CaptchaPlugin

Plugin for visual confirmation of new user registration, to prevent automated scripts to create users and spam your wiki with their url's to get a better google ranking.

Syntax Rules

• The tag %CAPTCHAURL% expands to the url of the image containing the scrambled text;
• The tag %CAPTCHAHASH% expands to the hash matching the image.

Examples

• N/A

Plugin Settings

Plugin settings are stored as preferences variables. To reference a plugin setting write %<plugin>_<setting>%, i.e. %INTERWIKIPLUGIN_SHORTDESCRIPTION%

• One line description, is shown in the TextFormattingRules topic:
  • Set SHORTDESCRIPTION = Plugin for Captcha verification / visual confirmation of new user registration.

• Debug plugin: (See output in data/debug.txt)
  • Set DEBUG = 1

• Custom settings (defaults shown):
  • Characters to use in generated strings:
    • Set CHARACTERS = ABCDEFGHKLMNPRSTVWXYZabcdeghpqsuvwxy@
  • Truetype font to use (place the font in $prefix/pub/TWiki/CaptchaPlugin, good source of apparently free fonts is http://www.webpagepublicity.com/free-fonts.html):
    • Set FONT = TahomaBold.ttf
  • Number of random lines to add (use none for 0):
    • Set LINES = 10
  • Number of random circles to add (use none for 0):
    • Set CIRCLES = 10
  • Noise, percentage of pixels to flip randomly after generating graphics (use none for 0%):
    • Set NOISE = 12

Plugin Installation Instructions

Note: You do not need to install anything on the browser to use this plugin. The following instructions are for the administrator who installs the plugin on the server where TWiki is running.

• Download the ZIP file from the Plugin web (see below)
• Unzip CaptchaPlugin.zip in your twiki installation directory. Content:

  File:	Description:
  data/TWiki/CaptchaPlugin.txt	Plugin topic
  data/TWiki/CaptchaPlugin.txt,v	Plugin topic repository
  register.patch	Patch for the register module
  templates/oopscaptcha.tmpl	Error template
  lib/TWiki/Plugins/CaptchaPlugin.pm	Plugin Perl module
  pub/TWiki/CaptchaPlugin/TahomaBold.ttf	Default font
  pub/TWiki/CaptchaPlugin/_db	Hash database directory
  pub/TWiki/CaptchaPlugin/_img	Image directory

• Apply the patch register.patch to lib/TWiki/UI/Register.pm (alternatively, patch Register.pm manually, see section below), be sure to make a backup so you can revert the patch if you want to disable the plugin:
  • cd /path/to/twiki
  • cp lib/TWiki/UI/Register.pm lib/TWiki/UI/Register.pm.dist
  • patch < ../register.patch
• Restrict access to the database files, for example, by including the following in your httpd.conf:

         <Directory "/path/to/twiki/pub/TWiki/CaptchaPlugin/_db">
           deny from all
         </Directory>

• Make sure the plugin has access to the preferred truetype font, by putting the .ttf file in pub/TWiki/CaptchaPlugin/
• Test if the installation was successful:
  • Create a topic containing <IMG SRC="%CAPTCHAURL%"> and %CAPTCHAHASH%
  • When loading this topic you should see an obfuscated character string loaded as a png and a hexadecimal hash.
  • Check whether the hash database is properly protected by going to the url http://my.twiki.server/my/twiki/path/pub/TWiki/CaptchaPlugin/db/hashes.pag, you should see a permission denied message.
• Now edit your TWikiRegistration topic
  • Display the image %CAPTCHAURL% somewhere in your form, along with a text instructing new users to copy the obfuscated text into the appropriate text input.
  • Add the appropriate text input as Twk1CaptchaString
  • Add a hidden input as Twk1CaptchaHash having as value %CAPTCHAHASH%
  • For example, add this to your TWikiRegistration:

            <tr>
              <td valign="top" align="right"><IMG SRC="%CAPTCHAURL%">: <br /> (..)   </td>
              <td><input type="hidden" name="Twk1CaptchaHash" value="%CAPTCHAHASH%">
                  <input type="text" name="Twk1CaptchaString" size="5"></td>  =<font color="red">**</font>=
            </tr>

• That's it.

Manually patching the register binary

Find these lines in lib/TWiki/UI/Register.pm:

 }
 
 # generate user entry

Insert the code below directly BEFORE the line containing the curly bracket '{':

    # check captcha
    my %database;
    my $vcHash=$data->{CaptchaHash};
    my $vcTxt=$data->{CaptchaString};
    open(LOCKFILE,">".&TWiki::Func::getPubDir()."/TWiki/CaptchaPlugin/_db/hashes.lock");
    flock(LOCKFILE,2);

    dbmopen(%database, &TWiki::Func::getPubDir()."/TWiki/CaptchaPlugin/_db/hashes" ,0644);

    if(!defined($database{$vcHash})) {
        throw TWiki::OopsException( 'captcha',
                                    web => $data->{webName},
                                    topic => $topic,
                                    def => 'expired_vchash',
                                    params => [ "expired" ] );
    }

    my ($time,$txt)=split(',',$database{$vcHash});

    if(not(lc($txt) eq lc($vcTxt))) {
        throw TWiki::OopsException( 'captcha',
                                    web => $data->{webName},
                                    topic => $topic,
                                    def => 'invalid_vcstr',
                                    params => [ "wrong" ] );
    }

    dbmclose(%database);

    close(LOCKFILE);

Further Development

• Make number of characters configurable
• Make font size configurable
• Find out how to safely delete images from the register binary

Plugin Info

Related Topics: TWikiPreferences, TWikiPlugins

-- TWiki:Main.KoenMartens - 03 Aug 2006