PHP Class Prado\Web\UI\WebControls\TCaptcha
Notice: while this class is easy to use and implement, it does not provide full security.
In fact, it's easy to bypass the checks reusing old, already-validated tokens (reply attack).
A better alternative is provided by {@link TReCaptcha}.
TCaptcha displays a CAPTCHA (a token displayed as an image) that can be used
to determine if the input is entered by a real user instead of some program.
Unlike other CAPTCHA scripts, TCaptcha does not need session or cookie.
The token (a string consisting of alphanumeric characters) displayed is automatically
generated and can be configured in several ways. To specify the length of characters
in the token, set {@link setMinTokenLength MinTokenLength} and {@link setMaxTokenLength MaxTokenLength}.
To use case-insensitive comparison and generate upper-case-only token, set {@link setCaseSensitive CaseSensitive}
to false. Advanced users can try to set {@link setTokenAlphabet TokenAlphabet}, which
specifies what characters can appear in tokens.
The validation of the token is related with two properties: {@link setTestLimit TestLimit}
and {@link setTokenExpiry TokenExpiry}. The former specifies how many times a token can
be tested with on the server side, and the latter says when a generated token will expire.
To specify the appearance of the generated token image, set {@link setTokenImageTheme TokenImageTheme}
to be an integer between 0 and 63. And to adjust the generated image size, set {@link setTokenFontSize TokenFontSize}
(you may also set {@link TWebControl::setWidth Width}, but the scaled image may not look good.)
By setting {@link setChangingTokenBackground ChangingTokenBackground} to true, the image background
of the token will be variating even though the token is the same during postbacks.
Upon postback, user input can be validated by calling {@link validate()}.
The {@link TCaptchaValidator} control can also be used to do validation, which provides
client-side validation besides the server-side validation. By default, the token will
remain the same during multiple postbacks. A new one can be generated by calling
{@link regenerateToken()} manually.
The following template shows a typical use of TCaptcha control:
Afficher le fichier
Open project: pradosoft/prado
Méthodes publiques
Méthodes protégées
Method Details
checkRequirements()
public static méthode
TCaptach requires GD2 with TrueType font support and PNG image support.
generatePrivateKeyFile()
protected méthode
Generates a file with a randomly generated private key.
generateRandomKey()
protected méthode
generateToken()
protected méthode
|
protected generateToken ( $publicKey, $privateKey, $alphabet, $tokenLength, $caseSensitive ) : string |
| Résultat |
string |
the token generated. |
getCaptchaScriptFile()
protected méthode
getCaseSensitive()
public méthode
getChangingTokenBackground()
public méthode
getFontFile()
protected méthode
getIsTokenExpired()
public méthode
getMaxTokenLength()
public méthode
getMinTokenLength()
public méthode
getPrivateKey()
public méthode
|
public getPrivateKey ( ) : string |
| Résultat |
string |
the private key used for generating the token. This is randomly generated and kept in a file for persistency. |
getPublicKey()
public méthode
|
public getPublicKey ( ) : string |
| Résultat |
string |
the public key used for generating the token. A random one will be generated and returned if this is not set. |
getTestLimit()
public méthode
getToken()
public méthode
getTokenAlphabet()
public méthode
|
public getTokenAlphabet ( ) : string |
| Résultat |
string |
the characters that may appear in the token. Defaults to '234578adefhijmnrtABDEFGHJLMNRT'. |
getTokenExpiry()
public méthode
|
public getTokenExpiry ( ) : integer |
| Résultat |
integer |
the number of seconds that a generated token will remain valid. Defaults to 600 seconds (10 minutes). |
getTokenFontSize()
public méthode
getTokenImageOptions()
protected méthode
getTokenImageTheme()
public méthode
getTokenLength()
protected méthode
hash2string()
protected méthode
Converts a hash string into a string with characters consisting of alphanumeric characters.
onPreRender()
public méthode
Configures the image URL that shows the token.
regenerateToken()
public méthode
By default, a token, once generated, will remain the same during the following page postbacks.
Calling this method will generate a new token.
setCaseSensitive()
public méthode
setChangingTokenBackground()
public méthode
setMaxTokenLength()
public méthode
setMinTokenLength()
public méthode
setPublicKey()
public méthode
setTestLimit()
public méthode
setTokenAlphabet()
public méthode
setTokenExpiry()
public méthode
setTokenFontSize()
public méthode
This property affects the generated token image size.
The image width is proportional to this font size.
setTokenImageTheme()
public méthode
You may test each theme to find out the one you like the most.
Below is the explanation of the theme value:
It is treated as a 5-bit integer. Each bit toggles a specific feature of the image.
Bit 0 (the least significant): whether the image is opaque (1) or transparent (0).
Bit 1: whether we should add white noise to the image (1) or not (0).
Bit 2: whether we should add a grid to the image (1) or not (0).
Bit 3: whether we should add some scribbles to the image (1) or not (0).
Bit 4: whether the image background should be morphed (1) or not (0).
Bit 5: whether the token text should cast a shadow (1) or not (0).
validate()
public méthode
Validates a user input with the token.