Captcha widget done - but

Randy_J_Houlahan_B.S 2009-06-26 15:29:54 UTC #1

Hello Ralf && Nathan

I completed the captcha widget based on the www.phpcaptcha.org open source code.

Some options that come with the code such as diff fonts and background images wa not implemented yet.

One ugly thing I did is in the post_process I could not get the value_in correctly (I believe). The name of the widget is what ever the creater makes it but the text field the widget uses is named captcha_code. $value_in would not ever return a value unless the widget itself was named the same as the text field it uses.

So i went to $_POST[exec][captcha_code] directly. How do i get [exec][captcha_code] value if the widget is is named ‘my_captcha’?

Thank You,

{

	    $value_in =$_POST['exec']['captcha_code'];

		if ($value_in=='' || !isset($value_in))
		{
			$loop=TRUE;
			return false; 
		}
		
		if ($this->img->getCode() != $value_in)
		{

			$tmpl->set_validation_error('captcha_code',lang(" Your code is incorrect !!!"));
            $loop=TRUE;
			return false; 
		}
		$value=$_POST['exec']['captcha_code'];

}//post process

function pre_process($name,&$value,&$cell,&$readonlys,&$extension_data,&$tmpl)
{

	//sets main etemplate cell with data created in etemplate.captcha_widget
	$cell['type'] = 'template';
	$cell['name'] = 'etemplate.captcha_widget';
	$widget =& new etemplate('etemplate.captcha_widget');
	$widget->no_onclick = True;
	$cell['obj'] = &$widget;


	// sets refresh icon link properties
	$refresh_image_wig =& $widget->get_widget_by_name('etemplate/refresh.gif');
	$refresh_image_wig['size'] = 'etemplate.captcha_widget.show_image';
	$refresh_image_wig['onclick']='
	document.getElementById(\'show_image\').src = \''.$GLOBALS['egw_info']['server']['webserver_url'].'/index.php?menuaction=etemplate.captcha_widget.show_image&sid=\' + Math.random(); return false;';
	
	$value = array('captcha'=>'','captcha_code'=>'');
	
	//set needed onload for refresh JS
	$GLOBALS['egw']->js->set_onload('"document.getElementById(\'show_image\').src = \''.$GLOBALS['egw_info']['server']['webserver_url'].'/index.php?menuaction=etemplate.captcha_widget.show_image&sid=\' + Math.random(); return false"'
	);
	
	// sets audio icon link properties
	$audio_image_wig =& $widget->get_widget_by_name('etemplate/audio_icon.gif');
	$audio_image_wig['size'] = 'etemplate.captcha_widget.play_sound';
	
	// sects code text field to be needed
	$code_text_wig =& $widget->get_widget_by_name('captcha_code');
	$code_text_wig['needed'] = 1;

	return True;	// no extra label
}

Nathan_Gray-2 2009-06-26 15:45:58 UTC #2

So i went to $_POST[exec][captcha_code] directly. How do i get
[exec][captcha_code] value if the widget is is named ‘my_captcha’?

It looks like somehow the name of your widget is not being included in
the generated HTML, and not passed back. Could be an issue with the
template is set up, but I’m not sure. Maybe the name needs to be in
the template somewhere.
You should be ending up with $_POST[exec][my_captcha][captcha_code].

Nathan Gray
nathan at goarctic dot com

eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers

Randy_J_Houlahan_B.S 2009-06-26 22:37:48 UTC #3

It would appear you are correct. I tried a few things to include the name but no luck.
Thanks again I will try again in the morning with a fresh brain.

Ralf_Becker_6 2009-06-27 07:51:53 UTC #4

Hi Randy,

that www.phpcaptcha.org looks good - a lot better then my mathematical
captcha used in the contact form.

eTemplate remembers all fields (and types of them) of an eTemplate in an
array in the request object. If you use a separate eTemplate for your
widget or construct it within your widgets code, you only have to care
about that. Only problem can be, your post_process only gets called, if
it’s name is different from the name used in the template.

Date widget is a good example for that:

eg. name of date widget in eTemplate is date
it created input fields like date[str], date[H] and date[i]
eTemplate first processes these fields and then calls date_widgets
post_process with $value = array(‘str’=>‘2009-06-27’, ‘H’ => '16, ‘i’ =>
‘46’)
post_process then sets $value with what date it parses out of the
different fields

If you want to debug that a bit more, use a simple template with a few
fields and add a _debug_array(self::$request->to_process); before the
call to:

$this->process_show($content,self::$request->to_process,self::$name_vars,$type);

in etemplate/inc/class.etemplate.inc.php at line 410 in trunk.

Sorry for not being able to help more, but I’m too busy currently with
an other project and polishing our EPL packages.

Ralf

randy schrieb:

Hello Ralf && Nathan

I completed the captcha widget based on the www.phpcaptcha.org open source
code.

Some options that come with the code such as diff fonts and background
images wa not implemented yet.

One ugly thing I did is in the post_process I could not get the value_in
correctly (I believe). The name of the widget is what ever the creater
makes it but the text field the widget uses is named captcha_code.
$value_in would not ever return a value unless the widget itself was named
the same as the text field it uses.

So i went to $_POST[exec][captcha_code] directly. How do i get
[exec][captcha_code] value if the widget is is named ‘my_captcha’?

Thank You,

{
      $value_in =$_POST['exec']['captcha_code'];

  	if ($value_in=='' || !isset($value_in))
  	{
  		$loop=TRUE;
  		return false; 
  	}
  	
  	if ($this->img->getCode() != $value_in)
  	{

  		$tmpl->set_validation_error('captcha_code',lang(" Your code is incorrect
!!!"));
$loop=TRUE;
return false;
}
$value=$_POST[‘exec’][‘captcha_code’];

}//post process

function
pre_process($name,&$value,&$cell,&$readonlys,&$extension_data,&$tmpl)
{
  //sets main etemplate cell with data created in etemplate.captcha_widget
  $cell['type'] = 'template';
  $cell['name'] = 'etemplate.captcha_widget';
  $widget =& new etemplate('etemplate.captcha_widget');
  $widget->no_onclick = True;
  $cell['obj'] = &$widget;


  // sets refresh icon link properties
  $refresh_image_wig =&
$widget->get_widget_by_name(‘etemplate/refresh.gif’);
$refresh_image_wig[‘size’] = ‘etemplate.captcha_widget.show_image’;
$refresh_image_wig[‘onclick’]=‘
document.getElementById(‘show_image’).src =
’’.$GLOBALS[‘egw_info’][‘server’][‘webserver_url’].’/index.php?menuaction=etemplate.captcha_widget.show_image&sid=’
Math.random(); return false;’;
$value = array('captcha'=>'','captcha_code'=>'');

//set needed onload for refresh JS
$GLOBALS[‘egw’]->js->set_onload(’"document.getElementById(‘show_image’).src

‘’.$GLOBALS[‘egw_info’][‘server’][‘webserver_url’].’/index.php?menuaction=etemplate.captcha_widget.show_image&sid=’
Math.random(); return false"’
);
// sets audio icon link properties
$audio_image_wig =&
$widget->get_widget_by_name(‘etemplate/audio_icon.gif’);
$audio_image_wig[‘size’] = ‘etemplate.captcha_widget.play_sound’;
  // sects code text field to be needed
  $code_text_wig =& $widget->get_widget_by_name('captcha_code');
  $code_text_wig['needed'] = 1;

  return True;	// no extra label
}

–
Ralf Becker
Director Software Development

Stylite GmbH
[open style of IT]

Morschheimer Strasse 15
67292 Kirchheimbolanden

fon +49 (0) 6352 70629-0
fax +49 (0) 6352 70629-30
mailto: rb@stylite.de

www.stylite.de
www.egroupware.org

Geschäftsführer Andre Keller, Gudrun Müller,
Nigel Vickers und Ralf Becker
Registergericht Kaiserslautern HRB 30575
Umsatzsteuer-Id / VAT-Id: DE214280951

eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers

Randy_J_Houlahan_B.S 2009-07-01 12:26:18 UTC #5

Thanks for the help. Using your debugging suggestion led me to discover that I needed to name my loaded template in the size field and not the name field.

$cell[‘size’] = $cell[‘name’];

New Problem. Sigh … never ending widget LOL.

My captcha widget make calls directly to functions within the widget class thus when using in sitemgr user anonymous needs access to etemplate. I was wide open to some mischief if someone stumbled upon my root url and etemplate folder. The anon user could modify etemplates. I created a small hack for protection in the mean time.

I put the captcha class in the same file at the captcha widget as well. I have never seen 2 class in one file but I was not sure the best spot for it given it was used only by etemplate and it is a third party class. Any suggestions?

Any suggestions on how the anon user can make calls to etamplate.captcha without actually editing any templates if they get into the editor?

Thanks

Randy

ralfbecker:

Hi Randy,

that www.phpcaptcha.org looks good - a lot better then my mathematical
captcha used in the contact form.

eTemplate remembers all fields (and types of them) of an eTemplate in an
array in the request object. If you use a separate eTemplate for your
widget or construct it within your widgets code, you only have to care
about that. Only problem can be, your post_process only gets called, if
it’s name is different from the name used in the template.

Date widget is a good example for that:

eg. name of date widget in eTemplate is date

it created input fields like date[str], date[H] and date[i]

eTemplate first processes these fields and then calls date_widgets
post_process with $value = array(‘str’=>‘2009-06-27’, ‘H’ => '16, ‘i’ =>
‘46’)

post_process then sets $value with what date it parses out of the
different fields

If you want to debug that a bit more, use a simple template with a few
fields and add a _debug_array(self::$request->to_process); before the
call to:

$this->process_show($content,self::$request->to_process,self::$name_vars,$type);

in etemplate/inc/class.etemplate.inc.php at line 410 in trunk.

Sorry for not being able to help more, but I’m too busy currently with
an other project and polishing our EPL packages.

Ralf

randy schrieb:
Hello Ralf && Nathan

I completed the captcha widget based on the www.phpcaptcha.org open source
code.

Some options that come with the code such as diff fonts and background
images wa not implemented yet.

One ugly thing I did is in the post_process I could not get the value_in
correctly (I believe). The name of the widget is what ever the creater
makes it but the text field the widget uses is named captcha_code.
$value_in would not ever return a value unless the widget itself was named
the same as the text field it uses.

So i went to $_POST[exec][captcha_code] directly. How do i get
[exec][captcha_code] value if the widget is is named ‘my_captcha’?

Thank You,

{
      $value_in =$_POST['exec']['captcha_code'];

  	if ($value_in=='' || !isset($value_in))
  	{
  		$loop=TRUE;
  		return false; 
  	}
  	
  	if ($this->img->getCode() != $value_in)
  	{

  		$tmpl->set_validation_error('captcha_code',lang(" Your code is incorrect
!!!"));
$loop=TRUE;
return false;
}
$value=$_POST[‘exec’][‘captcha_code’];

}//post process

function
pre_process($name,&$value,&$cell,&$readonlys,&$extension_data,&$tmpl)
{
  //sets main etemplate cell with data created in etemplate.captcha_widget
  $cell['type'] = 'template';
  $cell['name'] = 'etemplate.captcha_widget';
  $widget =& new etemplate('etemplate.captcha_widget');
  $widget->no_onclick = True;
  $cell['obj'] = &$widget;


  // sets refresh icon link properties
  $refresh_image_wig =&
$widget->get_widget_by_name(‘etemplate/refresh.gif’);
$refresh_image_wig[‘size’] = ‘etemplate.captcha_widget.show_image’;
$refresh_image_wig[‘onclick’]=‘
document.getElementById(‘show_image’).src =
’’.$GLOBALS[‘egw_info’][‘server’][‘webserver_url’].’/index.php?menuaction=etemplate.captcha_widget.show_image&sid=’
Math.random(); return false;’;
$value = array('captcha'=>'','captcha_code'=>'');

//set needed onload for refresh JS
$GLOBALS[‘egw’]->js->set_onload(’"document.getElementById(‘show_image’).src

‘’.$GLOBALS[‘egw_info’][‘server’][‘webserver_url’].’/index.php?menuaction=etemplate.captcha_widget.show_image&sid=’
Math.random(); return false"’
);
// sets audio icon link properties
$audio_image_wig =&
$widget->get_widget_by_name(‘etemplate/audio_icon.gif’);
$audio_image_wig[‘size’] = ‘etemplate.captcha_widget.play_sound’;
  // sects code text field to be needed
  $code_text_wig =& $widget->get_widget_by_name('captcha_code');
  $code_text_wig['needed'] = 1;

  return True;	// no extra label
}
–
Ralf Becker
Director Software Development

Stylite GmbH
[open style of IT]

Morschheimer Strasse 15
67292 Kirchheimbolanden

fon +49 (0) 6352 70629-0
fax +49 (0) 6352 70629-30
mailto: rb@stylite.de

www.stylite.de
www.egroupware.org

Geschäftsführer Andre Keller, Gudrun Müller,
Nigel Vickers und Ralf Becker
Registergericht Kaiserslautern HRB 30575
Umsatzsteuer-Id / VAT-Id: DE214280951

eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers

Ralf_Becker_6 2009-07-01 13:16:07 UTC #6

have a look for link_widget::ajax_search().

It uses a menuaction=validapp.link_widget.ajax_search.etemplate, which
xajax.php transforms into etemplate.link_widget.ajax_search()

Ralf

randy schrieb:

Thanks for the help. Using your debugging suggestion led me to discover that
I needed to name my loaded template in the size field and not the name
field.

$cell[‘size’] = $cell[‘name’];

New Problem. Sigh … never ending widget LOL.

My captcha widget make calls directly to functions within the widget class
thus when using in sitemgr user anonymous needs access to etemplate. I was
wide open to some mischief if someone stumbled upon my root url and
etemplate folder. The anon user could modify etemplates. I created a small
hack for protection in the mean time.

I put the captcha class in the same file at the captcha widget as well. I
have never seen 2 class in one file but I was not sure the best spot for it
given it was used only by etemplate and it is a third party class. Any
suggestions?

Any suggestions on how the anon user can make calls to etamplate.captcha
without actually editing any templates if they get into the editor?

Thanks

Randy

ralfbecker wrote:
Hi Randy,

that www.phpcaptcha.org looks good - a lot better then my mathematical
captcha used in the contact form.

eTemplate remembers all fields (and types of them) of an eTemplate in an
array in the request object. If you use a separate eTemplate for your
widget or construct it within your widgets code, you only have to care
about that. Only problem can be, your post_process only gets called, if
it’s name is different from the name used in the template.

Date widget is a good example for that:

eg. name of date widget in eTemplate is date

it created input fields like date[str], date[H] and date[i]

eTemplate first processes these fields and then calls date_widgets
post_process with $value = array(‘str’=>‘2009-06-27’, ‘H’ => '16, ‘i’ =>
‘46’)

post_process then sets $value with what date it parses out of the
different fields

If you want to debug that a bit more, use a simple template with a few
fields and add a _debug_array(self::$request->to_process); before the
call to:

$this->process_show($content,self::$request->to_process,self::$name_vars,$type);

in etemplate/inc/class.etemplate.inc.php at line 410 in trunk.

Sorry for not being able to help more, but I’m too busy currently with
an other project and polishing our EPL packages.

Ralf

randy schrieb:
Hello Ralf && Nathan

I completed the captcha widget based on the www.phpcaptcha.org open
source
code.

Some options that come with the code such as diff fonts and background
images wa not implemented yet.

One ugly thing I did is in the post_process I could not get the value_in
correctly (I believe). The name of the widget is what ever the creater
makes it but the text field the widget uses is named captcha_code.
$value_in would not ever return a value unless the widget itself was
named
the same as the text field it uses.

So i went to $_POST[exec][captcha_code] directly. How do i get
[exec][captcha_code] value if the widget is is named ‘my_captcha’?

Thank You,

{
      $value_in =$_POST['exec']['captcha_code'];

  	if ($value_in=='' || !isset($value_in))
  	{
  		$loop=TRUE;
  		return false; 
  	}
  	
  	if ($this->img->getCode() != $value_in)
  	{

  		$tmpl->set_validation_error('captcha_code',lang(" Your code is
incorrect
!!!"));
$loop=TRUE;
return false;
}
$value=$_POST[‘exec’][‘captcha_code’];

}//post process

function
pre_process($name,&$value,&$cell,&$readonlys,&$extension_data,&$tmpl)
{
  //sets main etemplate cell with data created in
etemplate.captcha_widget
$cell[‘type’] = ‘template’;
$cell[‘name’] = ‘etemplate.captcha_widget’;
$widget =& new etemplate(‘etemplate.captcha_widget’);
$widget->no_onclick = True;
$cell[‘obj’] = &$widget;
  // sets refresh icon link properties
  $refresh_image_wig =&
$widget->get_widget_by_name(‘etemplate/refresh.gif’);
$refresh_image_wig[‘size’] = ‘etemplate.captcha_widget.show_image’;
$refresh_image_wig[‘onclick’]=‘
document.getElementById(‘show_image’).src =
’’.$GLOBALS[‘egw_info’][‘server’][‘webserver_url’].’/index.php?menuaction=etemplate.captcha_widget.show_image&sid=’

Math.random(); return false;’;

$value = array(‘captcha’=>’’,‘captcha_code’=>’’);

//set needed onload for refresh JS

$GLOBALS[‘egw’]->js->set_onload(’"document.getElementById(‘show_image’).src

‘’.$GLOBALS[‘egw_info’][‘server’][‘webserver_url’].’/index.php?menuaction=etemplate.captcha_widget.show_image&sid=’

Math.random(); return false"’
);

// sets audio icon link properties
$audio_image_wig =&
$widget->get_widget_by_name(‘etemplate/audio_icon.gif’);
$audio_image_wig[‘size’] = ‘etemplate.captcha_widget.play_sound’;

// sects code text field to be needed
$code_text_wig =& $widget->get_widget_by_name(‘captcha_code’);
$code_text_wig[‘needed’] = 1;

return True; // no extra label
}
–
Ralf Becker
Director Software Development

Stylite GmbH
[open style of IT]

Morschheimer Strasse 15
67292 Kirchheimbolanden

fon +49 (0) 6352 70629-0
fax +49 (0) 6352 70629-30
mailto: rb@stylite.de

www.stylite.de
www.egroupware.org

Geschäftsführer Andre Keller, Gudrun Müller,
Nigel Vickers und Ralf Becker
Registergericht Kaiserslautern HRB 30575
Umsatzsteuer-Id / VAT-Id: DE214280951

eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers

–
Ralf Becker
Director Software Development

Stylite GmbH
[open style of IT]

Morschheimer Strasse 15
67292 Kirchheimbolanden

fon +49 (0) 6352 70629-0
fax +49 (0) 6352 70629-30
mailto: rb@stylite.de

www.stylite.de
www.egroupware.org

Geschäftsführer Andre Keller, Gudrun Müller,
Nigel Vickers und Ralf Becker
Registergericht Kaiserslautern HRB 30575
Umsatzsteuer-Id / VAT-Id: DE214280951

eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers