Captcha

Revised by: Fraenkiman

Originally developed by NoWhereMan, Piero VDFN, Stanley, italian translation by Giacomo Margarito

Simple but effective captcha plugin. It brings more security, accessibility and bot defense.

The font Schoolbell-pMMy.ttf can be used privately and commercially under the Apache 2.0 license. (License information in the archive)

captcha1_2_2.zip | Requires FlatPress 1.4 Notturno or higher

• eSpeak or eSpeak-NG must be installed on the server and located in the system path (calling which espeak-ng or which espeak may return a valid path).
• Optionally, the lame codec for .mp3 output can also be installed on the web server for better compatibility with visitors' end devices.
• PHP functions exec and passthru (as well as shell_exec, system, proc_open) must not be disabled.
• No restrictive open_basedir setting may prevent the execution of eSpeak.

https://frank-web.dedyn.io

a) Install classic eSpeak:

sudo apt update
sudo apt install espeak

b) Or install the newer eSpeak-NG:

sudo apt update
sudo apt install espeak-ng

Check installation with:

which espeak
which espeak-ng

sudo apt install lame

Verify:

which lame

Make sure the following functions are NOT disabled in php.ini:

disable_functions =

These must NOT appear in disable_functions:

• exec
• shell_exec
• passthru
• system
• proc_open

If they are listed, remove them and restart the web server.

If open_basedir is set in php.ini or virtual host config, ensure it includes the directories for espeak and lame:

open_basedir = /var/www:/usr/bin:/usr/local/bin:/tmp

You can check active values with:

<?php
echo ini_get("open_basedir");
?>

• Fixed: no playback of the audio captcha on iOS
• Changed: The FlatPress session cookie is only set to samesite None for the duration of the delivery of the image captcha.

• Fixed: Correct solution in the Brave browser with incognito window outputs incorrect input.
• In addition to the image captcha, an audio captcha is now also offered if the server supports eSpeak.
• More robust security/rate limiting mechanisms.

• More resistant to bots/OCR because the image now uses real 24-bit color with alpha channel.
• Overall, the CAPTCHA is more difficult to crack using automated text recognition.
• New invisible field (“honeypot”) blocks more bots.
• Hidden timestamp field ensures that a captcha is only valid for a limited time.
• If the bot takes less than 6 seconds to enter, this leads to an error.

• Fixed: Refreshing the captcha image was not possible when using the Firefox browser

• Revised captcha image
• Refresh link added
• New font Schoolbell-pMMy.ttf, which can be used personally, but also commercially
• Added check for required PHP extensions
• Error message in server log with active Accessible Antispam Plugin fixed

• Little bugfix update by Arvid Zimmermann

• Updated language files by Giacomo Margarito

Support

Please ask for help on the FlatPress Forum