Closed (fixed)
Project:
BOTCHA Spam Prevention
Version:
6.x-2.x-dev
Component:
Code
Priority:
Major
Category:
Task
Assigned:
Reporter:
Created:
6 Nov 2012 at 10:51 UTC
Updated:
4 Dec 2012 at 11:10 UTC
Jump to comment: Most recent file
Since the OOP-refactoring that was started in D7 (see #1804770: [META] Migrate to object-oriented architecture) is already ported to D6 (see #1827046: Migrate D6 to OOP-architecture) it is time to release a stable version.
| Comment | File | Size | Author |
|---|---|---|---|
| #17 | botcha-release_stable_d6-1833214-17.patch | 7.32 KB | PatchRanger |
| #16 | botcha-release_stable_d6-1833214-16.patch | 101.5 KB | PatchRanger |
| #14 | botcha-release_stable_d6-1833214-14.patch | 102.26 KB | PatchRanger |
| #12 | botcha-release_stable_d6-1833214-12.patch | 101.42 KB | PatchRanger |
| #12 | interdiff.txt | 26.37 KB | PatchRanger |
Comments
Comment #1
iva2k commentedI installed 6.x-2.x-dev. Here's my experience. Note that I did not try the refactored D7 version yet, so some observations may also apply to D7. I decided not to break out into separate bugs at this time. Let me know if you prefer to have separate issue for each item (it will be a bunch).
1. Update page (before updates can be applied)
User warning: Table '..._botcha_form' doesn't exist query: SELECT * FROM ..._botcha_form bf in _db_query() (line 134 of /home/ilya/www/drupal-6.x/includes/database.mysqli.inc).Also, Version 6100 is not shown for Botcha, one needs to expand the fieldset to see it. Perhaps it should be named update6200 so drupal logic handles it properly for 6.x-2.x-dev version upgrade?
2. Apply update
Warning: Invalid argument supplied for foreach() in update_results_page() (line 337 of drupal-6.x/update.php).Typically update function should return an array with results per each query. When there are no queries, I typically report a fake one.
3. Visit configuration pages.
For some reason the other tabs (Forms, Recipe Books) are not listed on "admin/by-module" page or on the help page. Something in the menu hook settings needs tweaking.
BUG: Button "Reset Botcha Statistics" seem to have no effect.
BUG: Link to permissions leads to "page not found". Looks like the path is from D7 "/admin/people/permissions/list#module-botcha"
4. Visit "forms" page.
There is no recipe book for each form. Should there be a column that shows which form uses which recipe book?
5. Visit "add recipe book"
Recipes are given by short name which is too cryptic, no detailed description is present. It would be nice to have detailed description listed for more user friendliness. Same for "Edit recipebook" page.
"recipebook" vs. "recipe book" - UI should be consistent. I propose to make all UI use two words "recipe book" throughout.
Default recipe book:
"Default recipe book" - do we need include "recipe book" in the name? It makes too many "recipe book" words, can be just "Default"
"It has no magic meaning, you can modify it as you like." - I think wording can be more formal and meaningful, something like "Default recipe book provided by BOTCHA installer. You can customize it."
Given some problems with AJAX and reports from D7 that some recipes did work, I suggest we should maintain one more recipe book installed by the module and call it "AJAX Friendly".
Observation: No parameters per recipe, so no multiple invocation of the same recipe. Area for future development.
6. trying to use registration form with default recipe
"You must be a human, not a spam bot, to submit forms on this website. If you insist that you are a human, please try again. If error persists, contact webmaster using contact link at the bottom of this page and give all the details of this error (your browser, version, OS).
Please enable Javascript to use this form."
Log has: "Failed 1 of 5 recipes [obscure_url] from "default" recipe book."
BUG: The symptom is the secure token does not show in query part of the submitted url. Critical.
This also suggests that order of the recipes is not the same as the order on the edit page. makes matching a bit complicated. Order of the recipes should no matter, but consistency can be better.
7. Disabled "obscureUrl" and retried the registration form with default recipe
Same error, different log: "Failed 3 of 4 recipes [honeypot2, timegate, honeypot] from "default" recipe book."
Timegate is annoying. 8 seconds is way too long for short forms. When thinking of the timegate recipe, I wondered if that will be an issue. Good practice would be to scale the minimum time based on number of input fields. With browser helping user to fill in forms we should allow quicker submissions. And bot scripts can be smart about it - delay is easy to implement. Timegate is not ready for Primetime.
Why (honeypot, honeypot2) also failed? They should pass - it was a legitimate submission.
8. Also disabled "timegate" and retried the registration form with default recipe
Same error, now log says "Failed 2 of 3 recipes [honeypot, honeypot2] from "default" recipe book."
BUG: honeypots fail for virgin form and pass for retrying. Something is broken (perhaps in seed and build id logic). Critical.
Verdict: Not ready for release, has critical problems.
Comment #2
PatchRanger commented1 & 2. Fixed. Since there is no exception handling for database queries exceptions in D6, I had to do some additional refactoring. Some of the key points of this refactoring:
- As you've mentioned, update numbers were fixed and update began to return an array of update results.
- 'update_script_selection_form' is excluded from BOTCHA protection. So there will be no problems with update process. The problem remains in case when we've download the latest version and didn't perform an update. In this case we are getting error messages all the time when we go to the page that contains a protected form. Though we can't alter this behavior in D6, now we put our own message to the log and to the screen to persuade a user to perform an update.
3.
a Listed.
b Works.
c Fixed.
4. Done.
5. Descriptions added. "Add recipebook" became "Add recipe book", so with "Edit recipe book". Description for default recipe book changed. "AJAX friendly" recipe book added. I've made a stub also for Recipe UI.
Other points are not implemented yet.
Comment #4
PatchRanger commentedComment #6
PatchRanger commented#4: botcha-release_stable_d6-1833214-4.patch queued for re-testing.
Comment #8
PatchRanger commentedComment #10
PatchRanger commentedComment #12
PatchRanger commentedComment #14
PatchRanger commentedComment #16
PatchRanger commentedComment #17
PatchRanger commentedComment #18
PatchRanger commentedFixed: http://drupalcode.org/project/botcha.git/commit/87ca182 & http://drupalcode.org/project/botcha.git/commit/389ddb5 & http://drupalcode.org/project/botcha.git/commit/9e0101e.
I have tested the work of every recipe on Firefox and Chromium: they block as designed and don't work when they shouldn't.
I have tested the update path: everything works as it should.
Default setting for timegate decreased to 5 seconds which imo makes sense.
Please review once more. Please note that dev-package seems to be not packed yet - so you should download the latest 6.x-2.x version directly from git.
Comment #19
PatchRanger commentedDone: http://drupal.org/node/1845608.