<?php
// $Id: mollom.module,v 1.1.2.48 2010-08-02 00:59:38 dries Exp $

/**
 * @file
 * Main file for the Mollom module, which protects against comment and contact form spam..
 */

define('MOLLOM_API_VERSION', '1.0');

define('MOLLOM_ANALYSIS_HAM'     , 1);
define('MOLLOM_ANALYSIS_SPAM'    , 2);
define('MOLLOM_ANALYSIS_UNSURE'  , 3);

define('MOLLOM_MODE_DISABLED', 0);
define('MOLLOM_MODE_CAPTCHA' , 1);
define('MOLLOM_MODE_ANALYSIS', 2);

define('MOLLOM_FALLBACK_BLOCK' , 0);
define('MOLLOM_FALLBACK_ACCEPT', 1);

define('MOLLOM_ERROR'   , 1000);
define('MOLLOM_REFRESH' , 1100);
define('MOLLOM_REDIRECT', 1200);

/**
 * Implementation of hook_help().
 */
function mollom_help($section) {
  if ($section == 'admin/settings/mollom') {
    return t("Allowing users to react, participate and contribute while still keeping your site's content under control can be a huge challenge. Mollom is a web service that helps you identify content quality and, more importantly, helps you stop spam. When content moderation becomes easier, you have more time and energy to interact with your web community. More information about Mollom is available on the <a href=\"@mollom-website\">Mollom website</a> or in the <a href=\"@mollom-faq\">Mollom FAQ</a>. For support, please consult the <a href=\"@mollom-support\">Mollom support page</a>.",
        array('@mollom-website' => 'http://mollom.com',
              '@mollom-faq' => 'http://mollom.com/faq',
              '@mollom-support' => 'http://mollom.com/support'));
  }
}

/**
 * Implementation of hook_link().
 */
function mollom_link($type, $object = NULL, $teaser = NULL) {
  $links = array();

  // Only show the links if the module is configured.
  if (variable_get('mollom_public_key', '') && variable_get('mollom_private_key', '')) {
    if ($type == 'comment' && user_access('administer comments') && _mollom_get_mode('comment_form')) {
      $links['mollom_comment_report'] = array(
        'title' => t('Report to Mollom'),
        'href' => 'mollom/comment/'. $object->cid,
      );
    }
    elseif ($type == 'node' && user_access('administer nodes') && _mollom_get_mode($object->type .'_node_form')) {
      $links['mollom_node_report'] = array(
        'title' => t('Report to Mollom'),
        'href' => 'mollom/node/'. $object->nid,
      );
    }
  }

  return $links;
}

/**
 * Implementation of hook_menu().
 */
function mollom_menu($may_cache) {
  $items = array();

  if ($may_cache) {
    $items[] = array(
      'path' => 'mollom/comment',
      'title' => t('Report and delete'),
      'callback' => 'drupal_get_form',
      'callback arguments' => array('mollom_report_comment'),
      'access' => user_access('administer comments'),
      'type' => MENU_CALLBACK,
    );
    $items[] = array(
      'path' => 'mollom/node',
      'title' => t('Report and delete'),
      'callback' => 'drupal_get_form',
      'callback arguments' => array('mollom_report_node'),
      'access' => user_access('administer nodes'),
      'type' => MENU_CALLBACK,
    );
    $items[] = array(
      'path' => 'mollom/contact',
      'title' => t('Report'),
      'callback' => 'drupal_get_form',
      'callback arguments' => array('mollom_report_contact'),
      'access' => TRUE, // Everyone can report contact form feedback
      'type' => MENU_CALLBACK,
    );
    $items[] = array(
      'path' => 'admin/settings/mollom',
      'title' => t('Mollom'),
      'description' => t('Mollom is a web service that helps you manage your community.'),
      'callback' => 'drupal_get_form',
      'callback arguments' => array('mollom_admin_settings'),
      'access' => user_access('administer mollom'),
      'type' => MENU_NORMAL_ITEM,
    );

    // A menu callback that is used for AJAX purposes:
    $items[] = array(
      'path' => 'mollom/captcha',
      'callback' => 'mollom_ajax_callback',
      'access' => TRUE,
      'type' => MENU_CALLBACK,
    );
  }

  return $items;
}

/**
 * Implementation of hook_perm().
 */
function mollom_perm() {
  return array(
    'administer mollom',
    'post with no checking',
  );
}

/**
 * An AJAX callback to retrieve a CAPTCHA.
 */
function mollom_ajax_callback($type, $session_id) {
  if ($type == 'audio') {
    $response = mollom('mollom.getAudioCaptcha', array('author_ip' => _mollom_ip_address(), 'session_id' => $session_id));
    if ($response) {
      $output = '<embed src="'. check_plain($response['url']) .'" autostart="true" width="120" height="30" />';
      $output .= ' (<a href="#" id="image-captcha">'. t('use image CAPTCHA') .'</a>)';
    }
  }

  if ($type == 'image') {
    $response = mollom('mollom.getImageCaptcha', array('author_ip' => _mollom_ip_address(), 'session_id' => $session_id));
    if ($response) {
      $output = '<a href="http://mollom.com"><img src="'. check_plain(url($response['url'])) .'" alt="Mollom CAPTCHA" /></a>';
      $output .= ' (<a href="#" id="audio-captcha">'. t('play audio CAPTCHA') .'</a>)';
    }
  }

  print $output;
  exit();
}

/**
 * Helper function used to load a Mollom session ID.
 */
function mollom_get_data($did) {
  return db_fetch_object(db_query_range("SELECT * FROM {mollom} WHERE did = '%s'", $did, 0, 1));
}

/**
 * Helper function used to store a Mollom session ID.
 */
function mollom_set_data($session, $quality, $did) {
  if (db_result(db_query_range("SELECT 1 FROM {mollom} WHERE did = '%s'", $did, 0, 1))) {
    db_query("UPDATE {mollom} SET session = '%s', quality = '%s' WHERE did = '%s'", $session, $quality, $did);
  }
  else {
    db_query("INSERT INTO {mollom} (session, quality, did) VALUES ('%s', '%s', '%s')", $session, $quality, $did);
  }
}

/**
 * Return a list of the possible feedback options for content.
 */
function _mollom_feedback_options() {
  return array(
    '#type' => 'radios',
    '#title' => t('Optionally report this to Mollom'),
    '#options' => array(
      'none' => t("Don't send feedback to Mollom"),
      'spam' => t('Report as spam or unsolicited advertising'),
      'profanity' => t('Report as obscene, violent or profane content'),
      'low-quality' => t('Report as low-quality content or writing'),
      'unwanted' => t('Report as unwanted, taunting or off-topic content'),
    ),
    '#default_value' => 'none',
    '#description' => t("Mollom is a web service that helps you moderate your site's content: see <a href=\"http://mollom.com\">http://mollom.com</a> for more information.  By sending feedback to Mollom, you teach Mollom what content you like and what content you dislike.  Like that, Mollom can do a better job helping you to moderate your site's content. If you want to report multiple posts at once, you can use Mollom's bulk operations on the content and comment administration pages."),
  );
}

/**
 * This function is used to report a comment as feedback and to delete it.
 */
function mollom_report_comment($cid) {
  if ($comment = _comment_load($cid)) {
    $form['cid'] = array('#type' => 'value', '#value' => $cid);
    $form['feedback'] = _mollom_feedback_options();

    return confirm_form($form,
        t('Are you sure you want to delete the comment and report it?'),
        $_GET['destination'] ? $_GET['destination'] : 'node/'. $comment->nid,
        t('This action cannot be undone.'),
        t('Delete'), t('Cancel'));
  }
}

/**
 * This function is used to delete a comment and to optionally send feedback to Mollom.
 */
function mollom_report_comment_submit($form_id, $form_values) {
  if ($form_values['confirm']) {
    if ($comment = _comment_load($form_values['cid'])) {
      // Load the Mollom session data:
      $data = mollom_get_data('comment-'. $comment->cid);

      // Provide feedback to Mollom if available:
      if ($data->session && $form_values['feedback']) {
        mollom('mollom.sendFeedback', array('session_id' => $data->session, 'feedback' => $form_values['feedback']));
      }

      // Delete comment and its replies.
      _comment_delete_thread($comment);
      _comment_update_node_statistics($comment->nid);
      cache_clear_all();

      drupal_set_message(t('The comment has been deleted.'));
    }
  }
  return "node/$comment->nid";
}

/**
 * This function is used to delete a node and to optionally send feedback to Mollom.
 */
function mollom_report_node($nid) {
  if ($node = node_load($nid)) {
    $form['nid'] = array('#type' => 'value', '#value' => $node->nid);
    $form['feedback'] = _mollom_feedback_options();

    return confirm_form($form,
        t('Are you sure you want to delete %title and report it?', array('%title' => $node->title)),
        $_GET['destination'] ? $_GET['destination'] : 'node/'. $node->nid,
        t('This action cannot be undone.'),
        t('Delete'), t('Cancel'));
  }
}

/**
 * This function is used to delete a node and to optionally send feedback to Mollom.
 */
function mollom_report_node_submit($form_id, $form_values) {
  if ($form_values['confirm']) {
    if ($node = node_load($form_values['nid'])) {
      // Load the Mollom session data:
      $data = mollom_get_data('node-'. $node->nid);

      // Provide feedback to Mollom if available:
      if ($data->session && $form_values['feedback']) {
        mollom('mollom.sendFeedback', array('session_id' => $data->session, 'feedback' => $form_values['feedback']));
      }

      // Delete the node. Calling this function will delete any comments,
      // clear the cache and print a status message.
      node_delete($node->nid);
    }
  }

  return '<front>';
}

/**
 * Implementation of hook_mail_alter().
 *
 * This function adds a 'report as inappropriate' link to the e-mails that are sent
 * by the contact module.
 */
function mollom_mail_alter($mailkey, $to, $subject, &$body, $from, $headers) {
  // Only attach the Mollom report link to mails sent by actual users and not
  // any mails sent by Drupal since they should never be reported as spam.
  $valid_keys = array('contact-page-mail', 'contact-page-copy', 'contact-user-mail', 'contact-user-copy');
  $response = $GLOBALS['mollom_response'];
  if (isset($response['session_id']) && in_array($mailkey, $valid_keys)) {
    $body .= "\n\n". t('Report as inappropriate: @link', array('@link' => url('mollom/contact/'. $response['session_id'], NULL, NULL, TRUE)));
  }
}

/**
 * This function is used to report a contact form message as inappropriate.
 */
function mollom_report_contact($session) {
  $form['session'] = array('#type' => 'value', '#value' => $session);
  $form['feedback'] = _mollom_feedback_options();

  return confirm_form($form,
      t('Are you sure you want to report the e-mail message as inappropriate?'),
      $_GET['destination'] ? $_GET['destination'] : '',
      t('This action cannot be undone.'),
      t('Report as inappropriate'), t('Cancel'));
}

/**
 * This function is used to report a contact form message as inappropriate.
 */
function mollom_report_contact_submit($form_id, $form_values) {
  if ($form_values['feedback']) {
    mollom('mollom.sendFeedback', array('session_id' => $form_values['session'], 'feedback' => $form_values['feedback']));
    drupal_set_message('The e-mail has been reported as inappropriate.');
  }

  drupal_goto();
}

/**
 * This function is called when a node is inserted.
 */
function mollom_nodeapi($node, $op) {
  if ($op == 'insert' && isset($GLOBALS['mollom_response']) && isset($GLOBALS['mollom_response']['session_id'])) {
    mollom_set_data($GLOBALS['mollom_response']['session_id'], $GLOBALS['mollom_response']['quality'], 'node-'. $node->nid);
  }
}

/**
 * This function is called when a comment is inserted.
 */
function mollom_comment($comment, $op) {
  if ($op == 'insert' && isset($GLOBALS['mollom_response']) && isset($GLOBALS['mollom_response']['session_id'])) {
    mollom_set_data($GLOBALS['mollom_response']['session_id'], $GLOBALS['mollom_response']['quality'], 'comment-'. $comment['cid']);
  }
}

/**
 * This function intercepts all forms in Drupal and Mollom enables them if
 * necessary.
 */
function mollom_form_alter($form_id, &$form) {
  // Catch all handlers -- this makes it easy to protect all forms
  // with Mollom.  Site administrators don't have their content
  // checked with Mollom.
  if (!user_access('post with no checking')) {
    $form['#pre_render'][] = 'mollom_captcha_prerender';
    $form['#validate']['mollom_validate'] = array();
  }

  // Hook into the mass comment administration page and add some
  // operations to communicate ham/spam to the XML-RPC server.
  if ($form_id == 'comment_admin_overview') {
    $form['options']['operation']['#options']['mollom-unpublish'] = t('Report to Mollom as spam and unpublish');
    $form['options']['operation']['#options']['mollom-delete'] = t('Report to Mollom as spam and delete');
    $form['#validate']['mollom_comment_admin_overview_submit'] = array();
  }

  // Hook into the mass comment administration page and add some
  // operations to communicate ham/spam to the XML-RPC server.
  if ($form_id == 'node_admin_nodes') {
    $form['options']['operation']['#options']['mollom-unpublish'] = t('Report to Mollom as spam and unpublish');
    $form['options']['operation']['#options']['mollom-delete'] = t('Report to Mollom as spam and delete');
    $form['#validate']['mollom_node_admin_overview_submit'] = array();
  }
}

function mollom_comment_admin_overview_submit($form_id, $form_values) {
  // The operation has the following format: mollom-<operation>,
  // where '<operation>' can be 'unpublish' or 'delete'.
  list($id, $operation) = explode('-', $form_values['operation']);

  if ($id == 'mollom') {
    foreach ($form_values['comments'] as $cid => $value) {
      if ($value) {
        // First, send the proper information to the XML-RPC server:
        if ($data = mollom_get_data('comment-'. $cid)) {
          mollom('mollom.sendFeedback', array('session_id' => $data->session, 'feedback' => 'spam'));
        }

        // Second, perform the proper operation on the comments:
        if ($comment = _comment_load($cid)) {
          if ($operation == 'unpublish') {
            db_query("UPDATE {comments} SET status = %d WHERE cid = %d", COMMENT_NOT_PUBLISHED, $cid);
            _comment_update_node_statistics($comment->nid);
          }
          elseif ($operation == 'delete') {
            _comment_delete_thread($comment);
            _comment_update_node_statistics($comment->nid);
          }
        }
      }
    }

    // Clear the cache:
    cache_clear_all();

    if ($operation == 'delete') {
      drupal_set_message(t('The selected comments have been reported as spam and are deleted.'));
    }
    else {
      drupal_set_message(t('The selected comments have been reported as spam and are unpublished.'));
    }
  }
}

function mollom_node_admin_overview_submit($form_id, $form_values) {
  // The operation has the following format: mollom-<operation>,
  // where '<operation>' can be 'unpublish' or 'delete'.
  list($id, $operation) = explode('-', $form_values['operation']);

  if ($id == 'mollom') {
    foreach ($form_values['nodes'] as $nid => $value) {
      if ($value) {
        if ($data = mollom_get_data('node-'. $nid)) {
          mollom('mollom.sendFeedback', array('session_id' => $data->session, 'feedback' => 'spam'));
        }

        if ($node = node_load($nid)) {
          if ($operation == 'unpublish') {
            db_query("UPDATE {node} SET status = 0 WHERE nid = %d", $nid);
          }
          elseif ($operation == 'delete') {
            node_delete($nid);
          }
        }
      }
    }

    // Clear the cache:
    cache_clear_all();

    if ($operation == 'delete') {
      drupal_set_message(t('The selected posts have been reported as spam and are deleted.'));
    }
    else {
      drupal_set_message(t('The selected posts have been reported as spam and are unpublished.'));
    }
  }
}

/**
 * This function will be called by mollom_validate to prepare the
 * XML-RPC data from the comment submission form's $form_values ...
 */
function mollom_data_contact_mail_page($form_values) {
  global $user;

  $data = array(
    'post_title'  => $form_values['subject'],
    'post_body'   => $form_values['message'],
    'author_name' => $form_values['name'] ? $form_values['name'] : $user->name,
    'author_mail' => $form_values['mail'] ? $form_values['mail'] : $user->mail,
    'author_id'   => $user->uid > 0 ? $user->uid : NULL,
    'author_ip'   => _mollom_ip_address(),
  );

  return $data;
}

/**
 * This function will be called by mollom_validate to prepare the
 * XML-RPC data from the comment submission form's $form_values ...
 */
function mollom_data_contact_mail_user($form_values) {
  global $user;

  $data = array(
    'post_title'  => $form_values['subject'],
    'post_body'   => $form_values['message'],
    'author_name' => $form_values['name'] ? $form_values['name'] : $user->name,
    'author_mail' => $form_values['mail'] ? $form_values['mail'] : $user->mail,
    'author_id'   => $user->uid > 0 ? $user->uid : NULL,
    'author_ip'   => _mollom_ip_address(),
  );

  return $data;
}

/**
 * This function will be called by mollom_validate to prepare the
 * XML-RPC data from the comment submission form's $form_values ...
 */
function mollom_data_comment_form($form_values) {
  global $user;

  $data = array(
    'post_title'  => $form_values['subject'],
    'post_body'   => $form_values['comment'],
    'author_name' => $form_values['name'] ? $form_values['name'] : $user->name,
    'author_mail' => $form_values['mail'] ? $form_values['mail'] : $user->mail,
    'author_url'  => $form_values['homepage'],
    'author_id'   => $user->uid > 0 ? $user->uid : NULL,
    'author_ip'   => $form_values['cid'] ? '' : _mollom_ip_address(),
  );

  return $data;
}

/**
 * This function will be called by mollom_validate to prepare the
 * XML-RPC data from the comment submission form's $form_values ...
 */
function mollom_data_node_form($form_values) {
  global $user;

  // Render the node so that all visible fields are prepared and
  // concatenated:
  $node = (object) $form_values;
  // Link module (and potentially other CCK fields) need to prepare submitted
  // form values prior to storage and rendering. This is a stop-gap fix for
  // http://drupal.org/node/271339, as this entire node validation approach
  // can be considered bogus, but this module won't be rewritten for Drupal 5.
  if (function_exists('_content_widget_invoke')) {
    _content_widget_invoke('prepare form values', $node);
  }
  $data = node_build_content($node, FALSE, FALSE);
  $content = drupal_render($data->content);

  $data = array(
    'post_title' => $form_values['title'],
    'post_body' => $content,
    'author_name' => $form_values['name'] ? $form_values['name'] : $user->name,
    'author_mail' => $form_values['mail'] ? $form_values['mail'] : $user->mail,
    'author_url'  => $form_values['homepage'],
    'author_id'   => $user->uid > 0 ? $user->uid : NULL,
    'author_ip'   => $form_values['nid'] ? '' : _mollom_ip_address(),
  );

  return $data;
}

/**
 * This function is a generic validate function that will protect any given
 * form as long there is a variable for it (i.e. as long it is configured to
 * be protected through Mollom). To protect a form in Drupal with Mollom,
 * just variable_set() the "mollom_$form_id" variable.
 */
function mollom_validate($form_id, $form_values) {
  $data = array();

  // Retrieve the mode of protection that is required for this form:
  $mode = _mollom_get_mode($form_id);

  // Don't process the form at all if we don't need to.
  if ($mode == MOLLOM_MODE_DISABLED) {
    return;
  }

  $pos = strpos($form_id, '_node_form');
  if ($pos !== FALSE) {
    // The node forms use dynamic form IDs so we had to create a special
    // case for these.
    $data = mollom_data_node_form($form_values);
  }
  else {
    $function = 'mollom_data_'. $form_id;
    if (function_exists($function)) {
      $data = $function($form_values);
    }
  }

  // Protect the form according to the mode.
  if ($mode == MOLLOM_MODE_ANALYSIS) {
    mollom_protect_form_analysis($form_values, $data);
  }
  else if ($mode == MOLLOM_MODE_CAPTCHA) {
    mollom_protect_form_captcha($form_values, $data);
  }
}

/**
 * Given a form ID, this function will return the strategy that is used
 * to protect this form.  Could be MOLLOM_MODE_DISABLED (none),
 * MOLLOM_MODE_CAPTCHA (CAPTCHAs only) or MOLLOM_MODE_ANALYSIS (text
 * analysis with smart CAPTCHA support).
 */
function _mollom_get_mode($form_id) {
  if (variable_get('mollom_'. $form_id, MOLLOM_MODE_DISABLED)) {
    $forms = mollom_protectable_forms();
    return $forms[$form_id]['mode'];
  }

  return MOLLOM_MODE_DISABLED;
}

/**
 * This function lists all the forms that you can protect with Mollom.
 * If you want to protect additional forms with Mollom add the form ID
 * to this list.
 */
function mollom_protectable_forms() {
  static $forms = NULL;

  if (!$forms) {
    if (module_exists('comment')) {
      $forms['comment_form'] = array(
        'name' => 'comment form',
        'mode' => MOLLOM_MODE_ANALYSIS,
      );
    }

    if (module_exists('contact')) {
      $forms['contact_mail_page'] = array(
        'name' => 'site-wide contact form',
        'mode' => MOLLOM_MODE_ANALYSIS,
      );

      $forms['contact_mail_user'] = array(
        'name' => 'per-user contact forms',
        'mode' => MOLLOM_MODE_ANALYSIS,
      );
    }

    $forms['user_register'] = array(
      'name' => 'user registration form',
      'mode' => MOLLOM_MODE_CAPTCHA,
    );

    $forms['user_pass'] = array(
      'name' => 'user password request form',
      'mode' => MOLLOM_MODE_CAPTCHA,
    );

    // Add all the node types:
    $types = node_get_types('names');
    foreach ($types as $type => $name) {
      $forms[$type .'_node_form'] = array(
        'name' => strtolower($name) ." form",
        'mode' => MOLLOM_MODE_ANALYSIS,
      );
    }
  }

  return $forms;
}

function mollom_admin_settings() {
  $keys = variable_get('mollom_public_key', '') && variable_get('mollom_private_key', '');

  if ($keys) {
    // Print a status message about the key:
    if (!$_POST) {
      // When a user visits the Mollom administration page, we automatically
      // clear the server list.  This will cause the client to fetch a fresh
      // server list from the server.
      variable_del('mollom_servers');

      // Verify the key:
      _mollom_verify_key();
    }

    $form['statistics'] = array(
      '#type' => 'fieldset',
      '#title' => t('Site usage statistics'),
      '#collapsible' => TRUE,
    );
    $form['statistics']['message'] = array(
      '#value' => '<div><embed src="http://mollom.com/statistics.swf?key='. check_plain(variable_get('mollom_public_key', '')) .'" quality="high" width="100%" height="430" name="Mollom" align="middle" play="true" loop="false" allowScriptAccess="sameDomain" type="application/x-shockwave-flash" pluginspage="http://www.adobe.com/go/getflashplayer"></embed></div>',
    );

    $form['spam'] = array(
      '#type' => 'fieldset',
      '#title' => t('Spam protection settings'),
      '#description' =>
        '<p>'. t("Mollom can be used to block all sorts of spam received by your website. Your Drupal site will send data you want checked for spam to the Mollom servers, which will reply with either 'spam' or 'ham' (not spam). If Mollom is not fully confident in its decision, it will ask the user to fill out a CAPTCHA.  On the rare occasion that Mollom asks the poster to fill out a CAPTCHA, Mollom assumes that all legitimate posters will take the extra time to fill out this CAPTCHA.  Using the CAPTCHA, Mollom avoids legitimate messages being incorrectly classified as spam and it eliminates the need to moderate messages that Mollom decided to block.  Administrators can still inspect the <a href=\"@logs\">logs</a> to see what Mollom has blocked.", array('@logs' => url('admin/logs/watchdog'))) .'</p>'.
        '<p>'. t("To perform its service, Mollom processes, stores and compares the data submitted by your site's visitors as explained in our <a href=\"http://mollom.com/service-agreement-free-subscriptions\">Web Service Privacy Policy</a>. As the controller of the data being processed, it is your responsibility to inform your website's visitors, and to obtain appropriate consent from them to allow Mollom to process their data.") .'</p>'.
        '<p>'. t("More information about how Mollom works, is available on the <a href=\"@mollom-workings\">\"How Mollom works\" page</a> and the <a href=\"@mollom-faq\">Mollom FAQ</a>.", array('@mollom-workings' => 'http://mollom.com/how-mollom-works', '@mollom-faq' => 'http://mollom.com/faq')) .'</p>',
      '#collapsible' => TRUE,
    );

    $forms = mollom_protectable_forms();
    foreach ($forms as $formid => $details) {
      $name = 'mollom_'. $formid;
      $form['spam'][$name] = array(
        '#type' => 'checkbox',
        '#title' => t('Protect @name', array('@name' => $details['name'])),
        '#default_value' => variable_get($name, MOLLOM_MODE_DISABLED),
      );
    }

    $form['server'] = array(
      '#type' => 'fieldset',
      '#title' => t('Server settings'),
      '#collapsible' => TRUE,
    );
    $form['server']['mollom_fallback'] = array(
      '#type' => 'radios',
      '#title' => t('Fallback strategy'),
      '#default_value' => variable_get('mollom_fallback', MOLLOM_FALLBACK_BLOCK ), // we default to treating everything as inappropriate
      '#options' => array(
        MOLLOM_FALLBACK_BLOCK  => t('Block all submissions on the protected forms until the server problems are resolved'),
        MOLLOM_FALLBACK_ACCEPT => t('Leave all forms unprotected and accept all submissions')
      ),
      '#description' => t('In the event that Mollom stopped servicing your requests, i.e. because a certain usage quota was reached, your Drupal site will use the configured fallback strategy.  You can choose to blindly accept all submissions without spam checking, or you can choose to block all submissions until this problem is resolved.  You can also <a href="@pricing">upgrade to Mollom Plus</a>: paying customers automatically get access to <a href="@sla">Mollom\'s high-availability backend infrastructure</a> not available to free users.', array('@pricing' => 'http://mollom.com/pricing', '@sla' => 'http://mollom.com/standard-service-level-agreement')),
    );
  }

  $form['access-keys'] = array(
    '#type' => 'fieldset',
    '#title' => t('Mollom access keys'),
    '#description' => t('In order to use Mollom, you need a public and a private key. Visit <a href="http://mollom.com/user">http://mollom.com/user</a> and create a user account to obtain a private and a public access key.'),
    '#collapsible' => TRUE,
    '#collapsed' => $keys,
  );
  $form['access-keys']['mollom_public_key'] = array(
    '#type' => 'textfield',
    '#title' => t('Public key'),
    '#default_value' => variable_get('mollom_public_key', ''),
    '#description' => t('The public key is used to uniquely identify you.'),
    '#required' => TRUE,
  );
  $form['access-keys']['mollom_private_key'] = array(
    '#type' => 'textfield',
    '#title' => t('Private key'),
    '#default_value' => variable_get('mollom_private_key', ''),
    '#description' => t('The private key is used to prevent someone from hijacking your requests. It is like a password and should never be shared with anyone.'),
    '#required' => TRUE,
  );

  return system_settings_form($form);
}

function _mollom_fallback() {
  $fallback = variable_get("mollom_fallback", MOLLOM_FALLBACK_BLOCK);
  if ($fallback == MOLLOM_FALLBACK_BLOCK) {
    form_set_error('mollom', t("The spam filter that is installed on this site is currently not available. Per the site's policy, we are unable to accept new submissions until that problem is resolved. Please try resubmitting the form in a couple minutes."));
  }

  watchdog('mollom', t('Mollom was unavailable (error: @errno - %error_msg)', array('@errno' => xmlrpc_errno(), '%error_msg' => xmlrpc_error_msg())), WATCHDOG_ERROR);
}

function mollom_protect_form_analysis(&$form, $data) {
  $mollom = $_POST['session-id'] ? array('session_id' => $_POST['session-id']) : array();

  $result = mollom('mollom.checkContent', $data + $mollom);

  if (isset($result['spam'])) {
    // We make the response available to other form API handlers:
    $GLOBALS['mollom_response'] = $result;

    if ($result['spam'] == MOLLOM_ANALYSIS_HAM) {
      watchdog('mollom', t('Ham: %message<br />Data: <pre>@data</pre>Result: <pre>@result</pre>', array('%message' => $data['post_body'], '@data' => print_r($data, TRUE), '@result' => print_r($result, TRUE))));
    }
    else if ($result['spam'] == MOLLOM_ANALYSIS_SPAM) {
      form_set_error('analysis', t('Your submission has triggered the installed spam filter and will not be accepted.'));
      watchdog('mollom', t('Spam: %message<br />Data: <pre>@data</pre>Result: <pre>@result</pre>', array('%message' => $data['post_body'], '@data' => print_r($data, TRUE), '@result' => print_r($result, TRUE))));
    }
    else {
      if ($_POST['captcha-solution']) {
        // Check the CAPTCHA result:
        $result = mollom('mollom.checkCaptcha', $data + array('session_id' => $_POST['session-id'], 'solution' => $_POST['captcha-solution'], 'author_ip' => _mollom_ip_address()));

        if (is_bool($result)) {
          if ($result) {
            $GLOBALS['mollom_response']['spam'] = MOLLOM_ANALYSIS_HAM;
            $GLOBALS['mollom_response']['session_id'] = $_POST['session-id'];
            watchdog('mollom', t('Correct CAPTCHA: %message<br />Data: <pre>@data</pre>Result: <pre>@result</pre>', array('%message' => $data['post_body'], '@data' => print_r($data, TRUE), '@result' => print_r($result, TRUE))));
          }
          else {
            form_set_error('captcha', t('The entered CAPTCHA solution is not correct. We generated a new CAPTCHA so please try again.'));
            watchdog('mollom', t('Incorrect CAPTCHA: %message<br />Data: <pre>@data</pre>Result: <pre>@result</pre>', array('%message' => $data['post_body'], '@data' => print_r($data, TRUE), '@result' => print_r($result, TRUE))));
          }
        }
        else {
          _mollom_fallback();
        }
      }
      else {
        form_set_error('analysis', t('We are sorry, but the spam filter on this site decided that your submission could be spam. Please fill in the CAPTCHA below to get your submission accepted.'));
        watchdog('mollom', t('Unsure: %message<br />Data: <pre>@data</pre>Result: <pre>@result</pre>', array('%message' => $data['post_body'], '@data' => print_r($data, TRUE), '@result' => print_r($result, TRUE))));
      }
    }
  }
  else {
    _mollom_fallback();
  }
}

function mollom_protect_form_captcha(&$form, $data) {
  if ($_POST['session-id']) {
    if ($_POST['captcha-solution']) {
      // Check the CAPTCHA result:
      $data += array(
        'session_id' => $_POST['session-id'],
        'captcha_result' => $_POST['captcha-solution'],
        'author_ip' => _mollom_ip_address(),
      );
      $result = mollom('mollom.checkCaptcha', $data);

      if (is_bool($result)) {
        // We make the response available to other form API handlers:
        $GLOBALS['mollom_response']['session_id'] = $_POST['session-id'];

        if (!$result) {
          form_set_error('captcha', t('The entered CAPTCHA solution is not correct. We generated a new CAPTCHA so please try again.'));
          watchdog('mollom', t('Incorrect CAPTCHA<br />Data: <pre>@data</pre>', array('@data' => print_r($data, TRUE))));

          // Generate a new CAPTCHA:
          $GLOBALS['mollom_response'] = mollom('mollom.getImageCaptcha', array('author_ip' => _mollom_ip_address(), 'session_id' => $_POST['session-id']));
        }
        else {
          watchdog('mollom', t('Correct CAPTCHA<br />Data: <pre>@data</pre>', array('@data' => print_r($data, TRUE))));
        }
      }
      else {
        _mollom_fallback();
      }
    }
    else {
      form_set_error('captcha', t('The CAPTCHA field is required.'));

      // Generate a new CAPTCHA:
      $GLOBALS['mollom_response'] = mollom('mollom.getImageCaptcha', array('author_ip' => _mollom_ip_address()));
    }
  }
  else {
    form_set_error('captcha', t('The form data has been altered, the session-id field is required.'));

    // Generate a new CAPTCHA:
    $GLOBALS['mollom_response'] = mollom('mollom.getImageCaptcha', array('author_ip' => _mollom_ip_address()));
  }
}

function mollom_captcha_prerender($form_id, &$form) {
  $response = $GLOBALS['mollom_response'];

  $mode = _mollom_get_mode($form_id);

  if ($mode == MOLLOM_MODE_ANALYSIS && $response['spam'] == MOLLOM_ANALYSIS_UNSURE) {
    $response = mollom('mollom.getImageCaptcha', array('author_ip' => _mollom_ip_address(), 'session_id' => $response['session_id']));
    $captcha = TRUE;
  }
  else if ($mode == MOLLOM_MODE_CAPTCHA) {
    $response = mollom('mollom.getImageCaptcha', array('author_ip' => _mollom_ip_address(), 'session_id' => $response['session_id']));
    $captcha = TRUE;
  }

  if (isset($response['session_id'])) {
    $form['session-id'] = array(
      '#type' => 'hidden',
      '#name' => 'session-id',
      '#id' => 'edit-session-id',
      '#value' => $response['session_id'],
    );

    if ($captcha) {
      // Include the Javascript that allows the user to switch to an
      // AUDIO captcha instead:
      $url = base_path() . (variable_get('clean_url', 0) ? '' : 'index.php?q=');
      drupal_add_js(array('mollom_base_url' => $url), 'setting');
      drupal_add_js(drupal_get_path('module', 'mollom') .'/mollom.js');

      // We add an image captcha to the form. We can't do this from the
      // validate hook, hence the need for the #pre_render trick. In
      // Drupal 6, we can simply use $form_state['rebuild'] = TRUE in
      // the validate-hook, and rebuild the form from there but in
      // Drupal 5, we have to use this prerender-hook hack.
      // Because we're already past the prepare state of the form API,
      // we have a little bit more work to do ...:
      $form['captcha-solution'] = array(
        '#type' => 'textfield',
        '#name' => 'captcha-solution',
        '#id' => 'edit-captcha-solution',
        '#parents' => array(),
        '#title' => t('Word verification'),
        '#field_prefix' => '<div id="captcha"><a href="http://mollom.com"><img src="'. url($response['url']) .'" alt="Mollom CAPTCHA" /></a> (<a href="#" id="audio-captcha">'. t('play audio CAPTCHA') .'</a>)</div>',
        '#required' => TRUE,
        '#size' => 10,
        '#value' => $form['#post']['captcha'],
        '#description' => t("Type the characters shown in the picture above; if you can't read them, submit the form and a new image will be generated."),
        '#weight' => min($form['submit']['#weight'], $form['preview']['#weight']) + 100,
      );

      // Move the preview and/or submit button below the captcha:
      $form['preview']['#weight'] += 101;
      $form['submit']['#weight'] += 101;

      // The weights changed so we re-sort the array:
      uasort($form, "_element_sort");
    }
  }
}

function _mollom_verify_key() {
  $status = mollom('mollom.verifyKey');

  $message = t('We contacted the Mollom servers to verify your keys');

  if (xmlrpc_errno()) {
    drupal_set_message(t('@message: %error (ERROR)', array('@message' => $message, '%error' => xmlrpc_error_msg())), 'error');
  }
  else {
    if ($status) {
      drupal_set_message(t('@message: the Mollom services are operating correctly. We are now blocking spam.', array('@message' => $message)));
    }
    else {
      drupal_set_message(t('@message: your keys do not exist or are no longer valid. Please visit the user settings page on the Mollom website again: <a href="@mollom-user">@mollom-user</a>.', array('@message' => $message, '@mollom-user' => 'http://mollom.com/user')), 'error');
    }
  }
}

function _mollom_ip_address() {
  static $ip_address = NULL;

  if (!isset($ip_address)) {
    $ip_address = $_SERVER['REMOTE_ADDR'];
    if (variable_get('reverse_proxy', 0) && array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER)) {
      // If an array of known reverse proxy IPs is provided, then trust
      // the XFF header if request really comes from one of them.
      $reverse_proxy_addresses = variable_get('reverse_proxy_addresses', array());
      if (!empty($reverse_proxy_addresses) && in_array($ip_address, $reverse_proxy_addresses, TRUE)) {
        // If there are several arguments, we need to check the most
        // recently added one, i.e. the last one.
        $ip_address = array_pop(explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']));
      }
    }
  }

  return $ip_address;
}

/**
 * This function is used to refresh the list of servers that can be used to contact Mollom.
 */
function _mollom_retrieve_server_list() {
  // Start from a hard coded list of servers:
  $servers = array('http://xmlrpc1.mollom.com', 'http://xmlrpc2.mollom.com', 'http://xmlrpc3.mollom.com');

  // Use the list of servers to retrieve a list of servers from mollom.com:
  foreach ($servers as $server) {
    $result = xmlrpc($server .'/'. MOLLOM_API_VERSION, 'mollom.getServerList', _mollom_authentication());
    if (!xmlrpc_errno()) {
      return $result;
    }
    else {
      watchdog('mollom', t('Error @errno: %server - %message - mollom.getServerList', array('@errno' => xmlrpc_errno(), '%server' => $server, '%message' => xmlrpc_error_msg()), WATCHDOG_ERROR));

      // Reset the XMLRPC error:
      xmlrpc_error(0);  // FIXME: this is crazy.
    }
  }

  return array();
}

/**
 * Call a remote procedure at the Mollom server.  This function will
 * automatically add the information required to authenticate against
 * Mollom.
 */
function mollom($method, $data = array()) {
  // Initialize refresh variable:
  $refresh = FALSE;

  // Retrieve the list of Mollom servers from the database:
  $servers = variable_get('mollom_servers', NULL);

  if ($servers == NULL) {
    // Retrieve a list of servers:
    $servers = _mollom_retrieve_server_list();

    // Store the list of servers in the database:
    variable_set('mollom_servers', $servers);
  }

  if (is_array($servers)) {
    reset($servers);
    while ($server = current($servers)) {
      $result = xmlrpc($server .'/'. MOLLOM_API_VERSION, $method, $data + _mollom_authentication());

      if ($errno = xmlrpc_errno()) {
        if ($errno == MOLLOM_REFRESH) {
          if (!$refresh) { // Safety pal to avoid endless loops
            // Retrieve a list of valid Mollom servers from mollom.com:
            $servers = _mollom_retrieve_server_list();

            // Reset the list of servers so we start from the first server in the list:
            reset($servers);

            // Store the updated list of servers in the database:
            variable_set('mollom_servers', $servers);

            // Log this for debuging purposes:
            watchdog('mollom', t('The list of available Mollom servers was refreshed: @servers.', array('@servers' => print_r($servers, TRUE))));

            // Mark that we have refreshed the list:
            $refresh = TRUE;
          }
        }
        elseif ($errno == MOLLOM_REDIRECT) {
          // If this is a network error, we go to the next server in the list.
          $next = next($servers);

          // Do nothing, we automatically select the next server.
          watchdog('mollom', t('The Mollom server %server asked to use the next Mollom server in the list: %next.', array('%server' => $server, '%next' => $next)));
        }
        else {
          watchdog('mollom', t('Error @errno from %server: %message - %method - <pre>@data</pre>', array('@errno' => xmlrpc_errno(), '%server' => $server, '%message' => xmlrpc_error_msg(), '%method' => $method, '@data' => print_r($data, TRUE)), WATCHDOG_ERROR));

          // If it is a 'clean' Mollom error we return instantly.
          if ($errno == MOLLOM_ERROR) {
            return $result;
          }

          // If this is a network error, we go to the next server in the list.
          next($servers);
        }

        // Reset the XMLRPC error:
        xmlrpc_error(0);  // FIXME: this is crazy.
      }
      else {
        return $result;
      }
    }
  }

  // If none of the servers worked, activate the fallback mechanism:
  _mollom_fallback();

  // If everything failed, we reset the server list to force Mollom to request a new list:
  variable_del('mollom_servers');

  // Report this error:
  watchdog('mollom', t('No Mollom servers could be reached or all servers returned an error -- the server list was emptied.'), WATCHDOG_ERROR);
}

/**
 * This function generate an array with all the information required to
 * authenticate against Mollom. To prevent that requests are forged and
 * that you are impersonated, each request is signed with a hash computed
 * based on a private key and a timestamp.
 *
 * Both the client and the server share the secret key that is used to
 * create the authentication hash based on a timestamp.  They both hash
 * the timestamp with the secret key, and if the hashes match, the
 * authenticity of the message has been validated.
 *
 * To avoid that someone can intercept a (hash, timestamp)-pair and
 * use that to impersonate a client, Mollom will reject the request
 * when the timestamp is more than 15 minutes off.
 *
 * Make sure your server's time is synchronized with the world clocks,
 * and that you don't share your private key with anyone else.
 */
function _mollom_authentication() {

  $public_key = variable_get('mollom_public_key', '');
  $private_key = variable_get('mollom_private_key', '');

  // Generate a timestamp according to the dateTime format (http://www.w3.org/TR/xmlschema-2/#dateTime):
  $time = gmdate("Y-m-d\TH:i:s.\\0\\0\\0O", time());

  // Generate a random number:
  $nonce = md5(mt_rand());

  // Calculate a HMAC-SHA1 according to RFC2104 (http://www.ietf.org/rfc/rfc2104.txt):
  $hash = base64_encode(
    pack('H*', sha1((str_pad($private_key, 64, chr(0x00)) ^ (str_repeat(chr(0x5c), 64))) .
    pack('H*', sha1((str_pad($private_key, 64, chr(0x00)) ^ (str_repeat(chr(0x36), 64))) .
    $time .':'. $nonce .':'. $private_key))))
  );

  // Store everything in an array. Elsewhere in the code, we'll add the
  // actual data before we pass it onto the XML-RPC library:
  $data['public_key'] = $public_key;
  $data['time'] = $time;
  $data['hash'] = $hash;
  $data['nonce'] = $nonce;

  return $data;
}