[Plugin: Register Plus] ERROR: Image Validation does not match.

The image bug is quite simple to solve; I think that modifying $_SESSION variable of main script with another one that is just being launched by <img src=”” /> will not work… Just think about it, one link to an image and one could gain access to your whole $_SESSION.
I’ve made a temporary workaround by replacing:
$_SESSION['key'] = $ResultStr;// carry the data through session
with

$plik = fopen('captcha.md5','wb');
flock($plik, LOCK_EX);
fputs($plik, md5($ResultStr));
flock($plik, LOCK_UN);
fclose($plik);

in file captcha.php, and

$key=substr($_SESSION['key'],0,5);
$number = $_POST['captcha'];

with

$key=trim(file_get_contents(trailingslashit(get_option('siteurl')) . 'wp-content/plugins/' . basename(dirname(__FILE__)) .'/captcha.md5'));
$number = md5($_POST['captcha']);

in file register-plus.php (both in register-plus home directory).

Beju
Unfortunately, many servers have file_get_contents disabled – so that fix will just cause more issues than it fixes. Also, I’m no security expert, but I don’t think using a $_SESSION variable in the image script will allow anyone to access your $_SESSION data. This will only create the $_SESSION data on the server the image is hosted on, not on a server linking to the image file. This seems to be a common practice for Captcha Scripts – so unless you can prove otherwise, I’m going to stick with it as it is the most compatible method I can find.

I’m going to change the Session key name in case it’s conflicting with something else on the server and add in md5 just cause it seems better. I’ll put up the upgrade and you guys can let me know if it changes anything for you.

raygene
Not sure what you mean by losing the “Remember Me” next to the checkbox – is the text gone and just a blank checkbox? This is another anomaly that doesn’t occur for me!

vanesta
Any chance you could answer those questions I posted above? That would help me figure out the problem. Cheers!

Plugin updated – let me know if it helped at all!

skullbit
it’s not too hard to replace file_get_contents with fopen,fread,fclose, isn’t it?
about $_SESSION var, you are right. I’m not going to prove You anything, I can only explain that, if I understand correctly, You were trying to modify the main $_SESSION variable (in wp-login.php) in a script which was called as an image! I don’t think it’ll work, since that “image” starts new session, and when it finishes execution, the session is destroyed and so are its session variables.
I can prove You something else: try to var_dump($_SESSION); right before $key=substr($_SESSION['key'],0,5); in register-plus.php.
Mine shows NULL. But I may be wrong. Maybe it somehow bases on WP or server configuration…? I’m not sure, I’ve installed wordpress yesterday;)

I’ll stick with my version for some time – it’s ugly, but it works;)

Hello –

I just tried out this plugin, and I’m afraid that I’m getting the same Image Validation problem. I’m on a Linux server, Apache version 1.3.41 (Unix), PHP version 5.2.5, MySQL version 4.1.22-standard.; and I just installed the newest version of WordPress last night. Currently active plugins, other than Register Plus: Akismet, Replace WP-Version and Yawasp.

Thank you for your help!

Captcha same here and I don´t get an Email Verification!
with checked: Prevent fake email address registrations.

Ah forgot: This plugin full functionally is great!