Security check for login/register using visual confirmation - Hacks - XOOPS News

XOOPS

News

News World of XOOPS Developers Hacks Themes Archive Submit News

Hacks: Security check for login/register using visual confirmation

Posted by: phpppOn 2004/9/16 14:53:55 10287 reads

A security check plug-in for xoops register and/or login.

How does it work:
1 The system generates a confirm id associated with a random code and stores it in a db table or in xoops_session table.
2 Meanwhile the random code will also be stored in a temporary file containing scripts protect against external scripts execution.
3 An image creation function will read the random code to create the confirmation image.
4 Once submitted, the typed code will be compared with the stored code.
5 An attempt limit is configurable.

How to use it? TODO? read the readme.txt
It is here!

The comments are owned by the author. We aren't responsible for their content.

Re: Security check for login/register using visual confir...

Stewdio Published 09/16/2004 14:59 Community Support Member Joined 05/07/2003 Comments 1560

Just looked it over, but havn't installed it yet.

Nice work!

Re: Security check for login/register using visual confir...

phppp Published 09/16/2004 15:09 XOOPS Contributor Joined 01/25/2004 Comments 2857

Thanks, Stewdio :)
demo: http://dev.xoops.org.cn
Demo in Chinese, tho.

Re: Security check for login/register using visual confir...

Stewdio Published 09/16/2004 15:14 Community Support Member Joined 05/07/2003 Comments 1560

Thats awesome! People have been asking for this kind feature for along time

Re: Security check for login/register using visual confir...

Published 09/16/2004 15:30 Joined Comments

Awesome work, phppp!

That was exactly what I was looking for

Re: Security check for login/register using visual confir...

smdcom Published 09/16/2004 16:22 Joined 04/27/2004 Comments 901

oohh... i try it.. but it doesn't works...

i overwrite all files which in the 'securitycheck_for_register'.

then.. i update system modules...

i try to register.. i get blank page... solution?

no debug message..

Re: Security check for login/register using visual confir...

phppp Published 09/16/2004 16:49 XOOPS Contributor Joined 01/25/2004 Comments 2857

This is a silly bug introduced while cleaning code
I have updated the scripts or you can fix it by adding

--------------------------------------------
if (ENABLE_SECURITYCHECK_REGISTER) {
include_once(XOOPS_ROOT_PATH."/include/randomscript.php");
}
--------------------------------------------

TO register.php just before
function userCheck($uname, $email, $pass, $vpass, $isNew = false)

If any problem/comment, let me know.

Re: Security check for login/register using visual confir...

ackbarr Published 09/16/2004 17:54 Joined 10/02/2002 Comments 1449

I'll try this out later today. Was writing my own CATCHPA system for xoops, but have been tied up working on xhelp. This will save me a bunch of time!

Re: Security check for login/register using visual confir...

smdcom Published 09/16/2004 18:34 Joined 04/27/2004 Comments 901

the registration working.. but can't login with admin access... error in randomscript.php in line 169

Re: Security check for login/register using visual confir...

smdcom Published 09/16/2004 18:58 Joined 04/27/2004 Comments 901

ok.. it's work now...

but why the image is to big?? how to re-size it to fit in my theme?

Re: Security check for login/register using visual confir...

phppp Published 09/16/2004 19:04 XOOPS Contributor Joined 01/25/2004 Comments 2857

you dont have GD ?
if not, that's in my TODO list.

check the readme.txt which states the following:
===========================================
Currently the first method works fine,
however the size of images that created by using the second method has not been tuned well enough, especially for the user login block.

Re: Security check for login/register using visual confir...

Society Published 09/16/2004 20:28 Updated 09/16/2004 20:34 Not too shy to talk Joined 01/10/2002 Comments 178

i do the first simple version of XOOPS image auth. i give predator the code for add it in the core... :) tzzz tzzz see here -> https://xoops.org/modules/news/article.php?storyid=1338 :)

Re: Security check for login/register using visual confir...

phppp Published 09/16/2004 20:49 XOOPS Contributor Joined 01/25/2004 Comments 2857

Thanks, Society.
Now I get the true image creation author.

I stated in the readme.txt concerning image creation:
==>method 1: a "ScriptReg Security Module add-in" provided by Predator (is Dennis Paulisch the original author?)

I will publish a bug-fix and feature-add version in a short while. Will correct my wrong statement :)

Re: Security check for login/register using visual confir...

phppp Published 09/16/2004 23:08 XOOPS Contributor Joined 01/25/2004 Comments 2857

Now the V1.1 version is available:
https://xoops.org.cn/modules/wfdownloads/visit.php?cid=4&lid=123

change log:
This is a quick bug-fix and feature-add release. Acturally both v1.0 and v1.1 released on Eastern Time, 2004/09/16. However I would take the Beijing Time for the v1.1 release.

Change log:
1 It's glad to find the author of the wonderful image-creation scripts, Society, which was stated as "Dennis Paulisch" in v1.0.
He made the first plug-in for XOOPS register security check (Thanks Predator for providing the scripts).
2 Add login check to closed-site login.
3 Check if its associated code-file exists before returning a confirm id.

For details, check the readme.txt file.

Re: Security check for login/register using visual confir...

smdcom Published 09/17/2004 3:46 Joined 04/27/2004 Comments 901

where's the GD? i don't have GD?

how can i make the image looks like http://dev.xoops.org.cn/??

sorry... to much question..

Re: Security check for login/register using visual confir...

Society Published 09/17/2004 6:42 Not too shy to talk Joined 01/10/2002 Comments 178

Nice thx for changing *G* the Credits, hehe
Now i hope you do the best for this addon... i started it but i stopped it because i wanted to wait until 2.1 XOOPS is released.... but as i can see you do your job good.. :)

Re: Security check for login/register using visual confir...

jlm69 Published 09/17/2004 17:37 Module Developer Joined 07/19/2002 Comments 719

First I want to say this is a great feature, Thanks to all involved.

Now I found a problem with it.

If you don't add the confirmation code and click on submit it will tell you "The confirm code is wrong"
At this point if you click on reload, it will accept the user and they are registered, without using the confirmation code.

Re: Security check for login/register using visual confir...

phppp Published 09/17/2004 18:21 XOOPS Contributor Joined 01/25/2004 Comments 2857

Thanks jlm69!

I was once thinking about the case of both codes empty, now it really comes :)

here is the fix:

if ($saved_code != $confirm_code || empty($saved_code)){
$stop .= _CONFIRM_CODE_WRONG;
...

Re: Security check for login/register using visual confir...

jlm69 Published 09/17/2004 18:29 Module Developer Joined 07/19/2002 Comments 719

Thanks for the quick reply, but where will that code go? Thanks again.

Re: Security check for login/register using visual confir...

phppp Published 09/17/2004 18:33 XOOPS Contributor Joined 01/25/2004 Comments 2857

I have updated the download and added to readme

Or you can fix it by changing the line #225 in file include/randomscript.php

=>
if ($saved_code != $confirm_code || empty($saved_code)){

Re: Security check for login/register using visual confir...

jlm69 Published 09/17/2004 18:49 Module Developer Joined 07/19/2002 Comments 719

Found it. Thanks

Re: Security check for login/register using visual confir...

domineaux Published 02/02/2005 2:00 Quite a regular Joined 09/29/2002 Comments 389

Is this module available now for 2.0.9.2 xoops?

Re: Security check for login/register using visual confir...

indream Published 03/04/2005 18:50 Not too shy to talk Joined 09/21/2004 Comments 170

Is this module available now for 2.0.9.2 xoops?

Re: Security check for login/register using visual confir...

Mithrandir Published 03/04/2005 20:12 XOOPS is my life! Joined 06/21/2003 Comments 6320

You mean it doesn't work with 2.0.9.2?

Re: Security check for login/register using visual confir...

Hisoka Published 03/16/2005 12:11 Just popping in Joined 03/02/2005 Comments 39

I use it on my website, works great with XOOPS 2.0.9.2 thanks a lot for this hack!

Re: Security check for login/register using visual confir...

Chappy Published 04/04/2005 8:21 Updated 04/04/2005 8:22 Friend of XOOPS Joined 12/14/2002 Comments 456

Works for me as well. Any idea if it will work with 2.0.10?

edit:
I'm working on corporate taxes right now but if I get the time in the next couple of days, I'll test it on one of my less travelled sites...

Re: Security check for login/register using visual confir...

Chappy Published 04/28/2005 4:36 Friend of XOOPS Joined 12/14/2002 Comments 456

FYI, I tried this hack and was not able to get it to work on 2.0.10. Indeed, I was not able to even update the system module after installation. There is the remotest possibility that I screwed it up but I don't think I did.

Login

Username

Password

Remember me

Search

Advanced Search

Donat-O-Meter

Stats
Goal:	$100.00
Due Date:	Nov 30
Gross Amount:	$0.00
Net Balance:	$0.00
Left to go:	$100.00

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}

{{ record.commit.author.name }} {{ record.commit.author.date | formatDate }}

Hacks: Security check for login/register using visual confirmation

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Re: Security check for login/register using visual confir...

Login

Search

Recent Comments

Re: New Admin Theme for XOOPS (Beta)

Sanford Pharmacy: Exceptional Pharmacy Services Tailored to You

Re: New Admin Theme for XOOPS (Beta)

Re: XOOPS 2.5.12 Beta-2 available for Testing

Re: XOOPS 2.5.12 Beta-2 available for Testing

Who's Online

Donat-O-Meter

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}

Archives

News archives