Planet Skyron

In the article, PHPBB 3.0x Registration Spam Control Mechanism, a guide was presented on how to tighten up access to the well-known bulletin board software, focusing on the registration component where anyone can sign up as a new user. The scheme was meant to make it more difficult to automatically sign up using common exploits. At the time of writing, the software version of interest was 3.0.4. As of the current version, 3.0.6, the scheme described will not work, owing to changes in the software. This article will briefly go over a new scheme that suits the newest version.

The image verification method has been incorporated into its own class and is located in the normal install directory, here: /includes/captcha/plugins/captcha_abstract.php. This class affects both registration and anonymous posting, unlike before, when the code was specific to the target areas. So, in addition to registration access control, anonymous posting will receive the same treatment with the following modifications to the file (line numbers are approximate):

25 class phpbb_default_captcha
26 {
27         var $confirm_id;
28         var $confirm_code;
29         var $confirm_char; // mod
30         var $code;

41                 // read input
42                 $this->confirm_id = request_var('confirm_id', '');
43                 $this->confirm_code = request_var('confirm_code', '');
44                 $this->confirm_char = request_var('confirm_char', ''); // mod
45                 $refresh = request_var('refresh_vc', false) && $config['confirm_refresh'];

308                                 AND confirm_type = " . $this->type;
309                 $result = $db->sql_query($sql);
310                 $row = $db->sql_fetchrow($result);
311                 $db->sql_freeresult($result);
312
313                 if ($row)
314                 {
315
316                         $this->code = $this->confirm_char . $row['code']; //mod
317                         $this->seed = $row['seed'];
318                         $this->attempts = $row['attempts'];
319                         return true;
320                 }
321
322                 return false;

The lines of code, added or altered, shown above, are marked with “//mod”. So, lines 29, 44, and 316 are the mods. Line 44 is the bit that retrieves the symbol randomly generated in the functions.php file (see previous article for more details). Line 316, having a slightly different look from the previous version, is the section of code where the symbol is integrated with the CAPTCHA code during the verification stage. These changes replace those described in the previous article affecting the ucp_register.php file located in /includes/ucp.

The changes to the templates described in the previous article are basically the same, but now include the template for anonymous posting, for example, posting_editing.html. The javascript code placed originally in the ucp_register.html template should go into the head portion of the overall_header.html template. The latter would cover both contingencies. The call to the dencoder function might also be placed in the footer template, but seems benign enough in the respective templates for registration and posting anonymously. Of course, depending on your theme, you may need to refresh the templates after you’ve made changes to these files. Needless to say, the image verification service should be activated.

Forum registration is the gateway to all manner of forum spam and staunching spam at the front door is the most effective policy. In the case of PHPBB forums, a particular method has been developed that is not unique in concept, but perhaps in execution.

The method in question basically imposes the requirement of additional information to be included with CAPTCHA code. Early versions required only a particular character to be prepended to the confirmation code value retrieved in the PHPBB3 forum file, ucp_register.php. However, the further enhancement described here involves random characters that are to some degree cloaked from detection by spam bots.

The cloaking method used is based on this article on cloaking emails. The character, itself, is generated by the following method

#random generator of non-alphanumeric ascii characters
while (is_numeric($randchar = chr(rand(33, 64)))) { continue; }

This random value is passed to a template variable in url encoded form. When the template is downloaded, a javascript decoder function found on Eric Meyer’s web site, converts the character back.
Read the rest of this entry »

The question of how to disassemble T3 components so as to free the digitizer of water was raised, recently. An admirable answer has already been provided in a series of well-illustrated steps, leaving little to the imagination (which is a positive boon, in this case). It’s particularly useful for those who want to replace either the digitizer or the LCD.

However one final step was never reached, namely, after the screen has been separated from the PDA, how to separate the digitizer from the LCD. More to the point, how on earth to disconnect the digitizer ribbon from the LCD. It’s not immediately apparent as one surveys the back of the metal screen case shown here:

View of T3 screen with detail of connector of interest

The original creator of BillGatus apparently used an image capture of a video featuring the The Best of Both Worlds sequel to the of Star Trek: Next Generation episode, Q Who?, where Q had unceremoniously flung the Enterprise into a very distance and uncharted sector of the universe populated by the rather ominous borg collective, then unknown to the United Federation of Planets. The sequel sees Capt. Picard dragooned by the borg collective for the purpose of communicating their message to people on earth targeted for assimilation that “resistance is futile.”

At any rate, the size of a teevee image on a computer screen was decidedly smaller than what one normally viewed on the average telly. The result was less than spectacular but the best one could do at the time it was created.

The original version looked like this:

It’s a bit muddy.
Read the rest of this entry »