- support - lists.drupal.org

Re: [support] Many false applications for accounts
by James Rome 08 Apr '14

08 Apr '14

I tried Honeypot, and it indeed cut down the number of false applications by about 80%. I could easily put in a field that legitimate users could fill in correctly, but spammers could not. But how could I check this and automatically cancel applications with bad information for that field? For example, on one site for a fraternity, I asked for the street address of the fraternity. Jim On 4/7/14, 8:00 AM, support-request(a)drupal.org wrote: > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 7 Apr 2014 07:28:40 -0400 > From: Philip_Wetzel(a)nhd.uscourts.gov > Subject: Re: [support] Many false applications for accounts > To: support(a)drupal.org > Cc: support-bounces(a)drupal.org, wdlists(a)gmail.com > Message-ID: > <OFF8EAD2B1.CAE81554-ON85257CB3.003ED071-85257CB3.003F0DAD(a)uscmail.uscourts.gov> > > Content-Type: text/plain; charset=US-ASCII > > The CAPTCHA code has been broken a number of times and they've > re-engineered it. If it's not currently effective, they'll probably come > up > with a fix. The game goes on. > > > > From: MBR <mbr(a)arlsoft.com> > To: support(a)drupal.org, wdlists(a)gmail.com, > Date: 04/05/2014 12:31 PM > Subject: Re: [support] Many false applications for accounts > Sent by: support-bounces(a)drupal.org > > > > It's been reported that the bad guys have set up CAPTCHA-breaking networks > that distribute the CAPTCHA to people in third-world countries who get paid > a small amount for each CAPTCHA they solve. It's looking like CAPTCHA is no > longer effective. > > I had to solve this problem for a site that was getting hit by about 15 > bogus account-registrations per hour, even though CAPTCHA was enabled. The > most effective approach I know of at present is to install a module that > does reverse-CAPTCHA - i.e. instead of asking the human to prove he's > human, it tricks the malware that's trying to pretend to be a human into > demonstrating behavior that proves it's just a dumb piece of software. It > does this by adding additional <input> tags to every <form> and making them > invisible with CSS. A human won't fill in these fields because they won't > be displayed. But software that's just parsing HTML will find these fields > and fill them in, thus allowing the code on your server to distinguish > between responses from humans and responses from machines. > > Among the modules that implement this approach are Honeypot, Botcha, and > Spamicide. I tried Botcha, but I ran into installation problems. I didn't > try Spamicide because it had a critical bug report claiming that the > installation erased the default/files directory. Honeypot installed > without problems and instantly cut the rate of bogus registrations > dramatically. It didn't cut it all the way to 0 as I'd hoped it would, but > the rate dropped from about 15/hr. to about 3/day. > Mark Rosenthal > mbr(a)arlsoft.com > On 4/5/14 8:51 AM, Walt Daniels wrote: > I get them to, but it is not mollom's fault. They are actually > registering and typing the captcha just like a legitimate user. In > our case they even have to use a legitimate email as they cannot do > anything more than an anonymous user until the verify their email. I > don't see any pattern I could apply to the user names that would > distinguish them from our valid users who have some pretty weird > usernames. You could find or right a module that enforced using "real > names", i.e. John Doe. But I even got some like that that turn out to > be spammers. > > > On Sat, Apr 5, 2014 at 8:13 AM, Linda Romey <lromey(a)gmail.com> wrote: > I am having the same issue. Have you contacted Mollom? That's on my > to-do list. I'm not sure of the value of the monthly fee if I still > have to continually monitor my site and delete spam accounts > manually. > > > On Sat, Apr 5, 2014 at 8:09 AM, James Rome <jamesrome(a)gmail.com> > wrote: > I have Mollom installed, but yet a handful of account applications > escape their captcha/analysis each day. The problem is that the > only > obviously wrong field is the username, which is not listed as a > field in > the Mollom configuration. I get names such as: qropspension_5362 > > Is there any other way to get rid of these would-be spammers? > > -- > James A. Rome > > http://jamesrome.net > > -- > [ Drupal support list | http://lists.drupal.org/ ] > > > -- > [ Drupal support list | http://lists.drupal.org/ ] > > > > -- > [ Drupal support list | http://lists.drupal.org/ ] > > > > ------------------------------ >

7 8

Many false applications for accounts
by Roger 08 Apr '14

08 Apr '14

Could you use Rules? Roger I tried Honeypot, and it indeed cut down the number of false applications by about 80%. I could easily put in a field that legitimate users could fill in correctly, but spammers could not. But how could I check this and automatically cancel applications with bad information for that field? For example, on one site for a fraternity, I asked for the street address of the fraternity.

1 0

Using the Drupal 7 Migrate module how would I migrate a Cold Fusion application into Drupal 7?
by John Mitchell 05 Apr '14

05 Apr '14

I have already utilized the Drupal 7 Migrate and the Drupal 7 Migrate d2d modules to migrate a Drupal 6 site to Drupal 7. Using the Drupal 7 Migrate module how would I migrate a Cold Fusion application into Drupal 7? -- John J. Mitchell

1 0

%email_values token in webform email message.
by Philip_Wetzel＠nhd.uscourts.gov 03 Apr '14

03 Apr '14

Hi all, I've created a survey using a grid in a webform. The form looks great, but the email formatting is somewhat undesirable. Is there any way to break out the values in the %email_values token so I can format things better? For instance, this is what I get: - 1. I will allow nothing to get in the way of me getting what I want.: 4 - 2. I find myself blaming society and external circumstances for the problems I have had in life.: 4 - 3. Change can be scary.: 4 - 4. Even though I may start out with the best of intentions I have trouble remaining focused and staying "on track".: 4 This is more like what I want: - 1. I will allow nothing to get in the way of me getting what I want.: 4 - 2. I find myself blaming society and external circumstances for the problems I have had in life.: 4 - 3. Change can be scary.: 4 - 4. Even though I may start out with the best of intentions I have trouble remaining focused and staying "on track".: 4 So, the responses are more in line. Or maybe have the response first and then the question. like: 4 - 1. I will allow nothing to get in the way of me getting what I want.: 4 - 2. I find myself blaming society and external circumstances for the problems I have had in life.: 4 - 3. Change can be scary.: 4 - 4. Even though I may start out with the best of intentions I have trouble remaining focused and staying "on track".: Thanks, Phil

1 0

entityPropertyInfo Type parameter
by Nancy Wichmann 01 Apr '14

01 Apr '14

The Entity module allows a Type parameter on the entityPropertyInfo definition. According to a page on D.O, "date" is a valid type. But what displays is the Unix timestamp value and not a user readable date. Does anyone know how to get around this?

1 0

Tightening up reCaptcha and Honeypot
by john boris 30 Mar '14

30 Mar '14

I am running reCaptcha and honeypot on my registration pages. It stemmed the tied of bogus login attempts but somehow they have started again. I am up to date on the modules. I am running Drupal 7 which is up to date. I get about 10 per day. I have the registration page set for recaptcha. But are there any other settings I can tweak in honeypot or recaptcha? I can supply any info that is needed to help with this. -- John J. Boris, Sr. Online Services www.onlinesvc.com

4 3

Set CSS class as taxonomy field for content type
by Matthias Fechner 25 Mar '14

25 Mar '14

Dear all, does anyone know a module where I can this: Define a taxonomy in my own content type and define in Views to use the taxonomy value and use it as CSS class for the div Thanks, Matthias -- "Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the universe trying to produce bigger and better idiots. So far, the universe is winning." -- Rich Cook

3 4

drupal_get_path('module', '<name>')
by Chris Miller 21 Mar '14

21 Mar '14

Hi Folks, I'm calling "drupal_get_path('module', '<name>') and it is returning the path "/sites/all/modules/<name>" rather then the specific site, "/sites/specific/modules/<name>". Am I using the wrong function? Chris.

4 4

Trivial module, or something else and not module at all?
by Chris Miller 21 Mar '14

21 Mar '14

Hi Folks, Not sure how to proceed... I want to be able to download files with a click, not a right-click context menu item. This is pretty easy. I have a custom formatter that will present the file as the argument to a script. The custom formatter looks like this: $s = '<a href="' . drupal_get_path('module', 'download') . '/download.php?file=' . $variables['#items'][0]['uri'] . '">'; $s .= '<img class="file-icon" alt="" title="audio/mpeg" src="/modules/file/icons/audio-x-generic.png">'; $s .= '</a>'; echo $s; And the script is equally simple: header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename='.basename($file)); header('Content-Transfer-Encoding: binary'); header('Expires: 0'); header('Cache-Control: must-revalidate, post-check=0, pre-check=0'); header('Pragma: public'); header('Content-Length: ' . filesize($file)); ob_clean(); flush(); readfile($file); So, here's the question. I need this script to be a module, so the custom formatter can find it (drupal_get_path()). I have a trivial download.info and an empty download.module. This is really just a utility script and not really a module. What is the recommended way to "register" this script for general use? hook_menu? Chris.

1 0

Panels read more link
by Tony 20 Mar '14

20 Mar '14

How do I turn off the read more in a panel. I want the full panel to appear. I can't fin anywhere to turn it off or on. -- *Anthony Stefan Maciejowski* *http://about.me/TonyMac <http://www.about.me/TonyMac>*

1 0