I made this quite simple, but working, captcha for BBtoNuke which hopefully should prevent many of the bot spammers from posting new topics and replies as guests. Logged in users is not affected.
In modules/Forums/posting.php
Find
Code:
include("includes/functions_post.php");
After, add
Code:
// MOD Captcha start
mt_srand ((double)microtime()*1000000);
$maxran = 1000000;
$captcha_num = mt_rand(0, $maxran);
// MOD Captcha end
//
// Post a new topic/reply/poll or edit existing post/poll
//
Change to
Code:
// MOD Captcha start
if (!empty($captcha_check))
{
if ( !$userdata['session_logged_in'] && ($mode == 'newtopic' || $mode == 'reply') )
{
$datekey = date("F j");
$rcode = hexdec(md5($_SERVER['HTTP_USER_AGENT'] . $sitekey . $_POST['captcha_num'] . $datekey));
$code = substr($rcode, 2, 6);
if ($code != $captcha_check)
{
$error_msg .= (!empty($error_msg)) ? '<br />Wrong security code' : 'Wrong security code';
}
}
}
else if ($captcha_check == '')
{
if ( !$userdata['session_logged_in'] && ($mode == 'newtopic' || $mode == 'reply') )
{
$error_msg .= (!empty($error_msg)) ? '<br />You must enter the security code' : 'You must enter the security code';
}
}
// MOD Captcha end
return;
}
//
// Post a new topic/reply/poll or edit existing post/poll
//
Thats about it...
The apperance of the captcha is found in modules/Forums/templates/subSilver/posting_body.tpl
I made mine a bit different from the original, like
yah, felt i've been asking for help all the time, so guess it's time to give a bit back.
Please feel free to make it more "allround" and get rid of any bad/unecesarry coding, as i said it's not tested on other than one of my sites.
Ah, I am not trying to be mean, but this is a poor way to do it and you can thank FB for it. The problem is your passing the number in two places which makes it visible to bots. This means it is very easy to break.
The first thing you need to do is ditch using FB's design to make a captcha, because to make the image you have to include the numbers. So modules.php?gfx=gfx&random_num=12345 can be read by a bot/scanner. This makes it VERY simple. The other problem is the hidden field that contains the number. Again this is readable.
The easiest fix would be to use sessions to hold and display the number. It would only take a few minutes to recode everything to work correctly.
Again I am not trying to be mean, I am just pointing out the flaws in the system that FB laid out. A more advanced spam bot is going to blast right through this.
But the random number itself does not match the value of the image. Is there an easy way to figure that out without knowing the randomization key?
Granted the CAPCHTA in phpNuke default is weak, as it ties one random number to a code for 24 hours. You can read it once by eye, and then have the script input the correct number for those 24 hrs.
For starters how many people do you think change the key? You can also post and get the code like you said.
Really the whole design is pretty messed up. It should be just rewritten using sessions and more proper random generator. It would not be too hard to do. In Evo and it will show up in the next release of RN, we are using an out side phpCATPCHA that already uses sessions, and I rewrote the default one to use sessions.
Here is the code from Evo, which would need some back porting to get working on standard nuke. It's a mix of the standard and the more advance phpCATPCHA.
GFX generator
Code:
if (realpath(__FILE__) == realpath($_SERVER['SCRIPT_FILENAME'])) {
exit('Access Denied');
}
Joined: Feb 21, 2006 Posts: 1497 Location: In front of a screen....HELP! lol
Posted:
Mon Nov 27, 2006 5:57 pm
In Raven's words, the old code could be hijacked to give the output.
Now as for technocrats code, looks Great but really was all that necessary?
I mean all we really would need to do is send the $random_num through sessions and not $_post. and tell the existing check to look at sessions and not the post variable, Just my thought on the matter considering that the captcha system you speak of sends the actual code itself through sessions, so no decoding.
Joined: Feb 21, 2006 Posts: 1497 Location: In front of a screen....HELP! lol
Posted:
Mon Nov 27, 2006 7:11 pm
sorry, I was reffering to the $random_num not what the user entered.
The check system in standard nuke, grabs 2 things, first the users input($_POST) and the random_num($_POST) but we could change the random number to be processed through sessions instead of post.
Thats all I meant by it.
Ah, I am not trying to be mean, but this is a poor way to do it and you can thank FB for it.
No offence taken, in any way As it says in the topic, it's a simple captcha, no more, no less. At least i got rid of a couple of spammers using this, it still remains to see if they come back with a more advanced user agent and continue their mission to inform my users of their adult sites (least they could do was to give us more interesting pictures to look on)...
Thanks for the sample code, i really hope someone make it work fully in BBtoNuke, easy to implement and also not only for the upcoming RN.
View next topic View previous topic
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
![[Valid RSS]](http://www.ravenphpscripts.com/images/valid-rss.png "Validate my RSS feed"){kind=small}
:: 
::
As it says in the topic, it's a simple captcha, no more, no less. At least i got rid of a couple of spammers using this, it still remains to see if they come back with a more advanced user agent and continue their mission to inform my users of their adult sites (least they could do was to give us more interesting pictures to look on)...