Wading Back In ... to the Good and the Not So Good

(Submitted Mon, 2007-01-22 02:49) | | | |

After having taken a few unexpected months off from most Drupal activities, I've been dipping my toes back into the water this week.

It's great to see that Drupal 5.0 has been officially let loose into the world. I'd played with and tested some of the pre-release dev versions, so it isn't entirely new territory for me, but I've still got a bit of catching up to do. I'm working on the first production site with 5.0, and I'm loving it. Cheers to everyone who has worked so hard to make it happen.

So that's the good.

The "not so good" is the spam on this pre-5.0 era blog. Lots of it! I use the captcha module for anonymous comments, and have been accustomed to the empty comment spam phenomenon (see also here and here)

It looks as though this may have been addressed in a fix to the comment module itself as of Dec. 12, 2006. However, I'd already used the following hack to the comment module in the comment_validate($edit) function:

if(trim($edit['comment']) == '')
{
form_set_error('comment', t('You have to supply some content in the comment.'));
}

So far that seems to be doing the trick.

But it wasn't the empty comment spam that got my attention, it was all the real "full of links" variety of spam that this site had accrued in my absence.

My best guess is that this is due to a bug in the captcha module, for which I've submitted an issue. I'm sure that I've read about this particular problem (defeating captcha with a space) before, however -- so I surprised to not be able to find mention of it in the module's issue queue or by searching the drupal.org forums. Installed the latest and greatest in the 4.7.x series of the module, but still no joy.

Anyone know what the deal is with that? Like I say, I've been a bit out of touch for awhile. There's always Akismet, of course.

Submitted by Anonymous (not verified) on Mon, 2007-01-22 17:35.

Welcome back :)

Submitted by zcEqUr on Tue, 2007-08-07 16:02.
Submitted by zGwwxq on Mon, 2007-08-13 15:23.

If You

Submitted by dalin (not verified) on Tue, 2007-01-23 01:02.

Many spam bots will just guess for a math captcha field, inserting a random number. So according to the odds, 1 in 20 will get through.

Math captcha is not foolproof, but combined with commentmail, it's good enough for me.

Submitted by drawk on Tue, 2007-01-30 22:56.

As it turns out, there was an exploit with the captcha module by which it could be easily defeated by spammers.

See security notice Captcha - response validation bypass.

I ended up in a discussion with Heine about a bypass that is fairly trivial to use. Captcha has been updated to prevent the exploit.

New versions:

Captcha 4.7.x-1.2
Captcha 5.x-1.1

Post new comment

The content of this field is kept private and will not be shown publicly.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd> <blockquote>
  • Lines and paragraphs break automatically.
  • You may post code using <code>...</code> (generic) or <?php ... ?> (highlighted PHP) tags.
More information about formatting options

Hosted By Dreamhost.com


Did you know?

You don't need to register at WWDD to post comments.

Isn't it annoying when you want to comment on an article, but don't want to go through the hassle of creating yet-another-user account at yet-another-website?

Feel free to comment anonymously, or log in with your username@drupal.org account.

We won't mind a bit.