Source Code

   1  <?php
   2  /**
   3   * guestbook.php  --  A classic flat-file guestbook. No database, no email
   4   * harvesting, no IP logging. Stores only the name + message you choose to type.
   5   * Includes a lightweight honeypot + timing check to deter dumb bots without
   6   * cookies or captchas.
   7   */
   8  require_once __DIR__ . '/includes/config.php';
   9  require_once __DIR__ . '/includes/functions.php';
  10  
  11  $PAGE_TITLE = 'Guestbook';
  12  $PAGE_ID    = 'guestbook.php';
  13  
  14  $flash = null;      // ['ok'|'err', message]
  15  
  16  // Handle a submission.
  17  if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  18      $name    = isset($_POST['name']) ? (string)$_POST['name'] : '';
  19      $message = isset($_POST['message']) ? (string)$_POST['message'] : '';
  20      $website = isset($_POST['website']) ? (string)$_POST['website'] : ''; // honeypot
  21      $started = isset($_POST['t']) ? (int)$_POST['t'] : 0;
  22  
  23      // Honeypot: real humans never fill the hidden "website" field.
  24      if ($website !== '') {
  25          $flash = array('err', 'Spam trap triggered. If you are human, leave the "website" box empty.');
  26      }
  27      // Timing: reject sub-2-second robo-submits.
  28      elseif ($started > 0 && (time() - $started) < 2) {
  29          $flash = array('err', 'That was too fast. Take a breath and try again.');
  30      } else {
  31          list($ok, $msg) = append_guestbook($name, $message);
  32          $flash = array($ok ? 'ok' : 'err', $msg);
  33          // On success, redirect to self (PRG pattern) to avoid resubmits.
  34          if ($ok && !headers_sent()) {
  35              header('Location: ' . url('guestbook.php') . '?signed=1');
  36              exit;
  37          }
  38      }
  39  }
  40  
  41  if (isset($_GET['signed'])) {
  42      $flash = array('ok', 'Signed. Thanks for stopping by.');
  43  }
  44  
  45  $entries = read_guestbook(200);
  46  $total   = count($entries);
  47  
  48  include __DIR__ . '/includes/header.php';
  49  ?>
  50  
  51    <h1><?php echo section_icon('folder', '#FFFF00', 22); ?> Guestbook</h1>
  52  
  53    <p>
  54      Sign it like it is 2002. Flat text file. No database. We never store your IP
  55      or anything else &mdash; just the handle and message you type below.
  56    </p>
  57  
  58  <?php if ($flash !== null): ?>
  59    <div class="<?php echo $flash[0] === 'ok' ? 'good' : 'badbx'; ?>">
  60      <?php echo e($flash[1]); ?>
  61    </div>
  62  <?php endif; ?>
  63  
  64    <!-- Sign the guestbook -->
  65    <div class="panel">
  66      <div class="panel-title"><?php echo section_icon('key', '#00FF00'); ?> Sign the Guestbook</div>
  67      <div class="panel-body">
  68        <form method="post" action="<?php echo eattr(url('guestbook.php')); ?>" autocomplete="off">
  69          <table class="layout">
  70            <tr>
  71              <td style="width:110px"><label for="gname">Handle:</label></td>
  72              <td><input type="text" id="gname" name="name" maxlength="<?php echo (int)GUESTBOOK_MAX_NAME; ?>" size="30" required></td>
  73            </tr>
  74            <tr>
  75              <td valign="top"><label for="gmsg">Message:</label></td>
  76              <td><textarea id="gmsg" name="message" rows="3" maxlength="<?php echo (int)GUESTBOOK_MAX_MESSAGE; ?>" required></textarea></td>
  77            </tr>
  78            <!-- Honeypot: hidden from humans, catnip for bots. -->
  79            <tr style="position:absolute;left:-9999px" aria-hidden="true">
  80              <td><label for="website">Website (leave blank):</label></td>
  81              <td><input type="text" id="website" name="website" tabindex="-1" autocomplete="off"></td>
  82            </tr>
  83            <tr>
  84              <td></td>
  85              <td>
  86                <input type="hidden" name="t" value="<?php echo (int)time(); ?>">
  87                <input type="submit" value="[ Sign it ]">
  88                <span class="dim">&nbsp;max <?php echo (int)GUESTBOOK_MAX_MESSAGE; ?> chars, no HTML</span>
  89              </td>
  90            </tr>
  91          </table>
  92        </form>
  93      </div>
  94    </div>
  95  
  96    <!-- Entries -->
  97    <h2><?php echo section_icon('disk', '#00FFFF'); ?> Entries (<?php echo (int)$total; ?>)</h2>
  98  
  99  <?php if ($total === 0): ?>
 100    <div class="note">No entries yet. Be the first to sign! <span class="new-gif">NEW!</span></div>
 101  <?php else: ?>
 102  <?php foreach ($entries as $i => $ent): ?>
 103    <div class="asciibox">
 104      <table class="layout" width="100%"><tr>
 105        <td><b class="cyan">&gt; <?php echo e($ent['name']); ?></b></td>
 106        <td class="right dim" style="font-size:14px"><?php echo e(gmdate('Y-m-d H:i', $ent['time'])); ?> UTC</td>
 107      </tr></table>
 108      <div style="margin-top:4px"><?php echo nl2br(e($ent['message'])); ?></div>
 109    </div>
 110  <?php endforeach; ?>
 111  <?php endif; ?>
 112  
 113    <p class="center dim">
 114      Guestbook is capped at <?php echo (int)GUESTBOOK_MAX_ENTRIES; ?> entries; oldest roll off.
 115      Messages are stored as plain text in <span class="mono">data/guestbook.txt</span>.
 116      Nothing else is recorded.
 117    </p>
 118  
 119  <?php include __DIR__ . '/includes/footer.php'; ?>
 120