<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[8636] sites/trunk/wordcamp.org/public_html/wp-content/mu-plugins/camptix-tweaks/camptix-tweaks.php: WC Camptix: Throttle ticket purchase request to prevent junk tickets.</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { white-space: pre-line; overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta" style="font-size: 105%">
<dt style="float: left; width: 6em; font-weight: bold">Revision</dt> <dd><a style="font-weight: bold" href="http://meta.trac.wordpress.org/changeset/8636">8636</a><script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","description":"Review this Commit","action":{"@type":"ViewAction","url":"http://meta.trac.wordpress.org/changeset/8636","name":"Review Commit"}}</script></dd>
<dt style="float: left; width: 6em; font-weight: bold">Author</dt> <dd>vedjain</dd>
<dt style="float: left; width: 6em; font-weight: bold">Date</dt> <dd>2019-04-12 11:21:15 +0000 (Fri, 12 Apr 2019)</dd>
</dl>
<pre style='padding-left: 1em; margin: 2em 0; border-left: 2px solid #ccc; line-height: 1.25; font-size: 105%; font-family: sans-serif'>WC Camptix: Throttle ticket purchase request to prevent junk tickets.
This patch adds throttling support to ticket purchase request to 39 per hour. This is not intended to prevent any kind of sophiscated attacks, but is just there so that we don't have to delete lots of failed tickets when a security runs any automated tests on us.
Form_Spam_Prevention provides honeypot feature as well, which we are intentionally not using here because we want don't want to be aggressive in blocking ticket purchase form.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#sitestrunkwordcamporgpublic_htmlwpcontentmupluginscamptixtweakscamptixtweaksphp">sites/trunk/wordcamp.org/public_html/wp-content/mu-plugins/camptix-tweaks/camptix-tweaks.php</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="sitestrunkwordcamporgpublic_htmlwpcontentmupluginscamptixtweakscamptixtweaksphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: sites/trunk/wordcamp.org/public_html/wp-content/mu-plugins/camptix-tweaks/camptix-tweaks.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- sites/trunk/wordcamp.org/public_html/wp-content/mu-plugins/camptix-tweaks/camptix-tweaks.php 2019-04-12 11:21:06 UTC (rev 8635)
+++ sites/trunk/wordcamp.org/public_html/wp-content/mu-plugins/camptix-tweaks/camptix-tweaks.php 2019-04-12 11:21:15 UTC (rev 8636)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -3,6 +3,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> namespace WordCamp\CampTix_Tweaks;
</span><span class="cx" style="display: block; padding: 0 10px"> use CampTix_Plugin;
</span><span class="cx" style="display: block; padding: 0 10px"> use WP_Post;
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+use WordCamp\Utilities\Form_Spam_Prevention;
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> defined( 'WPINC' ) or die();
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -14,7 +15,9 @@
</span><span class="cx" style="display: block; padding: 0 10px"> add_action( 'init', __NAMESPACE__ . '\hide_empty_tickets' );
</span><span class="cx" style="display: block; padding: 0 10px"> add_action( 'wp_print_styles', __NAMESPACE__ . '\print_login_message_styles' );
</span><span class="cx" style="display: block; padding: 0 10px"> add_filter( 'camptix_require_login_please_login_message', __NAMESPACE__ . '\override_please_login_message' );
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+add_action( 'camptix_checkout_start', __NAMESPACE__ . '\check_ip_throttling' );
</ins><span class="cx" style="display: block; padding: 0 10px"> add_action( 'camptix_form_start_errors', __NAMESPACE__ . '\add_form_start_error_messages' );
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+add_filter( 'camptix_form_attendee_info_errors', __NAMESPACE__ . '\show_throttle_notice' );
</ins><span class="cx" style="display: block; padding: 0 10px"> add_action( 'transition_post_status', __NAMESPACE__ . '\ticket_sales_opened', 10, 3 );
</span><span class="cx" style="display: block; padding: 0 10px"> add_action( 'camptix_payment_result', __NAMESPACE__ . '\track_payment_results', 10, 3 );
</span><span class="cx" style="display: block; padding: 0 10px"> add_filter( 'camptix_shortcode_contents', __NAMESPACE__ . '\modify_shortcode_contents', 10, 2 );
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -42,6 +45,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> add_action( 'camptix_tshirt_report_intro', __NAMESPACE__ . '\tshirt_report_intro_message', 10, 3 );
</span><span class="cx" style="display: block; padding: 0 10px"> add_filter( 'camptix_stripe_checkout_image_url', __NAMESPACE__ . '\stripe_default_checkout_image_url' );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+// Prefix for Form_Spam_Prevention class.
+define( 'WC_CAMPTIX_FSP_PREFIX', 'wc-camptix-fsp-prefix' );
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span><span class="cx" style="display: block; padding: 0 10px"> * Warn organizers when CampTix is in sandbox mode
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -920,6 +925,42 @@
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ * Show error message if IP Address has been throttled by `Form_Spam_Prevention`.
+ * We are not using honeypot feature provided by Form_Spam_Prevention because we do not want to be aggressive with blocking requests in ticket purchase page. We only block when we are extremely sure that its a bad actor, and even if it is a bot, we let it go if its not annoying.
+ */
+function show_throttle_notice() {
+ global $camptix;
+
+ $fsp = new Form_Spam_Prevention( [ 'prefix' => WC_CAMPTIX_FSP_PREFIX ] );
+
+ if ( $fsp->is_ip_address_throttled() ) {
+ $camptix->error( __( 'You are purchasing tickets too fast. Your IP address has been throttled for an hour since last ticket purchase.', 'wordcamporg' ) );
+
+ // With some payment methods, payment could have been deducted in the frontend before making a checkout request.
+ // Therefore its important that we disable payment methods tab if we are going to block the checkout request.
+ add_filter( 'tix_render_payment_options', '__return_empty_string', 20 );
+ }
+
+}
+
+/**
+ * Checks if IP is throttled. If not then increments the score by 0.1. This does not handle any sophisticated attack, but is just there so that we do not have to delete junk tickets if a security researcher runs a test on site.
+ *
+ * Maximum score threshold in Form_Spam_Prevention is 4, so using 0.1 implies an IP address will be able to make 39 purchase request before getting throttled.
+ */
+function check_ip_throttling() {
+ global $camptix;
+
+ $fsp = new Form_Spam_Prevention( [ 'prefix' => WC_CAMPTIX_FSP_PREFIX ] );
+
+ if ( $fsp->is_ip_address_throttled() ) {
+ $camptix->error_flag( 'ip_address_throttled' );
+ } else {
+ $fsp->add_score_to_ip_address( [ 0.1 ] );
+ }
+}
+
+/**
</ins><span class="cx" style="display: block; padding: 0 10px"> * Modify the list of personal data eraser callbacks.
</span><span class="cx" style="display: block; padding: 0 10px"> *
</span><span class="cx" style="display: block; padding: 0 10px"> * @param array $erasers
</span></span></pre>
</div>
</div>
</body>
</html>