Fossil SCM

Obscure the captcha text using a character substitution for three seconds.

drh 2015-02-13 19:39 UTC trunk
Commit 618420b1b8381e35acc38b063a3476a79bdaad3b
Parent cc94bd078e322b6…
1 file changed +35 -4
~ src/captcha.c
M src/captcha.c
+35 -4
--- src/captcha.c
+++ src/captcha.c
@@ -520,10 +520,39 @@
520520
 z[i] = c;
521521
 }
522522
 if( strncmp(zDecode,z,8)!=0 ) return 0;
523523
 return 1;
524524
 }
525
+
526
+/*
527
+** Make a captcha string initially illegible in an attempt to confuse
528
+** robots.
529
+*/
530
+static char *captcha_obscure(char *z){
531
+ int i;
532
+ for(i=0; z[i]; i++){
533
+ if( strchr("/\\()_ |",z[i]) ) z[i] ^= 0x10;
534
+ }
535
+ return z;
536
+}
537
+
538
+/*
539
+** Output javascript that will de-obscure the capture string contained
540
+** within the element name "zId"
541
+*/
542
+static void capture_output_deobscurer(const char *zId, int nDelay){
543
+ @ <script>
544
+ @ setTimeout(function(){
545
+ @ var x = document.getElementById('%s(zId)');
546
+ @ var str = x.innerHTML.replace(/&lt;/g,"<").replace(/&gt;/g,">")
547
+ @ x.innerHTML = str.replace(/[?l89O0L]/g,function(c){
548
+ @ return String.fromCharCode(c.charCodeAt(0)^0x10)
549
+ @ }).replace(/</g,"&lt;").replace(/>/g,"&gt;");
550
+ @ },%d(nDelay));
551
+ @ </script>
552
+}
553
+
525554
526555
 /*
527556
 ** Generate a captcha display together with the necessary hidden parameter
528557
 ** for the seed and the entry box into which the user will type the text of
529558
 ** the captcha. This is typically done at the very bottom of a form.
@@ -537,20 +566,21 @@
537566
538567
 if( !captcha_needed() ) return;
539568
 uSeed = captcha_seed();
540569
 zDecoded = captcha_decode(uSeed);
541570
 zCaptcha = captcha_render(zDecoded);
542
- @ <div class="captcha"><table class="captcha"><tr><td><pre>
543
- @ %h(zCaptcha)
571
+ @ <div class="captcha"><table class="captcha"><tr><td><pre id='cx15'>
572
+ @ %h(captcha_obscure(zCaptcha))
544573
 @ </pre>
545574
 @ Enter security code shown above:
546575
 @ <input type="hidden" name="captchaseed" value="%u(uSeed)" />
547576
 @ <input type="text" name="captcha" size=8 />
548577
 if( showButton ){
549578
 @ <input type="submit" value="Submit">
550579
 }
551580
 @ </td></tr></table></div>
581
+ capture_output_deobscurer("cx15",3000);
552582
 }
553583
554584
 /*
555585
 ** WEBPAGE: test-captcha
556586
 */
@@ -560,13 +590,14 @@
560590
 u64 x;
561591
 sqlite3_randomness(sizeof(x), &x);
562592
 zPw = mprintf("%016llx", x);
563593
 }
564594
 style_header("Captcha Test");
565
- @ <pre>
566
- @ %s(captcha_render(zPw))
595
+ @ <pre id='cx'>
596
+ @ %h(captcha_obscure(captcha_render(zPw)))
567597
 @ </pre>
598
+ capture_output_deobscurer("cx",2000);
568599
 style_footer();
569600
 }
570601
571602
 /*
572603
 ** Check to see if the current request is coming from an agent that might
573604
--- src/captcha.c
+++ src/captcha.c
@@ -520,10 +520,39 @@
520 z[i] = c;
521 }
522 if( strncmp(zDecode,z,8)!=0 ) return 0;
523 return 1;
524 }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
525
526 /*
527 ** Generate a captcha display together with the necessary hidden parameter
528 ** for the seed and the entry box into which the user will type the text of
529 ** the captcha. This is typically done at the very bottom of a form.
@@ -537,20 +566,21 @@
537
538 if( !captcha_needed() ) return;
539 uSeed = captcha_seed();
540 zDecoded = captcha_decode(uSeed);
541 zCaptcha = captcha_render(zDecoded);
542 @ <div class="captcha"><table class="captcha"><tr><td><pre>
543 @ %h(zCaptcha)
544 @ </pre>
545 @ Enter security code shown above:
546 @ <input type="hidden" name="captchaseed" value="%u(uSeed)" />
547 @ <input type="text" name="captcha" size=8 />
548 if( showButton ){
549 @ <input type="submit" value="Submit">
550 }
551 @ </td></tr></table></div>
 
552 }
553
554 /*
555 ** WEBPAGE: test-captcha
556 */
@@ -560,13 +590,14 @@
560 u64 x;
561 sqlite3_randomness(sizeof(x), &x);
562 zPw = mprintf("%016llx", x);
563 }
564 style_header("Captcha Test");
565 @ <pre>
566 @ %s(captcha_render(zPw))
567 @ </pre>
 
568 style_footer();
569 }
570
571 /*
572 ** Check to see if the current request is coming from an agent that might
573
--- src/captcha.c
+++ src/captcha.c
@@ -520,10 +520,39 @@
520 z[i] = c;
521 }
522 if( strncmp(zDecode,z,8)!=0 ) return 0;
523 return 1;
524 }
525
526 /*
527 ** Make a captcha string initially illegible in an attempt to confuse
528 ** robots.
529 */
530 static char *captcha_obscure(char *z){
531 int i;
532 for(i=0; z[i]; i++){
533 if( strchr("/\\()_ |",z[i]) ) z[i] ^= 0x10;
534 }
535 return z;
536 }
537
538 /*
539 ** Output javascript that will de-obscure the capture string contained
540 ** within the element name "zId"
541 */
542 static void capture_output_deobscurer(const char *zId, int nDelay){
543 @ <script>
544 @ setTimeout(function(){
545 @ var x = document.getElementById('%s(zId)');
546 @ var str = x.innerHTML.replace(/&lt;/g,"<").replace(/&gt;/g,">")
547 @ x.innerHTML = str.replace(/[?l89O0L]/g,function(c){
548 @ return String.fromCharCode(c.charCodeAt(0)^0x10)
549 @ }).replace(/</g,"&lt;").replace(/>/g,"&gt;");
550 @ },%d(nDelay));
551 @ </script>
552 }
553
554
555 /*
556 ** Generate a captcha display together with the necessary hidden parameter
557 ** for the seed and the entry box into which the user will type the text of
558 ** the captcha. This is typically done at the very bottom of a form.
@@ -537,20 +566,21 @@
566
567 if( !captcha_needed() ) return;
568 uSeed = captcha_seed();
569 zDecoded = captcha_decode(uSeed);
570 zCaptcha = captcha_render(zDecoded);
571 @ <div class="captcha"><table class="captcha"><tr><td><pre id='cx15'>
572 @ %h(captcha_obscure(zCaptcha))
573 @ </pre>
574 @ Enter security code shown above:
575 @ <input type="hidden" name="captchaseed" value="%u(uSeed)" />
576 @ <input type="text" name="captcha" size=8 />
577 if( showButton ){
578 @ <input type="submit" value="Submit">
579 }
580 @ </td></tr></table></div>
581 capture_output_deobscurer("cx15",3000);
582 }
583
584 /*
585 ** WEBPAGE: test-captcha
586 */
@@ -560,13 +590,14 @@
590 u64 x;
591 sqlite3_randomness(sizeof(x), &x);
592 zPw = mprintf("%016llx", x);
593 }
594 style_header("Captcha Test");
595 @ <pre id='cx'>
596 @ %h(captcha_obscure(captcha_render(zPw)))
597 @ </pre>
598 capture_output_deobscurer("cx",2000);
599 style_footer();
600 }
601
602 /*
603 ** Check to see if the current request is coming from an agent that might
604

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button