From e2a089478df45c8b90e38d7335055abb1f51fc9f Mon Sep 17 00:00:00 2001
From: Alexander Ebert <ebert@woltlab.com>
Date: Thu, 7 Mar 2019 22:59:57 +0100
Subject: [PATCH] StopForumSpam.com integration

See #2692
---
 com.woltlab.wcf/cronjob.xml                   |  13 ++
 com.woltlab.wcf/option.xml                    |  66 ++++++++-
 constants.php                                 |   5 +
 .../blacklist/entry/BlacklistEntry.class.php  | 127 ++++++++++++++++
 .../entry/BlacklistEntryAction.class.php      |  96 ++++++++++++
 .../entry/BlacklistEntryEditor.class.php      |  23 +++
 .../entry/BlacklistEntryList.class.php        |  24 +++
 .../status/BlacklistStatus.class.php          | 138 ++++++++++++++++++
 .../status/BlacklistStatusAction.class.php    |  22 +++
 .../status/BlacklistStatusEditor.class.php    |  23 +++
 .../status/BlacklistStatusList.class.php      |  24 +++
 .../files/lib/form/RegisterForm.class.php     |  28 +++-
 .../cronjob/UpdateBlacklistCronjob.class.php  |  24 +++
 wcfsetup/install/lang/de.xml                  |  28 ++++
 wcfsetup/install/lang/en.xml                  |  28 ++++
 wcfsetup/setup/db/install.sql                 |  21 +++
 16 files changed, 681 insertions(+), 9 deletions(-)
 create mode 100644 wcfsetup/install/files/lib/data/blacklist/entry/BlacklistEntry.class.php
 create mode 100644 wcfsetup/install/files/lib/data/blacklist/entry/BlacklistEntryAction.class.php
 create mode 100644 wcfsetup/install/files/lib/data/blacklist/entry/BlacklistEntryEditor.class.php
 create mode 100644 wcfsetup/install/files/lib/data/blacklist/entry/BlacklistEntryList.class.php
 create mode 100644 wcfsetup/install/files/lib/data/blacklist/status/BlacklistStatus.class.php
 create mode 100644 wcfsetup/install/files/lib/data/blacklist/status/BlacklistStatusAction.class.php
 create mode 100644 wcfsetup/install/files/lib/data/blacklist/status/BlacklistStatusEditor.class.php
 create mode 100644 wcfsetup/install/files/lib/data/blacklist/status/BlacklistStatusList.class.php
 create mode 100644 wcfsetup/install/files/lib/system/cronjob/UpdateBlacklistCronjob.class.php

diff --git a/com.woltlab.wcf/cronjob.xml b/com.woltlab.wcf/cronjob.xml
index c0dd47ff4c..012ea2c015 100644
--- a/com.woltlab.wcf/cronjob.xml
+++ b/com.woltlab.wcf/cronjob.xml
@@ -202,5 +202,18 @@
 			<startdow>*</startdow>
 			<canbedisabled>0</canbedisabled>
 		</cronjob>
+		<cronjob name="com.woltlab.wcf.updateBlacklist">
+			<classname>wcf\system\cronjob\UpdateBlacklistCronjob</classname>
+			<description>Refreshes the blacklist for spam prevention</description>
+			<description language="de">Aktualisiert die Sperrlisten zur Spambekämpfung</description>
+			<!-- Runs once every hour, even though the data is only refreshed every 6 hours,
+			     but allows instances to catch up when it misses some updates. -->
+			<startminute>15</startminute>
+			<starthour>*</starthour>
+			<startdom>*</startdom>
+			<startmonth>*</startmonth>
+			<startdow>*</startdow>
+			<canbedisabled>0</canbedisabled>
+		</cronjob>
 	</import>
 </data>
diff --git a/com.woltlab.wcf/option.xml b/com.woltlab.wcf/option.xml
index 00a14c6cbe..19c3df2293 100644
--- a/com.woltlab.wcf/option.xml
+++ b/com.woltlab.wcf/option.xml
@@ -172,6 +172,14 @@
 			<category name="security.blacklist">
 				<parent>security</parent>
 			</category>
+			<category name="security.blacklist.sfs">
+				<parent>security.blacklist</parent>
+				<showorder>1</showorder>
+			</category>
+			<category name="security.blacklist.custom">
+				<parent>security.blacklist</parent>
+				<showorder>2</showorder>
+			</category>
 			<category name="security.antispam">
 				<parent>security</parent>
 			</category>
@@ -703,20 +711,62 @@ private:wcf.acp.option.exception_privacy.private</selectoptions>
 				<validationpattern>^.{15,}$</validationpattern>
 			</option>
 			<!-- /security.general.secrets -->
-			<!-- security.blacklist -->
+			<!-- security.blacklist.sfs -->
+			<option name="blacklist_sfs_enable">
+				<categoryname>security.blacklist.sfs</categoryname>
+				<optiontype>boolean</optiontype>
+				<defaultvalue>1</defaultvalue>
+				<enableoptions>blacklist_sfs_username,blacklist_sfs_email_address,blacklist_sfs_ip_address,blacklist_sfs_action</enableoptions>
+			</option>
+			<option name="blacklist_sfs_username">
+				<categoryname>security.blacklist.sfs</categoryname>
+				<optiontype>select</optiontype>
+				<selectoptions><![CDATA[skip:wcf.acp.option.blacklist_sfs_enable.skip
+90percentile:wcf.acp.option.blacklist_sfs_enable.90percentile
+moreThanOnce:wcf.acp.option.blacklist_sfs_enable.moreThanOnce
+simpleMatch:wcf.acp.option.blacklist_sfs_enable.simpleMatch]]></selectoptions>
+				<defaultvalue>90percentile</defaultvalue>
+			</option>
+			<option name="blacklist_sfs_email_address">
+				<categoryname>security.blacklist.sfs</categoryname>
+				<optiontype>select</optiontype>
+				<selectoptions><![CDATA[skip:wcf.acp.option.blacklist_sfs_enable.skip
+90percentile:wcf.acp.option.blacklist_sfs_enable.90percentile
+moreThanOnce:wcf.acp.option.blacklist_sfs_enable.moreThanOnce
+simpleMatch:wcf.acp.option.blacklist_sfs_enable.simpleMatch]]></selectoptions>
+				<defaultvalue>moreThanOnce</defaultvalue>
+			</option>
+			<option name="blacklist_sfs_ip_address">
+				<categoryname>security.blacklist.sfs</categoryname>
+				<optiontype>select</optiontype>
+				<selectoptions><![CDATA[skip:wcf.acp.option.blacklist_sfs_enable.skip
+90percentile:wcf.acp.option.blacklist_sfs_enable.90percentile
+moreThanOnce:wcf.acp.option.blacklist_sfs_enable.moreThanOnce
+simpleMatch:wcf.acp.option.blacklist_sfs_enable.simpleMatch]]></selectoptions>
+				<defaultvalue>90percentile</defaultvalue>
+			</option>
+			<option name="blacklist_sfs_action">
+				<categoryname>security.blacklist.sfs</categoryname>
+				<optiontype>select</optiontype>
+				<selectoptions><![CDATA[disable:wcf.acp.option.blacklist_sfs_action.disable
+block:wcf.acp.option.blacklist_sfs_action.block]]></selectoptions>
+				<defaultvalue>disable</defaultvalue>
+			</option>
+			<!-- /security.blacklist.stopforumspam -->
+			<!-- security.blacklist.custom -->
 			<option name="blacklist_ip_addresses">
-				<categoryname>security.blacklist</categoryname>
+				<categoryname>security.blacklist.custom</categoryname>
 				<optiontype>textarea</optiontype>
 			</option>
 			<option name="blacklist_user_agents">
-				<categoryname>security.blacklist</categoryname>
+				<categoryname>security.blacklist.custom</categoryname>
 				<optiontype>textarea</optiontype>
 			</option>
 			<option name="blacklist_hostnames">
-				<categoryname>security.blacklist</categoryname>
+				<categoryname>security.blacklist.custom</categoryname>
 				<optiontype>textarea</optiontype>
 			</option>
-			<!-- /security.blacklist -->
+			<!-- /security.blacklist.custom -->
 			<!-- security.antispam.captcha -->
 			<option name="captcha_type">
 				<categoryname>security.antispam.captcha</categoryname>
@@ -1683,5 +1733,11 @@ DESC:wcf.global.sortOrder.descending</selectoptions>
 	</import>
 	<delete>
 		<option name="module_attachment"/>
+		<option name="blacklist_sfs_username_time_period" />
+		<option name="blacklist_sfs_sensitivity" />
+		<option name="blacklist_sfs_action" />
+		<option name="blacklist_sfs_username" />
+		<option name="blacklist_sfs_email_address" />
+		<option name="blacklist_sfs_ip_address" />
 	</delete>
 </data>
diff --git a/constants.php b/constants.php
index cd16aa4e92..fad8369f12 100644
--- a/constants.php
+++ b/constants.php
@@ -252,3 +252,8 @@ define('CONTACT_FORM_PRUNE_ATTACHMENTS', 180);
 define('IMAGE_EXTERNAL_SOURCE_WHITELIST', '');
 define('SEARCH_MAX_COMBINED_TAGS', 3);
 define('ENABLE_PRODUCTION_DEBUG_MODE', 0);
+define('BLACKLIST_SFS_ENABLE', 1);
+define('BLACKLIST_SFS_USERNAME', '90percentile');
+define('BLACKLIST_SFS_EMAIL_ADDRESS', 'moreThanOnce');
+define('BLACKLIST_SFS_IP_ADDRESS', '90percentile');
+define('BLACKLIST_SFS_ACTION', 'disable');
diff --git a/wcfsetup/install/files/lib/data/blacklist/entry/BlacklistEntry.class.php b/wcfsetup/install/files/lib/data/blacklist/entry/BlacklistEntry.class.php
new file mode 100644
index 0000000000..468f1a319c
--- /dev/null
+++ b/wcfsetup/install/files/lib/data/blacklist/entry/BlacklistEntry.class.php
@@ -0,0 +1,127 @@
+<?php
+namespace wcf\data\blacklist\entry;
+use wcf\data\DatabaseObject;
+use wcf\system\database\util\PreparedStatementConditionBuilder;
+use wcf\system\WCF;
+use wcf\util\UserUtil;
+
+/**
+ * Represents a blacklist entry.
+ * 
+ * @author      Alexander Ebert
+ * @copyright   2001-2019 WoltLab GmbH
+ * @license     GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ * @package     WoltLabSuite\Core\Data\Blacklist\Entry
+ * 
+ * @property-read string $type One of 'email', 'ipv4', 'ipv6' or 'username'
+ * @property-read string $hash SHA256 hash of the original value
+ * @property-read int $lastSeen Timestamp of the last report, derivation is up to 24hrs
+ * @property-read int $occurrences Number of times this value was reported, capped at 32,767
+ * @since 5.2
+ */
+class BlacklistEntry extends DatabaseObject {
+	/**
+	 * @param string $username
+	 * @param string $email
+	 * @param string $ipAddress
+	 * @return boolean
+	 */
+	public static function shouldReject($username, $email, $ipAddress) {
+		if (BLACKLIST_SFS_USERNAME === 'skip' && BLACKLIST_SFS_EMAIL_ADDRESS === 'skip' && BLACKLIST_SFS_IP_ADDRESS === 'skip') {
+			return false;
+		}
+		
+		$conditions = new PreparedStatementConditionBuilder(true, 'OR');
+		if (BLACKLIST_SFS_USERNAME) {
+			$conditions->add('(type = ? AND hash = ?)', ['username', hash('sha256', $username)]);
+		}
+		if (BLACKLIST_SFS_EMAIL_ADDRESS) {
+			$conditions->add('(type = ? AND hash = ?)', ['email', hash('sha256', $email)]);
+		}
+		if (BLACKLIST_SFS_IP_ADDRESS) {
+			UserUtil::convertIPv6To4($ipAddress);
+			if ($ipAddress) {
+				if (filter_var($ipAddress, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false) {
+					$conditions->add('(type = ? AND hash = ?)', ['ipv4', hash('sha256', $ipAddress)]);
+				}
+				else {
+					$parts = explode(':', $ipAddress);
+					
+					// StopForumSpam uses the first two to four segments of an IPv6 address.
+					$ipv6TwoParts = hash('sha256', "{$parts[0]}:{$parts[1]}::");
+					$ipv6ThreeParts = hash('sha256', "{$parts[0]}:{$parts[1]}:{$parts[2]}::");
+					$ipv6FourParts = hash('sha256', "{$parts[0]}:{$parts[1]}:{$parts[2]}:{$parts[3]}::");
+					
+					$conditions->add('(type = ? AND hash IN (?))', ['ipv6', [$ipv6TwoParts, $ipv6ThreeParts, $ipv6FourParts]]);
+				}
+			}
+		}
+		
+		$sql = "SELECT  type, occurrences
+			FROM    wcf".WCF_N."_blacklist_entry
+			".$conditions;
+		$statement = WCF::getDB()->prepareStatement($sql);
+		$statement->execute($conditions->getParameters());
+		while ($row = $statement->fetchArray()) {
+			if (self::isMatch($row['type'], $row['occurrences'])) {
+				return true;
+			}
+		}
+		
+		return false;
+	}
+	
+	protected static function isMatch($type, $occurrences) {
+		$setting = [
+			'email' => BLACKLIST_SFS_EMAIL_ADDRESS,
+			'ipv4' => BLACKLIST_SFS_IP_ADDRESS,
+			'ipv6' => BLACKLIST_SFS_IP_ADDRESS,
+			'username' => BLACKLIST_SFS_USERNAME,
+		][$type];
+		
+		switch ($setting) {
+			case '90percentile':
+				if ($occurrences >= self::get90Percentile($type)) {
+					return true;
+				}
+				break;
+				
+			case 'moreThanOnce':
+				return $occurrences > 1;
+				
+			case 'simpleMatch':
+				// We could just return `true`, but this makes it much more clearer.
+				return $occurrences > 0;
+		}
+		
+		return false;
+	}
+	
+	protected static function get90Percentile($type) {
+		static $percentile = [];
+		if (!isset($percentile[$type])) {
+			// Fake value that will cause the check to always evaluate to false.
+			$percentile[$type] = 99999;
+			
+			$sql = "SELECT  COUNT(*) AS count
+				FROM    wcf".WCF_N."_blacklist_entry
+				WHERE   type = ?";
+			$statement = WCF::getDB()->prepareStatement($sql);
+			$statement->execute([$type]);
+			$count = $statement->fetchSingleColumn();
+			
+			if ($count > 0) {
+				$sql = "SELECT          occurrences
+					FROM            wcf".WCF_N."_blacklist_entry
+					WHERE           type = ?
+					ORDER BY        occurrences DESC";
+				$statement = WCF::getDB()->prepareStatement($sql, 1, round($count * 0.9));
+				$statement->execute([$type]);
+				
+				$percentile[$type] = $statement->fetchSingleColumn();
+			}
+		}
+		
+		return $percentile[$type];
+	}
+}
diff --git a/wcfsetup/install/files/lib/data/blacklist/entry/BlacklistEntryAction.class.php b/wcfsetup/install/files/lib/data/blacklist/entry/BlacklistEntryAction.class.php
new file mode 100644
index 0000000000..3f352135c2
--- /dev/null
+++ b/wcfsetup/install/files/lib/data/blacklist/entry/BlacklistEntryAction.class.php
@@ -0,0 +1,96 @@
+<?php
+namespace wcf\data\blacklist\entry;
+use wcf\data\AbstractDatabaseObjectAction;
+use wcf\data\blacklist\status\BlacklistStatus;
+use wcf\data\blacklist\status\BlacklistStatusEditor;
+use wcf\system\exception\HTTPNotFoundException;
+use wcf\system\exception\HTTPServerErrorException;
+use wcf\system\exception\HTTPUnauthorizedException;
+use wcf\system\exception\SystemException;
+use wcf\system\WCF;
+use wcf\util\exception\HTTPException;
+use wcf\util\HTTPRequest;
+use wcf\util\JSON;
+
+/**
+ * Executes blacklist entry-related actions.
+ * 
+ * @author      Alexander Ebert
+ * @copyright   2001-2019 WoltLab GmbH
+ * @license     GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ * @package     WoltLabSuite\Core\Data\Blacklist\Entry
+ * 
+ * @method BlacklistEntryEditor[] getObjects()
+ * @method BlacklistEntryEditor getSingleObject()
+ * @since 5.2
+ */
+class BlacklistEntryAction extends AbstractDatabaseObjectAction {
+	/**
+	 * @inheritDoc
+	 */
+	protected $className = BlacklistEntryEditor::class;
+	
+	public function import() {
+		// Check if we need to import any data at all.
+		$status = BlacklistStatus::getAll();
+		$nextDelta = BlacklistStatus::getNextDelta($status);
+		if ($nextDelta === null) {
+			return;
+		}
+		
+		$request = new HTTPRequest("https://assets.woltlab.com/blacklist/{$nextDelta}");
+		try {
+			$request->execute();
+		}
+		catch (SystemException $e) {
+			if (
+				$e instanceof HTTPNotFoundException
+				|| $e instanceof HTTPUnauthorizedException
+				|| $e instanceof HTTPServerErrorException
+				|| $e instanceof HTTPException
+			) {
+				\wcf\functions\exception\logThrowable($e);
+				
+				return;
+			}
+			
+			throw $e;
+		}
+		
+		$response = $request->getReply();
+		if ($response['statusCode'] == 200) {
+			$data = JSON::decode($response['body']);
+			if (is_array($data)) {
+				$sql = "INSERT INTO             wcf".WCF_N."_blacklist_entry
+								(type, hash, lastSeen, occurrences)
+					VALUES                  (?, ?, ?, ?)
+					ON DUPLICATE KEY UPDATE lastSeen = VALUES(lastSeen),
+								occurrences = VALUES(occurrences)";
+				$statement = WCF::getDB()->prepareStatement($sql);
+				
+				$lastSeen = preg_replace('~^(.+)T(.+)Z~', '$1 $2', $data['meta']['end']);
+				
+				WCF::getDB()->beginTransaction();
+				foreach (['email', 'ipv4', 'ipv6', 'username'] as $type) {
+					foreach ($data[$type] as $hash => $occurrences) {
+						$statement->execute([
+							$type,
+							$hash,
+							$lastSeen,
+							min($occurrences, 32767),
+						]);
+					}
+				}
+				WCF::getDB()->commitTransaction();
+				unset($entries);
+				
+				$blacklistStatus = new BlacklistStatus($data['meta']['date']);
+				if (!$blacklistStatus->date) {
+					$blacklistStatus = BlacklistStatusEditor::create(['date' => $data['meta']['date']]);
+				}
+				
+				(new BlacklistStatusEditor($blacklistStatus))->update([$data['meta']['type'] => 1]);
+			}
+		}
+	}
+}
diff --git a/wcfsetup/install/files/lib/data/blacklist/entry/BlacklistEntryEditor.class.php b/wcfsetup/install/files/lib/data/blacklist/entry/BlacklistEntryEditor.class.php
new file mode 100644
index 0000000000..5f9a78961e
--- /dev/null
+++ b/wcfsetup/install/files/lib/data/blacklist/entry/BlacklistEntryEditor.class.php
@@ -0,0 +1,23 @@
+<?php
+namespace wcf\data\blacklist\entry;
+use wcf\data\DatabaseObjectEditor;
+
+/**
+ * Provides functions to edit blacklist entries.
+ * 
+ * @author      Alexander Ebert
+ * @copyright   2001-2019 WoltLab GmbH
+ * @license     GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ * @package     WoltLabSuite\Core\Data\Blacklist\Entry
+ * 
+ * @method static BlacklistEntry create(array $parameters = [])
+ * @method BlacklistEntry getDecoratedObject()
+ * @mixin BlacklistEntry
+ * @since 5.2
+ */
+class BlacklistEntryEditor extends DatabaseObjectEditor {
+	/**
+	 * @inheritDoc
+	 */
+	public static $baseClass = BlacklistEntry::class;
+}
diff --git a/wcfsetup/install/files/lib/data/blacklist/entry/BlacklistEntryList.class.php b/wcfsetup/install/files/lib/data/blacklist/entry/BlacklistEntryList.class.php
new file mode 100644
index 0000000000..2003684b93
--- /dev/null
+++ b/wcfsetup/install/files/lib/data/blacklist/entry/BlacklistEntryList.class.php
@@ -0,0 +1,24 @@
+<?php
+namespace wcf\data\blacklist\entry;
+use wcf\data\DatabaseObjectList;
+
+/**
+ * Represents a list of blacklist entries.
+ * 
+ * @author      Alexander Ebert
+ * @copyright   2001-2019 WoltLab GmbH
+ * @license     GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ * @package     WoltLabSuite\Core\Data\Blacklist\Entry
+ * 
+ * @method BlacklistEntry current()
+ * @method BlacklistEntry[] getObjects()
+ * @method BlacklistEntry|null search($objectID)
+ * @property BlacklistEntry[] $objects
+ * @since 5.2
+ */
+class BlacklistEntryList extends DatabaseObjectList {
+	/**
+	 * @inheritDoc
+	 */
+	public $className = BlacklistEntry::class;
+}
diff --git a/wcfsetup/install/files/lib/data/blacklist/status/BlacklistStatus.class.php b/wcfsetup/install/files/lib/data/blacklist/status/BlacklistStatus.class.php
new file mode 100644
index 0000000000..e6db68023c
--- /dev/null
+++ b/wcfsetup/install/files/lib/data/blacklist/status/BlacklistStatus.class.php
@@ -0,0 +1,138 @@
+<?php
+namespace wcf\data\blacklist\status;
+use wcf\data\DatabaseObject;
+use wcf\system\exception\HTTPNotFoundException;
+use wcf\system\exception\HTTPServerErrorException;
+use wcf\system\exception\HTTPUnauthorizedException;
+use wcf\system\exception\SystemException;
+use wcf\util\exception\HTTPException;
+use wcf\util\HTTPRequest;
+use wcf\util\JSON;
+
+/**
+ * Represents a blacklist status.
+ * 
+ * @author      Alexander Ebert
+ * @copyright   2001-2019 WoltLab GmbH
+ * @license     GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ * @package     WoltLabSuite\Core\Data\Blacklist\Status
+ * 
+ * @property-read string $date ISO 8601 date (UTC)
+ * @property-read int $delta1 Is 1 if the first delta (00:00-05:59 UTC) of the day has been fetched, otherwise 0
+ * @property-read int $delta2 Is 1 if the second delta (06:00-11:59 UTC) of the day has been fetched, otherwise 0
+ * @property-read int $delta3 Is 1 if the third delta (12:00-17:59 UTC) of the day has been fetched, otherwise 0
+ * @property-read int $delta4 Is 1 if the fourth delta (18:00-23:59 UTC) of the day has been fetched, otherwise 0
+ * @since 5.2
+ */
+class BlacklistStatus extends DatabaseObject {
+	protected static $databaseTableIndexName = 'date';
+	protected static $databaseTableIndexIsIdentity = false;
+	
+	/**
+	 * Returns true if the delta for the time period of the UTC hour has already been fetched.
+	 * 
+	 * @param int $utcHour
+	 * @return bool
+	 */
+	public function hasDelta($utcHour) {
+		if ($utcHour < 6) return !!$this->delta1;
+		else if ($utcHour < 12) return !!$this->delta2;
+		else if ($utcHour < 18) return !!$this->delta3;
+		else return !!$this->delta4;
+	}
+	
+	/**
+	 * Returns true if all values for this date have been fetched.
+	 * 
+	 * @return bool
+	 */
+	public function isComplete() {
+		return $this->delta1 && $this->delta2 && $this->delta3 && $this->delta4;
+	}
+	
+	/**
+	 * Returns a list of all known dates grouped by their ISO date.
+	 * 
+	 * @return BlacklistStatus[]
+	 */
+	public static function getAll() {
+		$objectList = new BlacklistStatusList();
+		$objectList->readObjects();
+		
+		$status = [];
+		foreach ($objectList as $blacklistStatus) {
+			$status[$blacklistStatus->date] = $blacklistStatus;
+		}
+		
+		return $status;
+	}
+	
+	/**
+	 * Evaluates the available and already processed delta update in order to determine the
+	 * next delta update. Returns the relative filename or `null` if there is no update or
+	 * an error occurred.
+	 * 
+	 * @param BlacklistStatus[] $status
+	 * @return string|null
+	 */
+	public static function getNextDelta(array $status) {
+		// Fetch the index file to determine the oldest possible value that can be retrieved.
+		$request = new HTTPRequest('https://assets.woltlab.com/blacklist/index.json');
+		try {
+			$request->execute();
+		}
+		catch (SystemException $e) {
+			if (
+				$e instanceof HTTPNotFoundException
+				|| $e instanceof HTTPUnauthorizedException
+				|| $e instanceof HTTPServerErrorException
+				|| $e instanceof HTTPException
+			) {
+				\wcf\functions\exception\logThrowable($e);
+				
+				return null;
+			}
+			
+			throw $e;
+		}
+		
+		$response = $request->getReply();
+		if ($response['statusCode'] == 200) {
+			$data = JSON::decode($response['body']);
+			if (is_array($data)) {
+				$deltas = ['delta1', 'delta2', 'delta3', 'delta4'];
+				
+				// The array is ordered from "now" to "14 days ago".
+				foreach (array_reverse($data) as $entry) {
+					$date = $entry['date'];
+					if (isset($status[$date])) {
+						$dateStatus = $status[$date];
+						if ($dateStatus->isComplete()) {
+							continue;
+						}
+						
+						foreach ($deltas as $delta) {
+							if ($entry['files'][$delta] && !$dateStatus->{$delta}) {
+								return "{$date}/{$delta}.json";
+							}
+						}
+					}
+					else {
+						foreach ($deltas as $delta) {
+							if ($entry['files'][$delta]) {
+								return "{$date}/{$delta}.json";
+							}
+						} 
+					}
+					
+					// The `full.json` file is not considered for now, because it is very unlikely that none of the
+					// delta files are available. Also, it's significant larger than the delta updates and we cannot
+					// reliably predict if we're able to import it at all: slow hosts or max_execution_time almost
+					// exhausted by other cronjobs.
+				}
+			}
+		}
+		
+		return null;
+	}
+}
diff --git a/wcfsetup/install/files/lib/data/blacklist/status/BlacklistStatusAction.class.php b/wcfsetup/install/files/lib/data/blacklist/status/BlacklistStatusAction.class.php
new file mode 100644
index 0000000000..dc8a0a1ea0
--- /dev/null
+++ b/wcfsetup/install/files/lib/data/blacklist/status/BlacklistStatusAction.class.php
@@ -0,0 +1,22 @@
+<?php
+namespace wcf\data\blacklist\status;
+use wcf\data\AbstractDatabaseObjectAction;
+
+/**
+ * Executes blacklist status-related actions.
+ * 
+ * @author      Alexander Ebert
+ * @copyright   2001-2019 WoltLab GmbH
+ * @license     GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ * @package     WoltLabSuite\Core\Data\Blacklist\Status
+ * 
+ * @method BlacklistStatusEditor[] getObjects()
+ * @method BlacklistStatusEditor getSingleObject()
+ * @since 5.2
+ */
+class BlacklistStatusAction extends AbstractDatabaseObjectAction {
+	/**
+	 * @inheritDoc
+	 */
+	protected $className = BlacklistStatusEditor::class;
+}
diff --git a/wcfsetup/install/files/lib/data/blacklist/status/BlacklistStatusEditor.class.php b/wcfsetup/install/files/lib/data/blacklist/status/BlacklistStatusEditor.class.php
new file mode 100644
index 0000000000..310eb0a519
--- /dev/null
+++ b/wcfsetup/install/files/lib/data/blacklist/status/BlacklistStatusEditor.class.php
@@ -0,0 +1,23 @@
+<?php
+namespace wcf\data\blacklist\status;
+use wcf\data\DatabaseObjectEditor;
+
+/**
+ * Provides functions to edit blacklist status.
+ * 
+ * @author      Alexander Ebert
+ * @copyright   2001-2019 WoltLab GmbH
+ * @license     GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ * @package     WoltLabSuite\Core\Data\Blacklist\Status
+ * 
+ * @method static BlacklistStatus create(array $parameters = [])
+ * @method BlacklistStatus getDecoratedObject()
+ * @mixin BlacklistStatus
+ * @since 5.2
+ */
+class BlacklistStatusEditor extends DatabaseObjectEditor {
+	/**
+	 * @inheritDoc
+	 */
+	public static $baseClass = BlacklistStatus::class;
+}
diff --git a/wcfsetup/install/files/lib/data/blacklist/status/BlacklistStatusList.class.php b/wcfsetup/install/files/lib/data/blacklist/status/BlacklistStatusList.class.php
new file mode 100644
index 0000000000..da281448de
--- /dev/null
+++ b/wcfsetup/install/files/lib/data/blacklist/status/BlacklistStatusList.class.php
@@ -0,0 +1,24 @@
+<?php
+namespace wcf\data\blacklist\status;
+use wcf\data\DatabaseObjectList;
+
+/**
+ * Represents a list of blacklist status.
+ * 
+ * @author      Alexander Ebert
+ * @copyright   2001-2019 WoltLab GmbH
+ * @license     GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ * @package     WoltLabSuite\Core\Data\Blacklist\Status
+ * 
+ * @method BlacklistStatus current()
+ * @method BlacklistStatus[] getObjects()
+ * @method BlacklistStatus|null search($objectID)
+ * @property BlacklistStatus[] $objects
+ * @since 5.2
+ */
+class BlacklistStatusList extends DatabaseObjectList {
+	/**
+	 * @inheritDoc
+	 */
+	public $className = BlacklistStatus::class;
+}
diff --git a/wcfsetup/install/files/lib/form/RegisterForm.class.php b/wcfsetup/install/files/lib/form/RegisterForm.class.php
index 645458873a..e259a49a2b 100644
--- a/wcfsetup/install/files/lib/form/RegisterForm.class.php
+++ b/wcfsetup/install/files/lib/form/RegisterForm.class.php
@@ -1,6 +1,7 @@
 <?php
 namespace wcf\form;
 use wcf\acp\form\UserAddForm;
+use wcf\data\blacklist\entry\BlacklistEntry;
 use wcf\data\object\type\ObjectType;
 use wcf\data\user\avatar\Gravatar;
 use wcf\data\user\avatar\UserAvatarAction;
@@ -29,6 +30,7 @@ use wcf\system\WCF;
 use wcf\util\HeaderUtil;
 use wcf\util\StringUtil;
 use wcf\util\UserRegistrationUtil;
+use wcf\util\UserUtil;
 
 /**
  * Shows the user registration form.
@@ -81,6 +83,13 @@ class RegisterForm extends UserAddForm {
 	 */
 	public $randomFieldNames = [];
 	
+	/**
+	 * the user will be disabled and requires manual approval
+	 * @var bool
+	 * @since 5.2
+	 */
+	public $forceDisableUser = false;
+	
 	/**
 	 * min number of seconds between form request and submit
 	 * @var	integer
@@ -164,6 +173,17 @@ class RegisterForm extends UserAddForm {
 		if (!$this->isExternalAuthentication && (!WCF::getSession()->getVar('registrationStartTime') || (TIME_NOW - WCF::getSession()->getVar('registrationStartTime')) < self::$minRegistrationTime)) {
 			throw new UserInputException('registrationStartTime', []);
 		}
+		
+		if (BLACKLIST_SFS_ENABLE) {
+			if (BlacklistEntry::shouldReject($this->username, $this->email, UserUtil::getIpAddress())) {
+				if (BLACKLIST_SFS_ACTION === 'disable') {
+					$this->forceDisableUser = true;
+				}
+				else {
+					throw new PermissionDeniedException();
+				}
+			}
+		}
 	}
 	
 	/**
@@ -411,7 +431,7 @@ class RegisterForm extends UserAddForm {
 		
 		// generate activation code
 		$addDefaultGroups = true;
-		if ((REGISTER_ACTIVATION_METHOD == 1 && !$registerVia3rdParty) || REGISTER_ACTIVATION_METHOD == 2) {
+		if ($this->forceDisableUser || (REGISTER_ACTIVATION_METHOD == 1 && !$registerVia3rdParty) || REGISTER_ACTIVATION_METHOD == 2) {
 			$activationCode = UserRegistrationUtil::getActivationCode();
 			$this->additionalFields['activationCode'] = $activationCode;
 			$addDefaultGroups = false;
@@ -453,10 +473,10 @@ class RegisterForm extends UserAddForm {
 		}
 		
 		// activation management
-		if (REGISTER_ACTIVATION_METHOD == 0) {
+		if (REGISTER_ACTIVATION_METHOD == 0 && !$this->forceDisableUser) {
 			$this->message = 'wcf.user.register.success';
 		}
-		else if (REGISTER_ACTIVATION_METHOD == 1) {
+		else if (REGISTER_ACTIVATION_METHOD == 1 && !$this->forceDisableUser) {
 			// registering via 3rdParty leads to instant activation
 			if ($registerVia3rdParty) {
 				$this->message = 'wcf.user.register.success';
@@ -473,7 +493,7 @@ class RegisterForm extends UserAddForm {
 				$this->message = 'wcf.user.register.success.needActivation';
 			}
 		}
-		else if (REGISTER_ACTIVATION_METHOD == 2) {
+		else if (REGISTER_ACTIVATION_METHOD == 2 || $this->forceDisableUser) {
 			$this->message = 'wcf.user.register.success.awaitActivation';
 		}
 		
diff --git a/wcfsetup/install/files/lib/system/cronjob/UpdateBlacklistCronjob.class.php b/wcfsetup/install/files/lib/system/cronjob/UpdateBlacklistCronjob.class.php
new file mode 100644
index 0000000000..8f451ccfbb
--- /dev/null
+++ b/wcfsetup/install/files/lib/system/cronjob/UpdateBlacklistCronjob.class.php
@@ -0,0 +1,24 @@
+<?php
+namespace wcf\system\cronjob;
+use wcf\data\blacklist\entry\BlacklistEntryAction;
+use wcf\data\cronjob\Cronjob;
+
+/**
+ * Updates the built-in blacklist data.
+ * 
+ * @author      Alexander Ebert
+ * @copyright	2001-2019 WoltLab GmbH
+ * @license     GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
+ * @package     WoltLabSuite\Core\System\Cronjob
+ * @since       5.2
+ */
+class UpdateBlacklistCronjob extends AbstractCronjob {
+	/**
+	 * @inheritDoc
+	 */
+	public function execute(Cronjob $cronjob) {
+		if (!BLACKLIST_SFS_ENABLE) return;
+		
+		(new BlacklistEntryAction([], 'import'))->executeAction();
+	}
+}
diff --git a/wcfsetup/install/lang/de.xml b/wcfsetup/install/lang/de.xml
index 3aac8fd984..554d7659b4 100644
--- a/wcfsetup/install/lang/de.xml
+++ b/wcfsetup/install/lang/de.xml
@@ -1674,6 +1674,34 @@ Als Benachrichtigungs-URL in der Konfiguration der sofortigen Zahlungsbestätigu
 		<item name="wcf.acp.option.contact_form_prune_attachments.description"><![CDATA[Alte Dateianhänge werden nach Ablauf der Frist automatisch gelöscht. [0, um die Löschung zu deaktivieren]]]></item>
 		<item name="wcf.acp.option.firstTimeSetup"><![CDATA[Erstmalige Einrichtung]]></item>
 		<item name="wcf.acp.option.firstTimeSetup.description"><![CDATA[{if LANGUAGE_USE_INFORMAL_VARIANT}Konfiguriere{else}Konfigurieren Sie{/if} die wichtigsten Einstellungen, diese können auch später über die Optionen verändert werden.]]></item>
+		<item name="wcf.acp.option.category.security.blacklist.sfs"><![CDATA[Stop Forum Spam]]></item>
+		<item name="wcf.acp.option.category.security.blacklist.sfs.description"><![CDATA[Datenschutzkonforme Überprüfung auf Basis einer lokalen Kopie der StopForumSpam.com-Datenbestände.]]></item>
+		<item name="wcf.acp.option.category.security.blacklist.custom"><![CDATA[Eigene Sperrlisten]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_enable"><![CDATA[Abgleich mit Stop Forum Spam aktivieren]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_enable.description"><![CDATA[Die lokale Datenbank enthält Informationen zur Häufigkeit, mit der ein Eintrag als Spammer gemeldet wurde.<br>
+<strong>Hinweis: Es werden zu keinem Zeitpunkt Daten an Drittseiten übertragen.</strong><br>
+<br>
+Die Datenbestände werden sorgfältig gepflegt, aber es ist nicht ausgeschlossen, dass manche Einträge nicht korrekt oder veraltet sind. Zu diesem Zweck existieren unterschiedliche unterschiedliche Abstufungen, wie die jeweiligen Übereinstimmungen zu werten sind. Die empfohlenen Einstellungen basieren auf jahrelangen Erfahrungswerten und Veränderungen sollten daher nur mit Bedacht getätigt werden.
+<ul class="nativeList">
+	<li><strong>Nicht überprüfen</strong> – Dieses Feld wird nicht abgeglichen.</li>
+	<li><strong>Top 10%</strong> – Nur die 10% am häufigsten gemeldeten Treffer werden gewertet.</li>
+	<li><strong>Mehrfach gemeldet</strong> – Es muss mehr als eine Meldung geben.</li>
+	<li><strong>Einfacher Treffer reicht aus</strong> – Die Anzahl der Meldungen wird nicht berücksichtigt, jede Übereinstimmung reicht aus. Nicht empfohlen.</li>
+</ul>]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_enable.skip"><![CDATA[Nicht überprüfen]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_enable.90percentile"><![CDATA[Top 10%]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_enable.moreThanOnce"><![CDATA[Mehrfach gemeldet]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_enable.simpleMatch"><![CDATA[Einfacher Treffer reicht aus]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_username"><![CDATA[Benutzername]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_username.description"><![CDATA[Erfahrungsgemäß ein sehr unzuverlässiges Kriterium zur Erkennung. Empfohlene Einstellung: <strong>Top 10%</strong>.]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_email_address"><![CDATA[E-Mail-Adresse]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_email_address.description"><![CDATA[E-Mail-Adressen sind einzigartig und stellen eine solide Basis dar. Empfohlene Einstellung: <strong>Mehrfach gemeldet</strong>.]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_ip_address"><![CDATA[IP-Adresse]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_ip_address.description"><![CDATA[IP-Adressen sind insbesondere durch die dynamische Vergabe (z. B. Privatanschlüsse oder Mobilfunk) nur bedingt verlässlich. Empfohlene Einstellung: <strong>Top 10%</strong>.]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_action"><![CDATA[Aktion bei Übereinstimmung]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_action.block"><![CDATA[Blockieren]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_action.description"><![CDATA[Es besteht immer das Risiko eines fehlerhaften Eintrages, daher wird die Einstellung <strong>Deaktivierung, erfordert manuelle Freischaltung</strong> ausdrücklich empfohlen.]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_action.disable"><![CDATA[Deaktivierung, erfordert manuelle Freischaltung]]></item>
 	</category>
 	<category name="wcf.acp.customOption">
 		<item name="wcf.acp.customOption.list"><![CDATA[Eingabefelder]]></item>
diff --git a/wcfsetup/install/lang/en.xml b/wcfsetup/install/lang/en.xml
index 96ff30dc54..29661797b0 100644
--- a/wcfsetup/install/lang/en.xml
+++ b/wcfsetup/install/lang/en.xml
@@ -1659,6 +1659,34 @@ When prompted for the notification URL for the instant payment notifications, pl
 		<item name="wcf.acp.option.contact_form_prune_attachments.description"><![CDATA[Older attachments are automatically removed to recover disk space. Use 0 to disable.]]></item>
 		<item name="wcf.acp.option.firstTimeSetup"><![CDATA[First Time Setup]]></item>
 		<item name="wcf.acp.option.firstTimeSetup.description"><![CDATA[Configure the most important settings now, you can change them later at any time.]]></item>
+		<item name="wcf.acp.option.category.security.blacklist.sfs"><![CDATA[Stop Forum Spam]]></item>
+		<item name="wcf.acp.option.category.security.blacklist.sfs.description"><![CDATA[Privacy compliant verification based on a local copy of the StopForumSpam.com database.]]></item>
+		<item name="wcf.acp.option.category.security.blacklist.custom"><![CDATA[Own Blacklists]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_enable"><![CDATA[Enable the verification using Stop Forum Spam]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_enable.description"><![CDATA[The local database contains information about the number of times that an entry was reported as a spammer.<br>
+<strong>Notice: No data is transferred to a third party service at any point in the process.</strong><br>
+<br>
+The database is carefully maintained, but it there will be always be a margin of error, caused by incorrect or outdated entries. You can chose from a set of options that controls how matches are evaluated in order to reduce false-positives. The recommended settings are based on years of experience and changes should therefore be made with caution.
+<ul class="nativeList">
+	<li><strong>Do not check</strong> – This value is completely ignore.</li>
+	<li><strong>Top 10%</strong> – Only the top 10% most frequently reported values are considered.</li>
+	<li><strong>Multiple reports</strong> – Any match that has been reported more than once.</li>
+	<li><strong>Any match is sufficient</strong> – The number of reports is entirely ignored. Not recommended.</li>
+</ul>]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_enable.skip"><![CDATA[Do not check]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_enable.90percentile"><![CDATA[Top 10%]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_enable.moreThanOnce"><![CDATA[Multiple reports]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_enable.simpleMatch"><![CDATA[Any match is sufficient]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_username"><![CDATA[Username]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_username.description"><![CDATA[Usernames are the least reliable criteria. Recommended setting: <strong>Top 10%</strong>.]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_email_address"><![CDATA[Email Address]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_email_address.description"><![CDATA[Email addresses are unique and yield the best results. Recommended setting: <strong>Multiple reports</strong>.]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_ip_address"><![CDATA[IP Address]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_ip_address.description"><![CDATA[IP addresses are more likely to be imprecise, because a lot of them are dynamically assigned, e. g. for private households or celluar connections. Recommended setting: <strong>Top 10%</strong>.]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_action"><![CDATA[Action in Case of a Match]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_action.block"><![CDATA[Block]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_action.description"><![CDATA[There is always the risk of a false-positive match, therefore its highly recommended to set it to <strong>Disable and require manual approval</strong>.]]></item>
+		<item name="wcf.acp.option.blacklist_sfs_action.disable"><![CDATA[Disable and require manual approval]]></item>
 	</category>
 	<category name="wcf.acp.customOption">
 		<item name="wcf.acp.customOption.list"><![CDATA[Option Fields]]></item>
diff --git a/wcfsetup/setup/db/install.sql b/wcfsetup/setup/db/install.sql
index 44c3d8106b..645dc3b79d 100644
--- a/wcfsetup/setup/db/install.sql
+++ b/wcfsetup/setup/db/install.sql
@@ -288,6 +288,27 @@ CREATE TABLE wcf1_bbcode_media_provider (
 	UNIQUE KEY name (name, packageID)
 );
 
+DROP TABLE IF EXISTS wcf1_blacklist_status;
+CREATE TABLE wcf1_blacklist_status (
+	date DATE NOT NULL,
+	delta1 TINYINT(1) NOT NULL DEFAULT 0,
+	delta2 TINYINT(1) NOT NULL DEFAULT 0,
+	delta3 TINYINT(1) NOT NULL DEFAULT 0,
+	delta4 TINYINT(1) NOT NULL DEFAULT 0,
+	
+	UNIQUE KEY day (date)
+);
+
+DROP TABLE IF EXISTS wcf1_blacklist_entry;
+CREATE TABLE wcf1_blacklist_entry (
+	type ENUM('email', 'ipv4','ipv6','username'),
+	hash CHAR(64),
+	lastSeen DATETIME NOT NULL,
+	occurrences SMALLINT(5) NOT NULL,
+	
+	UNIQUE KEY entry (type, hash)
+);
+
 DROP TABLE IF EXISTS wcf1_box;
 CREATE TABLE wcf1_box (
 	boxID INT(10) NOT NULL AUTO_INCREMENT PRIMARY KEY,
-- 
2.20.1