reCAPTCHA Plugin 2.8 Preview

  • Hey guys! I’m developing the next version of the official reCAPTCHA plugin. As most of you know, reCAPTCHA is a clever CAPTCHA method in which words that industry level OCR scanners couldn’t read are used to construct the CAPTCHAs (Meaning that home-made spam bots who also use OCR libraries to try to read the CAPTCHAs will have a harder time if not impossible). There are many libraries and plugins available for reCAPTCHA and I’m working on the WordPress one.

    It is available here. If you want to install it to try it out (Like I said this isn’t the final release yet) and already have the old reCAPTCHA plugin (Version 2.7 or below), the folder is named differently so you can simply upload this one, disable the old one and then enable this one (They also use different options variables so there won’t be any conflicts as far as that goes).

    I have added a whole ton of new features to this new version so far and I would really like to know what you guys think: suggestions, criticisms, whatever. You can find more information about the plugin here. Aside from having the ability to show reCAPTCHA for comment spam protection and for registration spam protection, there is also the ability to hide emails from spammers using MailHide, a spam protection method also by reCAPTCHA.

    This is NOT the final version of the plugin but I would like you guys to try it out if you don’t mind to tell me what you think.

    Included Stylesheet
    Among the few things that I have yet to work out are whether or not I should include a separate stylesheet for this plugin. I believe that having a separate stylesheet for this plugin (The one included in the plugin folder, recaptcha.css) is more intuitive since users will be able to easily edit it, after all it’s not that big or complicated. Ben Maurer, the software architect for reCAPTCHA that contacted me to write this plugin, thinks that it will just create more overhead and a performance impact. I know it will, but I believe that considering the trade-off between intuitiveness and the small overhead (Again it’s a small stylesheet), it will be negligible.

    Among the things included in the stylesheet are the styling of the classes which are (1) applied to hidden emails (If MailHide is enabled), (2) incorrect CAPTCHA notification, (3) styling of the registration form for when reCAPTCHA is to be shown there, and finally (4) the administration options. I believe 3 and 4 can be inlined (Like he wants) without any or little implications on user freedom (To style it how they want) but the reason I didn’t inline them was because some XHTML Standards-knowing people advised me against it. For 1 and 2 I can simply apply the class and explain somewhere which classes can style what so that they can edit their own theme’s stylesheet. I’m already doing this for the hidden email styling class emailrecaptcha, I’m stating it in the administration options.

    What do you guys think I should do: Not include the separate stylesheet for styling anything reCAPTCHA related all in one spot or not include it to remove any overhead that might occur (On my blog there seems to be none at all).

    Cross Site Scripting (XSS)
    For the MailHide sections I use regular expressions to scan for emails and hide them accordingly. Ben Maurer states:

    Apostrophes are allowed in email matching regex for MailHide, can it be used to escape out of Javascript?

    Unfortunately (And embarrassingly) I’m no expert in XSS and so I’d like to ask for your help. The regular expressions start at line 134 in function mh_insert_email. I did change the regular expressions after he told me this but I don’t know if they’re still vulnerable. I ran a vulnerability scanner on it by Acunetix and it didn’t find any risks, but I don’t know how reliable that is.

    Thanks again and sorry for the long post. Please tell me what you think!

Viewing 13 replies - 16 through 28 (of 28 total)
  • Thread Starter BlaenkDenum

    (@blaenkdenum)

    This is really weird. Might proxies have anything to do with it? Is the server or you behind any type of proxy? And yeah I’ve already signed up at your blog with a different address and it did indeed work. I thought it might have something to do with plugin priorities. Do you mind, please, listing all the activated plugins you have running? I don’t need an extensive description of each, just a text list of the names. I would like to see if any of them have any participation in the registration form. Also, that you know of, do any of them have anything to do with the registration form/process other than this plugin? Either way I would like to have the list. Thanks and sorry for the trouble! I am really confused seeing as how others are using it for exactly the same reason you are and they don’t seem to be having any problems.

    Do you by any chance have abnormal settings in your browser? i.e. turned off javascript, etc. Sorry once again for the problem, I will continue to investigate.

    The webserver is hosted in a conventional manner. I don’t believe it is proxied.

    Plugins:

    Dean’s Permalinks Migration 1.0
    dTabs 1.2.2
    Get Custom Field Values 2.1
    Inline Google Maps 5.10
    Nice Archive 1.4
    reCAPTCHA 2.8
    Spam Karma 2 – Reloaded 2.1 b4
    WP-Cron 1.4
    WP-Cron-Mail
    WP-DBManager

    I don’t believe any of these have an impact on registration.

    The problem (being able to register for the blog without completing the reCAPTCHA) is apparent in a range of Browsers (IE on Windows, Firefox/Safari on OSX). There are no special settings on any of them.

    When I tested it in IE it does work in the sense that you can complete a registration using the reCAPTCHA box, but also you can complete the registration just by leaving it blank too.

    Thread Starter BlaenkDenum

    (@blaenkdenum)

    Hey if you could respond a little quicker I would really appreciate it, maybe you can give me your email address? Mine is jorg…@gmail.com (Click the three dots to reveal it).

    I have updated it. First disable reCAPTCHA and remove the recaptcha folder in your plugins folder. This new version (RC5) is now wp-recaptcha so it’ll be a different folder.

    Anyways, this time it should at least check for when the user leaves the field completely blank. It’s working on my site try for yourself. If not, then the problem will be that it’s not even hooking onto those actions or something, or something is conflicting with it. I will continue to investigate, let me know how it goes.

    You can get the new version, RC5, here.

    Thread Starter BlaenkDenum

    (@blaenkdenum)

    IGNORE THE ABOVE POST: Only the part about RC5. Do take into consideration everything else including the email. The installation process is the same as for RC5 though, meaning you have to disable recaptcha and delete it then upload this one (wp-recaptcha).

    Instead get RC6. If this doesn’t fix it, I don’t know what will. It should now check for both if you leave it empty and if it’s wrong. It’s always worked for me but this new way uses a different hook (registration_errors) hopefully this works fine, if not please let me know!

    Get RC6.

    Fixed ??

    Thanks for all the hard work!

    Thread Starter BlaenkDenum

    (@blaenkdenum)

    Awesome! Now I can go live! ?? I was getting worried there haha. Alright cool, no problem man! The plugin’s page is at https://www.blaenkdenum.com/wp-recaptcha/ and on www.ads-software.com it will be available at: https://www.ads-software.com/extend/plugins/wp-recaptcha/

    Hi, im using wordpress 2.5.1 and have installed recaptcha 2.8.1, i have input the keys, but the form doesnt show up in the comments area and you cant submit comments, any ideas? ??

    Interesting, i changed to the wordpress default theme and it shows up, but not in the theme i use ??

    ok the theme i use didnt have <?php do_action(‘comment_form’, $post->ID); ?> before the end of the form </form> so i added it and recaptcha showed up, might be worth adding that to the documantation ??

    Thread Starter BlaenkDenum

    (@blaenkdenum)

    @KodeStart: Thanks, I didn’t check this thread until now. I’m glad you were able to figure it out on your own and I will add it to the documentation since I figured that most if not all themes had that. I will though, thanks again for the heads up!

    Thoughts on recaptcha plugin in general:

    Regarding making the CSS a separate stylesheet but avoiding the performance hit: I would suggest making it a separate file, but then using PHP to insert its contents directly into the <head> of the page. That’s if you want to avoid the hit from the additional HTTP request.

    (I’m trying to figure out a similar issue with a plugin of mine that includes _two_ stylesheets!)

    Separately, I take issue with the fact that you think you can either be XHTML compliant _or_ require JavaScript. You can do both if the JavaScript degrades gracefully. (I assume the XHTML non-compliance involves a “target” attribute?)

    You can make it so that if there is no JavaScript, clicking the Submit actually takes you to a separate page with the Captcha. Yes, a popup is cleaner, but that’s my point — JS can make things neater, but is not required for basic function.

    Otherwise a great plugin!

    If I had the know-how I would make a Recaptcha plugin for Spam Karma ??

    Thread Starter BlaenkDenum

    (@blaenkdenum)

    The reason it’s either no XHTML compliance or no support for non-Javascript users is not really in my hands as far as I know. I didn’t write recaptchalib.php but I had to modify it to be XHTML compliant. Basically recaptchalib uses an iframe to display the form if Javascript is disabled, and according to the XHTML 1.0 Strict validator, iframe isn’t a valid tag ?? Take a look at recaptchalib.php starting on line 123 to see what I mean. If you know a way around this or something please let me know.

    As for the head idea, that’s a possibility but I think that’d be too messy, I’d have to ask more people what they think about that first, thanks for the idea though.

    I believe there is a way to get both XHTML (1.0 Transitional) compliance [the iframe does prevent validating XHTML 1.0 Strict] and save functionality for non-Javascript users. I’ve detailed it here:

    Making the reCAPTCHA WordPress Plugin Validate

    This solution is out of the plugin developer’s hands, however: it requires changes to both the plugin itself and the WordPress comments template.

    Hope this helps somebody.

Viewing 13 replies - 16 through 28 (of 28 total)
  • The topic ‘reCAPTCHA Plugin 2.8 Preview’ is closed to new replies.