2 replies to this topic

[kastor]

THIS MODIFICATION REQUIRES SOME KNOWLEDGE OF PHP, THEREFORE USE IT ONLY IF YOU KNOW WHAT YOU ARE DOING AND TEST IT BEFORE USING IT IN A PRODUCTIVE WEBSITE! IF YOU DON'T EVEN KNOW WHAT PHP IS, READ NOT FURTHER

Hi,

I've developed some scripts which make use of a captcha function to protect the input (guestbook entries, e-mail) from spam. The original captcha number generated from Etomite was in my opinion insufficient. For example, I dislike that only numbers are used to generate the captcha, and the length of it will be readable by the image src from the <img> tag.
I know the excellent captcha class coded by Horst Nogajski, and adapted it to my needs (more generally, I simplified it). To be able to use my and Etomites captcha function, I've added two new calls which you have to add manually to the index.php. The two functions follow here:

 function getCaptchaCode($length, $alt='Captcha Number', $title='Security Code') {
  // returns a Captcha Number image to caller and stores value in $_SESSION['captchNumber']
  // $length = number of digits to return
  // $alt = alternate text if image cannot be displayed
  // $title = message to display for onhover event
	if ($length < 1) {
  return false;
	} else {
  $_SESSION['etomite_CaptchaLength'] = $length;
  return '<img src="./manager/includes/captchacode/captchaCode.php" alt="">';
	}
  }

  function validCaptchaCode($code) {
  // returns Captcha Number validation back to caller - boolean (true|false)
  // $number = number entered by user for validation (example: $_POST['captchaNumber'])
	$result = ($_SESSION['etomite_CaptchaCode'] == $code) ? true : false;
	return $result;
  }  

Place them after the original captcha function, around line 2112, after this block:

########################################
// END New functions - Ralph - 0.6.1
########################################

Now extract the attached file to your manager/includes directory, so that there will be a new directory named captchacode.
You need fonts to generate the image, and if there is more than one ttf file in the ttf directory, the script will use for every char a random font.
The fonts I personally use are a set known as msttfcorefonts, which are freely distributeable as long as the eula from Microsoft is attached, and the excellent GPLed Gentium font.
Get the msttcorefonts from kde-look.org
Get the Gentium font

After copiing the files, you are basically ready to use the new function.
$etomite->getCaptchaCode: creates a captcha code and the appropiate image, stores the code serverside in the users session and returns a complete, xhtml conformant <img> tag
$etomite->validCaptchaCode($code): validates the user entered captcha code against the one stored at the session, returns true if the code is the right one, otherwise it returns false.

Before you try it, make a backup of the original index.php, and you are on the safe side.

To see the captcha at work, look at http://www.akkordeon-spielring.de. This is by the way my guestbook snippet in version 2 (kgbook2). Please don't create fake/test entries, this website is in "productive" use.

Greetings, Kastor

Attached Files

•  captchacode.zip   3.66K   117 downloads

[Pelleke]

A little note about

$_SESSION['etomite_CaptchaCode'] == $code

This means that the $code is actually stored in a session-variable, which will often be sent to the UA in a cookie. This way is very easy hackable by automated systems.

A better way is to alter the captchaCode.php in such a way that it does not store the code itself to the session, but the MD5()-output of it, and then check it with ($_SESSION['etomite_CaptchaCode'] == md5($code)). With this workaround the inserted code can be evaluated without examining the actual generated code.

[kastor]

pelleke, on Apr 5 2006, 11:17 AM, said:

A little note about

$_SESSION['etomite_CaptchaCode'] == $code

This means that the $code is actually stored in a session-variable, which will often be sent to the UA in a cookie. This way is very easy hackable by automated systems.

A better way is to alter the captchaCode.php in such a way that it does not store the code itself to the session, but the MD5()-output of it, and then check it with ($_SESSION['etomite_CaptchaCode'] == md5($code)). With this workaround the inserted code can be evaluated without examining the actual generated code.

Hi,

you are right, I'll add this to (possible) future releases. By the way: is anybody using this functions?

Greetings, Kastor