Category: Spam protection (Anti-bot CAPTCHA)

!Retested

Fixed in 15.0alpha (REV 57761)

!Bug

When enabling CAPTCHA Questions, the following error is displayed below the comment entry text area, in stead of the CAPTCHA and the submit control buttons.

-+Fatal error: Call to undefined method Captcha_Questions::getService() in [[snip tiki path]/lib/captcha/captchalib.php on line 179+-

It is not possible to submit a comment, since the submit button is not displayed.

The bug appears for comments in all features accepting comments.

!Reproduction

!!Enable advanced preference filters

tiki-admin.php

!!Enable comments for wiki pages

tiki-admin.php?page=comments

Enable "Comments below wiki pages"

Set "Allow comments per wiki page" = "Enable (default On)"

!!Enable captcha questions

tiki-admin.php?page=security

Go to tab "Spam protection"

Enable "Anonymous editors must enter anti-bot code (CAPTCHA)"

Enable "CAPTCHA Questions"

Enter into "CAPTCHA Questions and answers":

q1:a1
q2:a2
q3:a3
q4:a4

!!Set permissions for Anonymous users

tiki-objectpermissions.php

Allow for Anonymous:

*comments/Can post new comments (tiki_p_post_comments)
*comments/Can read comments (tiki_p_read_comments)
*wiki/Can view wiki comments (tiki_p_wiki_view_comments)

!!Enable comments for HomePage

Edit the page, and save.

!!Test

Log out, and see the error message below the comment entry text area.

(End of reproduction)

{syntax type="tiki" editor="plain"}
At tiki-admin.php?page=login admin can set "CAPTCHA questions and answers".

A question with a single answer.
-+What is the capital of France:Paris+-

However this is fine for ===unique=== language Tikis.
If you use French+English+German you should be able to ask the question and have an answer depending on the language displayed.

After deleting spam, we can ((doc:Ban)) users but this should be easier/faster.


Ex.: after deleting a comment or rollbacking a wiki revision, have a link to ban the user.

Or maybe a "ban user" link from tiki-adminusers.php

Comments are good in this respect

Using services like http://www.stopforumspam.com can help to identify and handle spam-related mail addresses trying to create an account.

stopforumspam provides an API to test a mail address against a "known spammer"-list. This could be used to warn an admin before confirming an account.

This tracker is made to help filtering and sorting the features vs categories vs options we need to tag a bug/regression/wish with.

When attempting to register a new user in a 12.x tiki site (svn updated to recent revisions as of today {sign user="xavi" datetime="2016-03-03T09:31:44+00:00"}), users see this image after filling in the form with all required fields (and images from the recaptcha test) and clicking at the register button:

Fatal error: Call to undefined function curl_init() in /path/tiki12svn/lib/captcha/Captcha_ReCaptcha20.php on line 49

We are getting a lot spam on current space and sooner or later, we need to move.

Also, the auto-responders are stuck on tikiwiki.org instead of tiki.org When we migrate, we can address this.

The old server is being shut down shortly.

See: ((tw:Community Mail Server))

Missing (12.x) or wrong (13.x) feedback to comment poster when Comments Moderation is on and post is not shown

However, in the show.t.o instance for 12.x, I couldn't get the same behavior I saw a few weeks in a 12.x in localhost.

Current issues reproduced in the show.t.o 12.x instance:
Adding a comment as anon to the homepage (with comments moderation enabled):
http://xavi-9794-5310.show.tikiwiki.org/tiki-index.php

{CODE()}
Notice: Array to string conversion in /var/www/xavi-9794-5310/vendor/bombayworks/zendframework1/library/Zend/Filter/Alnum.php on line 144
{CODE}

{CODE()}
Your comment was posted.

No object information provided.
{CODE}

In 13.x I saw the same output (without the initial array notice):
{CODE()}
Your comment was posted.

No object information provided.
{CODE}

This seems to be an error message:
{QUOTE()}
__No object information provided__
{QUOTE}

And "Your comment was posted." is a missleading information, since the comment is not visible yet (until moderation happens). So a better message could be shown in this case, something like:

"__Your comment was posted but is pending moderation, and until approval, it will not be shown__"

When viewing the page again, it says:
"There are no comments at this time."

when you would expect to see something like:

"__There are some comments hidden pending moderation__"
---
^ __And last, as registered users, there is no feedback of what happens in that tiki site that their comments are gone after clicking at "post".__ ^

{syntax type="tiki" editor="plain"}
When Tiki adds the antibot code to a form or table, there is no specific class assigned to the TD or TR. Sometime this results in odd UI (because sometimes the table is NORMAL, sometimes FORM, someimtes FORMCOLOR, etc.)

We were trying to have the new antibot captcha working in a Tiki site based on Tiki trunk (during TikiFestBarcelona2 - mid July 2010), were a user tracker was set to collect more information from users at registration time.

when we enabled zend new antibot-captcha , no antibot code was shown at registration time, because there seems to be some conflict with the user tracker.
Once the user tracker was disabled, the antibot-captcha was shown properly, etc.

----
Update: disaled the new zend antibot catpcha, in order to use the former simple captchaimage, but that one is not working either, if user tracker is on.

In earlier Tiki versions, the CAPTCHA for the registration was separate from other anti-bot protection. It was possible to have CAPTCHA protection for some areas (such as comments and trackers) but not other areas (such as registration).

I have several sites that use "Require Admin Approval" and/or passcode options for Registration, so the CAPTCHA is not needed.

In Tiki 6, CAPTCHA was made global -- there is no longer any way to have CAPTCHA support for some items, such as comments, but not other items (such as registration).

Please see:
http://www.wikimatrix.org/wiki/feature:nofollow
http://googleblog.blogspot.com/2005/01/preventing-comment-spam.html

When using OpenID + Registration CAPTCHA...
With Tiki 2.2...

I attempted to register using my OpenID:

#On the Login page, I entered my OpenID.
#My OpenID was validated and Tiki shows the page where I can either associate my OpenID with an existing Tiki account, or register as a new user.
#I completed the registration form (including the correct CAPTCHA), but Tiki keeps saying that the Anti-bot code was incorrect.

Additionally, the registration form presented with the OpenID __does not__:
*Display the password minimum requirements (such as number of characters).
*Allow for the selection of groups.


__Duplicate of {wish id=1505}__

Google ReCaptcha is displayed in english only.
This is wrong, it should use the selected language by the page (tiki) and be displayed in the corresponding language.

https://developers.google.com/recaptcha/docs/language

You can test and check at : http://bsfez-11581-6186.show.tikiwiki.org/tiki-register.php
Change the language, the recaptcha stays in english.

I couldn't find a related issue (registration / register => dogfood category) so I create this.

It is actually super hard to register at Tiki.org.
This is critical and should be fixed asap.

If you don’t enter correctly the captcha ''(this may also subject to a sub-bug because when I tested I paid attention to those too hard too read letters)'' you enter in a loop of error you can’t get out.

{img fileId="1276" thumb="box"}
{img fileId="1277" thumb="box"}
{img fileId="1278" thumb="box"}
{img fileId="1275" thumb="box"}

When the website was back I tried to login and got another error:
Error
Account requires administrator approval.

I had to validate and then to confirm email using tiki-adminusers.php.

This is very bad for new user willing to register and it ended with Tiki.org not being available.

On Tiki Security and Login admin control panels we have an option to display Captcha_questions.
This is working fine where Google re-captcha fail (and it fail) or if your user have issues with the internal Tiki captcha.

{img fileId="1782" thumb="box"}

But how do we do that ?

May be the easiest way is to perform a translation using the custom translation existing system, BEFORE the answer is verified.

Simple number case;
"Answer to submit, 3+4=:7" => "Combien font 3+4=:7",

Text case;
"In which country is the Liberty Statues: New York" => "Dans quelle ville trouve t'on la Tour Eiffel:Paris",

Translation being done before the verification allow a better multilingual and multi-cultural usage.

On Tiki23, when captcha is set to the original one (not Google) an image is displayed below an input field where you need to enter what you see on the image.

However with Select2 enable as soon as I change focus on the input field (click in it) the feedback message "No items to show" is displayed over the image the user should "read" hidden it.

Select2 is located here: Control panels, Features, Interface;
jQuery Select2 Select Boxes : enable
Select2 Sortable Multiselect : enable

Captcha is located at Control panels, Log in, Captcha.

See this screenshot (dev upload is broken) : https://ibb.co/h1pQz95

Here are some options
http://framework.zend.com/manual/en/zend.service.akismet.html
http://bad-behavior.ioerror.us/
http://antispam.typepad.com/
http://www.defensio.com/
http://mollom.com/

See: ((Spam Protection))

In Tiki 1.10, there is a feature to protect all emails against spam harvesters. Great.

1- Check that this protection is indeed powerful (so spammers can't get around it)

2- Have an option to show an image of the email when javascript is not available.

3- Extend this protection to [tiki-view_tracker_item.php?itemId=1147|the e-mail address in tiki-contact.php]

A form anonymous can fill is still very common and used in many website (tracker items, registration and contact form).
We are used to it for so many years that we don't see it, but for others, this is not a good image for Tiki.

On mobile and desktop it really look like unfinished work.
# The buttons colours are wrong:
* Submit should be primary
* Refresh captcha should be secondary
# Width and field should match.

{img fileId="1866" thumb="box"}

{img fileId="1867" thumb="box"}

There should be a note, only visible to tiki_p_admin that the anti-bot code is not currently here because the GD lib is not there.