block registration by ip

Code/Lib/Account.php

@@ -13,7 +13,7 @@ use Code\Render\Theme;
 
 class Account {
     
-    public static function check_email($email)
+    public static function check_email($email, $ip = '')
     {
 
         $email = punify($email);
@@ -30,6 +30,8 @@ class Account {
             $result['message'] .= t('Not a valid email address') . EOL;
         } elseif (! allowed_email($email)) {
             $result['message'] = t('Your email domain is not among those allowed on this site');
+        } elseif (! allowed_ip($ip)) {
+            $result['message'] = t('Registration is not permitted');
         } else {
             $r = q(
                 "select account_email from account where account_email = '%s' limit 1",
@@ -188,7 +190,7 @@ class Account {
             return $result;
         }
 
-        $email_result = self::check_email($email);
+        $email_result = self::check_email($email, $_SERVER['REMOTE_ADDR'] ?? '');
 
         if ($email_result['error']) {
             $result['message'] = $email_result['message'];

Code/Module/Register.php

@@ -35,7 +35,7 @@ class Register extends Controller
                 $result = Account::check_invite($_REQUEST['invite_code']);
                 break;
             case 'email_check.json':
-                $result = Account::check_email($_REQUEST['email']);
+                $result = Account::check_email($_REQUEST['email'], $_SERVER['REMOTE_ADDR'] ?? '');
                 break;
             case 'password_check.json':
                 $result = Account::check_password($_REQUEST['password1']);

include/network.php

@@ -338,6 +338,69 @@ function allowed_email($email)
     return $return;
 }
 
+/**
+ * @brief Check if ip address is allowed to register here.
+ *
+ * Compare against our list (wildcards allowed).
+ *
+ * @param string $ip
+ * @return bool Returns false if not allowed, true if allowed or if allowed list is
+ * not configured.
+ */
+function allowed_ip($ip)
+{
+
+
+    $str_allowed = Config::Get('system', 'allowed_register_ip');
+    $str_not_allowed = Config::Get('system', 'not_allowed_register_ip');
+
+    if (! $str_allowed && ! $str_not_allowed) {
+        return true;
+    }
+
+    if (!$ip) {
+        return true;
+    }
+
+    $return = false;
+    $found_allowed = false;
+    $found_not_allowed = false;
+
+    $fnmatch = function_exists('fnmatch');
+
+    $allowed = explode(',', $str_allowed);
+
+    if (count($allowed)) {
+        foreach ($allowed as $a) {
+            $pat = strtolower(trim($a));
+            if ($fnmatch && fnmatch($pat, $ip)) {
+                $found_allowed = true;
+                break;
+            }
+        }
+    }
+
+    $not_allowed = explode(',', $str_not_allowed);
+
+    if (count($not_allowed)) {
+        foreach ($not_allowed as $na) {
+            $pat = strtolower(trim($na));
+            if ($fnmatch && fnmatch($pat, $ip)) {
+                $found_not_allowed = true;
+                break;
+            }
+        }
+    }
+
+    if ($found_allowed) {
+        $return = true;
+    } elseif (!$str_allowed && !$found_not_allowed) {
+        $return = true;
+    }
+
+    return $return;
+}
+
 
 
 function parse_xml_string($s, $strict = true)