Don't forget to rebuild the themes on origin board when moving

- if you're moving a post to a different board it would only
  rebuildThemes of the target board

inc/config.php

@@ -33,6 +33,8 @@
 
     // Enables captcha
     $config['securimage'] = false;
+    // Limits captcha to TOR users
+    $config['captcha_tor_only'] = false;
 
     // Global announcement -- the very simple version.
     // This used to be wrongly named $config['blotter'] (still exists as an alias).

inc/functions.php

@@ -2905,3 +2905,34 @@ function strategy_first($fun, $array) {
         return array('defer');
     }
 }
+
+function ipIsLocal($ip) {
+    // Define the local IP ranges commonly used in private networks
+    $localRanges = [
+        '10.0.0.0/8',       // Private network range 10.0.0.0 to 10.255.255.255
+        '172.16.0.0/12',    // Private network range 172.16.0.0 to 172.31.255.255
+        '192.168.0.0/16',   // Private network range 192.168.0.0 to 192.168.255.255
+        '127.0.0.0/8',      // Loopback range for localhost
+        '169.254.0.0/16'    // Link-local addresses
+    ];
+
+    foreach ($localRanges as $range) {
+        if (ipInRange($ip, $range)) {
+            return true;
+        }
+    }
+
+    return false;
+}
+
+function ipInRange($ip, $range) {
+    // Split the range to get the base IP and the netmask
+    list($baseIP, $netmask) = explode('/', $range);
+    // Convert IPs into long format for easy comparison
+    $ipLong = ip2long($ip);
+    $rangeLong = ip2long($baseIP);
+    $maskLong = ~((1 << (32 - $netmask)) - 1);
+
+    // Check if the IP is in the given range
+    return (($ipLong & $maskLong) == ($rangeLong & $maskLong));
+}

inc/instance-config.php

@@ -142,7 +142,8 @@ $config['spam_noticer']['website_name'] = "leftychan";
 /*
  * Basic captcha. See also: captchaconfig.php
  */
-$config['securimage'] = false;
+$config['securimage'] = true;
+$config['captcha_tor_only'] = true;
 
 /*
  * Permissions

inc/lib/securimage/securimage.php

@@ -338,6 +338,8 @@ class Securimage
 
     /*%*********************************************************************%*/
     // Properties
+    public $config_file;
+    public $gdnoisecolor;
 
     /**
      * The width of the captcha image
@@ -2232,9 +2234,9 @@ class Securimage
         $py       = array(); // y coordinates of poles
         $rad      = array(); // radius of distortion from pole
         $amp      = array(); // amplitude
-        $x        = ($this->image_width / 4); // lowest x coordinate of a pole
+        $x        = round($this->image_width / 4); // lowest x coordinate of a pole
         $maxX     = $this->image_width - $x;  // maximum x coordinate of a pole
-        $dx       = mt_rand($x / 10, $x);     // horizontal distance between poles
+        $dx       = mt_rand(intval($x / 10), $x);     // horizontal distance between poles
         $y        = mt_rand(20, $this->image_height - 20);  // random y coord
         $dy       = mt_rand(20, $this->image_height * 0.7); // y distance
         $minY     = 20;                                     // minimum y coordinate
@@ -2277,7 +2279,7 @@ class Securimage
                 $x *= $this->iscale;
                 $y *= $this->iscale;
                 if ($x >= 0 && $x < $width2 && $y >= 0 && $y < $height2) {
-                    $c = imagecolorat($this->tmpimg, $x, $y);
+                    $c = imagecolorat($this->tmpimg, intval($x), intval($y));
                 }
                 if ($c != $bgCol) { // only copy pixels of letters to preserve any background image
                     imagesetpixel($this->im, $ix, $iy, $c);
@@ -2298,7 +2300,7 @@ class Securimage
 
             $theta = ($this->frand() - 0.5) * M_PI * 0.33;
             $w = $this->image_width;
-            $len = mt_rand($w * 0.4, $w * 0.7);
+            $len = mt_rand(intval($w * 0.4), intval($w * 0.7));
             $lwid = mt_rand(0, 4);
 
             $k = $this->frand() * 0.6 + 0.2;
@@ -2318,7 +2320,7 @@ class Securimage
             for ($i = 0; $i < $n; ++ $i) {
                 $x = $x0 + $i * $dx + $amp * $dy * sin($k * $i * $step + $phi);
                 $y = $y0 + $i * $dy - $amp * $dx * sin($k * $i * $step + $phi);
-                imagefilledrectangle($this->im, $x, $y, $x + $lwid, $y + $lwid, $this->gdlinecolor);
+                imagefilledrectangle($this->im, intval($x), intval($y), intval($x + $lwid), intval($y + $lwid), $this->gdlinecolor);
             }
         }
     }

inc/mod/pages.php

@@ -1562,7 +1562,7 @@ function mod_merge($originBoard, $postID) {
             }
         }
 
-        if ($targetBoard === $originBoard){
+        if ($targetBoard === $originBoard) {
             // Just update the thread id for all posts in the original thread to new op
             $query = prepare(sprintf('UPDATE ``posts_%s`` SET `thread` = :newthread WHERE `id` = :oldthread OR `thread` = :oldthread', $originBoard));
             $query->bindValue(':newthread', $targetOp, PDO::PARAM_INT);
@@ -1586,8 +1586,7 @@ function mod_merge($originBoard, $postID) {
 
             // redirect
             header('Location: ?/' . sprintf($config['board_path'], $board['uri']) . $config['dir']['res'] . link_for($newpost) . '#' . $targetOp, true, $config['redirect_http']);
-        }
+        } else {
-            else {
             // Move thread to new board without shadow thread and then update the thread id for all posts in that thread to new op
             // indicate that the post is a thread
             if (count($boards) <= 1)
@@ -1726,6 +1725,7 @@ function mod_merge($originBoard, $postID) {
             deletePost($postID);
             modLog("Deleted post #{$postID}");
             buildIndex();
+            rebuildThemes('post', $originBoard);
 
             openBoard($targetBoard);
             // Just update the thread id for all posts in the original thread to new op

post.php

@@ -511,7 +511,11 @@ function handle_post(){
             }
         }
 
-        if(isset($config['securimage']) && $config['securimage']){
+        if((isset($config['securimage']) && $config['securimage'])
+            && (
+                !(isset($config['captcha_tor_only']) && $config['captcha_tor_only'])
+                || ipIsLocal($_SERVER['REMOTE_ADDR'])
+                )){
 
             if(!isset($_POST['captcha'])){
                 error($config['error']['securimage']['missing']);

templates/post_form.html

@@ -5,13 +5,10 @@
     method="post"
     data-max-images="{{ config.max_images }}"
     >
-{{ antibot.html() }}
 {% if id %}<input type="hidden" name="thread" value="{{ id }}">{% endif %}
-{{ antibot.html() }}
 {% if board.uri not in config.overboards|keys %}
 <input type="hidden" name="board" value="{{ board.uri }}">
 {% endif %}
-{{ antibot.html() }}
 {% if current_page %}
 	<input type="hidden" name="page" value="{{ current_page }}">
 {% endif %}
@@ -103,15 +100,39 @@
 		</tr>
 		{% endif %}
 		{% if config.securimage %}
-		<tr>
+            <tr class="post_form_captcha_row">
-			<th>
+                <th>
-				Captcha
+                    Captcha
-			</th>
+                    {% if config.captcha_tor_only %}
-			<td>
+                    <br/>
-		        <img name="captcha-img" id="captcha-img" src="/captcha.php" onClick="this.src='/captcha.php?'+Date.now();document.getElementById('captcha').value = '';"><br />
+                    <small>Tor Only</small>
-				<input type="text" name="captcha" id="captcha" size="25" maxlength="10" autocomplete="off">
+                    {% endif %}
-			</td>
+                </th>
-		</tr>
+                <td>
+                    <img name="captcha-img" id="captcha-img" src="/captcha.php" onClick="this.src='/captcha.php?'+Date.now();document.getElementById('captcha').value = '';"><br />
+                    <input type="text" name="captcha" id="captcha" size="25" maxlength="10" autocomplete="off">
+                </td>
+            </tr>
+            {% if config.captcha_tor_only %}
+            <script>
+                (() => {
+                    function isOnionDomain() {
+                        const hostname = window.location.hostname;
+                        return hostname.endsWith('.onion');
+                    }
+
+                    function removeCaptchaField() {
+                        document.querySelectorAll('.post_form_captcha_row')
+                            .forEach(e => e.parentNode.removeChild(e));
+                    }
+
+                    if (!isOnionDomain()) {
+                        removeCaptchaField();
+                    }
+                })();
+            </script>
+            {% else %}
+            {% endif %}
 		{% endif %}
 		{% if config.user_flag %}
 			<tr>
@@ -204,7 +225,6 @@
 			</td>
 		</tr>{% endif %}
 	</table>
-{{ antibot.html(true) }}
 <input type="hidden" name="hash" value="{{ antibot.hash() }}">
 </form>