+- ZenphotoCMS Forum (https://forum.zenphoto.org)
+-- Forum: Support (https://forum.zenphoto.org/forum-1.html)
+--- Forum: General support (https://forum.zenphoto.org/forum-4.html)
+--- Thread: Adding CAPTCHA-validation to stop comment spam (/thread-1662.html)
Adding CAPTCHA-validation to stop comment spam - ulfben - 2007-09-20
I want to add reCaptcha to my zenphoto installation.
Looking through the code in class-image.php revealed that `addComment($name, $email, $website, $comment)` is responsible for validating the comment form input. Thus, this is where I want to add some CAPTCHA controlls.
Problem is, I'm not certain how the form data (POST) gets sent to `addComment`. How do I get
`$_SERVER["REMOTE_ADDR"],
$_POST["recaptcha_challenge_field"],
$_POST["recaptcha_response_field"]);`
to `addComment`?
Adding CAPTCHA-validation to stop comment spam - ulfben - 2007-09-21
It seems zp_handle_comment() in functions_controller.php is what I'm looking for.
I'll report back in a while.
Adding CAPTCHA-validation to stop comment spam - ulfben - 2007-09-21
Got it working. I'll post the code when I've cleaned it up a bit.
Adding CAPTCHA-validation to stop comment spam - ulfben - 2007-09-21
Here's my edits. Note that this will [i]not[/i] remember what's in the comment textbox if the visitor fail their captcha - they'll have to start over again.
My next post has the code needed to keep the text intact.
[b]image.php:[/b]
`
<!-- Comment Box -->
<div id="commentbox">
Leave a Reply
<form id="commentform" action="#" method="post">
<?php
require_once('recaptchalib.php');
$publickey = "Get a key from http://recaptcha.net/api/getkey";
?>
`
[snip]
`
<textarea name="comment" id="comment" rows="5" cols="100%" tabindex="4"></textarea>
<?php echo recaptcha_get_html($publickey); ?>
<input type="submit" value="Submit" class="pushbutton" />
`
[b]functions-controller.php:[/b]
`
if (in_context(ZP_IMAGE) && isset($_POST['name']) && isset($_POST['email']) && isset($_POST['comment'])) {
if (isset($_POST['website'])) $website = strip_tags($_POST['website']); else $website = "";
require_once("/path/to/wherever/you/put/recaptchalib.php");
$privatekey = "Get a key from http://recaptcha.net/api/getkey";
$resp = recaptcha_check_answer ($privatekey,
$_SERVER["REMOTE_ADDR"],
$_POST["recaptcha_challenge_field"],
$_POST["recaptcha_response_field"]);
if ($resp->is_valid)
{
$commentadded = $_zp_current_image->addComment(strip_tags($_POST['name']), strip_tags($_POST['email']),
$website, kses($_POST['comment'], zp_conf('allowed_tags')));
}
`
Adding CAPTCHA-validation to stop comment spam - ulfben - 2007-09-21
[b]NOTE:[/b] I am not a web developer. I'm frightingly unaware of safe practices and standards. What I'll show you now might quite possibly feed bad data to your server, prompting the return of SATAN and a premature end of mankind. [b]However[/b], it does seem to work pretty well for me.
If you've got more knowledge that I do, please inform us all. If you just got more sense than I do, stay away.
Here goes:
In [b]functions-controller.php[/b], this is what happens if the user fail their submission (bad captcha or no name/email/comment):
`
$stored = array($_POST['name'], $_POST['email'], $website, $_POST['comment'], false);
if (isset($_POST['remember'])) $stored[3] = true;
$error = true;
`
Specifically note `if (isset($_POST['remember'])) $stored[3] = true;`. This line confuses the hell out of me. It overwrites the `$_POST['comment']` (comment text) that we just inserted the line before, with a "1". I can't find where this hardcoded value is read again, so I'd rather not mess with it. If you know - please inform me.
Now, here's my ugly workaround:
`
$stored = array($_POST['name'], $_POST['email'], $website, $_POST['comment'], false);
$stored[5] = $_POST['comment'];
if (isset($_POST['remember'])) $stored[3] = true;
$error = true;
`
Simply added a sixth field and keeping the comment text safe in there. To get this back out into the comment form, heres what you need to add in [b]image.php[/b]:
`<textarea name="comment" id="comment" rows="5" cols="100%" tabindex="4" >[b]<?=$stored[5];?>[/b]</textarea>`