Subject: human validation on post comments

From: Travis Hein <[email-masked]>
Date: Sat, 18 Mar 2006 10:57:20 -0500

Hi,

my name is Travis, I am new to pgsql-www.

I have been integrating a component that will ask the user to enter the word 
in a dynamic image before their comments can be submitted.

I had resumed this work in progress from Gevik.

The current setup is the development site in my sandbox
http://travis.pgadmin.org

I was looking for feedback, and guidance for the following things:

- is the input validator being invoked on all the spots where it should be?
currently the comments feedback for the documentation, i know about.
validation is invoked from  /system/page/form.php
- currently the invalid human feedback page is a simple validation failed 
message, outside of portal look and feel.

and technical details (if they follow our best practices)

- there is a single table session_capture for managing remote ip, session, and 
the word used in the generated image.
- the validation script that manipulates dynamic image and session table are 
in a top level folder /validation
- gettext macro used for the messages displayed
- modify system/page.php
    to add validate case to action handler list
- modify system/page/form.php
    to send to our /validate handler, instead of /system/handleform.php
- modify the .htaccess 
    to pass /validationimage through to the /validation/validation_image.php

Then if things are looking ok, what and how is the process for integrating the 
enhancements back to the site.

looking forward to constructive comments,
Travis

---

From: Josh Berkus <[email-masked]>
Date: Sat, 18 Mar 2006 10:15:12 -0800

Travis,

> I have been integrating a component that will ask the user to enter the
> word in a dynamic image before their comments can be submitted.

Terrific!  I'm sure the people who clear the comments will have nice things to 
say.

The image is generated dynamically?   That's good -- the spammers are already 
working on systems that harvest static images from sites and match them 
against a database.  Grrrr.

-- 
Josh Berkus
Aglio Database Solutions
San Francisco

---

From: David Fetter <[email-masked]>
Date: Mon, 20 Mar 2006 21:42:34 -0800

On Sat, Mar 18, 2006 at 10:15:12AM -0800, Josh Berkus wrote:
> Travis,
> 
> > I have been integrating a component that will ask the user to
> > enter the word in a dynamic image before their comments can be
> > submitted.
> 
> Terrific!  I'm sure the people who clear the comments will have nice
> things to say.
> 
> The image is generated dynamically?   That's good -- the spammers
> are already working on systems that harvest static images from sites
> and match them against a database.  Grrrr.

Actually, they've already got one, and here's how it works:

1.  Put up a free porn site.
2.  Present somebody else's capcha image as an entry.
3.  Let the person see the porn if they've correctly cracked the
    capcha.
4.  Spam site.

The sad part of this one is that they don't have to crack any single
capcha system.  Instead, they've cracked the entire capcha process.

Cheers,
D
-- 
David Fetter <[email-masked]> http://fetter.org/
phone: +1 415 235 3778        AIM: dfetter666
                              Skype: davidfetter

Remember to vote!