Preventing Comment Spam, Gallery's use of Captcha

the captcha module is written to be used as a plugin by other modules/views.. we'd welcome a patch to make use of the plugin from the comment module.

I was trying out G2 yesterday for the first time and noticed that the Captcha module wasn't being used for anonymous comments. I've taken a stab at getting it to work. This is my first time trying to modify G2, so please use this modification at your own risk.

This modification will display a Captcha when the "guest" user attempts to add a comment. The Captcha will not be displayed for users who login and which to add comments.

This implementation seems to have (at least) these problems:

1) When the Captcha is displayed for the comment, if "enter" is pressed after entering the Captcha word, the page refreshes rather than saving the comment. However, if you click on "Save" the comment Captcha is validated and the comment is saved.

2) I haven't been able to reproduce this problem, but there was one time that I saw the Captcha show up when the user login screen was displayed even though I didn't think I had entered any wrong passwords. (It's supposed to show up after 3 failures, I gather) When I saw the problem occur is was in Safari, but I have no idea if that's relevant. I imagine that this could be a problem since when I use Captcha in the comment module, I set "security" to 'HIGH', but the UserLogin module uses it at 'MEDIUM'.

3) If another ValidationPlugin subclass is created, it will also be used to add the comment in addition to the Captcha.

4) I don't know if it handles Captcha not being installed gracefully. I works fine if the Captcha module is present, and disabled. But I'm not sure what will happen since I have the two relativeRequireOnce statements at the top.

Also, I could not find the proper way to submit patches, so below are "diff -c" of my changes to modules/comment/AddComment.inc and modules/comment/templates/AddComment.tpl .
-Rob

*** AddComment.inc.orig	Wed Nov  2 10:33:04 2005
--- AddComment.inc	Wed Nov  2 12:22:11 2005
***************
*** 28,33 ****
--- 28,39 ----
   */
  
  /**
+  * require necessary classes
+  */
+ GalleryCoreApi::relativeRequireOnce('modules/core/classes/GalleryValidationPlugin.class');
+ GalleryCoreApi::relativeRequireOnce('modules/captcha/CaptchaValidationPlugin.inc');
+ 
+ /**
   * Add a comment to an item.
   *
   * @package Comment
***************
*** 64,69 ****
--- 70,106 ----
  	    }
  
  	    if (empty($error)) {
+ 	        /* Get all the login plugins */
+ 	        list ($ret, $pluginInstances) =
+ 		    GalleryCoreApi::getAllFactoryImplementationIds('ValidationPlugin');
+ 		if ($ret->isError()) {
+ 		    return array($ret->wrap(__FILE__, __LINE__), null);
+ 		}
+ 
+ 		foreach (array_keys($pluginInstances) as $pluginId) {
+ 		    list ($ret, $pluginInstances[$pluginId]) =
+ 		        GalleryCoreApi::newFactoryInstanceById('ValidationPlugin', $pluginId);
+ 		    if ($ret->isError()) {
+ 		        return array($ret->wrap(__FILE__, __LINE__), null);
+ 		    }
+ 		}
+ 
+ 		/* Let each plugin do its verification */
+ 		foreach ($pluginInstances as $pluginId => $plugin) {
+ 		    list ($ret, $pluginErrors, $continue) = $plugin->performValidation($form);
+ 		    if ($ret->isError()) {
+ 			return array($ret->wrap(__FILE__, __LINE__), null);
+ 		    }
+ 
+ 		    $error = array_merge($error, $pluginErrors);
+ 
+ 		    if (!$continue) {
+ 			break;
+ 		    }
+ 		}
+ 	    }
+ 
+ 	    if (empty($error)) {
  		/* Add the comment */
  		list ($ret, $comment) =
  		    GalleryCoreApi::newFactoryInstance('GalleryEntity', 'GalleryComment');
***************
*** 140,145 ****
--- 177,184 ----
       * @see GalleryView::loadTemplate
       */
      function loadTemplate(&$template, &$form) {
+ 	global $gallery;
+ 
  	/* Load our item */
  	list ($ret, $item) = $this->_getItem();
  	if ($ret->isError()) {
***************
*** 168,174 ****
  	$AddComment['host'] = GalleryUtilities::getRemoteHostAddress();
  	$AddComment['itemId'] = $item->getId();
  
- 	$template->setVariable('AddComment', $AddComment);
  	$template->setVariable('controller', 'comment.AddComment');
  
  	list($ret, $module) = GalleryCoreApi::loadPlugin('module', 'comment');
--- 207,212 ----
***************
*** 178,183 ****
--- 216,268 ----
  
  	$template->title($module->translate('Add Comment'));
  
+ 	/* Check if we are the anonymous user. If so, load up captcha */
+ 	$activeUserId = $gallery->getActiveUserId();
+ 
+ 	$userId = GalleryUtilities::getRequestVariables('userId');
+ 	if (empty($userId)) {
+ 	    $userId = $activeUserId;
+ 	}
+ 
+ 	list ($ret, $anonymousUserId) =
+ 	    GalleryCoreApi::getPluginParameter('module', 'core', 'id.anonymousUser');
+ 	if ($ret->isError()) {
+ 	    return array($ret->wrap(__FILE__, __LINE__), null);
+ 	}
+ 	if ($userId == $anonymousUserId) {
+ 	    /* See if the CaptchaValidationPlugin is installed */
+ 	    /* Get all the login plugins */
+ 	    list ($ret, $allPluginIds) =
+ 	        GalleryCoreApi::getAllFactoryImplementationIds('ValidationPlugin');
+ 	    if (! $ret->isError()) {
+ 	        /* Let Captcha load it's template data. Set security to HIGH so
+ 		 * Captcha will display immediately */
+ 	        /* Let each plugin load its template data */
+ 	        $AddComment['plugins'] = array();
+ 		foreach (array_keys($allPluginIds) as $pluginId) {
+ 		    list ($ret, $plugin) =
+ 		        GalleryCoreApi::newFactoryInstanceById('ValidationPlugin', $pluginId);
+ 		    if ($ret->isError()) {
+ 		        return array($ret->wrap(__FILE__, __LINE__), null);
+ 		    }
+ 
+ 		    list ($ret, $data['file'], $data['l10Domain']) =
+ 		        $plugin->loadTemplate($template, $form, 'HIGH');
+ 		    if ($ret->isError()) {
+ 		        return array($ret->wrap(__FILE__, __LINE__), null);
+ 		    }
+ 
+ 		    if (isset($data['file'])) {
+ 		        $AddComment['plugins'][] = $data;
+ 		    }
+ 		}
+ 	    }
+ 	    else {
+ 	      /* Ignore if Captcha not intalled */
+ 	    }
+ 	}
+ 	$template->setVariable('AddComment', $AddComment);
+ 	
  	return array(GalleryStatus::success(),
  		     array('body' => 'modules/comment/templates/AddComment.tpl'));
      }

*** templates/AddComment.tpl	Tue Jul 12 06:07:38 2005
--- templates/local/AddComment.tpl	Wed Nov  2 12:13:54 2005
***************
*** 71,76 ****
--- 71,81 ----
      {/if}
    </div>
  
+ {* Include our extra ItemAddOptions *}
+ {foreach from=$AddComment.plugins item=plugin}
+   {include file="gallery:`$plugin.file`" l10Domain=$plugin.l10Domain}
+ {/foreach}
+ 
    <div class="gbBlock gcBackground1">
      <input type="submit" class="inputTypeSubmit"
        name="{g->formVar var="form[action][preview]"}" value="{g->text text="Preview"}"/>

I just tried it without the relativeRequireOnce calls and it fails with the error message, "[04-Nov-2005 15:07:11] PHP Fatal error: Class captchavalidationplugin: Cannot inherit from undefined class validationplugin in /path/to/gallery/modules/captcha/CaptchaValidationPlugin.inc on line 36"

I don't know enough about how G2 works to know whether this means there's an include missing in the CaptchaValidationPlugin or if I need to make some other modifications to the AddComment.inc (or comment module)

Success! It works fine with just the one require for GalleryValidationPlugin.

Thank you for the suggestions.

Cool feature!

I just had to change the "ValidationPlugin" to "GalleryValidationPlugin" to make it work, don't know why but know it works

mindless, it also works without the require calls. http://www.schmittat.com/gallery2/main.php

kedoin, if no ValidationPlugin is activated, it is not the if/else part that keeps it from loading. The foreach (array_keys($allPluginIds) as $pluginId) will just not be exercised. So it still works but you can delete the empty "else" part.

I also added an option in the Site Admin area where you can now decide whether you want captcha to be used or not. I included that option in the changes I made for the "Latest Comments" feature: http://gallery.menalto.com/node/39802

So here's a dumb question. (I'm still trying to understand what the procedures are for G2). When you say this code is now integrated into the comment module, does that mean I can download a newer version of the comment module and install it over my old version? Or does it mean that the next release of Gallery2 will have these changes in it?

Again, sorry if the question's a little dumb.

this means you can get the current nightly release of G2 from the downloads page -> nightly snapshots and it's in there.
you can also wait for the next official, super stable release, which is due early february.