SMF 1.1.7 AND 2.0
Test site: http://captcha17.e-debatten.dk/ (SMF1.1.7)
Test site: http://captcha20.e-debatten.dk/ (SMF2.0)
I'm working on a new mod that works in this way:
When people enter the registration page, 10 avatar images are fetched from the avatar folder. Above these 10 images an image is shown to the registrant. Besides that, only the registration agreement is shown.
The idea is that to see the complete registration page, the registrant must verify the single image by clicking on one of the other ten images shown below.
If the registrant fails on clicking the right image, 10 new images are fetched from the avatar folder. The registrant can fail 2 times. After the third time, the user can no longer register.
The registration page as it is shown to the user the first time it is entered:
(http://smf.e-debatten.dk/images/VerificationImage_1.jpg)
After a failed registration attempt, a warning is shown
(http://smf.e-debatten.dk/images/VerificationImage_2.jpg)
3 times selected the wrong image, and the registrant is banned.
(http://smf.e-debatten.dk/images/VerificationImage_3.jpg)
If there aren't enough avatars (less than 3), the mod defults to some simple images with a number within.
(http://smf.e-debatten.dk/images/VerificationImage_8.jpg)
As admin part, the admin has the ability to choose which avatar subfolders he/she wants to use for registration. As standard - and not changeable - the admin cannot select/deselect the "Actors" and the "Musicians" folders.
I would like to add the registrant to the ban list, if he/she fails, but it seems it's only possible to ban a IP for a day. Done :)
Features:
* Show 10 images at first registration. Maybe expanded to btw. 10 and 20 (randomly)
* Each image will be modified in random different ways, like adjusting the contrast of the image
* In admin center, admin can add a commaseparated list of additional folders to use for verification, besides the standard SMF avatar folders
* The registrant is banned 1 hour the first time he fails the test 3 times (can be edited in admin center).
* The registrant is banned 24 hour the second time and on further attempts if he fails the test 3 times (can be edited in admin center).
* Loop - you can set the number of images there should be verified to btw. 1 and 3
* Automatically defaults to simple images with a number within, if there are less than 3 avatars in the forum
Latest release: http://www.simplemachines.org/community/index.php?topic=280188.msg2288647#msg2288647
Another image, this time from the admin center:
(http://smf.e-debatten.dk/images/VerificationImage_4.jpg)
The mod is soon ready as a beta. It works this way:
When people click the wrong image, they get yet another set of images to verify. If they fail 3 times, they are automatically banned from registering in one hour.
If they later try to register again, they are banned for 24 hours if they fail 3 times.
I also added a loop, so that people has to verify from 1 to 3 images.
More images. This time from a forum where I installed the package:
A ban has been added to the ban list. The registrant (me) chose the wrong image 3 times.
(http://smf.e-debatten.dk/images/VerificationImage_5.jpg)
Edit of the ban: Note that it tells how many attempts there has been done. It also says that the ban will expire in 0 days, but it's really one hour as this was my first hacking attempt. If the registrant tries again after one hour and yet again fails, he will be banned for 24 hours.
(http://smf.e-debatten.dk/images/VerificationImage_6.jpg)
.. and a ban trigger is also created:
(http://smf.e-debatten.dk/images/VerificationImage_7.jpg)
I'll BETA test this one... looks interesting. I'll be amazed if a bot get's through this one.
I get a few errors in the forum error log, but besides that it seems to work. When I solve those issues, I'll upload a beta.
You can still get past this verification after you have been banned, but when you enter your information in the normal registration page and click "register", you will get the message that you are banned. Just like the normal way people are banned from registering.
lax.slash: I guess it's you who are banned now ;)
And I can see in the DB you have been banned for 3600 seconds ;)
Quote from: akyhne on December 15, 2008, 09:21:20 PM
lax.slash: I guess it's you who are banned now ;)
And I can see in the DB you have been banned for 3600 seconds ;)
Yup! lol. I tried it in FF and IE. Got through on FF, then repeated the test in IE, where I got banned. Looks like this is going to be a great SPAM prevention tool. :)
I think the flaw about other test like the "are you human" and other captcha tests, don't add people to the ban list. They can just close the browser, open it again and try again until they get through.
This mod prevents people from doing it by banning them. I you are really bothered by hackers, the first hacking attempt can be adjusted from 1-99 hours (or disabled), and further hacking attempts can be adjusted from 1-999 hours (24 as default).
I wonder if there's a mod or something that will ban users after x number of CAPTCHA fails.
I'd be interested in this as well as soon as you release it,.. Ill keep an eye on this thread and look for the release.
You can now test the mod here: http://captcha17.e-debatten.dk/
The server is very slow, so have patience. Just register an account if you like as the forum is just a test forum.
Not a lot of response on this one. Does noone bother trying it out? I even made a V2.0 version.
Where can we download it? ???
No where. I would like people to try it on the link I gave you so that I can test wether banning is working and to see if i get any errors.
But you can get an early beta if you like.
Oh..... okay! I misunderstood. But where do we test SMF 2?
EDIT: I should be banned on 1.1.x. Just tried it.
http://captcha20.e-debatten.dk
Quote from: lax.slash on December 19, 2008, 02:26:37 PM
Oh..... okay! I misunderstood. But where do we test SMF 2?
EDIT: I should be banned on 1.1.x. Just tried it.
Yeah, I can see you are banned 2 times on the 1.1.7 forum.
A beta 2 version of the mod. Works for both 1.1.7 and 2.0 beta 4
There's one thing I still have to work on: What happens if there are no images.
In SMF 1.1.7 the settings for the mod are in "Registration" -> "Settings"
In SMF 2.0 the settings for the mod are in "Security and Moderation" -> "Anti-spam"
Maybe people are to busy with christmas.. maybe my mod isn't working :(
No one has been banned in my two test forums http://captcha17.e-debatten.dk (1.1.7) and http://captcha20.e-debatten.dk (SMF 2.0 beta 4).
PLEASE take a moment and try it out: If you end up on the regular registration page because you clicked the right images, you will have to close your browser and then try again. When you are banned, you end up with this message on the screen:
"Unfortunately it seems you are not capable to verify the image verification. We have the feeling you are not a human, but a spambot trying to register in our forum. If this is not the case, we are sorry to bother you. You will have to come back later and try again."
If you do, you should be banned. Then please post here that you were banned and I will confirm it.
Please...
I should be banned on SMF 2 and SMF 1.1.7. :) Also, not sure if it's my computer, or what, but it seems kind of slow...
It's the test server that is very slow. When my host isn't under a lot of pressure, the images are generated in no time.
http://captcha20.e-debatten.dk:
69.xxx.x.xxx Hacking Attempt No: 0003 updated 2008-12-20 08:12:42 PM GMT hacking_attempt_in_verification_image_mod December 20, 2008 1 day(s)
http://captcha17.e-debatten.dk:
69.xxx.x.xxx Hacking Attempt No: 0004 updated 2008-12-20 08:12:29 PM GMT hacking_attempt_in_verification_image_mod December 16, 2008 1 day(s)
I tried it and I was banned.
victornj. i guess this is you:
24.1xx.x.xxx Hacking Attempt No: 0001 2008-12-26 06:12:57 PM GMT December 26, 2008
Thanks for trying.
The developement is on hold because my ADSL is down :(
i tried 3 times with wrong image and was banned. 17
tried on 20. wrong image twice, then correct image, asks for another image. got it correct and directed to the registration page. works great on my end...
New beta.
Should work with SMF 2.0 Beta 4 ans SMF 1.1.7.
Works with SMF 1.1.8 and SMF 2 RC 1.
82.143.***.*** was just banned at captcha17.
yeah, i tried the 1.1.x version :D
Great. You are also registered in the banning list. If you are going to test the mod, then pm me your site and I will try it out. Keep an eye on the log if you get any errors.
Are you troubled a lot with spammers?
199.81.xxx.xxx just banned on captcha17.e-debatten.dk:
Ban:
Hacking Attempt No: 0001 2009-02-13 06:02:32 PM GMT
hacking_attempt_in_verification_avatar_mod
It doesn't seem people are interested in this mod. And I really don't understand. People are complaining about being attacked by spammers, having a lot of bots registering in their forums. This mod should prevent them from doing it.
I might just drop it here and keep it in my forums as extra sequrity.
I love the mod :D !
Please adjust the mod Enhanced Captcha Image Verification of vBulletin to SMF.
This mod is really perfect.
My skills are poor for this.
I believe that you can easily ;D.
Some ss and the original version of vBulletin you examine the code.
Cheers.
(http://hosting03.imagecross.com/image-hosting-th-07/7430imageverification1.jpg) (http://www.imagecross.com/03/image-hosting-view-07.php?id=7430imageverification1.jpg)
(http://hosting03.imagecross.com/image-hosting-th-07/2374imageverification2.jpg) (http://www.imagecross.com/03/image-hosting-view-07.php?id=2374imageverification2.jpg)
I don't believe the sequrity is the same in that mod as in my version. Therefore it has no interest to me.
IP:212.69.*.* was banned on captcha20.e-debatten.dk
IP:61.17.2**.*.* was banned on captcha20.e-debatten.dk. Someone from here?
Quote from: akyhne on February 19, 2009, 08:01:53 AM
It doesn't seem people are interested in this mod. And I really don't understand. People are complaining about being attacked by spammers, having a lot of bots registering in their forums. This mod should prevent them from doing it.
I might just drop it here and keep it in my forums as extra sequrity.
I'm still interested, but I've been busy a while with a new site I'm working on. Once I get it fairly set up good enough, I'll put the BETA on it. I'll also put CAVECOST on it... :) (Still in use on my other site)
I think a lot of people are interested, but just afraid of testing a BETA.
CAVECOST is not something I will be working anymore as it will never be supported in SMF 2.x.
And there seems to be no interest in this mod. I've had it running in 5-6 forums for a long time now without any issues, any complains from registrants... and hardly any spammers.
The reason I won't release this mod is simple: When barely anyone wants to test it on my sites and repport back, the interest is to little.
Know how you feel but you should not give up. Why? Because your drive should be self driven and you quest for "perfection" be self-judged, not driven by the public's tastes, knowledge or ignorance or disinterest.
Anyways, yesterday I installed your avatar verification mod on my web site that is running SMF 1.1.8 with about 8 mods installed and Tiny Portal 0.98. Installation was though the package manager and it went as smooth as oil.
If me was you, as Lil' Abner used to say, I would feel great, but since me is me I am glad to have found this thread and your mod.
Thankd for the nice words marzi.
What I don't want is this: Release a mod, then having a lot of people complaining about installation issues etc.
I don't have the time for that and I don't have the skills. It would be much easier if people would help testing on my test sites, and if someone would also test the mod themself. Then I could take it easy and solve issues when I had the time.
OK.
I went to your 1.1.x test site yesterday and tested the mod and it worked fine for me (Windows 2000 professional+Firefox 3).
I then installed on one of my sites (described earlier) and will give you relevant feedback.
Thx.
Quote from: marzi on April 03, 2009, 03:00:01 PM
OK.
I went to your 1.1.x test site yesterday and tested the mod and it worked fine for me (Windows 2000 professional+Firefox 3).
I then installed on one of my sites (described earlier) and will give you relevant feedback.
Feedback?
Finally, finally, finally... YEEESSSSS, for the first time I could confirm this mod to work. Not only one, but even 2 of my forums were attacked within an hour from the same bot.
It took 2-3 minutes to make exact 7 attacks in each forum, probably "that long" as the browser cache has to be emptied and/or the browser has to be closed to make another attempt (or banning time has to run out). Hmm, does the bots even use a regular browser to hack... I really don't know.
Checked for support of SMF 1.1.9 & SMF 2.0 RC1-1
got a weird issue, when using this on one of my sites. None of the avatars are showing up, just red lines.
Try disabling the TP block. What does your error log say?
turned off the tp block, no change, error log shows this Apply Filter: Only show the error messages of this member Guest Today at 07:45:16 AM
Apply Filter: Only show the error messages of this IP address xxx.xxx.xxx.xxx Apply Filter: Only show the error messages of this session 6f5379720c6b487f0a6c06ec5ccf5847
Apply Filter: Only show the error messages of this URL http://www.clan-ascension.org/index.php?pretty;action=register
Apply Filter: Only show the errors with the same message
8: Undefined index: approved_image_verification
File: /home/content/g/w/y/gwyndion6977/html/Themes/default/Register.template.php (eval?)
Line: 99
What other mods regarding spam check do you have installed? Can you attach register.template.php?
only other spam mode is the anti-spam verification questions. Screenshot of installed mods, and register.template.php
I have no issues running anti spam verification questions along with my mod, although I have to install anti spam verification questions first, then my mod.
What folders are you using for the avatars? Any custom folders?
no, no custom avatars at allstill only have the default set
funny thing is, it works on my other forums, but all the settings are the same, as well as the mods
Your Register.template.php compares exactly to mine... strange.
Quote from: clashbot on June 01, 2009, 08:27:17 AM
funny thing is, it works on my other forums, but all the settings are the same, as well as the mods
Well, that's great to hear at least. Was you bothered a lot with spammers?
Only thing I can suggest for now is to run the Repair Settings tool to check wether your paths are correct: http://download.simplemachines.org/?tools
Ok, I found out why it doesn't work. It is because you don't allow guests to access your forum. Whenever I disable guest access, it doesn't work on my forums as well.
yep, that was it...thanks
atleast I still have a little hair left, and didn't pull out all of it. Great mod btw, look forward to an official release on the mods
one little caveat though...appears the verification is stuck in session or cookie, not sure which...
Steps to reproduce:
register, pass verification
don't go any further with registration and login with account already in place
log out
register again
goes straight to the normal capcha registration, bypassing the avatar
might be something to think about for public computers...
I don't think it will be released as I don't have the time and skills to support it.
I found the "error" and corrected it. I just need to test wether it works in all SMF versions and then upload it here. In the mean time, just uninstall your current version, and I will be right back.
Quote from: clashbot on June 01, 2009, 08:49:09 AM
one little caveat though...appears the verification is stuck in session or cookie, not sure which...
Steps to reproduce:
register, pass verification
don't go any further with registration and login with account already in place
log out
register again
goes straight to the normal capcha registration, bypassing the avatar
might be something to think about for public computers...
I'm aware of that, but I don't see it as an issue. Bots don't register more than one account each time, not to drag attension.
k, and it's too bad there won't be an official release, I actually prefer this one to most of the anti-spam captures...
Really wish I knew php more :P
Well, you can still use it, can't you ;)
My big trouble is time, and the fact that I use this mod on 15 of my forums but none of them ever was bothered by spammers. So I don't know the effect of this mod.
definately I will be using it..you said you were uploading a ver 4?
Just need some testing... give me 15 minutes.
Quote from: clashbot on June 01, 2009, 08:49:09 AM
one little caveat though...appears the verification is stuck in session or cookie, not sure which...
Steps to reproduce:
register, pass verification
don't go any further with registration and login with account already in place
log out
register again
goes straight to the normal capcha registration, bypassing the avatar
might be something to think about for public computers...
Btw. in SMF 2.xx you can only register one account from one computer.
yeah, that might be an issue with shared computers and the like....curious though if it is based on ip, or sessid, if it is ip based, that would prove problematic on home networks that have a shared ip address...
but can see the benefits, if the computer is zombied
Avatar Verification version 1.0 beta2 revision 4 released:
Quote from: clashbot on June 01, 2009, 09:17:47 AM
yeah, that might be an issue with shared computers and the like....curious though if it is based on ip, or sessid, if it is ip based, that would prove problematic on home networks that have a shared ip address...
I had to bypass it ín one of my forums for the same reason.
I'll cross that bridge when I get to the 2.0, currently I am sticking with the 1.1.9, I'll give the RC a little more time to stabalize. That will be one thing I will have to disable. I run two gaming forums, some of which either have a father/son membership or a spouse/spouse membership...somthing that would prevent a login will be problematic. Although curious if it is just based on registration, or access...in which case, work-around would be for admin creation of the account. One feature it would be good for, would be a banned member, trying to gain access by creating a new account. But, even this is already taken care of in ban triggers....will be interesting to see. Thanks again for the update. It is working as expected now on both forums.
You don't have guest access enabled on your site. If you do, I will test it.
My guess is they use the IP to verify wether a computer tries to register more than one account.
guest is enabled on both sites, but with no boards... you can try either forum,
www.lupusdraconis.com (http://www.lupusdraconis.com) or www.clan-ascension.org (http://www.clan-ascension.org)
Done. I should be banned in both forums. Please don't reveal my IP.
yes it worked as intended...thanks, ban is removed, and ip erased
and also thanks for testing opera compatibility too ;)
Also tried this mod, but gives me error in log:
Quote8: Undefined index: approved_image_verification
File: /Themes/default/Register.template.php (before sub template - eval?)
Line: 108
Prolly caused by guests not being allowed on the forum?
Install and uninstall went flawless!!
Dutch translation attached
That's odd. If you disable eval, I would be able to see what causes the error.
You are using this version, right?
http://www.simplemachines.org/community/index.php?topic=280188.msg2088520#msg2088520
Strange thing is I do not have evaluation mode enabled....
yep: using that version.
Does the mod work? When do errors occur? Do you have other bot software installed?
How to Enable / Disable eval() (http://www.simplemachines.org/community/index.php?topic=290186.0)
Ah that eval.. Thought for a moment you meant maintenance mode.
When eval is disabled this is the error:
Quote8: Undefined index: approved_image_verification
File: /Themes/default/Register.template.php
Line: 108
I've attached my register.template.php
And yes the mod works, however, it is not displaying images from my avatar folder, but squares with a number in it. Also just going to the register page is enough to get the error....
The mod defaults to those images, if there are less than 3 avatars in your forum.
I know, I uploaded 20 avatar files to the folder to make sure there are enough images in the folder, prior to testing the mod
Hmm, something tells me you are having problems with sessions. Do you have a link to your forum?
http://www.bitethebullet.dk/index.php
Just found out: I only get the error written in the log when the mod is installed but disabled. When the mod is enabled there is no error, but I defaults to the squares with the numbers
A Dutch guy with a Danish site lol.
It's actually my gf's site together with a danish friend. I was asked to do all the technical stuff ::)
Quote from: JulesW on October 02, 2009, 08:48:33 AM
I know, I uploaded 20 avatar files to the folder to make sure there are enough images in the folder, prior to testing the mod
They need to be placed in the two default folders "Actors" and "Musicians". If they are outside those folders, you need to tell the mod which folders to look in. You do that in your admin center where you adjust settings for the mod (Admin -> Registration -> Settings for SMF1).
Quote from: JulesW on October 02, 2009, 10:15:04 AM
Just found out: I only get the error written in the log when the mod is installed but disabled. When the mod is enabled there is no error, but I defaults to the squares with the numbers
Ok, I got the errors now as well. I'll correct the error and upload a new package.
QuoteThey need to be placed in the two default folders "Actors" and "Musicians".
Ah, that might be the cause. I've put them in the avatar folder.
After moving them to the actor folder, it worked!!! Although there are still one or two blank squares there. (see image)
(http://img202.imageshack.us/img202/1961/registration.jpg)
Edit: just realised: Does the mod support all types of images like png and gif or only jpg?
edit2: Also got new errors written:
Quote2: imagecreatefromjpeg(avatars/Actors/Chewie-&-Han.jpg) [<a href='function.imagecreatefromjpeg'>function.imagecreatefromjpeg</a>]: failed to open stream: Success
File: blabla/Sources/Subs-CaptchaAvatar.php
Line: 58
and
Quote2: imagesx(): supplied argument is not a valid Image resource
File: blabla/Sources/Subs-CaptchaAvatar.php
Line: 62
The above is repeated for multiple lines like 63,65,66,71,72,74,75,76,108,109,115,116 <-- thats just the same error propagating through the code because of the error in line 58 I presume, and the error in line 58 is because it fails to open the image file I guess?
Sounds like those jpeg images are corrupted.
On my pc the images work, I think it has anything to do with the filename being Chewie-&-Han.jpg. Maybe the "-" or the "&" isn't handled correctly.
It doesn't help you can open the file in a browser or with an image viewer. But you can try renaming them to see if it helps.
Renaming the file helped.
did get 2 other errors however:
Quote2: imagecopyresampled(): supplied argument is not a valid Image resource
File: blabla/Sources/Subs-CaptchaAvatar.php
Line: 108
Quote
2: imagedestroy(): supplied argument is not a valid Image resource
File: blabla/Sources/Subs-CaptchaAvatar.php
Line: 109
Any idea whats going on here?
Could you zip the image files and email them to me or attach them here?
no prob
Here ya go
The Sail-Barge.gif file is corrupted.
That explains it. How can you test whether a file is corrupted? It show perfectly fine in my browser, the gimp and file explorer.
Sometimes you can tell by opening the file in a decent image editor such as Corel Photopaint or Adobe Photoshop, and sometimes you just can't edit them with the GD functions.
I'm going to release a new version with a few corrections soon. Your Dutch translation has some untranslated entities. Could you please walk through the file attached and translate the rest, please.
Remember to escape ' like '.... gescheiden met komma\'s';
There was only the komma\'s in your translation so far. I corrected that for you.
Here is the rest of the translation.
Looking forward to the new version!
Avatar Verification 1.0 beta 2 rev. 6 released
I installed this new version it yesterday, and thus far all is well!
No more errors in the log!
Great mod!
Thanks, I finally applied it as an official mod.
... and finally approved as an official mod: http://custom.simplemachines.org/mods/index.php?mod=2182