Maths Captcha

[Scratchilito]

Hi,
I'm under attack for some days and I wish to install this captcha on Phoenix 1.08.20

Unfortunately errors appear :


This is the contact page, but it's the same in: 'create_account.php', 'contact_us.php', 'checkout_guest.php' (I added this last page myself on line 77, because I need it).

I think that there is only this file to modify (/includes/hooks/shop/siteWide/addMaths.php)

But I am not familiar with the functions. Does anyone can explain how to proceed ?

[Kofod95]

I went to github and searched the repository for the deprecated functions, which enabled me to say:

Line 47:

Code: Select all

        $_e = (new Input('protect', ['placeholder' =>$_y, 'title' => $_z, 'aria-required' => 'true', 'id' => 'inputMaths'], 'number'))->require();

Line 50:

Code: Select all

        $_e = (new Input('protect', ['aria-required' => 'true', 'id' => 'inputMaths'], 'number'))->require();

Line 52:

Code: Select all

      $_e .= FORM_REQUIRED_INPUT . (new Input('lock', [], 'hidden'))->set('value', $_d);

Seems to work

//Daniel

[Scratchilito]

Great!
It works locally, I'm putting it into production immediately. Thanks again.

Would you be willing to explain the research process you used on Github?

[Kofod95]

Glad it's working!

Would you be willing to explain the research process you used on Github?

Sure!
I find CE PhoenixCart on GitHub - I have it bookmarked, but there's also a link in the bottom here: https://phoenixcart.org/features.php?ce ... u8nd8u9mn9

In the top right corner, I enter the deprecated function (fx tep_draw_input_field) and search the repository for results. In this case, it gave me a hit on includes/functions/general.php, so I click that and use CTRL+F to locate the exact lines.
There, the function is defined with a set of parameters (tep_function($one, $two, $three){)
Right below, the deprecated notice is added to the function, but all that comes after that, makes the function work as it used to, but with new style code. For tep_draw_input_field() we see that new Input() is the replacement. Instead of parameters going tep_draw_input_field($name, $value, $params, $type), it goes new Input($name, [$param1 => $1, $param2 => $2], $type)
Making the param an array is done in phoenix_normalize(), but since it's no longer needed in core, that function is deprecated too. Luckily, it's not too difficult to do what that function did.
To set values and required, the class has functions, but then we need to wrap the entire thing like (new Input($name, [], $type))->set('value', $value) or to require ->require()

I hope this helps! I will gladly expound or reword, if something is not too clear!

//Daniel

[raiwa]

See also the link in my signature:
Public Phoenix Change Log Cheat Set on Google Sheets

[Scratchilito]

Hi,
Thanks for all your helps.
As I went a little further into fixing this plugin, I realised that there are errors when the captcha answer is wrong:

Deprecated: The tep_db_prepare_input function has been deprecated. in \includes\functions\database.php on line 85
Deprecated: The tep_db_prepare_input function has been deprecated. in \includes\functions\database.php on line 85
Deprecated: The tep_block_form_processing function has been deprecated. in \includes\functions\general.php on line 374

In the Raiwa file : https://docs.google.com/spreadsheets/d/ ... edit#gid=0 I was able to find:

tep_db_prepare_input solution (but not the tep_block_form_processing one)

With Kofod95's method, I was able to find:

tep_block_form_processing solution (but not the tep_db_prepare_input one)

In the results, I propose to modify, still in the file /includes/hooks/shop/siteWide/addMaths.php

Code: Select all

Line 25:
      $protect = Text::prepare($_POST['protect']);
	  
Line 26:
      $lock    = Text::prepare(base64_decode($_POST['lock']));

Line 31:
        Form::block_processing();

For me it is working, but I wonder if I should have put 'input' instead of 'prepare' in line 26.

[raiwa]

Hi,
In the Raiwa file : https://docs.google.com/spreadsheets/d/ ... edit#gid=0 I was able to find:

tep_db_prepare_input solution (but not the tep_block_form_rocessing one)

With Kofod95's method, I was able to find:

tep_block_form_processing solution (but not the tep_db_prepare_input one)

You are welcome to add missing functions to that file.

[Scratchilito]

You are welcome to add missing functions to that file.

Dear Raiwa,
As a complete newbie in programming languages (I'm only like 'monkey does = banana') I would be too afraid to write nonsense. I prefer to go through the confirmation of the specialists.

[Kofod95]

As a complete newbie in programming languages (I'm only like 'monkey does = banana') I would be too afraid to write nonsense. I prefer to go through the confirmation of the specialists.

I understand you, and often have the same fear!
I too am an amateur with code, but at times I'm also surprised of how much I've managed to pick up.
The sheet Raiwa linked to is meant as a community ressoruce, meaning that anyone can add whatever might be missing and write their name in the "author field" -> others can correct it if it doesn't work, but they would have something to get them started, which may be very helpful.
That said, I haven't yet added anything to the spreadsheet, as I've completely forgotten about it.. It is easier to use than the github-way, which sometimes requires you to look in older versions for the code to replace.

For me it is working, but I wonder if I should have put 'input' instead of 'prepare' in line 26.

I used 'input' when I updated my copy.
Text::prepare removes whitespace and other superflous characters from the string.
Text::input removes {[<]} and > (maybe more than that) before it removes the same as above, to prevent forms from inputting scripts or similar.
As the input from this add-on isn't outputted anywhere, 'prepare' *may* be okay, but I'm not sure. The input will be sent via the headers, so I *think* a hacker could use it for bad.

//Daniel

[ecartz]

As a rule of thumb, you should

1. Always use Text::input on the catalog side.
2. Prefer input to prepare if it doesn't break things on the admin side.

So yes, in this case, Text::input would be preferred, as you are on the catalog side.

The only reason to ever use prepare is if you need to enter HTML. For example, for the product description in admin.