Tags:
authentication1Add my vote for this tag spam2Add my vote for this tag create new tag
view all tags

CaptchaPlugin

NOTE: The author stopped maintaining this plugin, it might not work with all TWiki releases. (New maintainer please remove this message)

A visual confirmation plugin, known as Captcha, for new user registration. This plugin prevents automated scripts in creating users and spam your wiki with their url's to get a better google ranking.


Syntax Rules

  • The tag %CAPTCHAURL% expands to the url of the image containing the scrambled text;
  • The tag %CAPTCHAHASH% expands to the hash matching the image.

Plugin Settings

Plugin settings are stored as preferences variables. To reference a plugin setting write %<plugin>_<setting>%, i.e. %INTERWIKIPLUGIN_SHORTDESCRIPTION%

  • One line description, is shown in the TextFormattingRules topic:
    • Set SHORTDESCRIPTION = To prevent automated bots from spamming

  • Debug plugin: (See output in data/debug.txt)
    • Set DEBUG = 0

Additionally, the following settings must be defined in lib/LocalSite.cfg, the list below shows the default values.

  • $TWiki::cfg{Plugins}{CaptchaPlugin}{Expiry} = 3600; # Time in seconds after which a Captcha will expire and be removed
  • $TWiki::cfg{Plugins}{CaptchaPlugin}{EnableSave} = 0; # Enable Captcha for topic save
  • $TWiki::cfg{Plugins}{CaptchaPlugin}{SaveForAll} = 0; # Enable Captcha for all users, not just TWikiGuest
  • $TWiki::cfg{Plugins}{CaptchaPlugin}{DeleteAfterSave} = 0; # Delete Captcha after successful topic save
  • $TWiki::cfg{Plugins}{CaptchaPlugin}{ColourSafe} = 0; # Enable for black and white shades only
  • $TWiki::cfg{Plugins}{CaptchaPlugin}{NumberOfCharacters} = 5; # Number of characters on Captcha
  • $TWiki::cfg{Plugins}{CaptchaPlugin}{Characters} = '1234567890'; # Captcha characters, numbers are the safest

Plugin Installation Instructions

Note: You do not need to install anything on the browser to use this plugin. The following instructions are for the administrator who installs the plugin on the server where TWiki is running.

  • Download the ZIP file from the Plugin web (see below)
  • Unzip CaptchaPlugin.zip in your twiki installation directory. Content:
    File: Description:
    data/TWiki/CaptchaPlugin.txt Plugin topic
    data/TWiki/CaptchaPlugin.txt,v Plugin topic repository
    Register.pm-4.1.2.patch Patch for the register module
    edit.pattern.tmpl-4.1.2.patch Patch for Pattern
    edittoolbar.nat.tmpl-3.0-pre13.patch Patch for NatSkin
    templates/oopscaptcha.tmpl Error template
    templates/editcaptcha.tmpl Edit template
    lib/TWiki/Plugins/CaptchaPlugin.pm Plugin Perl module
    pub/TWiki/CaptchaPlugin/fonts/* A collection of free fonts to get you started
    pub/TWiki/CaptchaPlugin/_db Hash database directory
    pub/TWiki/CaptchaPlugin/img Image directory

  • Apply the patch Register.pm-4.1.2.patch to lib/TWiki/UI/Register.pm (alternatively, patch Register.pm manually, see section below), be sure to make a backup so you can revert the patch if you want to disable the plugin:
    • cd /path/to/twiki
    • cp lib/TWiki/UI/Register.pm lib/TWiki/UI/Register.pm.dist
    • patch < ../register.patch
  • Restrict access to the files, for example, by including the following in your httpd.conf:
         <Directory "/path/to/twiki/pub/TWiki/CaptchaPlugin/_db">
           deny from all
         </Directory>
         <Directory "/path/to/twiki/pub/TWiki/CaptchaPlugin/fonts">
           deny from all
         </Directory>
  • Enable the plugin via the bin/configure script
  • Install necessary TrueType fonts in to pub/TWiki/CaptchaPlugin/fonts/
    • This allows the plugin to randomly choose the fonts to use
    • The more you have, the higher the chances of fending off spambots
  • Test if the installation was successful:
    • Create a topic containing <IMG SRC="%CAPTCHAURL%"> and %CAPTCHAHASH%
    • When loading this topic you should see an obfuscated character string loaded as a png and a hexadecimal hash.
    • Check whether the hash database is properly protected by going to the url http://my.twiki.server/my/twiki/path/pub/TWiki/CaptchaPlugin/db/hashes.pag, you should see a permission denied message.
  • Now edit your TWikiRegistration topic
    • Display the image %CAPTCHAURL% somewhere in your form, along with a text instructing new users to copy the obfuscated text into the appropriate text input.
    • Add the appropriate text input as Twk1CaptchaString
    • Add a hidden input as Twk1CaptchaHash having as value %CAPTCHAHASH%
    • For example, add this to your TWikiRegistration:
            <tr>
              <td valign="top" align="right"><IMG SRC="%CAPTCHAURL%">: <br /> (..)   </td>
              <td><input type="hidden" name="Twk1CaptchaHash" value="%CAPTCHAHASH%">
                  <input type="text" name="Twk1CaptchaString" size="5"></td>  =<font color="red">**</font>=
            </tr>
  • That's it.

Captcha on topic edit

If you want to protect edits by TWikiGuest with a captcha, add the following line to your lib/LocalSite.cfg:

$TWiki::cfg{Plugins}{CaptchaPlugin}{EnableSave} = 1;

You will need to modifiy

$TWiki::cfg{AuthScripts}
and remove save and edit. This ensures that TWikiGuest is able to post without any authentication. This does NOT affect other access and permission controls (for TemplateLogin at least).

A editcaptcha.tmpl has been prepared for you. All you need to do is TMPL:INCLUDE it into your edit*.tmpl. Two patches are available for Pattern (edit.pattern.tmpl) and NatSkin (edittoolbar.nat.tmpl).

At the moment, editcaptcha.tmpl requires TWiki:Plugins.IfDefinedPlugin to determine whether the user is TWikiGuest or not. If you have enabled $TWiki::cfg{Plugins}{CaptchaPlugin}{SaveForAll} = 1;, modify editcaptcha.tmpl appropriately.

Manually patching the register binary

Refer to the patch file.

Guide for TWiki 4.0.5

Find these lines in lib/TWiki/UI/Register.pm:
 }
 
 # generate user entry

Insert the code below directly BEFORE the line containing the curly bracket '{':

    # verify captcha
    eval { use TWiki::Plugins::CaptchaPlugin; };

    my %database;
    my $vcHash = $data->{CaptchaHash};
    my $vcTxt = $data->{CaptchaString};

    open(LOCKFILE,">".&TWiki::Func::getPubDir()."/TWiki/CaptchaPlugin/_db/hashes.lock");
    flock(LOCKFILE,2);

    dbmopen(%database, &TWiki::Func::getPubDir()."/TWiki/CaptchaPlugin/_db/hashes",0644);

    my ($time,$txt) = split(',',$database{$vcHash});

    if ( not(lc($txt) eq lc($vcTxt)) || ($txt eq '') ) {
                dbmclose(%database);
                close(LOCKFILE);
                throw TWiki::OopsException( 'captcha',
                                           web => $data->{webName},
                                       topic => $topic,
                                       def => 'invalid_vcstr',
                                       params => [ "wrong" ] );
    }

    dbmclose(%database);

    close(LOCKFILE);

        TWiki::Plugins::CaptchaPlugin::expire($vcHash);

Now find:

             # 'WikiName' omitted because they can't
             # change it, and 'Confirm' is a duplicate
             push( @{$data->{form}}, $form )
              unless ($name eq 'WikiName' || $name eq 'Confirm');

and change the last line to:

             # 'WikiName' omitted because they can't
             # change it, and 'Confirm' is a duplicate
             push( @{$data->{form}}, $form )
              unless ($name eq 'WikiName' || $name eq 'Confirm' || $name eq 'CaptchaHash' || $name eq 'CaptchaString');

Making the Above Section (4.0.5) work under 5.0.1

Edit the above file, Register.pm-4.1.2.patch. Change the reference to "$topic" on line 27 to read "$session->{topicName}". Diff format below:

diff -r 1.5-pre3/Register.pm-4.1.2.patch 1.6/Register.pm-4.1.2.patch
27c27
< +									topic => $topic,
---
> +									topic => $session->{topicName},

Further Development

  • Refactor to comply with TWiki's convention
  • Adjustable font size range
  • Adjustable height and width

Plugin Info

Plugin Author: TWiki:Main.KoenMartens, TWiki:Main.KwangErnLiew
Plugin Version: 28 Oct 2007 1.5-pre4
Change History:  
28 Oct 2007: Fixed bug on TWikiRegistrationAgent
16 Aug 2007: Added black and white shades only; Added editcaptcha.tmpl; Moved all attributes to LocalSite.cfg; Removed DeleteAfterRegistration
08 Aug 2007: Added support for captcha on topic save (thanks TWiki:Main.KwangErnLiew), fixed some minor bugs, added some free fonts
06 Aug 2007: Colourised fonts; Randomised font type, font size, background colour, and font positioning; Fixed hash display on user pages; Modified oopscaptcha.tmpl
03 Aug 2006: Renamed to CaptchaPlugin, adapted to Dakar (TWiki 4.0.x).
03 Jan 2006: Fixed some problems with expiry, also optimised according to TWiki:TWiki.TWikiPlugins#FastPluginHints.
10 Oct 2005: Strip hash and text from arguments to register binary, or they will end up in the newly created user topic.
07 Oct 2005: Initial version
TWiki Dependency: $TWiki::Plugins::VERSION 1.1
CPAN Dependencies: GD, Digest::MD5
Optional Dependencies: TWiki:Plugins.IfDefinedPlugin
Other Dependencies: none
Perl Version: 5.005
License: GPL (GNU General Public License)
TWiki:Plugins/Benchmark: GoodStyle 98%, FormattedSearch 98%, TWikiRegistration (patched) 85%
Plugin Home: http://TWiki.org/cgi-bin/view/Plugins/CaptchaPlugin
Feedback: http://TWiki.org/cgi-bin/view/Plugins/CaptchaPluginDev
Appraisal: http://TWiki.org/cgi-bin/view/Plugins/CaptchaPluginAppraisal

Related Topics: TWikiPreferences, TWikiPlugins

Topic attachments
I Attachment History Action Size Date Who Comment
Unknown file formatgz CaptchaPlugin.tar.gz r8 r7 r6 r5 r4 manage 204.4 K 2007-10-28 - 14:38 UnknownUser  
Compressed Zip archivetgz CaptchaPlugin.tgz r1 manage 204.3 K 2007-08-16 - 12:40 UnknownUser OLD
Compressed Zip archivezip CaptchaPlugin.zip r9 r8 r7 r6 r5 manage 210.4 K 2007-10-28 - 14:39 UnknownUser  
Edit | Attach | Watch | Print version | History: r17 < r16 < r15 < r14 < r13 | Backlinks | Raw View | Raw edit | More topic actions
Topic revision: r17 - 2011-08-29 - SeanNewton
 
  • Learn about TWiki  
  • Download TWiki
This site is powered by the TWiki collaboration platform Powered by Perl Hosted by OICcam.com Ideas, requests, problems regarding TWiki? Send feedback. Ask community in the support forum.
Copyright © 1999-2024 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.