RN v2.10.01 and CNBYA v4.2.2 with full Captcha security

Regular Joined: Mar 26, 2006 Posts: 87 Location: UK

Being the plodder I am, I'd been working on getting Captcha fully running with rn 2.10.00 + cnbya 4.4.2 only to find that rn's now at 2.10.01. Bang Head

Anyway, with a couple of extra tweaks, I got it all working with 2.10.01. Cool

I won't explain here exactly what I've done - just that captcha works on the cnbya side of things now, plus I fixed a couple of other issues.

If there's an admin from this site who would put my test site through it's paces, please pm me and I'll send a link to the site. If you then create an account, I'll promote it and you'll receive an HTTPAuth p/w.

If you find what I've done acceptable, I'll post the edits.

Oh - my web-host can run a little slow at times, so don't expect too easy a ride. Razz

Involved Joined: Apr 22, 2006 Posts: 356

I would love to see what you did as I am trying to use it on a site as well.

Regular Joined: Dec 28, 2004 Posts: 94

Well done fade, I've been battling at this for a while now on and off.

Was getting nowhere.

Hope this gets a rubber stamp and posted.

Trub

Posted: Fri Jun 01, 2007 1:03 pm

Well, the admins don't seem interested so anyone interested in trying out what I've done click Only registered users can see links on this board! Get registered or login!. You'll find three test sites; a basic install of rn2.10.01, a basic install of rn2.10.01 with cnbya4.2.2 and a basic install of rn2.10.01 with cnbya4.2.2 and fixes so you compare the differences.

If you create an account on any of the sites, you will automatically be activated on the other two. Please use the same username as in this forum.
(Edit: If you want to see the differences between the three user registration routines, create 'your_username' on site 1 and 'your_username_2' and 'your_username_3' on sites 2 and 3 respectively'.)

Admin rights will be granted on a 1-by-1 basis for those who want it.

Good luck. Groovy

My host's severs are down at the moment so the above link won't take you anywhere. Crying or Very sad

(back up now Very Happy

)

Posted: Fri Jun 01, 2007 1:11 pm

It's not that we have no interest, many of us have our own sites to monitor as well as performing admin and/or moderation duties on many other sites as well as undertaking private work and our own little projects, plus a million other things like eating and breathing so please do not be offended that no one has jumped at this opportunity.

Having an admin log in would tell us nothing about the code construction or data flow which is far more important. It was only through our work with RN that we (actually Montego) discovered a flaw in user registration which still persists in many other versions and forks - the fact that something works doesnt mean it works as well as it could or is secure.

I would love to take a look myself but sadly, I just simply have far too many other things on at the moment.

Posted: Fri Jun 01, 2007 1:57 pm

No offence intended, was just hoping that someone would give it the once over to ensure I hadn't introduced any security risks in it's current state.

Posted: Fri Jun 01, 2007 2:14 pm

Not a problem, I just wish I had time to take a look myself Sad

registered · Posted: Sat Jun 02, 2007 8:04 pm

I wanna take a look. I am no admin, but its a task I been meaning to do myself so I am eager to see this get released.

IMO you don't really need any admins approval, just do your best to provide support for your tweak and let the cards fall where they may.

registered · Posted: Tue Jun 05, 2007 6:54 am

Quote:

to ensure I hadn't introduced any security risks in it's current state.

That, unfortunately, would take reviewing the code. Since I have no first-hand experience with the CNBYA code, it would just take me way to much time to review. Sorry about that.

Posted: Fri Jun 08, 2007 8:27 pm

could I get a copy of it when you release it?

Posted: Fri Jun 08, 2007 8:43 pm

kevinkap wrote:

could I get a copy of it when you release it?

Did you read my 2nd post in this thread? There is a link to the test sites where you'll find a file called rn_cnbya.zip in the downloads module in the 3rd site. The zip contains the files I edited and some rudimentary instructions.

Let me know how you get on.

Posted: Fri Jun 08, 2007 8:58 pm

My bad, I did not go to all the sites. I have it now. I will ask this while I am waiting on activation e-mail. Does your version add the users real name to the profile when it is required for registration? Also does it send the users real name to the admin in the notification e-mail, as the copy I have now does not do either. I have looked at it but not sure where to fix it at.

Thanks for your hard work!!

Posted: Fri Jun 08, 2007 10:39 pm

kevinkap wrote:

My bad, I did not go to all the sites. I have it now. I will ask this while I am waiting on activation e-mail. Does your version add the users real name to the profile when it is required for registration? Also does it send the users real name to the admin in the notification e-mail, as the copy I have now does not do either. I have looked at it but not sure where to fix it at.

Thanks for your hard work!!

I've made the user's realname optional or required on registration, depending on how you set the control that I've added in the users configuration menu.

No, the admin new user notification email does not show anything other than the user's nickname and ip address. I imagine that if you request that a real name is supplied at registration, then you would also configure the settings to require admin approval, so you'd vet the users details at the time you approve or deny the request for registration.

If you would like the user's realname and email address added to the admin notification, let me know and I'll do the edit - won't be anytime too soon though.

And thanks for your gratitude.

Posted: Fri Jun 08, 2007 10:53 pm

Since kevinkap's reply, I've noticed an omission in my edits.

In the files I have edited -
nuke/modules/Your_Account/public/new_confirm1.php
nuke/modules/Your_Account/public/new_confirm2.php
nuke/modules/Your_Account/public/new_confirm3.php

Find

Code:

if ($ya_realname == '') {

and replace with

Code:

if ($ya_realname == '' && $ya_config['reqrealname']==0) {

otherwise users will be forced to supply a realname whether or not it has been set to optional in users configuration.

Edit: The previously mentioned zip file has been amended to reflect the above changes.

Posted: Sat Jun 09, 2007 9:51 am

HMM,now i only get the dreaded blank page when going to the "your account" module.

It happens after uploading the ya module from your edited package. Not sure why yet, but I can simply over wright those files with the ones from the cnbya module and it works again.

Posted: Sat Jun 09, 2007 10:28 am

kevinkap wrote:

HMM,now i only get the dreaded blank page when going to the "your account" module.

It happens after uploading the ya module from your edited package. Not sure why yet, but I can simply over wright those files with the ones from the cnbya module and it works again.

Would make any queries Only registered users can see links on this board! Get registered or login! please.

Posted: Sat Jun 09, 2007 6:54 pm

ok, it has been narrowed down to one file causing the issue.

The only code changes to the file are:

Code:

// START:f2g: add option to make realname required or optional


    echo "<tr><td align='right' bgcolor='$bgcolor2'>"._REQREALNAME."</td>\n<td>";


    if ($ya_config['reqrealname']==0) { $ck1 = " checked"; $ck2 = ""; } else { $ck1 = ""; $ck2 = " checked"; }


    echo "<input type='radio' name='xreqrealname' value='0'$ck1>"._YES." &nbsp;";


    echo "<input type='radio' name='xreqrealname' value='1'$ck2>"._NO."</td></tr>\n";


// END:f2g:

and

Code:

    if ($ya_config['allowusertheme']==0) { $ck1 = " checked"; $ck2 = ""; } else { $ck1 = ""; $ck2 = " checked"; }


    echo "<input type='radio' name='xallowusertheme' value='0'$ck1>"._YES." &nbsp;";


    echo "<input type='radio' name='xallowusertheme' value='1'$ck2>"._NO."</td></tr>\n";


    


// START:f2g: remove cnbya gfxcheck options (use nuke/config.php for captcha options)


/*    


    if (extension_loaded("gd")) {


      echo "<tr><td align='right' bgcolor='$bgcolor2' valign='top'>"._USEGFXCHECK."</td>\n";


        $ck0 = $ck1 = $ck2 = $ck3 = "";


        if ($ya_config['usegfxcheck']==0) { $ck0 = " checked"; } elseif ($ya_config['usegfxcheck']==1) { $ck1 = " checked"; } elseif ($ya_config['usegfxcheck']==2) { $ck2 = " checked"; } elseif ($ya_config['usegfxcheck']==3) { $ck3 = " checked"; }


        echo "<td><input type='radio' name='xusegfxcheck' value='0'$ck0>"._YA_NC."<br>\n";


        echo "<input type='radio' name='xusegfxcheck' value='1'$ck1>"._YA_RC."<br>\n";


        echo "<input type='radio' name='xusegfxcheck' value='2'$ck2>"._YA_LC."<br>\n";


        echo "<input type='radio' name='xusegfxcheck' value='3'$ck3>"._YA_CA."</td>";


      echo "</tr>\n";


      echo "<tr><td align='right' bgcolor='$bgcolor2' valign='top'>"._YA_CODESIZE."</td><td><select name='xcodesize'>\n";


       for ($ss = 1; $ss <= 10; $ss++) {echo "<option value = $ss "; if ($ya_config['codesize'] == "$ss") { echo " selected"; }   echo ">$ss</option>\n";}


    } else {


      echo "<tr><td align='right' bgcolor='$bgcolor2' valign='top'>"._USEGFXCHECK."</td>\n";


        echo "<td><input type='hidden' name='xusegfxcheck' value='0'>"._YA_GD."</td>";


      echo "</tr>\n";


    }


*/


// END:f2g:    


    


    echo "<tr><td align='center' colspan='2'>&nbsp;</td></tr>\n";


    echo "<tr><td align='center' bgcolor='$bgcolor3' colspan='2'><b>"._YA_EXPOPTIONS."</b></td></tr>\n";

Why would either of these give this issue?

Thanks for any help.

Posted: Sat Jun 09, 2007 7:32 pm

kevinkap wrote:

ok, it has been narrowed down to one file causing the issue.

Wrong site. Exclamation

Posted: Sat Jun 09, 2007 7:37 pm

no, you said you could not help me any farther.. So I said I was going to post over here and see if anyone else had any idea's. But, since then you have maybe come up with something.

Thanks.

Posted: Sat Jun 09, 2007 8:00 pm

kevinkap wrote:

no, you said you could not help me any farther.. So I said I was going to post over here and see if anyone else had any idea's. But, since then you have maybe come up with something.

The file name. Question

Posted: Sat Jun 09, 2007 8:10 pm

yes. The file name is your accoutn/admin/userconfig.php. the same one. I realize that this is for rn2.10.01 and i am using rn2.10. I really do not see how the updates made in the 10.01 would affect that one page in a third party module, but I will upgrade and see if that fixes it.

I did install it on another site running the same setup with the exception of a subscription module. It did not give a blank page but showed both the captcha and the number codes for the login and only the numbers for the registration. Just 2 weird..

Posted: Sat Jun 09, 2007 9:54 pm

In rn_cnbya.php you need to set usegfxcheck to 0 if your not going to rip all the cnbya code out from index.php.

Posted: Sun Jun 10, 2007 5:50 am

that code is not in that file, all it does is update the db tables.

Posted: Sun Jun 10, 2007 6:16 am

kevinkap wrote:

I did install it on another site running the same setup with the exception of a subscription module. It did not give a blank page but showed both the captcha and the number codes for the login and only the numbers for the registration. Just 2 weird..

fade2gray wrote:

NOTE: This project is being developed with clean installations of rn2.10.01 and cnbya4.4.2 using only the fisubice theme and English language files. If you try any other flavours then your mileage may vary and If you follow any of my edits, please back up any affected files and databases first.

You need to go into the nuke_cnbya_config table and set usegfxcheck to 0(zero).

And please note, this forum is for "RN v2.10.01 - Feedback". If you need to ask other's advice about my project, it would be best to address it in RN's "CNB Your Account" forum. Perhaps a mod could move this thread there?

Posted: Sun Jun 10, 2007 2:35 pm

Yes, if a mod would move this, that would be great.

The issue has been resolved. Please see the info here.

Only registered users can see links on this board! Get registered or login!