Protect Author Names from impersonation

[coldstone]

This is a modified mod from the original forums. I basically tweaked what was originally contributed by Stex.

Purppose: This mod will protect an authors name by requiring any comment that uses an authors name to provide a password. This matching is fairly loose. It looks for any commenter name that contains an authors name such as "coldstone sux" so it can't be fooled by leading spaces. Also, it ignores capitilization so "cOldStoNe sux" will also be caught.

Usage: When a real GreyMatter author wishes to post a comment, they must enter their comment name as "AUTHORNAME_PASSWORD" (note that correct capitalization must be used). Basiclaly, just seperate the author's name with the author's password.

Changes:

• Add this line to gm-comments.cgi (its around line 129, near "&gm_blankcheck;":
  &gm_authorcheck;
  
• Change line 330 from:
  $previewcommentauthor = $IN{'newcommentauthor'};
  to:
  $previewcommentauthor = $IN{'newcommentauthor_org'};
  
• Add this to the bottom of the file:
  
## GM Author Check
# Will check that the commenters name does not contain an author name.  If it does
#  will check that the comment author string is "AUTHOR_PASSWORD" and use the password
#  to verify the identity of the author.
# Coldstone modified code from Stex
sub gm_authorcheck {

## so that preview works, using org var, since we need to keep the 'Name_Pw'
# note that we are _always_ setting this so that if we preview, a valid value
# goest into the commentauthorname isn't a gm author ...
$IN{'newcommentauthor_org'} = $IN{'newcommentauthor'};

open (FUNNYFEETVISHNU, "./gm-authors.cgi") ||
&gm_dangermouse("Can't read the authors file.  Please make sure that gm-authors.cgi is CHMODed to 666 and is in the same place as all your other Greymatter CGI files; also try running Diagnostics & Repair from the Configuration screen.");
@gettheauthordata = <FUNNYFEETVISHNU>;
close (FUNNYFEETVISHNU);

## Going through code to see if we have an author name match
foreach $gettheauthordataline (@gettheauthordata) {
chomp ($gettheauthordataline);
@gettheauthorinfo = split (/\|/, $gettheauthordataline);

## we are doing a regex to get a match since we don't want to be fooled by leading spaces (or case)
if ($IN{'newcommentauthor'} =~ /$gettheauthorinfo[0]/i) {
## We got an athor name match, lets check the pw
# the pw will be attached to the endof the author name, seperated by '_'
my( $author, $auth_pw ) = split( '_', $IN{'newcommentauthor'} );
my $commentpassword = crypt($auth_pw, $auth_pw);

## hmm, we are checking if the password matches both the plain and the crypted, no idea why...
if ( ($gettheauthorinfo[1] eq $commentpassword) || ($gettheauthorinfo[1] eq $auth_pw) ){
$IN{'newcommentauthor'} = $gettheauthorinfo[0];
$IN{'newcommenthomepage'} = $gettheauthorinfo[3];
$IN{'newcommentemail'}= $gettheauthorinfo[2];
} else {
print "Content-type: text/html\n\n";
print<<GMAUTHORNOTICE;
$gmheadtag
$gmframetop
You cannot use that name to post a comment without the correct password. Please pick another name or check your password.<br />
<br />
$gmframebottom
</BODY>
</HTML>
GMAUTHORNOTICE
  &gm_writetocplog("<B><FONT COLOR=\"#dd0000\">Invalid Password on comment:</font></B> $IN{'newcommentauthor'} ($IN{'newcommentpassword'})");
  exit;
}}}}

  

Please leave feedback if there are issues. Note that this will work even using comment preview.

8/14 Oops, noticed that I had a line out of place so that Preview for normal posters would stop working. grrrr. Above code fixed.