diff --git a/docs/changelog/6.x.x.txt b/docs/changelog/6.x.x.txt
index a296502eb..243c72337 100644
--- a/docs/changelog/6.x.x.txt
+++ b/docs/changelog/6.x.x.txt
@@ -20,6 +20,8 @@
more powerful and will use slightly less memory.
- fix [ 1406210 ] 6.9 i18n in create.sql, previous.sql broken.
- fix [ 1410577 ] WebGUI::Session not included
+ - Strengthened security of Captcha validation.
+ - Added Captcha form control type.
6.8.6
- Added logic to deal with case sensitivity and whitespace problems in LDAP
diff --git a/lib/WebGUI/Auth/WebGUI.pm b/lib/WebGUI/Auth/WebGUI.pm
index 51ecdbe49..c387f72e6 100644
--- a/lib/WebGUI/Auth/WebGUI.pm
+++ b/lib/WebGUI/Auth/WebGUI.pm
@@ -169,13 +169,9 @@ sub createAccount {
}
my $i18n = WebGUI::International->new($self->session);
$vars->{'create.message'} = $_[0] if ($_[0]);
- my $storage = WebGUI::Storage::Image->createTemp($self->session);
- my ($filename, $challenge) = $storage->addFileFromCaptcha;
$vars->{useCaptcha} = $self->session->setting->get("webguiUseCaptcha");
if ($vars->{useCaptcha}) {
- $vars->{'create.form.captcha'} = WebGUI::Form::text($self->session,{"name"=>"authWebGUI.captcha", size=>6, maxlength=>6})
- .WebGUI::Form::hidden($self->session,{name=>"authWebGUI.captcha.validation", value=>Digest::MD5::md5_base64(lc($challenge))})
- .'
';
+ $vars->{'create.form.captcha'} = WebGUI::Form::Captcha($self->session,{"name"=>"authWebGUI.captcha"});
$vars->{'create.form.captcha.label'} = $i18n->get("captcha label","AuthWebGUI");
}
$vars->{'create.form.username'} = WebGUI::Form::text($self->session,{"name"=>"authWebGUI.username","value"=>$self->session->form->process("authWebGUI.username")});
@@ -211,7 +207,7 @@ sub createAccountSave {
$error = $self->error unless($self->validUsername($username));
if ($self->session->setting->get("webguiUseCaptcha")) {
- unless ($self->session->form->process('authWebGUI.captcha.validation') eq Digest::MD5::md5_base64(lc($self->session->form->process('authWebGUI.captcha')))) {
+ unless ($self->session->form->process('authWebGUI.captcha', "Captcha")) {
$error .= $i18n->get("captcha failure","AuthWebGUI");
}
}
diff --git a/lib/WebGUI/Form/Captcha.pm b/lib/WebGUI/Form/Captcha.pm
new file mode 100644
index 000000000..9e8292523
--- /dev/null
+++ b/lib/WebGUI/Form/Captcha.pm
@@ -0,0 +1,108 @@
+package WebGUI::Form::Captcha;
+
+=head1 LEGAL
+
+ -------------------------------------------------------------------
+ WebGUI is Copyright 2001-2006 Plain Black Corporation.
+ -------------------------------------------------------------------
+ Please read the legal notices (docs/legal.txt) and the license
+ (docs/license.txt) that came with this distribution before using
+ this software.
+ -------------------------------------------------------------------
+ http://www.plainblack.com info@plainblack.com
+ -------------------------------------------------------------------
+
+=cut
+
+use strict;
+use base 'WebGUI::Form::Text';
+use WebGUI::International;
+use WebGUI::Storage::Image;
+
+=head1 NAME
+
+Package WebGUI::Form::Captcha
+
+=head1 DESCRIPTION
+
+Creates a captcha form element that helps verify a human is submitting the form rather than a bot.
+
+=head1 SEE ALSO
+
+This is a subclass of WebGUI::Form::Text.
+
+=head1 METHODS
+
+The following methods are specifically available from this class. Check the superclass for additional methods.
+
+=cut
+
+#-------------------------------------------------------------------
+
+=head2 definition ( [ additionalTerms ] )
+
+See the super class for additional details.
+
+=head3 additionalTerms
+
+The following additional parameters have been added via this sub class.
+
+=head4 profileEnabled
+
+Flag that tells the User Profile system that this is a valid form element in a User Profile
+
+=cut
+
+sub definition {
+ my $class = shift;
+ my $session = shift;
+ my $definition = shift || [];
+ my $i18n = WebGUI::International->new($session,"Form_Captcha");
+ push(@{$definition}, {
+ formName=>{
+ defaultValue=>$i18n->get("formName")
+ },
+ profileEnabled=>{
+ defaultValue=>1
+ },
+ });
+ return $class->SUPER::definition($session, $definition);
+}
+
+#-------------------------------------------------------------------
+
+=head2 getValueFromPost ( )
+
+Returns a boolean indicating whether the string typed matched the image.
+
+=cut
+
+sub getValueFromPost {
+ my $self = shift;
+ my $value = $self->session->form->param($self->get("name"));
+ my $challenge = $self->session->scratch->get("captcha_".$self->get("name"));
+ $self->session->scratch->delete("captcha_".$self->get("name"));
+ return (lc($value) eq lc($challenge));
+}
+
+#-------------------------------------------------------------------
+
+=head2 toHtml ( )
+
+Renders a captcha field.
+
+=cut
+
+sub toHtml {
+ my $self = shift;
+ my $storage = WebGUI::Storage::Image->createTemp($self->session);
+ my ($filename, $challenge) = $storage->addFileFromCaptcha;
+ $self->set("size", 6);
+ $self->set("maxlength", 6);
+ $self->session->scratch->set("captcha_".$self->get("name"), $challenge);
+ $self->set("subtext", '
'.$self->get("subtext"));
+ return $self->SUPER::toHtml;
+}
+
+1;
+
diff --git a/lib/WebGUI/i18n/English/Form_Captcha.pm b/lib/WebGUI/i18n/English/Form_Captcha.pm
new file mode 100644
index 000000000..15512e60e
--- /dev/null
+++ b/lib/WebGUI/i18n/English/Form_Captcha.pm
@@ -0,0 +1,12 @@
+package WebGUI::i18n::English::Form_Captcha;
+
+our $I18N = {
+ 'formName' => {
+ message => q|Captcha|,
+ context => q|Captcha is an acronym, it cannot be translated.|,
+ lastUpdated => 1131394072,
+ },
+
+};
+
+1;