Spam customer registrations, CAPTCHA not stopping it, Max field rule being bypassed

Question

Over the last few days we have been getting spam customer registrations, every 90mins about 20 "accounts" are created in a few mins, with the first name being eg Рассадина Зинаида Пантелеймоновна, мы определили победителей совместного конкурса с помощью Google и Random.Org: https://www.google.com/#btnI=RandomOrg-%32&q=b%54%63%320%31%38rU

Its seems the idea is to spam using our welcome email with the link in the first name field going to a targets email ( we got a reported spam warning from hotmail)

We already have captcha running as suggested in this answer: https://stackoverflow.com/questions/47144150/preventing-spam-direct-post-request-customer-registrations-in-magento

and we have changed the maxlength on the create account page for the first and second name from 255 to 50 thinking at least we can stop the there goal of posting the long url link in the first name. But that is being bypassed and they are still able to post first names with 200+ characters.

Is there a way to enforce the 50 character limit?

Answer 1

I had the same problem and solved it as follows.

Go with phpmyadmin to the database table customer_eav_attribute and edit the record 5 (attribute_id 5).

Edit content table column validate_rules -> max_text_length "; i: 255" to "-> max_text_length"; i: 65.

attribute_id 5 is the first name and the values in the validate_rules are checked before the update to the database.

Because the bot almost always enters 155 characters. Should it only be rejected from now on.

Answer 2

Please use the following code for adding google invisible captcha and the following code server-side validation.

<?php class Addpeople_Validatecaptcha_Model_Customer_Customer extends Mage_Customer_Model_Customer {

public function validate()
{
    $errors = array();
    if (!Zend_Validate::is( trim($this->getFirstname()) , 'NotEmpty')) {
        $errors[] = Mage::helper('customer')->__('The first name cannot be empty.');
    }

    if (!Zend_Validate::is( trim($this->getLastname()) , 'NotEmpty')) {
        $errors[] = Mage::helper('customer')->__('The last name cannot be empty.');
    }

    if (!Zend_Validate::is($this->getEmail(), 'EmailAddress')) {
        $errors[] = Mage::helper('customer')->__('Invalid email address "%s".', $this->getEmail());
    }

    $password = $this->getPassword();
    if (!$this->getId() && !Zend_Validate::is($password , 'NotEmpty')) {
        $errors[] = Mage::helper('customer')->__('The password cannot be empty.');
    }
    if (strlen($password) && !Zend_Validate::is($password, 'StringLength', array(self::MINIMUM_PASSWORD_LENGTH))) {
        $errors[] = Mage::helper('customer')
            ->__('The minimum password length is %s', self::MINIMUM_PASSWORD_LENGTH);
    }
    if (strlen($password) && !Zend_Validate::is($password, 'StringLength', array('max' => self::MAXIMUM_PASSWORD_LENGTH))) {
        $errors[] = Mage::helper('customer')
            ->__('Please enter a password with at most %s characters.', self::MAXIMUM_PASSWORD_LENGTH);
    }
    $confirmation = $this->getPasswordConfirmation();
    if ($password != $confirmation) {
        $errors[] = Mage::helper('customer')->__('Please make sure your passwords match.');
    }

    $entityType = Mage::getSingleton('eav/config')->getEntityType('customer');
    $attribute = Mage::getModel('customer/attribute')->loadByCode($entityType, 'dob');
    if ($attribute->getIsRequired() && '' == trim($this->getDob())) {
        $errors[] = Mage::helper('customer')->__('The Date of Birth is required.');
    }
    $attribute = Mage::getModel('customer/attribute')->loadByCode($entityType, 'taxvat');
    if ($attribute->getIsRequired() && '' == trim($this->getTaxvat())) {
        $errors[] = Mage::helper('customer')->__('The TAX/VAT number is required.');
    }
    $attribute = Mage::getModel('customer/attribute')->loadByCode($entityType, 'gender');
    if ($attribute->getIsRequired() && '' == trim($this->getGender())) {
        $errors[] = Mage::helper('customer')->__('Gender is required.');
    }

    if( Mage::getStoreConfig('validate_captcha/server_side_validation/enabled') ) {
        $errors = $this->validateCaptcha($errors);
    }

    if (empty($errors)) {
        return true;
    }
    return $errors;
}

private function validateCaptcha( $errors ) {

    /* additional reCAPTCHA validation */

    $action = Mage::app()->getRequest()->getActionName();
    if ( $action == 'createpost' ) {

        $captcha = Mage::app()->getRequest()->getPost('g-recaptcha-response', 1);
        if ( $captcha == '' ) {

            $errors[] = Mage::helper('customer')->__('Please check the reCAPTCHA field to continue.');
        } else {
            $params = array();
            $params['secret'] =  Mage::getStoreConfig('validate_captcha/server_side_validation/secret_key');
            $params['response'] = Mage::app()->getRequest()->getPost('g-recaptcha-response', 1);
            $params['remoteip'] = $_SERVER['REMOTE_ADDR'];

            $params_string = http_build_query($params);
            $url = 'https://www.google.com/recaptcha/api/siteverify?'.$params_string;

            $ch = curl_init();
            curl_setopt( $ch, CURLOPT_URL, $url );
            curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1);
            $response = curl_exec( $ch );

            $result = json_decode( $response, true );
            if ( trim( $result['success'] ) != true ) {

                // This will be shown at the top of the registration page
                $errors[] = Mage::helper('customer')->__('reCAPTCHA unable to verify.');
            }
        }
    }

}}

Please refer my website for layout and config file.

https://www.pearlbells.co.uk/invisible-recaptcha-register-form-magento/