Edward
Correct me if I'm wrong but as I mentioned in my first reply to your
post a hacker can use GET method to post registration request in the
URL.
The hacker can set the value of register to 1 and this will pass your
check and register. As you already know having incorrect captcher
doesn't matter, new user still gets registered. Try GET method
yourself!!! I hope I'm wrong :-(
Ajdin
-----Original Message-----
From: users-bounces(a)xwiki.org [mailto:users-bounces@xwiki.org] On Behalf
Of Edward Laptop
Sent: 09 July 2009 15:22
To: XWiki Users
Subject: [xwiki-users] working captcha
Dear All
I have spent quite a few hours playing with the captcha trying to get it
to work. There were some useful posts on the new group, but none of them
was a complete solution.
The below has worked for me... hopefully it will prove useful to someone
else.
This code is taken from a fairly old xwiki that my client didn't want to
upgrade. It is based around registerinline.vm, which had previously been
edited to add a lot more fields. I am not an expert on OOP but got it to
work with a selection of conditional statements.
First declare the plugin - you have to make sure its enabled - but
apparently it is by default. "if ($reg)..." will evaluate to true/false
and if the value is negative its an error. You test the state of the
captcha using $captchaPlugin.verifyCaptcha("edit") where edit is the
name - set much later on.
One of the problems was that the form would come back with the correct
messages eg it would tell you if the captcha filled in wrong, but the
new user would still be regsitered (assuming all the other fields filled
in correctly). By playing I found that <input type="hidden"
name="register"
value="1"/> was the key - if value="1" then registration occurs,
if
="0"
then it doesn't. So put this in a conditional - which seems to only
depend on the captcha being ture/flase - which was odd, because I would
ahve thought you'd want to test with $reg as well. However, I couldn't
get it to work with $reg at this stage - reg=$reg usually prints out the
nunber - but at this point it just printed out ref=$reg...
Don't forget to put "verifyCaptcha" into the action of the form tag.
call the displayCaptcha pass the class name as "register_captcha" which
should map to the css classname to render the image with
$captchaPlugin.displayCaptcha("edit","register_captcha")
pass the name as edit
go to
http://<host>:<port>/xwiki/bin/edit/XWiki/XWikiPreferences?editor=object
&
find XWiki.XWikiPreferences[0]: XWiki.DefaultSkin select the values for
Anonymous: and Registered: as image or text - text gives you a simple
sum to fill in. There were 3 sets of each on mine, I set them all to
imgae or all to text
Anyway, back to work...
## declare the plugin
#set($captchaPlugin = $xwiki.jcaptcha)
#if(!$reg||$reg<0 )
<p>Welcome .....</p>
#end
#*
if reg is true (ie form filled), but less than zero OR the captcha is
wrong *#
#if( ($reg && $reg<=0) || !$captchaPlugin.verifyCaptcha("edit") )
#if($reg==-2)
#error("$msg.get('core.register.passwordMismatch')")
#elseif($reg==-3)
#error("$msg.get('core.register.userAlreadyExists')")
#elseif($reg==-4)
#error("$msg.get('core.register.invalidUsername')")
#elseif($reg==-8)
#error("$msg.get('core.register.userAlreadyExists')")
#else
##error("$msg.get('core.register.registerFailed', [$reg])")
#error("The captcha field was filled in wrongly.")
#end
#elseif($reg && $captchaPlugin.verifyCaptcha("edit"))
#set($xwname = "XWiki.${request.xwikiname}")
#info("$msg.get('core.register.successful',
[$xwiki.getUserName($xwname), $request.xwikiname])")
#end
##form appears if reg is not true or its -ve or capatcha is wrong
#if(!$reg||$reg<0 || !$captchaPlugin.verifyCaptcha("edit") )
<form id="register" action="verifyCaptcha"
method="post">
<div>
<input type="hidden" name="template"
value="XWiki.XWikiUserTemplate" />
##this is a key statement
#if ($captchaPlugin.verifyCaptcha("edit"))
##set it to 1
<input type="hidden" name="register" value="1"/> #else
##set it to 0
<input type="hidden" name="register" value="0"/> #end
#set($class = $xwiki.getClass("XWiki.XWikiUsers"))
#set($obj = $class.newObject())
#set($serverobj = $class.newObject())
#set($discard = $doc.use("XWiki.XWikiUsers"))
#if($request.register_first_name)
$doc.set("first_name", $request.register_first_name)
#end
#if($request.register_last_name)
$doc.set("last_name", $request.register_last_name)
#end
<dl>
##username
<dt>$msg.get("core.register.username")</dt>
<dd><input name="xwikiname" type="text"
size="20" onfocus="
prepareName(document.forms.register);" /></dd>
... lots more fields
#if ($captchaPlugin)
$captchaPlugin.displayCaptcha("edit","register_captcha")
#end
<span class="buttonwrapper"><input type="submit"
value="$msg.get("core.register.submit")"/></span></div>
</form>
#end
_______________________________________________
users mailing list
users(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/users
--------------------------------------------------------
NOTICE
This message and any files transmitted with it is intended for the addressee only and may
contain information that is confidential or privileged. Unauthorised use is strictly
prohibited. If you are not the addressee, you should not read, copy, disclose or otherwise
use this message, except for the purpose of delivery to the addressee.
Any views or opinions expressed within this e-mail are those of the author and do not
necessarily represent those of Coventry University.