Support Forum

I just went in to try and edit the sp-post.php with the intention of checking to see if the captcha was even filled out, and if it was blank halt execution there. This should kill the majority of the bots while causing a minimal impact on real people. However, I am running into an issue trying to figure out exactly what I should be checking for. Tracing through the code it appears as if there are 3 checks, 1) a honeypot for whether or not the url field has been filled out, 2) a built in math captcha, and 3) an addon for a capthca located in wp-content/sp-resources/forum-plugins/captcha/library/sp-captcha.php.

Based on the actual errors getting submitted to the database it appears that it is the addon that is blank when the form is submitted. I cannot tell though if this means that it is getting checked first, or if 1 & 2 are being checked and pass and then it fails on 3. My guess is that it is the former. Where should I be looking to implement an emptiness test (or filled in test in the case of the url) for these fields, if I want them to be checked before anything else happens? What exactly should I be checking and where should I put it in the code?

Thanks.

we dont do a honeypot… or have a hidden url field… wonder if there is some other plugin at work here?  or perhaps I am misunderstanding what you are seeing…

In sp-api/sp-api-primitives.php, function sp_spamcheck(), first if{} block:

    # Check dummy input field
    if (array_key_exists ('url', $_POST)) {
        if (!empty($_POST['url'])) {
            $spamcheck[0] = true;
            $spamcheck[1] = sp_text('Form not filled by human hands!');
            return $spamcheck;
        }
    }

That corresponds to a hidden field on the form named "url", which is, from what I can tell, generated on line 401 of sp-startup/site/sp-site-support-functions.php:

        $out = '<input type="hidden" size="30" name="url" value="" /></p>'."\n";

That is, as far as I know, in the core SimplePress, and not in a plugin.

What I want to do is if it is not a human, halt all further processing, and I need to put this as high up in the code as possible. I don't know whether or not the bots are filling out the url field, since it's not getting that far, so I would like to create a check for the empty captcha at the top, prior to even checking if the user has permissions, in order to prevent these bots from using up the server resources. What exactly would I need to check for, and where should I put this check? I am ok with a non-graceful die() at that point as well, so no need for any pretty error messages.

 *note: I stated that I wanted to put this check in sp-post.php based on the earlier suggestion on where to block the transient entries, and because the naming scheme suggests that file is what is initially invoked when a post is submitted. However, if there is a more efficient (eg, further up in the process) place where I should place this check please let me know, thanks.

Ok, this is getting really frustrating...

Changing Javascript will not stop the bots. The bots are, I am fairly certain, not loading the page to begin with. What I need to do is this:

If on a post submission the captcha is empty, not process anything. What do I look for as far as the form fields to make this check, and where in the files should I put it for maximum effectiveness?

Thank you, so far this seems to be working. I appreciate the help.