Captcha Number Different In User Info Block & Modules

emmaphp · Worker Joined: Aug 22, 2006 Posts: 175

Hi everyone,

I notice that on one of my older websites using Raven's RavenNuke(tm) v2.02.02 Distro, that the Site Info Block is displaying a different Captcha Security Number than in the New User Registration Module or the Registered Users log in Module.

Firstly, I am interested to learn why/how the PHPNuke system/software is generating 2 different numbers at the same instance.

Also, I would be grateful if someone would advise me how to begin eliminating this problem.

For your information, I have confirmed the correct security number is that being displayed in both the modules (because using this number allows for a user to successfully sign in to their account), while the numbers displayed in the Site Info Block never appear to be relevant/correct.

I am not sure if this information is of help, but when I try to check the URL for both the different Security Numbers being displayed, (by using Firefox and right clicking and selecting properties), they both appear to be coming from the SAME URL,

Only registered users can see links on this board!
Get registered or login to the forums!

As ever, thanks in advance everyone.

Rolling Eyes

evaders99 · Moderator Joined: Apr 30, 2004 Posts: 2853

RavenNuke uses some new CAPTCHA code. The older Site Info block probably uses the original phpNuke CAPTCHA. You'd have to modify your code to work with the new system. I don't know it off-the-top, but check your Your_Account code for it

emmaphp · Worker Joined: Aug 22, 2006 Posts: 175

Thanks for the reply Evaders99,

To confirm, both Captcha images being displayed are of the 'older' style/type.

To clarify, they have a Grey colored background with the uniform chequered/block patterning and are black numbers (in a font akin to Ariel). They are not the type/style used in the latest RavenNuke Version 2.10.01. with multi-colored lines behind the various sized alphabetical characters/letters.

I hope someone (else) can assist further with resolving this matter.

Thanks guys and gals.

Smile

bobbyg · Posted: Mon Dec 10, 2007 12:50 am

I am not sure but you may find what you need in this post:

Only registered users can see links on this board!
Get registered or login to the forums!

There is a link to code in his comments.

jakec · Posted: Mon Dec 10, 2007 7:23 am

Before you go to the Your Accout login page, or Registration page, can you login through the User Info block?

I think what may be happening is that the User Info block is generating a random number and then also the Login/registration page is creating another random number which superseeds the first.

emmaphp · Worker Joined: Aug 22, 2006 Posts: 175

Hi jakec,

Thanks for your last reply and for addressing this matter.

As my original post explained, the Site Info Block is displaying a different Captcha Security Number than in the New User Registration Module or the Registered Users log in Module.

Moreover, for your information, I have confirmed the correct security number is that being displayed in both the modules (because using this number allows for a user to successfully sign in to their account), while the numbers displayed in the Site Info Block never appear to be relevant/correct.

So in other words, if I try to sign in to an account using the User Info block and the security number that is being displayed in it, I am not able to log in.

Any further thoughts/advise?

jakec · Posted: Mon Dec 10, 2007 1:21 pm

Would you be able to PM me your site details, just the address and maybe a test account. I'll pop on over and take a peek, just to make sure I am understanding you correctly.

I'll also try some checks my end to see if I can replicate the problem.

montego · Posted: Mon Dec 10, 2007 7:32 pm

Just so everyone knows, the new captcha only came in with RavenNuke 2.10.00, not 2.02.02. If you are on 2.10.x and you are using a Site Info block that is NOT coded to work with the new captcha, you will see two different captchas (as Evaders was eluding to).

bobbyg · Posted: Sat Dec 15, 2007 12:43 pm

Only registered users can see links on this board!
Get registered or login to the forums!

Would this code solve her problem with the captcha in 2.02.02

montego · Posted: Tue Dec 18, 2007 5:34 am

bobbyg, there are about three unique versions of the security code found within RavenNuke. The code I am showing may work just fine, but there are numerous examples within RavenNuke of the same...

emmaphp · Worker Joined: Aug 22, 2006 Posts: 175

Hi everyone,

An update to my original posting:

I notice that on one of my older websites using Raven's RavenNuke(tm) v2.02.02 Distro, that the Site Info Block is displaying a different Captcha Security Number than in the New User Registration Module or the Registered Users log in Module.

Unlike the original post I made here, if you sign in using the Site Info Block using the Captcha Security Number displayed in the Site Info Block, then sign in is successful.

If you sign in using the Registered Users log in Module using the Captcha Security Number displayed in the Registered Users log in Module, then sign in is successful.

However, you are not able to use the Captcha Security Number displayed in the Site Info Block and sign in using the Registered Users log in Module or vice verse.

The point that I originally observed and that I would appreciate an answer to is this:

Observation:

I note that although the Site Info Block is displaying a different Captcha Security Number than in the New User Registration Module or the Registered Users log in Module, I have identified the URL for both the different Security Numbers being displayed, (by using Firefox and right clicking and selecting properties), but they both appear to be coming from the SAME URL.

Of course there is a slight difference in the URL's, because the final part of the URL is whatever the displayed Captcha Security Number is. So for example, if the Captcha Security Number is 123456, then the URL is:

Only registered users can see links on this board!
Get registered or login to the forums!

But if the Captcha Security Number is 654321, then the URL is:

Only registered users can see links on this board!
Get registered or login to the forums!

The fundamental question:

How can 2 separate Captcha Security Numbers be generated on the 'same page' when that page is called from the server and they are apparently being pulled from the same URL?

jakec · Posted: Sun Feb 03, 2008 12:08 pm

When you upgrade your site you must ensure the files for the Siteinfo Block are overwritten, otherwise it will continue to display the old captcha.

jakec · Posted: Sun Feb 03, 2008 12:11 pm

Actually just re-read your post and I think I misunderstood you. Embarassed

So what you are saying is that the captcha image is the same, but the numbers are different?

jakec · Posted: Sun Feb 03, 2008 12:20 pm

I believe what you are seeing is correct. The captchas are generated as they are displayed from a different random number and therefore they can vary between the Site Info Block and the Your_Account module.

jakec · Posted: Sun Feb 03, 2008 12:23 pm

If you are worried that someone might get confused and enter the wrong number, I would suggest putting the Site Info block on the right, then if they click on the Your_Account link only Your_Account should be displayed and not blocks on the right, i.e. the Site Info block.

emmaphp · Worker Joined: Aug 22, 2006 Posts: 175

Hi Jakec,

Thanks for your intuitive suggestion as a remedy to the situation.

However it would be good if someone would advise me how it is possible for 2 diferent Captcha Security Numbers to be generated on the 'same page' when that page is called from the server and they are apparently being pulled from the same URL?

Moreover, advise on how I can make both Captcha Security Numbers identical would be much appreciated too.

jakec · Posted: Sun Feb 03, 2008 4:27 pm

The captcha is not the same as any normal static object like HTML calling an image, otherwise it would be easy to crack. Wink

The image is generated from code, which involves a random number being generated. If I remember rightly the random number is generated in both the Site Info block and also in the Your_Account module and therefore it is possible to get two separate numbers, because the code is called twice.

emmaphp · Worker Joined: Aug 22, 2006 Posts: 175

Hi again Jakec,

Now you are certainly understanding my way of thinking and why I would raise this question as to how 2 different Captcha Security Number images are shown, specifically when you call the Registered Users log in Module page and then compare the Captcha Security Number in the module to the User Info Block.

So now the question is, how can I make the 2 Captcha Security Numbers identical, thus eliminating any confusion, (without me having to resort to your solution of moving the User Info Block to the right side of the web site. I any case, this wouldn't work for me because I have all right side blocks showing with all modules, which was a request from my customer.

Please can anyone help?

Gremmie · Posted: Sun Feb 03, 2008 8:17 pm

Why would you want two different login blocks in the same page?

Regardless, don't be concerned about why there are two different numbers. It's because two different scripts are running, generating random numbers and sessions independently of each other. My advice: turn off one of the blocks.

emmaphp · Worker Joined: Aug 22, 2006 Posts: 175

emmaphp · Worker Joined: Aug 22, 2006 Posts: 175

emmaphp wrote:

Hi everyone,

An update to my original posting:

I notice that on one of my older websites using Raven's RavenNuke(tm) v2.02.02 Distro, that the Site Info Block is displaying a different Captcha Security Number than in the New User Registration Module or the Registered Users log in Module.

Unlike the original post I made here, if you sign in using the Site Info Block using the Captcha Security Number displayed in the Site Info Block, then sign in is successful.

If you sign in using the Registered Users log in Module using the Captcha Security Number displayed in the Registered Users log in Module, then sign in is successful.

However, you are not able to use the Captcha Security Number displayed in the Site Info Block and sign in using the Registered Users log in Module or vice verse.

The point that I originally observed and that I would appreciate an answer to is this:

Observation:

I note that although the Site Info Block is displaying a different Captcha Security Number than in the New User Registration Module or the Registered Users log in Module, I have identified the URL for both the different Security Numbers being displayed, (by using Firefox and right clicking and selecting properties), but they both appear to be coming from the SAME URL.

Of course there is a slight difference in the URL's, because the final part of the URL is whatever the displayed Captcha Security Number is. So for example, if the Captcha Security Number is 123456, then the URL is:

Only registered users can see links on this board!
Get registered or login to the forums!

But if the Captcha Security Number is 654321, then the URL is:

Only registered users can see links on this board!
Get registered or login to the forums!

The fundamental question:

How can 2 separate Captcha Security Numbers be generated on the 'same page' when that page is called from the server and they are apparently being pulled from the same URL?

Why would you want two different login blocks in the same page?

Regardless, don't be concerned about why there are two different numbers. It's because two different scripts are running, generating random numbers and sessions independently of each other. My advice: turn off one of the blocks.

montego · Posted: Mon Feb 04, 2008 6:26 am

emmaphp, not sure what you are trying to get at with your last two posts. Sad

However, here is the bottom line:

1. RavenNuke 2.02.x is using the old PHP-Nuke captcha system, which really doesn't protect you from automated registrations. That captcha has been broken by the spammers many years ago.

2. Number 1 above is why RavenNuke, starting with version 2.10.00, employs a newer captcha, and you see the same number on the page regardless.

3. Your fundamental question was answered. So, if you have another question, please feel free to ask it.

Regards,
montego