We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 18913
    • 654 Posts
    Has anyone had any success integrating reCaptcha with eForm (or similar MODx snippet)? If so, could you share where you needed to make the edits? I’ve got the reCaptcha field showing up in the form without a problem. But I don’t seem to be able to get it to validate - all that happens is the form is brought up again, but with different word pairs.

    I used the tutorial on getting reCaptcha and Jot working as a guideline, but I suspect I’m not doing the validation in the right place. It looks like there are 3 or 4 places where vericode-related code is used in the eform.inc.php file. But the meat of validation seems to take place here (line 175ish)
    		# check vericode
    		if($vericode) {
    			//add support for captcha code - thanks to Djamoer
    			$code = $_SESSION['veriword'] ? $_SESSION['veriword'] : $_SESSION['eForm.VeriCode'];
    			if($fields['vericode']!=$code) {
    				$vMsg[count($vMsg)]=$_lang['ef_failed_vericode'];
    				$rClass['vericode']=$invalidClass; //added in 1.4.4
    			}
    		}

    and here (line 600ish)
    	// set vericode
    	if($vericode) {
    		$_SESSION['eForm.VeriCode'] = $fields['vericode'] = substr(uniqid(''),-5);
    		$fields['verimageurl'] = $modx->config['base_url'].'manager/includes/veriword.php?rand='.rand();
    	}


    Any help? Thanks in advance!
    Matt
      • 3749
      • 24,544 Posts
      The MODx vericode code sets the $_SESSION[’veriword’] variable when it generates the image.

      Later, the user’s input is compared to that $_SESSION variable for validation.

      reCaptcha isn’t setting the $_SESSION variable so you’d either need to set it yourself by getting the correct code from reCaptcha (if that’s possible), or find every instance where the $_SESSION variable check appears and replace it with a validation through the reCaptcha server.

      BTW, many people find reCaptcha annoying because the images are so hard to read. I assume that you’re using it because bots can read the MODx vericode images (not sure how much of a problem that really is). Mollom is one alternative and there is a MODx Mollom class around here somewhere that should be relatively easy to integrate (though I don’t think anyone has done it yet).

      The MODx SPForm snippet has the option of using a simple equation that the user has to solve as the image (e.g. 2 + 4 = ?). AFAIK, no bots have broken that. It uses a modified version of the MODx vericode.php file (included in the snippet .zip file) so it’s much easier to integrate with any standard MODx components.

      Hope this helps. smiley
        Did I help you? Buy me a beer
        Get my Book: MODX:The Official Guide
        MODX info for everyone: http://bobsguides.com/modx.html
        My MODX Extras
        Bob's Guides is now hosted at A2 MODX Hosting
        • 28042 ☆ A M B ☆
        • 24,524 Posts
        I started using a dummy field that must be left blank and is hidden by being moved off the screen in CSS. I haven’t gotten a single spam form submission since setting this up. I now use it for all the forms I set up for all my clients, and haven’t had any complaints yet. I took this from the SPForm, by the way.
          Studying MODX in the desert - http://sottwell.com
          Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
          Join the Slack Community - http://modx.org
          • 3749
          • 24,544 Posts
          I have gotten spam submissions with just the hidden field, but not very many and it’s possible they were entered by hand. Once I banned a few by IP in SPForm, they stopped.
            Did I help you? Buy me a beer
            Get my Book: MODX:The Official Guide
            MODX info for everyone: http://bobsguides.com/modx.html
            My MODX Extras
            Bob's Guides is now hosted at A2 MODX Hosting