[Plugin: Cimy User Extra Fields] User avoiding reCAPTCHA can still register

  • Resolved corij

    (@corij)


    12 years, 5 months ago

    Ran into a potential security issue that would allow any user to bypass reCAPTCHA and registration will still work.

    I am using Firefox (8.0) and the RequestPolicy add-in (v0.5.23). That add-on allows me to block browser requests to other sites. In this case, it was blocking the request to google for the reCAPTCHA.
    With it blocked, I expected the registration to fail, as it would not have a valid code (since it never showed up on the page).
    Turns out it let me register as if there was no reCAPTCHA (of course, there was none on screen).

    I don’t think this is an reCAPTCHA problem. If I use a service like hotfile.com, and I block google/recaptcha, it won’t let me continue. I have to enable/unblock in order for it to continue. However, with the cimy plug-in, if i block google/recaptcha, it proceeds as if it never needed the verification.
    If I unblock google/recaptcha for when accessing my site using cimy, it works as expected and prevents registration if i mistype the code.

    I have not tried any other registration enhancement plug-ins on wordpress, so I don’t know if the others would behave similarly.

    Installation info:
    Wordpress 2.3.1
    Cimy 2.2.0
    Role Scoper 1.3.46
    Category Icons Lite 1.0.4

    http://wordpress.org/extend/plugins/cimy-user-extra-fields/

Viewing 6 replies - 1 through 6 (of 6 total)
  • Plugin Author Marco Cimmino

    (@cimmo)

    12 years, 5 months ago

    I’ll take a look, thanks for the detailed bug report, much appreciated!

    Plugin Author Marco Cimmino

    (@cimmo)

    12 years, 5 months ago

    Fixed in next version, you can try the development version here:
    http://downloads.wordpress.org/plugin/cimy-user-extra-fields.zip

    it says v2.2.0 but has the fix already 😉
    thanks

    Plugin Author Marco Cimmino

    (@cimmo)

    12 years, 4 months ago

    My initial fix broke several things and wasn’t secure enough. v2.3.1 contains a new fix that should work quite well.

    Let me know.

    icc97

    (@icc97)

    12 years, 2 months ago

    Hi Marco,

    I’m pretty sure this is still not working. The fix you added in v2.3.1 (add_action('register_post', 'cimy_registration_captcha_check', 11, 3);) relies on there being a do_action(‘register_post’) somewhere. The only place that action exists is in your OFFICIAL_README.txt where you advise people to fix the Theme My Login plugin with adding do_action(‘register_post’).

    I’m guessing that you have that plugin installed with that code where you test. However if you don’t have that plugin with your extra code the captcha_check is never called.

    I fixed this by adding a call to cimy_registration_captcha_check into your cimy_profile_check_wrapper function.

    icc97

    (@icc97)

    12 years, 2 months ago

    Actaully I’ve just realised of course my fix creates an error when you try to update the profile.

    Plugin Author Marco Cimmino

    (@cimmo)

    12 years, 2 months ago

    Please try v2.3.6 should work.

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘[Plugin: Cimy User Extra Fields] User avoiding reCAPTCHA can still register’ is closed to new replies.