Closed (fixed)
Project:
CAPTCHA
Version:
6.x-2.x-dev
Component:
Code
Priority:
Normal
Category:
Task
Assigned:
Reporter:
Created:
27 Sep 2006 at 18:37 UTC
Updated:
13 Jan 2007 at 18:41 UTC
Jump to comment: Most recent file
See subject .. tested only with the math question.
This patch also includes the one for coding standards
| Comment | File | Size | Author |
|---|---|---|---|
| #32 | captcha_6.patch | 9.27 KB | RobRoy |
| #20 | captcha_5-3.patch | 5.39 KB | mfer |
| #19 | captcha_5-2.patch | 4.15 KB | mfer |
| #18 | captcha_5-1.patch.txt | 9.89 KB | Egon Bianchet |
| #17 | captcha_5.patch | 3.94 KB | mfer |
Comments
Comment #1
wundo commentedThanks Egon, but I will wait a bit more before port the module to 5.0, I want to make it more stable in 4.7 before.
Comment #2
drummI'm working on making this apply correctly and removing use of $_SESSION, since anonymous users no longer have sessions.
Comment #3
drewish commentedhere's a re-roll that applies cleanly. i also added an info file, cleaned up the module description, and simplified the way the settings form was called.
Comment #4
reikiman commentedHi, I decided to check out this port to 5.0. I have 5.0beta1 and am working on converting one of my existing sites.
The replacement captcha.module on this thread works pretty well. I didn't see an info file so I made the following:
And it does show up in the modules listing after that.
The issue is about behavior. The test system it's installed on doesn't have GD nor TextImage .. it's Mac OS X with the default apache+PHP. For the captcha challenge it's showing a math question. So, it asks what is "1+5" and I enter "6" and it says that's wrong. I tried this several times, giving the right answer each time, and it keeps saying my answer is wrong.
Comment #5
Egon Bianchet commentedIt's because captca relies on sessions, see comment #2 ...
any updates drumm?
Comment #6
drummnope, sorry
Comment #7
drummComment #8
drewish commenteddrumm, i'd be willing to work on this if you'll provide some guidance. is this something that'd even be doable without sessions for anon users? what did you have in mind?
Comment #9
Egon Bianchet commentedMy idea:
1. generate a "private key" when the module is installed, something like variable_set('captcha_key', rand(1, 10000))
2. store the captcha challenge result in a hidden form value, combined with the key, and md5 hashed
3. on form validation combine user submitted captcha value with the key, and test its md5 with the hidden field value
What do you think about it?
Comment #10
mfer commentedThe random key is not a bad idea. Though, I would think that there needs to be a better random key than a single number. The overall lookup table a bot would need to find the number associated with the key in a hidden field wouldn't be that big. Maybe some random string instead.
Another option, that might be more secure, is to create a captcha_id and put that in a hidden field. When the form is submitted it looks up the result associated with the id. Just to make sure the database doesn't get to big a cron job removed the old ones every day or so. This will keep the result out of the form completely but does add another database table. Could this table be a cache table?
Comment #11
Egon Bianchet commentedWell maybe I was just reinventing the wheel: http://drupal.org/node/89999, the standard form token mechanism should already handle it ...
Comment #12
mfer commentedMaybe I am missing something (wouldn't be surprising) but how does the token solve this problem? Maybe I am misunderstanding what the token does.
Comment #13
mfer commentedDisregard my last post. I went and learned. I is smarter now.
Comment #14
bloomaniac commentedto the captcha.info file:
shouldn't textimage be added as a dependency?
Comment #15
drewish commentedbloomaniac, no, it's an optional dependency, not a a required one.
Comment #16
mfer commentedI've started writing a patch but run into a roadblock. It works with captchas to post but fails when previewing a post comes into play. Not storing that it passed the captcha it gives a new question. Any ideas how to store this without sessions? Does this need to be multistep forms?
Comment #17
mfer commentedTo clarify on my last post the reason I am having trouble is the removal of sessions. Patch attached addes .info file, updates captcha.module, and figures for it being in the sites/all/modules/captcha folder.
Comment #18
Egon Bianchet commentedThis one is actually a small rewrite, it makes better use of the Drupal API. The issue with preview isn't fixed ... but i noticed that it works if leave the user leaves the captcha response to the initial value
Comment #19
mfer commentedAnonymous sessions still work (verified both on my own and with chx) so storing captcha info in $_SESSION is still ok. This patch updates the menu changes to 5.x. Also, updated grabbing the captcha_response variable from the form from $_POST['edit']['captcha_response'] to $_POST['captcha_response'] because my captchas kept failing because it was grabbing the variable from the wrong place.
Comment #20
mfer commentedRemoved a couple of testing functions that got left behind and added some comments.
Comment #21
Egon Bianchet commentedIt's working for me ... thanks for getting the session thing clear
Comment #22
aries commentedIt's working for me too. Thanks!
Comment #23
drewish commentedi'm not sure this is working. i tried putting in the wrong answer to the math problem and it still posted the comments.
Comment #24
mfer commentedWhat version of 5.x are you running? RC1? When I enter the wrong answer it can't post.
What version of PHP? Web server?
Comment #25
drewish commentedmfer, i'm running a freshly updated copy of HEAD. try posting a comment to http://defordbailey.info/
Comment #26
mfer commented@drewish - I just tried your test site and for incorrect captcha answers I get the expected "The answer you entered to the math problem is incorrect." Were you an anonymous user when you tried to post that comment? Or, admin user?
Comment #27
drewish commentedI was not logged. The problem seems to occur when using IE 6. It does appear to work in Firefox.
Comment #28
mfer commented@drewish - Not sure how this would be a browser side problem but I checked it in IE6 and it worked like a charm. Couldn't duplicate your issue. I checked both the site you posted here and my test site. Can anyone else duplicate his issue?
Comment #29
aries commentedNo, but it's not working for anonymous users because 5.x doesn't use $_SESSION for them.
Comment #30
mfer commented@aries - It works for me with anonymous users without a problem. And, on my test install of 5.x-RC1 anonymous users show up in the sessions table just like they previously have. Can you point me to documentation showing the removal of $_SESSION for anonymous users? And, any ideas why it still works for me?
Comment #31
mfer commentedMarking this as needs work. The code does work but the patch does not take into account the changes needed to the language files. While the translations should not have to change the line numbers do.
Comment #32
RobRoy commentedHere is a new patch that cleans up some more code and follows the coding standards better. The translations should probably be opened as a separate issue and not hold this up.
Comment #33
RobRoy commentedFix priority.
Comment #34
gregglesThis worked great on a site of mine using the default captcha (e.g. not the image based one).
Thanks!
Comment #35
filiptc commentedI have been using the patch from #32 with the ported (& extended -> #104952) textimage functionality and it seems to work like a charm.
Setting as RTBC.
Phil
Comment #36
filiptc commentedWhops, sorry, wrong issue#. http://drupal.org/node/107897 is the correct one
Comment #37
mfer commentedI think it would be good to post this update and release a 5.0-1.0 version. When the captcha module is rewritten to add new features release a 5.0-2.0 version. This was this module can get out the door soon.
Comment #38
drewish commented+1 on that, i've been testing the latest patch and it's working fine. i'm not sure what was causing my earlier problems with IE.
Comment #39
wundo commented#32 doesn't seen to work with Drupal 5RC2 and math question.
Comment #40
wundo commentedSorry it's working, but not with webforms
Comment #41
wundo commented