• $TWiki::cfg{Plugins}{CaptchaPlugin}{EnableSave}=0; # enable captcha for topic save
• $TWiki::cfg{Plugins}{CaptchaPlugin}{SaveForAll}=0; # enable captcha for all users, not just TWikiGuest
• $TWiki::cfg{Plugins}{CaptchaPlugin}{DeleteAfterRegistration}=0; # delete captcha after succesfull registration
• $TWiki::cfg{Plugins}{CaptchaPlugin}{DeleteAfterSave}=0; # delete captcha after succesfull topic save

• $TWiki::cfg{Plugins}{CaptchaPlugin}{Expiry}=3600; # time in seconds after which a captcha will expire and be removed
• $TWiki::cfg{Plugins}{CaptchaPlugin}{EnableSave}=1; # enable captcha for topic save

• Restrict access to the files, for example, by including the following in your httpd.conf:

• Enable the plugin via the bin/configure script
• Install necessary TrueType fonts in to pub/TWiki/CaptchaPlugin/fonts/

Captcha on topic edit

If you want to protect edits by TWikiGuest with a captcha, add the following line to your lib/LocalSite.cfg:

$TWiki::cfg{Plugins}{CaptchaPlugin}{EnableSave} = 1;

Of course, you will need the Twk1CaptchaHash and Twk1CaptchaString input fields somewhere in your edit template.

For example, if you are using the default pattern skin, change templates/edit.pattern.tmpl. Find:

%TMPL:DEF{"textarea"}%<textarea class="twikiEditboxStyleProportional" id="topic" name="text" rows="%EDITBOXHEIGHT%" cols="%EDITBOXWIDTH%" style='%EDITBOXSTYLE%' onkeydown='handleKeyDown(event)'>%TEXT%</textarea><script type="text/javascript">initTextAreaHeight();</script>
%TMPL:END%

and add before TMPL:END:

%TMPL:DEF{"textarea"}%<textarea class="twikiEditboxStyleProportional" id="topic" name="text" rows="%EDITBOXHEIGHT%" cols="%EDITBOXWIDTH%" style='%EDITBOXSTYLE%' onkeydown='handleKeyDown(event)'>%TEXT%</textarea><script type="text/javascript">initTextAreaHeight();</script>
              <IMG SRC="/twiki/pub/TWiki/CaptchaPlugin/img/65128ddcadc1088222fe8cc7a48c741d.png"/>
              <input type="hidden" name="Twk1CaptchaHash" value="65128ddcadc1088222fe8cc7a48c741d"/>
              <input type="text" name="Twk1CaptchaString" size="5"/>
%TMPL:END%

You might want to hide the captcha for logged in users (context authenticated), see VarIF for more information on conditional rendering.

             # 'WikiName' omitted because they can't
             # change it, and 'Confirm' is a duplicate
             push( @{$data->{form}}, $form )
              unless ($name eq 'WikiName' || $name eq 'Confirm');

and change the last line to:

             # 'WikiName' omitted because they can't
             # change it, and 'Confirm' is a duplicate
             push( @{$data->{form}}, $form )
              unless ($name eq 'WikiName' || $name eq 'Confirm' || $name eq 'CaptchaHash' || $name eq 'CaptchaString');

• Remove created .png files -> is already done on expiry, right?

• • Set DEBUG = 0

• • Number of characters for Captcha:
    • Set LENGTH = 5
  • The characters that you want to use in Captcha:
    • Set CHARACTERS = abcdefghijklmnopqrstuvwxyz%&?@!1234567890

• Apply the patch register-4.1.2.patch to lib/TWiki/UI/Register.pm (alternatively, patch Register.pm manually, see section below), be sure to make a backup so you can revert the patch if you want to disable the plugin:

• Install necessary TrueType fonts in to pub/TWiki/CaptchaPlugin/Fonts/
  • This allows the plugin to randomly choose the fonts to use

Guide for TWiki 4.0.5

• Fix timer (expiry)
• Refactor to comply with TWiki's convention
• Remove created .png files
• Adjustable font size range
• Adjustable height and width
• Option of Black and White only

• The tag %CAPTCHAURL% expands to the url of the image containing the scrambled text;
• The tag %CAPTCHAHASH% expands to the hash matching the image.

• • Set SHORTDESCRIPTION = Plugin for Captcha verification / visual confirmation of new user registration.

• • Truetype font to use (place the font in $prefix/pub/TWiki/CaptchaPlugin, good source of apparently free fonts is http://www.webpagepublicity.com/free-fonts.html):

• Apply the patch register.patch to lib/TWiki/UI/Register.pm (alternatively, patch Register.pm manually, see section below), be sure to make a backup so you can revert the patch if you want to disable the plugin:
  • cd /path/to/twiki
  • cp lib/TWiki/UI/Register.pm lib/TWiki/UI/Register.pm.dist

• Make sure the plugin has access to the preferred truetype font, by putting the .ttf file in pub/TWiki/CaptchaPlugin/

• • Create a topic containing <IMG SRC="%CAPTCHAURL%"> and %CAPTCHAHASH%

• • Check whether the hash database is properly protected by going to the url http://my.twiki.server/my/twiki/path/pub/TWiki/CaptchaPlugin/db/hashes.pag, you should see a permission denied message.

• • Display the image %CAPTCHAURL% somewhere in your form, along with a text instructing new users to copy the obfuscated text into the appropriate text input.
  • Add the appropriate text input as Twk1CaptchaString
  • Add a hidden input as Twk1CaptchaHash having as value %CAPTCHAHASH%

# generate user entry

• • • Set FONT = TahomaBold? .ttf

• • • Set NOISE = 12

• N/A

• Custom settings (defaults shown):
  • Characters to use in generated strings:
    • Set CHARACTERS = ABCDEFGHKLMNPRSTVWXYZabcdeghpqsuvwxy@
  • Truetype font to use:
    • Set FONT = luxisbi.ttf
  • Number of random lines to add (use none for 0):
    • Set LINES = 10
  • Number of random circles to add (use none for 0):
    • Set CIRCLES = 10
  • Noise, percentage of pixels to flip randomly after generating graphics (use none for 0%):
    • Set NOISE = 15

• Apply the patch register.patch to bin/register (alternatively, patch register manual, see section below):
  • cd bin
  • patch < ../register.patch
• Create the directories visualconfirm and visualconfirm/db in your pub/ directory, and make sure it is readable and writable by the user that TWiki is executing as.
  • mkdir -p pub/visualconfirm/db
  • chown -R nobody pub/visualconfirm
  • chmod -R 644 pub/visualconfirm
• Restrict access to the database files, for example, by including the following in your httpd.conf:

			<Directory "/path/to/twiki/pub/visualconfirm/db">
			  deny from all
			</Directory>

• Make sure the plugin has access to the preferred truetype font, by putting the .ttf file in pub/visualconfirm/

• • Create a topic containing <IMG SRC="%VISUALCONFIRMURL%"> and %VISUALCONFIRMHASH%
  • When loading this topic you should see an obfuscated character string loaded as a png and a hexadecimal hash.
  • Check whether the hash database is properly protected by going to the url http://my.twiki.server/my/twiki/path/pub/visualconfirm/db/hashes.pag, you should see a permission denied message.
• Now edit your TWikiRegistration topic
  • Display the image %VISUALCONFIRMURL% somewhere in your form, along with a text instructing new users to copy the obfuscated text into the appropriate text input.
  • Add the appropriate text input as Twk1VisualConfirm
  • Add a hidden input as Twk1VisualConfirmHash
  • For example, add this to your TWikiRegistration:

				<tr>
				  <td valign="top" align="right"><IMG SRC="%VISUALCONFIRMURL%">: <br /> (..)   </td>
				  <td><input type="hidden" name="Twk1VisualConfirmHash" value="%VISUALCONFIRMHASH%">
						<input type="text" name="Twk1VisualConfirm" size="5"></td>
				</tr>

• That's it.

Manually patching the register binary

Find the line in bin/register that says:

	 # everything OK

Insert the code below directly BEFORE that line:

	 # check valid visual confirmation
	 for( $x = 0; $x < $formLen; $x++ ) {
		$vcHash=$formDataValue[$x]
		  unless(not($formDataName[$x] eq "Visual Confirm Hash"));
		$vcTxt=$formDataValue[$x]
		  unless(not($formDataName[$x] eq "Visual Confirm"));
	 }

	 open(LOCKFILE,">".&TWiki::getPubDir()."/visualconfirm/db/hashes.lock");
	 flock(LOCKFILE,2);

	 dbmopen(%database, &TWiki::getPubDir()."/visualconfirm/db/hashes" ,0644);

	 if(!defined($database{$vcHash})) {
		$url = &TWiki::getOopsUrl( $webName, $topic, "oopsregvisualconfirm",
		  "The visual confirmation has expired.");
		TWiki::redirect( $query, $url );
		return;
	 }

	 my ($time,$txt)=split(',',$database{$vcHash});

	 if(not(lc($txt) eq lc($vcTxt))) {
		$url = &TWiki::getOopsUrl( $webName, $topic, "oopsregvisualconfirm",
		  "The character string you entered for visual confirmation is incorrect.");
		TWiki::redirect( $query, $url );
		return;
	 }
	 dbmclose(%database);

	 close(LOCKFILE);

Further Development

• Make number of characters configurable
• Make font size configurable
• Find out how to safely delete images from the register binary

• • Set CHARACTERS = ABC
  • Set FONT = luximb.ttf
  • Set NOISE = kjfksd
  • Set LINES = 3
  • Set CIRCLES = 20

CaptchaPlugin

Plugin for visual confirmation of new user registration.

Syntax Rules

• None

Examples

• None yet

Plugin Settings

Plugin settings are stored as preferences variables. To reference a plugin setting write %<plugin>_<setting>%, i.e. %INTERWIKIPLUGIN_SHORTDESCRIPTION%

• One line description, is shown in the TextFormattingRules topic:
  • Set SHORTDESCRIPTION = Plugin for visual confirmation of new user registration.

• Debug plugin: (See output in data/debug.txt)
  • Set DEBUG = 1

• My own setting:
  • Set HOWTO = got it!

Plugin Installation Instructions

Note: You do not need to install anything on the browser to use this plugin. The following instructions are for the administrator who installs the plugin on the server where TWiki is running.

• Download the ZIP file from the Plugin web (see below)
• Unzip CaptchaPlugin.zip in your twiki installation directory. Content:

  File:	Description:
  data/TWiki/CaptchaPlugin.txt	Plugin topic
  data/TWiki/CaptchaPlugin.txt,v	Plugin topic repository
  lib/TWiki/Plugins/CaptchaPlugin.pm	Plugin Perl module

• Test if the installation was successful:
  • enter samples here

Plugin Info

<-- versions below in reverse order -->

Related Topics: TWikiPreferences, TWikiPlugins

-- KoenMartens? - 07 Oct 2005