From 97bc3daf3d32a73d2b614eecacfe1abc0639a271 Mon Sep 17 00:00:00 2001
From: Nik Okuntseff <support@anuko.com>
Date: Fri, 24 May 2019 14:54:37 +0000
Subject: [PATCH] Improved protection from mass bot registrations.

---
 WEB-INF/lib/ttRegistrator.class.php | 21 ++++++++++++++++++---
 WEB-INF/templates/footer.tpl        |  2 +-
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/WEB-INF/lib/ttRegistrator.class.php b/WEB-INF/lib/ttRegistrator.class.php
index 33d32597..e054fe00 100644
--- a/WEB-INF/lib/ttRegistrator.class.php
+++ b/WEB-INF/lib/ttRegistrator.class.php
@@ -215,13 +215,28 @@ class ttRegistrator {
     return true;
   }
 
-  // registeredRecently determines if we already have a successful recent registration from user IP.
-  // "recent" means "within the last minute" and is set in a query by the following condition:
-  // "and created > now() - interval 1 minute". Change if necessary.
+  // registeredRecently determines if we already have successful recent registration(s) from user IP.
+  // "recent" means the following:
+  // - 2 or more registrations during last 10 minutes, or
+  // - 1 registration during last minute.
+  //
+  // This offers some level of protection from bot registrations.
   function registeredRecently() {
     $mdb2 = getConnection();
 
     $ip_part = ' created_ip = '.$mdb2->quote($_SERVER['REMOTE_ADDR']);
+    $sql = 'select count(*) as cnt from tt_groups where '.$ip_part.' and created > now() - interval 10 minute';
+    $res = $mdb2->query($sql);
+    if (is_a($res, 'PEAR_Error'))
+      return false;
+    $val = $res->fetchRow();
+    if ($val['cnt'] == 0)
+      return false; // No registrations in last 10 minutes.
+    if ($val['cnt'] >= 2)
+      return true;  // 2 or more registrations in last 10 mintes.
+
+    // If we are here, there was exactly one registration during last 10 minutes.
+    // Determine if it occurred within the last minute in a separate query.
     $sql = 'select created from tt_groups where '.$ip_part.' and created > now() - interval 1 minute';
     $res = $mdb2->query($sql);
     if (is_a($res, 'PEAR_Error'))
diff --git a/WEB-INF/templates/footer.tpl b/WEB-INF/templates/footer.tpl
index cbd5f911..a51049ae 100644
--- a/WEB-INF/templates/footer.tpl
+++ b/WEB-INF/templates/footer.tpl
@@ -12,7 +12,7 @@
       <br>
       <table cellspacing="0" cellpadding="4" width="100%" border="0">
         <tr>
-          <td align="center">&nbsp;Anuko Time Tracker 1.19.4.5010 | Copyright &copy; <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |
+          <td align="center">&nbsp;Anuko Time Tracker 1.19.4.5011 | Copyright &copy; <a href="https://www.anuko.com/lp/tt_3.htm" target="_blank">Anuko</a> |
             <a href="https://www.anuko.com/lp/tt_4.htm" target="_blank">{$i18n.footer.credits}</a> |
             <a href="https://www.anuko.com/lp/tt_5.htm" target="_blank">{$i18n.footer.license}</a> |
             <a href="https://www.anuko.com/lp/tt_7.htm" target="_blank">{$i18n.footer.improve}</a>
-- 
2.20.1