bloqué.
*
* OK -> redirige vers suite.php
* PAS OK -> redirige vers bloque.html
*/
session_start();
// ---------- Réglages ----------
define('MIN_DELAY_MS', 900); // délai mini entre affichage et soumission (anti-script instantané)
define('MAX_DELAY_MS', 30000); // délai maxi avant expiration du token
define('FONT_MIN_COUNT', 3); // nb mini de polices détectées
define('WEBGL_BLACKLIST', [
'swiftshader', 'llvmpipe', 'mesa offscreen', 'google swiftshader',
'microsoft basic render', 'vmware, inc.', 'virtualbox',
]);
define('UA_BLACKLIST', [
'headlesschrome', 'phantomjs', 'selenium', 'puppeteer', 'playwright',
'python-requests', 'curl/', 'wget/', 'httpclient', 'scrapy', 'bot', 'spider', 'crawler',
]);
// ---------- Fonctions de vérification ----------
function isBlacklistedUserAgent(): bool {
$ua = strtolower($_SERVER['HTTP_USER_AGENT'] ?? '');
if ($ua === '') return true;
foreach (UA_BLACKLIST as $needle) {
if (strpos($ua, $needle) !== false) return true;
}
return false;
}
function honeypotPassed(array $p): bool {
return isset($p['website']) && $p['website'] === '';
}
function tokenPassed(array $p): bool {
if (empty($_SESSION['page_token']) || empty($_SESSION['page_token_time'])) return false;
if (!isset($p['page_token']) || !hash_equals($_SESSION['page_token'], $p['page_token'])) return false;
$elapsedMs = (microtime(true) - $_SESSION['page_token_time']) * 1000;
return $elapsedMs >= MIN_DELAY_MS && $elapsedMs <= MAX_DELAY_MS;
}
function webdriverPassed(array $p): bool {
return ($p['webdriver'] ?? '1') === '0';
}
function canvasPassed(array $p): bool {
$data = $p['canvas_data'] ?? '';
return is_string($data) && strlen($data) > 120;
}
function webglPassed(array $p): bool {
if (($p['webgl_supported'] ?? '0') !== '1') return false;
$renderer = strtolower($p['webgl_renderer'] ?? '');
$vendor = strtolower($p['webgl_vendor'] ?? '');
if ($renderer === '' && $vendor === '') return false;
foreach (WEBGL_BLACKLIST as $needle) {
if (strpos($renderer, $needle) !== false || strpos($vendor, $needle) !== false) return false;
}
return true;
}
function fontsPassed(array $p): bool {
return (int)($p['font_count'] ?? 0) >= FONT_MIN_COUNT;
}
function interactionPassed(array $p): bool {
return ($p['interacted'] ?? '0') === '1';
}
function verifyAll(array $p): bool {
return !isBlacklistedUserAgent()
&& honeypotPassed($p)
&& tokenPassed($p)
&& webdriverPassed($p)
&& canvasPassed($p)
&& webglPassed($p)
&& fontsPassed($p)
&& interactionPassed($p);
}
// ---------- Endpoint AJAX de vérification ----------
if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'verify') {
header('Content-Type: application/json; charset=utf-8');
if (verifyAll($_POST)) {
echo json_encode(['status' => 'ok', 'redirect' => 'suite.php']);
} else {
echo json_encode(['status' => 'blocked', 'redirect' => 'bloque.html']);
}
exit;
}
// ---------- Génération du token pour cette page-vue ----------
$pageToken = bin2hex(random_bytes(24));
$_SESSION['page_token'] = $pageToken;
$_SESSION['page_token_time'] = microtime(true);
?>
Vérification en cours...