Wither Veriword in 0.9.7?

I thought of posting this as a bug, but had second thoughts because I don’t know what the plan is for the veriword function in 0.9.7.

There is some unused and some unreachable code in the current file and, at least on my machine, it won’t work (though it works fine for me under 0.9.6).

I have what I think is an improved version but it won’t work either because I absolutely can’t get it (or the original) to save the session variable and have it be available later. I think it’s because there’s no longer a startCMSSession() function in the core.

I’ve looked for viable alternatives on the web but re-captcha sucks (IMHO) and I can’t find anything else that will work.

One alternative that would avoid images altogether would be to just use a simple Q: and A: to detect humans rather than an image (e.g. What animal goes meow) but you need a lot of questions and, even then, miscreants could just collect them and the answers. Also, they’d all require translation. On the plus side, it’s much more accessible.

Another approach would be to forget about images and just add in the two js options in SPForm that set a min/max time to sign on and can require use of the mouse and/or keyboard.

One last method would be to use the mathstring option in SPForm -- solve the math problem: 2 X 3. This can be done with or without images. Without images, miscreants could potentially write code to parse and solve the math problems. With images, we’re back to the session variable problem.

This form (iirc) http://www.bobsguides.com/contact-form.html
uses the mathstring, kb/mouse/ and timer options. I haven’t gotten a single spam message through it yet.

But I’ve been completely stumped in trying to save the session variable to make it work in 0.9.7.

Bob

I’m refactoring the way authentication works at this very moment BobRay, and one of my goals is to make sure the core is in no way tied to any particular captcha implementation, regardless if it is accessible, image-based, etc. This goes back to the discussion regarding extensions to handle all types of what are essentially security services; everything from blacklists, to whitelists, to captcha mechanisms, to flood attack controls, and other tools to fight spam, DoS attacks, security exploit attempts, and other such nuisances.

Let’s throw away veriword and find consensus for a good reference implementation of this to release with 0.9.7 as an extension. Something simple but that has a few options would be the best. This will help me define all the integration points that need to be considered for these kinds of extensions.

Maybe SPForm is it? What do others think?

OpenGeek,

You and I seem to be the only ones in this discussion.

I certainly don’t want to pass off SPForm as a model of anything (although some people around here might take a look at it so see what commented code looks like)

It does have several options that foil bots without captcha images at all:

• Test for mouse and/or keyboard use.
• Settable timer to test for people who take too little or too much time.
• Extra Last_name form field hidden by .css

I don’t know if people would be willing to give up captcha images, though.

In that area, it has:

• clearer images
• the opportunity to send it a string for display
• mathstrings (see here: http://bobsguides.com/contact-form.html).

What it doesn’t have, and this is important, is a way of effectively saving SESSION variables in 0.9.7. Solve that for me and we have all the bases covered.

I should say that SPForm itself is a contact form so it’s not a candidate for MODx authentification. I’d have to pull out the code for a log in page but it should be very easy to do if the SESSION problem is solved.

Bob

Quote from: BobRay at Mar 12, 2008, 10:34 PM

What it doesn’t have, and this is important, is a way of effectively saving SESSION variables in 0.9.7. Solve that for me and we have all the bases covered.

I’m not sure I understand, what about sessions is not working in 0.9.7? All of my tests have proven successful. Do you have a test case that shows the problem you are having?

I’m sure sessions work fine in general.

In the case of the veriword code, though, I’ve never been able to save SESSION data in veriword and then access it elsewhere in 0.9.7, which we need to do for verification.

In the 0.9.6 veriword function, there is a call to StartCMSSession(). I’m guessing that was necesssary for saving the SESSION data successfully, though I don’t understand why -- maybe it has something to do with the fact that the veriword code is accessed as an img src url.



StartCMESession() no longer exists in 0.9.7 so I can’t find any way to get the SESSION data to be saved and retrieved successfully.

Bob

Like I said, that code has not been converted to work with 0.9.7; you have to start the session by getting an instance of the modX class (like you do in index.php), and during the context initialization, the session is started. This was not done like that in previous releases because the overhead of creating the modx object was entirely too large. It’s still a little much, but will continue to get slimmer as we move towards 1.0.

Quote from: OpenGeek at Mar 13, 2008, 10:55 AM

Like I said, that code has not been converted to work with 0.9.7; you have to start the session by getting an instance of the modX class (like you do in index.php), and during the context initialization, the session is started. This was not done like that in previous releases because the overhead of creating the modx object was entirely too large. It’s still a little much, but will continue to get slimmer as we move towards 1.0.

I just can’t seem to get this to work. I’ve shrunk the code down to its bare bones and left out the image creation altogether, but the SESSION variable comes up empty when I check it later:



I’m 99% sure that all the lines here (and the lines in the includes) are executing without error because when I include the image code after this, I see the image, which I know won’t display after any error. I’ve also tried it with and without the ob_start and ob_end_flush. All the rest of the code works fine in 0.9.6 and is unchanged. This is on my local machine so it can’t be a clustered server problem.

I’m probably missing something obvious.

Bob

You just forgot to initialize a new-fangled `context`.

Quote from: OpenGeek at Mar 13, 2008, 09:47 PM

You just forgot to initialize a new-fangled `context`.

I thought there was something I should probably be doing with the MODx object.
It’s working now (finally).

Do I need the ob_start and/or ob_end_flush? It seems to work without them.

Bob

Quote from: BobRay at Mar 14, 2008, 08:31 AM

Do I need the ob_start and/or ob_end_flush? It seems to work without them.

Bob

Bump...