Add ACP option to allow HTTP for Stop Forum Spam reports

adm/style/banhammer_body.html

@@ -75,6 +75,15 @@ <h1>{L_ACP_BH_SETTINGS}</h1>
 				<!-- ENDIF -->
 			</dd>
 		</dl>
+		<!-- IF SFS_CURL -->
+		<dl>
+			<dt><label for="sfs_allow_http">{L_SFS_ALLOW_HTTP}{L_COLON}</label><br /><span>{L_SFS_ALLOW_HTTP_EXPLAIN}</span></dt>
+			<dd>
+				<label><input type="radio" class="radio" name="sfs_allow_http" value="1" <!-- IF SFS_ALLOW_HTTP -->id="sfs_allow_http" checked="checked"<!-- ENDIF -->/> {L_YES}</label> &nbsp;
+				<label><input type="radio" class="radio" name="sfs_allow_http" value="0" <!-- IF not SFS_ALLOW_HTTP -->id="sfs_allow_http" checked="checked"<!-- ENDIF -->/> {L_NO}</label>
+			</dd>
+		</dl>
+		<!-- ENDIF -->
 
 		<p class="submit-buttons">
 			<input class="button1" type="submit" id="submit" name="submit" value="{L_SUBMIT}" />&nbsp;

controller/admin_controller.php

@@ -109,8 +109,9 @@ public function display_options()
 			'DEL_PROFILE'	=> (!empty($this->config['bh_del_profile'])) ? true : false,
 			'DEL_SIGNATURE'	=> (!empty($this->config['bh_del_signature'])) ? true : false,
 			'MOVE_GROUP'	=> $this->get_groups($this->request->variable('move_group', $this->config['bh_group_id'])),
-			'SFS_API_KEY'	=> (!empty($this->config['bh_sfs_api_key'])) ? $this->config['bh_sfs_api_key'] : '',
-			'SFS_CURL'		=> (function_exists('curl_init')) ? true : false,
+			'SFS_ALLOW_HTTP'	=> (!empty($this->config['bh_sfs_allow_http'])) ? true : false,
+			'SFS_API_KEY'		=> (!empty($this->config['bh_sfs_api_key'])) ? $this->config['bh_sfs_api_key'] : '',
+			'SFS_CURL'			=> (function_exists('curl_init')) ? true : false,
 
 			'U_ACTION'		=> $this->u_action,
 		));
@@ -133,6 +134,7 @@ protected function set_options()
 		$this->config->set('bh_del_signature', $this->request->variable('del_signature', 0));
 		$this->config->set('bh_group_id', $this->request->variable('move_group', 0));
 		$this->config->set('bh_sfs_api_key', $this->request->variable('sfs_api_key', '', true));
+		$this->config->set('bh_sfs_allow_http', $this->request->variable('sfs_allow_http', 0));
 		$this->config->set('bh_ban_time', $this->request->variable('ban_time', 0));
 	}
 

event/banhammer_listener.php

@@ -416,8 +416,10 @@ public function do_ban_hammer_stuff($event)
 
 		if ($this->request->variable('sfs_report', 0) && !empty($this->config['bh_sfs_api_key']) && $curl_exists)
 		{
-			// add the spammer to the SFS database
-			$http_request = 'https://www.stopforumspam.com/add.php';
+			// add the spammer to the SFS database. HTTPS unless the admin
+			// has explicitly opted into HTTP for it in the ACP.
+			$sfs_scheme = (!empty($this->config['bh_sfs_allow_http'])) ? 'http://' : 'https://';
+			$http_request = $sfs_scheme . 'www.stopforumspam.com/add.php';
 			$http_request .= '?username=' . urlencode($this->data['username']);
 			$http_request .= '&ip_addr=' . urlencode($this->data['user_ip']);
 			$http_request .= '&email=' . urlencode($this->data['user_email']);

language/en/banhammer_acp.php

@@ -49,6 +49,8 @@
 	'ACP_MOVE_GROUP'			=> 'Move to group',
 	'ACP_MOVE_GROUP_EXPLAIN'	=> 'Name of the group to which banned users should be moved. This will also be their default group.<br /><strong>If nothing but <em>“No group specified.”</em> is in the drop down then you have not set up any groups.</strong>',
 	'BAN_LENGTH_EXPLAIN'	=> 'If either of the ban options is set then the user will be banned for the amount of time as set here.  This is also able to be set when ban hammering the user.',
+	'SFS_ALLOW_HTTP'		=> 'Allow HTTP for Stop Forum Spam reports',
+	'SFS_ALLOW_HTTP_EXPLAIN'	=> 'Reports are sent over HTTPS by default. <strong>Only enable this if your server cannot make outbound HTTPS requests</strong> - your API key and the reported user\'s username, IP address, and email are sent in clear text over HTTP.',
 	'SFS_API_KEY'			=> 'SFS API key',
 	'SFS_API_KEY_EXPLAIN'	=> 'If you want to report spammers automatically to StopForumSpam you need an API key, <a href="http://www.stopforumspam.com/signup">http://www.stopforumspam.com/signup</a>.',
 	'SFS_NEEDS_CURL'		=> '<span style="color:red;">Your server needs cURL installed to use the stop forum spam service.</span>',

migrations/v105_data.php

@@ -0,0 +1,32 @@
+<?php
+/**
+ *
+ * Ban Hammer extension for the phpBB Forum Software package
+ *
+ * @copyright (c) 2026, phpBB Modders, https://www.phpbbmodders.com/
+ * @license GNU General Public License, version 2 (GPL-2.0)
+ *
+ */
+
+namespace phpbbmodders\banhammer\migrations;
+
+/**
+* Primary migration
+*/
+
+class v105_data extends \phpbb\db\migration\container_aware_migration
+{
+	static public function depends_on()
+	{
+		return array('\phpbbmodders\banhammer\migrations\v104_data');
+	}
+
+	public function update_data()
+	{
+		return array(
+			// Off by default: the Stop Forum Spam report uses HTTPS unless
+			// an admin explicitly opts into HTTP in the ACP.
+			array('config.add', array('bh_sfs_allow_http', 0)),
+		);
+	}
+}