Added autoban by the hidden field (to ban spammers and prevent them from trying to post anything).

boards/forms.py

@@ -1,252 +1,254 b''
 import re
 from captcha.fields import CaptchaField
 from django import forms
 from django.forms.util import ErrorList
 from django.utils.translation import ugettext_lazy as _
 import time
 from boards.models import TITLE_MAX_LENGTH, User
 from neboard import settings
 from boards import utils
 
 LAST_POST_TIME = "last_post_time"
 LAST_LOGIN_TIME = "last_login_time"
 
 LOGIN_DELAY = 60 * 60
 
 MAX_TEXT_LENGTH = 30000
 MAX_IMAGE_SIZE = 8 * 1024 * 1024
 
 
 class PlainErrorList(ErrorList):
     def __unicode__(self):
         return self.as_text()
 
     def as_text(self):
         return ''.join([u'(!) %s ' % e for e in self])
 
 
 class NeboardForm(forms.Form):
 
     def as_p(self):
         "Returns this form rendered as HTML <p>s."
         return self._html_output(
             normal_row='<div class="form-row">'
                        '<div class="form-label">'
                        '%(label)s'
                        '</div>'
                        '<div class="form-input">'
                        '%(field)s'
                        '</div>'
                        '%(help_text)s'
                        '</div>',
             error_row='<div class="form-errors">%s</div>',
             row_ender='</p>',
             help_text_html=' <span class="helptext">%s</span>',
             errors_on_separate_row=True)
 
 
 class PostForm(NeboardForm):
 
     title = forms.CharField(max_length=TITLE_MAX_LENGTH, required=False,
                             label=_('Title'))
     text = forms.CharField(widget=forms.Textarea, required=False,
                            label=_('Text'))
     image = forms.ImageField(required=False, label=_('Image'))
 
     # This field is for spam prevention only
     email = forms.CharField(max_length=100, required=False, label=_('e-mail'),
                             widget=forms.TextInput(attrs={
                                 'class': 'form-email'}))
 
     session = None
+    need_to_ban = False
 
     def clean_title(self):
         title = self.cleaned_data['title']
         if title:
             if len(title) > TITLE_MAX_LENGTH:
                 raise forms.ValidationError(_('Title must have less than %s '
                                               'characters') %
                                             str(TITLE_MAX_LENGTH))
         return title
 
     def clean_text(self):
         text = self.cleaned_data['text']
         if text:
             if len(text) > MAX_TEXT_LENGTH:
                 raise forms.ValidationError(_('Text must have less than %s '
                                               'characters') %
                                             str(MAX_TEXT_LENGTH))
         return text
 
     def clean_image(self):
         image = self.cleaned_data['image']
         if image:
             if image._size > MAX_IMAGE_SIZE:
                 raise forms.ValidationError(_('Image must be less than %s '
                                               'bytes') % str(MAX_IMAGE_SIZE))
         return image
 
     def clean(self):
         cleaned_data = super(PostForm, self).clean()
 
         if not self.session:
             raise forms.ValidationError('Humans have sessions')
 
         if cleaned_data['email']:
+            self.need_to_ban = True
             raise forms.ValidationError('A human cannot enter a hidden field')
 
         if not self.errors:
             self._clean_text_image()
 
         if not self.errors and self.session:
             self._validate_posting_speed()
 
         return cleaned_data
 
     def _clean_text_image(self):
         text = self.cleaned_data.get('text')
         image = self.cleaned_data.get('image')
 
         if (not text) and (not image):
             error_message = _('Either text or image must be entered.')
             self._errors['text'] = self.error_class([error_message])
 
     def _validate_posting_speed(self):
         can_post = True
 
         if LAST_POST_TIME in self.session:
             now = time.time()
             last_post_time = self.session[LAST_POST_TIME]
 
             current_delay = int(now - last_post_time)
 
             if current_delay < settings.POSTING_DELAY:
                 error_message = _('Wait %s seconds after last posting') % str(
                     settings.POSTING_DELAY - current_delay)
                 self._errors['text'] = self.error_class([error_message])
 
                 can_post = False
 
         if can_post:
             self.session[LAST_POST_TIME] = time.time()
 
 
 class ThreadForm(PostForm):
 
     regex_tags = re.compile(ur'^[\w\s\d]+$', re.UNICODE)
 
     tags = forms.CharField(max_length=100, label=_('Tags'))
 
     def clean_tags(self):
         tags = self.cleaned_data['tags']
 
         if tags:
             if not self.regex_tags.match(tags):
                 raise forms.ValidationError(
                     _('Inappropriate characters in tags.'))
 
         return tags
 
     def clean(self):
         cleaned_data = super(ThreadForm, self).clean()
 
         return cleaned_data
 
 
 class PostCaptchaForm(PostForm):
     captcha = CaptchaField()
 
     def __init__(self, *args, **kwargs):
         self.request = kwargs['request']
         del kwargs['request']
 
         super(PostCaptchaForm, self).__init__(*args, **kwargs)
 
     def clean(self):
         cleaned_data = super(PostCaptchaForm, self).clean()
 
         success = self.is_valid()
         utils.update_captcha_access(self.request, success)
 
         if success:
             return cleaned_data
         else:
             raise forms.ValidationError(_("Captcha validation failed"))
 
 
 class ThreadCaptchaForm(ThreadForm):
     captcha = CaptchaField()
 
     def __init__(self, *args, **kwargs):
         self.request = kwargs['request']
         del kwargs['request']
 
         super(ThreadCaptchaForm, self).__init__(*args, **kwargs)
 
     def clean(self):
         cleaned_data = super(ThreadCaptchaForm, self).clean()
 
         success = self.is_valid()
         utils.update_captcha_access(self.request, success)
 
         if success:
             return cleaned_data
         else:
             raise forms.ValidationError(_("Captcha validation failed"))
 
 
 class SettingsForm(NeboardForm):
 
     theme = forms.ChoiceField(choices=settings.THEMES,
                               label=_('Theme'))
 
 
 class ModeratorSettingsForm(SettingsForm):
 
     moderate = forms.BooleanField(required=False, label=_('Enable moderation '
                                                           'panel'))
 
 
 class LoginForm(NeboardForm):
 
     user_id = forms.CharField()
 
     session = None
 
     def clean_user_id(self):
         user_id = self.cleaned_data['user_id']
         if user_id:
             users = User.objects.filter(user_id=user_id)
             if len(users) == 0:
                 raise forms.ValidationError(_('No such user found'))
 
         return user_id
 
     def _validate_login_speed(self):
         can_post = True
 
         if LAST_LOGIN_TIME in self.session:
             now = time.time()
             last_login_time = self.session[LAST_LOGIN_TIME]
 
             current_delay = int(now - last_login_time)
 
             if current_delay < LOGIN_DELAY:
                 error_message = _('Wait %s minutes after last login') % str(
                     (LOGIN_DELAY - current_delay) / 60)
                 self._errors['user_id'] = self.error_class([error_message])
 
                 can_post = False
 
         if can_post:
             self.session[LAST_LOGIN_TIME] = time.time()
 
     def clean(self):
         if not self.session:
             raise forms.ValidationError('Humans have sessions')
 
         self._validate_login_speed()
 
         cleaned_data = super(LoginForm, self).clean()
 
-        return cleaned_data
  No newline at end of file
+        return cleaned_data

boards/views.py

@@ -1,419 +1,448 b''
 import hashlib
 import string
 from django.core import serializers
 from django.core.urlresolvers import reverse
 from django.http import HttpResponseRedirect
 from django.http.response import HttpResponse
 from django.template import RequestContext
 from django.shortcuts import render, redirect, get_object_or_404
 from django.utils import timezone
 
 from boards import forms
 import boards
 from boards import utils
 from boards.forms import ThreadForm, PostForm, SettingsForm, PlainErrorList, \
     ThreadCaptchaForm, PostCaptchaForm, LoginForm, ModeratorSettingsForm
 
 from boards.models import Post, Tag, Ban, User, RANK_USER, SETTING_MODERATE
 from boards import authors
 from boards.utils import get_client_ip
 import neboard
 
 
 def index(request, page=0):
     context = _init_default_context(request)
 
     if utils.need_include_captcha(request):
         threadFormClass = ThreadCaptchaForm
         kwargs = {'request': request}
     else:
         threadFormClass = ThreadForm
         kwargs = {}
 
     if request.method == 'POST':
         form = threadFormClass(request.POST, request.FILES,
                                error_class=PlainErrorList, **kwargs)
         form.session = request.session
 
         if form.is_valid():
             return _new_post(request, form)
+        if form.need_to_ban:
+            # Ban user because he is suspected to be a bot
+            _ban_current_user(request)
     else:
         form = threadFormClass(error_class=PlainErrorList, **kwargs)
 
     threads = []
     for thread in Post.objects.get_threads(page=int(page)):
         threads.append({'thread': thread,
                         'bumpable': thread.can_bump()})
 
     context['threads'] = None if len(threads) == 0 else threads
     context['form'] = form
     context['pages'] = range(Post.objects.get_thread_page_count())
 
     return render(request, 'boards/posting_general.html',
                   context)
 
 
 def _new_post(request, form, thread_id=boards.models.NO_PARENT):
     """Add a new post (in thread or as a reply)."""
 
     ip = get_client_ip(request)
     is_banned = Ban.objects.filter(ip=ip).exists()
 
     if is_banned:
         return redirect(you_are_banned)
 
     data = form.cleaned_data
 
     title = data['title']
     text = data['text']
 
     if 'image' in data.keys():
         image = data['image']
     else:
         image = None
 
     tags = []
 
     new_thread = thread_id == boards.models.NO_PARENT
     if new_thread:
         tag_strings = data['tags']
 
         if tag_strings:
             tag_strings = tag_strings.split(' ')
             for tag_name in tag_strings:
                 tag_name = string.lower(tag_name.strip())
                 if len(tag_name) > 0:
                     tag, created = Tag.objects.get_or_create(name=tag_name)
                     tags.append(tag)
 
     op = None if thread_id == boards.models.NO_PARENT else \
         get_object_or_404(Post, id=thread_id)
     post = Post.objects.create_post(title=title, text=text, ip=ip,
                                     thread=op, image=image,
                                     tags=tags, user=_get_user(request))
 
     thread_to_show = (post.id if new_thread else thread_id)
 
     if new_thread:
         return redirect(thread, post_id=thread_to_show)
     else:
         return redirect(reverse(thread, kwargs={'post_id': thread_to_show}) +
                         '#' + str(post.id))
 
 
 def tag(request, tag_name, page=0):
-    """Get all tag threads (posts without a parent)."""
+    """
+    Get all tag threads. Threads are split in pages, so some page is
+    requested. Default page is 0.
+    """
 
     tag = get_object_or_404(Tag, name=tag_name)
     threads = []
     for thread in Post.objects.get_threads(tag=tag, page=int(page)):
         threads.append({'thread': thread,
                         'bumpable': thread.can_bump()})
 
     if request.method == 'POST':
         form = ThreadForm(request.POST, request.FILES,
                           error_class=PlainErrorList)
         if form.is_valid():
             return _new_post(request, form)
+        if form.need_to_ban:
+            # Ban user because he is suspected to be a bot
+            _ban_current_user(request)
     else:
         form = forms.ThreadForm(initial={'tags': tag_name},
                                 error_class=PlainErrorList)
 
     context = _init_default_context(request)
     context['threads'] = None if len(threads) == 0 else threads
     context['tag'] = tag
     context['pages'] = range(Post.objects.get_thread_page_count(tag=tag))
 
     context['form'] = form
 
     return render(request, 'boards/posting_general.html',
                   context)
 
 
 def thread(request, post_id):
     """Get all thread posts"""
 
     if utils.need_include_captcha(request):
         postFormClass = PostCaptchaForm
         kwargs = {'request': request}
     else:
         postFormClass = PostForm
         kwargs = {}
 
     if request.method == 'POST':
         form = postFormClass(request.POST, request.FILES,
                              error_class=PlainErrorList, **kwargs)
         form.session = request.session
 
         if form.is_valid():
             return _new_post(request, form, post_id)
+        if form.need_to_ban:
+            # Ban user because he is suspected to be a bot
+            _ban_current_user(request)
     else:
         form = postFormClass(error_class=PlainErrorList, **kwargs)
 
     posts = Post.objects.get_thread(post_id)
 
     context = _init_default_context(request)
 
     context['posts'] = posts
     context['form'] = form
     context['bumpable'] = posts[0].can_bump()
 
     return render(request, 'boards/thread.html', context)
 
 
 def login(request):
     """Log in with user id"""
 
     context = _init_default_context(request)
 
     if request.method == 'POST':
         form = LoginForm(request.POST, request.FILES,
                          error_class=PlainErrorList)
         form.session = request.session
 
         if form.is_valid():
             user = User.objects.get(user_id=form.cleaned_data['user_id'])
             request.session['user_id'] = user.id
             return redirect(index)
 
     else:
         form = LoginForm()
 
     context['form'] = form
 
     return render(request, 'boards/login.html', context)
 
 
 def settings(request):
     """User's settings"""
 
     context = _init_default_context(request)
     user = _get_user(request)
     is_moderator = user.is_moderator()
 
     if request.method == 'POST':
         if is_moderator:
             form = ModeratorSettingsForm(request.POST,
                                           error_class=PlainErrorList)
         else:
             form = SettingsForm(request.POST, error_class=PlainErrorList)
 
         if form.is_valid():
             selected_theme = form.cleaned_data['theme']
 
             user.save_setting('theme', selected_theme)
 
             if is_moderator:
                 moderate = form.cleaned_data['moderate']
                 user.save_setting(SETTING_MODERATE, moderate)
 
             return redirect(settings)
     else:
         selected_theme = _get_theme(request)
 
         if is_moderator:
             form = ModeratorSettingsForm(initial={'theme': selected_theme,
                                          'moderate': context['moderator']},
                                 error_class=PlainErrorList)
         else:
             form = SettingsForm(initial={'theme': selected_theme},
                                 error_class=PlainErrorList)
 
     context['form'] = form
 
     return render(request, 'boards/settings.html', context)
 
 
 def all_tags(request):
     """All tags list"""
 
     context = _init_default_context(request)
     context['all_tags'] = Tag.objects.get_not_empty_tags()
 
     return render(request, 'boards/tags.html', context)
 
 
 def jump_to_post(request, post_id):
     """Determine thread in which the requested post is and open it's page"""
 
     post = get_object_or_404(Post, id=post_id)
 
     if not post.thread:
         return redirect(thread, post_id=post.id)
     else:
         return redirect(reverse(thread, kwargs={'post_id': post.thread.id})
                         + '#' + str(post.id))
 
 
 def authors(request):
     """Show authors list"""
 
     context = _init_default_context(request)
     context['authors'] = boards.authors.authors
 
     return render(request, 'boards/authors.html', context)
 
 
 def delete(request, post_id):
     """Delete post"""
 
     user = _get_user(request)
     post = get_object_or_404(Post, id=post_id)
 
     if user.is_moderator():
         # TODO Show confirmation page before deletion
         Post.objects.delete_post(post)
     
     if not post.thread:
         return _redirect_to_next(request)
     else:
         return redirect(thread, post_id=post.thread.id)
 
 
 def ban(request, post_id):
     """Ban user"""
 
     user = _get_user(request)
     post = get_object_or_404(Post, id=post_id)
 
     if user.is_moderator():
         # TODO Show confirmation page before ban
         Ban.objects.get_or_create(ip=post.poster_ip)
 
     return _redirect_to_next(request)
 
 
 def you_are_banned(request):
     """Show the page that notifies that user is banned"""
 
     context = _init_default_context(request)
     return render(request, 'boards/staticpages/banned.html', context)
 
 
 def page_404(request):
     """Show page 404 (not found error)"""
 
     context = _init_default_context(request)
     return render(request, 'boards/404.html', context)
 
 
 def tag_subscribe(request, tag_name):
     """Add tag to favorites"""
 
     user = _get_user(request)
     tag = get_object_or_404(Tag, name=tag_name)
 
     if not tag in user.fav_tags.all():
         user.fav_tags.add(tag)
 
     return _redirect_to_next(request)
 
 
 def tag_unsubscribe(request, tag_name):
     """Remove tag from favorites"""
 
     user = _get_user(request)
     tag = get_object_or_404(Tag, name=tag_name)
 
     if tag in user.fav_tags.all():
         user.fav_tags.remove(tag)
 
     return _redirect_to_next(request)
 
 
 def static_page(request, name):
     """Show a static page that needs only tags list and a CSS"""
 
     context = _init_default_context(request)
     return render(request, 'boards/staticpages/' + name + '.html', context)
 
 
 def api_get_post(request, post_id):
     """
     Get the JSON of a post. This can be
     used as and API for external clients.
     """
 
     post = get_object_or_404(Post, id=post_id)
 
     json = serializers.serialize("json", [post], fields=(
         "pub_time", "_text_rendered", "title", "text", "image",
         "image_width", "image_height", "replies", "tags"
     ))
 
     return HttpResponse(content=json)
 
 
 def get_post(request, post_id):
-    """ Get the html of a post. Used for popups. """
+    """Get the html of a post. Used for popups."""
 
     post = get_object_or_404(Post, id=post_id)
 
     context = RequestContext(request)
     context["post"] = post
 
     return render(request, 'boards/post.html', context)
 
 
 def _get_theme(request, user=None):
     """Get user's CSS theme"""
 
     if not user:
         user = _get_user(request)
     theme = user.get_setting('theme')
     if not theme:
         theme = neboard.settings.DEFAULT_THEME
 
     return theme
 
 
 def _init_default_context(request):
     """Create context with default values that are used in most views"""
 
     context = RequestContext(request)
 
     user = _get_user(request)
     context['user'] = user
     context['tags'] = user.get_sorted_fav_tags()
 
     theme = _get_theme(request, user)
     context['theme'] = theme
     context['theme_css'] = 'css/' + theme + '/base_page.css'
 
+    # This shows the moderator panel
     moderate = user.get_setting(SETTING_MODERATE)
     if moderate == 'True':
         context['moderator'] = user.is_moderator()
     else:
         context['moderator'] = False
 
     return context
 
 
 def _get_user(request):
-    """Get current user from the session"""
+    """
+    Get current user from the session. If the user does not exist, create
+    a new one.
+    """
 
     session = request.session
     if not 'user_id' in session:
         request.session.save()
 
         md5 = hashlib.md5()
         md5.update(session.session_key)
         new_id = md5.hexdigest()
 
         time_now = timezone.now()
         user = User.objects.create(user_id=new_id, rank=RANK_USER,
                                    registration_time=time_now)
 
         session['user_id'] = user.id
     else:
         user = User.objects.get(id=session['user_id'])
 
     return user
 
 
 def _redirect_to_next(request):
+    """
+    If a 'next' parameter was specified, redirect to the next page. This is
+    used when the user is required to return to some page after the current
+    view has finished its work.
+    """
+
     if 'next' in request.GET:
         next_page = request.GET['next']
         return HttpResponseRedirect(next_page)
     else:
         return redirect(index)
+
+
+def _ban_current_user(request):
+    """Add current user to the IP ban list"""
+
+    ip = utils.get_client_ip(request)
+    Ban.objects.get_or_create(ip=ip)