings an URL that can be used by an external tool to get the name of a thirdparty or contact from its phone number. URL to use is: 
 ScriptIsEmpty=The script is empty
 ShowHideTheNRequests=Show/hide the %s SQL request(s)
 DefinedAPathForAntivirusCommandIntoSetup=Define a path for an antivirus program into <b>%s</b>

htdocs/public/ticket/create_ticket.php

@@ -232,10 +232,35 @@ if (empty($reshook)) {
 		}
 
 		if (!$error) {
-			$object->db->begin();
+			$object->type_code = GETPOST("type_code", 'aZ09');
+			$object->category_code = GETPOST("category_code", 'aZ09');
+			$object->severity_code = GETPOST("severity_code", 'aZ09');
+			$object->ip = getUserRemoteIP();
+
+			$nb_post_max = getDolGlobalInt("MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS", 1000);
+
+			// Calculate nb of post for IP
+			$nb_post_ip = 0;
+			if ($nb_post_max > 0) {	// Calculate only if there is a limit to check
+				$sql = "SELECT COUNT(ref) as nb_tickets";
+				$sql .= " FROM ".MAIN_DB_PREFIX."ticket";
+				$sql .= " WHERE ip = '".$db->escape($object->ip)."'";
+				$resql = $db->query($sql);
+				if ($resql) {
+					$num = $db->num_rows($resql);
+					$i = 0;
+					while ($i < $num) {
+						$i++;
+						$obj = $db->fetch_object($resql);
+						$nb_post_ip = $obj->nb_tickets;
+					}
+				}
+			}
 
 			$object->track_id = generate_random_id(16);
 
+			$object->db->begin();
+
 			$object->subject = GETPOST("subject", "restricthtml");
 			$object->message = GETPOST("message", "restricthtml");
 			$object->origin_email = $origin_email;
@@ -301,6 +326,14 @@ if (empty($reshook)) {
 
 			$object->context['disableticketemail'] = 1; // Disable emails sent by ticket trigger when creation is done from this page, emails are already sent later
 
+			if ($nb_post_max > 0 && $nb_post_ip >= $nb_post_max) {
+				$error++;
+				$errors = array($langs->trans("AlreadyTooMuchPostOnThisIPAdress"));
+				array_push($object->errors, array($langs->trans("AlreadyTooMuchPostOnThisIPAdress")));
+				$action = 'create_ticket';
+			}
+
+			if (!$error) {
 				$id = $object->create($user);
 				if ($id <= 0) {
 					$error++;
@@ -308,12 +341,12 @@ if (empty($reshook)) {
 					array_push($object->errors, $object->error ? array($object->error) : $object->errors);
 					$action = 'create_ticket';
 				}
+			}
 
 			if (!$error && $id > 0) {
 				if ($usertoassign > 0) {
 					$object->add_contact($usertoassign, "SUPPORTCLI", 'external', 0);
 				}
-			}
 
 				if (!$error) {
 					$object->db->commit();
@@ -446,6 +479,7 @@ if (empty($reshook)) {
 			}
 		}
 	}
+}
 
 
 /*

htdocs/ticket/class/ticket.class.php

@@ -467,7 +467,8 @@ class Ticket extends CommonObject
 			$sql .= "date_read,";
 			$sql .= "date_close,";
 			$sql .= "entity,";
-			$sql .= "notify_tiers_at_create";
+			$sql .= "notify_tiers_at_create,";
+			$sql .= "ip";
 			$sql .= ") VALUES (";
 			$sql .= " ".(!isset($this->ref) ? '' : "'".$this->db->escape($this->ref)."'").",";
 			$sql .= " ".(!isset($this->track_id) ? 'NULL' : "'".$this->db->escape($this->track_id)."'").",";
@@ -492,6 +493,7 @@ class Ticket extends CommonObject
 			$sql .= " ".(!isset($this->date_close) || dol_strlen($this->date_close) == 0 ? 'NULL' : "'".$this->db->idate($this->date_close)."'")."";
 			$sql .= ", ".((int) $conf->entity);
 			$sql .= ", ".(!isset($this->notify_tiers_at_create) ? '1' : "'".$this->db->escape($this->notify_tiers_at_create)."'");
+			$sql .= ", ".(!isset($this->ip) ? 'NULL' : "'".$this->db->escape($this->ip)."'");
 			$sql .= ")";
 
 			$this->db->begin();