We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 13481
    • 97 Posts
    This is an auto-generated support/comment thread for Better Veriword Captcha Display.

    Use this forum to post any comments about this addition or any questions you have regarding its use.

    Brief Description:
    A better (IMHO) looking captcha display that uses random letters/numbers instead of predefined words.
      • 27708 MODX Staff
      • 2,502 Posts
      Quote from: devtrench at Jun 22, 2007, 03:45 PM

      random letters/numbers instead of predefined words.

      There is actually a school of thought that nonsense words or combined word fragments with numbers are actually better than random alpha numerics because someone scripting to find a password/passphrase will be more likely to focus energy on random vs human designed.

      Can’t for the life of me find the article.

      Anyway for CAPTCHA I just make up my own nonsense word letter number combinations and enter them into MODX.

      Cheers.
        Author of zero books. Formerly of many strange things. Pairs well with meats. Conversations are magical experiences. He's dangerous around code but a markup magician. Blog ✦ Twitter ✦ LinkedIn ✦ GitHub
        • 13481
        • 97 Posts
        Quote from: smashingred at Jun 22, 2007, 10:52 PM

        There is actually a school of thought that nonsense words or combined word fragments with numbers are actually better than random alpha numerics

        Thanks for the thoughts, and if you do want to do that, then changing the code would be very simple. If you don’t know PHP though I’d consider writing some kind of configuration to handle either case. Ideally, this piece of code would have some parameters in the main Configuration pane, but I think it would have to be merged into the core code in order to do that well.

        Thanks,

        James
          • 15219
          • 16 Posts
          For those that are willing, I’ve implemented the above:

          This is a quick hack.

          Files (sorry it’s a funky OSX zip archive, but you should be able to yank the contents out on any platform, I have): http://www.asherwolf.com/captcha_package_config.zip.

          I apologize ahead of time for the language files I couldn’t translate, and if I made errors on the ones I did. I have setup a fall-back method (I saw there was some kind of fallback method built in to the core for language but I didn’t quite understand it) for language as well, to english. If you already have made modifications to your installation obviously don’t just copy the files right over. To help you, I have included the code changes I made:

          (english language file and others)
          ...
          $_lang["captcha_code"] = 'Security code';
          $_lang["captcha_message"] = 'Enable this to strengthen security by requiring users to enter a code which is unreadable by machines (and scriptkiddy hacking scripts).';
          $_lang["captcha_title"] = 'Use CAPTCHA codes:';
          $_lang["captcha_words_message"] = 'Here you can specify the dimensions and number of letters for your CAPTCHA block.';
          $_lang["captcha_words_title"] = 'CAPTCHA Settings';
          $_lang["captcha_dimensions_height"] = 'Height:';
          $_lang["captcha_dimensions_width"] = 'Width:';
          $_lang["captcha_number_letters"] = 'Characters:';
          $_lang["category_heading"] = 'Category';
          ...


          The fallback file (captcha_english_fallback.inc.php) can be copied.

          (veriword.php)
          ...
          include_once("config.inc.php");
          
          if ( !isset( $captcha_height ) ) {
          	$captcha_height = 30;
          }
          
          if ( !isset( $captcha_width ) ) {
          	$captcha_width = 120;
          }
          
          if ( !isset( $captcha_chars ) ) {
          	$captcha_chars = 6;
          }
          
          $vword = new VeriWord( $captcha_width, $captcha_height, $captcha_chars );
          $vword->output_image();
          ...


          ...
          function VeriWord($w=100, $h=40, $c=6) {
          	/* create session to set word for verification */
          	startCMSSession();
          	$this->set_veriword();	
          	$this->im_width 		= $w;
          	$this->im_height 		= $h;
          	$this->word_length		= $c;
          }
          ...


          (accesscontrol.inc.php)
          ...
          if($use_captcha==1)  {
          	$modx->setPlaceholder('login_captcha_message',$_lang["login_captcha_message"]);
          	$modx->setPlaceholder('captcha_image','<a href="'.$_SERVER['PHP_SELF'].'" class="loginCaptcha"><img id="captcha_image" src="'.$modx->getManagerPath().'includes/veriword.php?rand='.rand().'&h='.$captcha_height.'&w='.$captcha_width.'&c='.$captcha_chars.'" alt="'.$_lang["login_captcha_message"].'" /></a>');
          	$modx->setPlaceholder('captcha_input','<label>'.$_lang["captcha_code"].'</label> <input type="text" name="captcha_code" tabindex="3" value="" />');
          }
          ...


          (mutate_settings.dynamic.php)
          ...
          <tr>
                      <?php if ( !isset( $_lang["captcha_dimensions_height"] ) ) { include( 'lang/captcha_english_fallback.inc.php' ); } ?>
                      <td nowrap class="warning"><b><?php echo $_lang["captcha_words_title"] ?></b></td>
                      <td><?php echo( $_lang["captcha_dimensions_height"] ); ?> <input name="captcha_height" style="width:75px" value="<?php echo isset($captcha_height) ? $captcha_height : "30" ; ?>" /> <?php echo( $_lang["captcha_dimensions_width"] ); ?> <input name="captcha_width" style="width:75px" value="<?php echo isset($captcha_width) ? $captcha_width : "120" ; ?>" /><br /><?php echo( $_lang["captcha_number_letters"] ); ?> <input name="captcha_chars" style="width:75px" value="<?php echo isset($captcha_chars) ? $captcha_chars : "6" ; ?>" /></td>
          
          <!-- <input name="captcha_words" style="width:250px" value="<?php // echo isset($captcha_words) ? $captcha_words : "MODx,Access,Better,BitCode,Chunk,Cache,Desc,Design,Excell,Enjoy,URLs,TechView,Gerald,Griff,Humphrey,Holiday,Intel,Integration,Joystick,Join(),Oscope,Genetic,Light,Likeness,Marit,Maaike,Niche,Netherlands,Ordinance,Oscillo,Parser,Phusion,Query,Question,Regalia,Righteous,Snippet,Sentinel,Template,Thespian,Unity,Enterprise,Verily,Tattoo,Veri,Website,WideWeb,Yap,Yellow,Zebra,Zygote" ; ?>" /></td> -->
                    </tr>
          ...


          And if you want case-insensitive captcha (no necessary capitals)...

          (login.processor.php)
          ...
          if($use_captcha==1) {
          	if (!isset ($_SESSION['veriword'])) {
          		jsAlert('Captcha is not configured properly.');
          		return;
          	}
          	elseif ( strtolower( $_SESSION['veriword'] ) != strtolower( $captcha_code ) ) {
                  jsAlert($e->errors[905]);
                  $newloginerror = 1;
              }
          }
          ...
            • 28042 ☆ A M B ☆
            • 24,524 Posts
            Seems to me that there should be a way to make a plugin to replace the default veriword system, using the OnManagerLoginFormPrerender event, instead of hacking the core code. The plugin would check to see if captcha was enabled, then replace the section with its own. I presume it would also have to catch the onManagerAuthentication event to process it.
              Studying MODX in the desert - http://sottwell.com
              Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
              Join the Slack Community - http://modx.org
              • 3749
              • 24,544 Posts
              Quote from: smashingred at Jun 22, 2007, 10:52 PM

              Quote from: devtrench at Jun 22, 2007, 03:45 PM

              random letters/numbers instead of predefined words.
              Anyway for CAPTCHA I just make up my own nonsense word letter number combinations and enter them into MODX.
              Cheers.

              SPForm uses nonsense words with random numbers on the end. It also has pretty clear rendering code. You can see it here:

              http://bobsguides.com/contact.html

              It’s set to produce simple math problems right now, but the rendering is about the same.

              I like using pronouncable nonsense words like Jux and Gek because they’re easier to type than random strings. They also avoid the occasional obscene words you get in a random generator.

              BTW, if you’re generating random combinations, it’s a good idea to avoid the number 0 and the letter O.

              Bob
                Did I help you? Buy me a beer
                Get my Book: MODX:The Official Guide
                MODX info for everyone: http://bobsguides.com/modx.html
                My MODX Extras
                Bob's Guides is now hosted at A2 MODX Hosting
                • 13481
                • 97 Posts
                I agree with Susan that the Captcha code should be a plugin. In fact, I think they should replace the core code with a plugin system. The captcha code is implemented so differently from the core code to snippets, and there really needs to be an API for this. There’s my feature request smiley
                  • 3749
                  • 24,544 Posts
                  Quote from: devtrench at Jan 02, 2008, 08:18 AM

                  I agree with Susan that the Captcha code should be a plugin. In fact, I think they should replace the core code with a plugin system. The captcha code is implemented so differently from the core code to snippets, and there really needs to be an API for this. There’s my feature request smiley

                  I have no objection, but I’d request that it be implemented so that you have the option to send it a string to display. You’re welcome to take the code from SPForm (which has that option) and try to convert it to a plugin.

                  Remember, also, that the Captcha code has to save session-specific data for comparision with the user’s input and that comparison will probably have to be implemented for any other add-on that uses the plugin.

                  Bob
                    Did I help you? Buy me a beer
                    Get my Book: MODX:The Official Guide
                    MODX info for everyone: http://bobsguides.com/modx.html
                    My MODX Extras
                    Bob's Guides is now hosted at A2 MODX Hosting
                    • 15219
                    • 16 Posts
                    If there was a way to adjust the configuration set-up screen and such using a plugin structure I would have done that. If there is a way that I’m unaware of, then I apologize (it was a quick hack after all). I’d be interested in using that instead.

                    EDIT: Quick errata for my above hack - you should also change your FormSignup template to reflect the following:

                    ...
                    <a href="[+action+]"><img align="top" src="manager/includes/veriword.php?h=[(captcha_height)]&w=[(captcha_width)]&c=[(captcha_chars)]" alt="If you have trouble reading the code, click on the code itself to generate a new random code." style="border: 1px solid #039" /></a>
                    ...


                    As well, if you want case insensitivity, you should change your websignup.inc.php file (and anywhere else that tests this) to read:

                    ...
                    // verify form code
                        if($useCaptcha && strtolower( $_SESSION['veriword'] ) != strtolower( $formcode ) ) {
                            $output = webLoginAlert( "Incorrect form code. Please enter the correct code displayed by the image.").$tpl;
                            return;
                        }
                    ...


                    Asher
                      • 13481
                      • 97 Posts
                      I also would have made a plugin, but I simply don’t have time to figure that out unless a client project needs it. I know this isn’t the most user friendly code, but for me, my core hack works well smiley