Article: Implementing the DotNetNuke CAPTCHA Control

jminatel · February 11th, 2009, 08:48 PM

This article is exerpted from chapter 12 "DotNetNuke User Controls" of the Wrox book Professional DotNetNuke Module Programming by Mitchel Sellers and is reused by permission of the publisher. This may not be reused without publisher permission. The guestbook example in this article is available as part of the code download for the book.

Registering the Controls

With the exception of Label and a handful of other controls, all DotNetNuke Web controls are contained as compiled controls inside the DotNetNuke.UI.WebControls namespace. Therefore, a single Register tag can handle registering them for use. This Register tag must be added at the top of any .ascx control that needs to use the controls. As illustrated by the following, the code is the same for C# and VB:

asp Code:

<%@ Register TagPrefix="dnn" Assembly="DotNetNuke" 
     Namespace="DotNetNuke.UI.WebControls" %>

This single Register tag grants access to all controls inside the DotNetNuke.UI.WebControls namespace. Inside the modified .ascx file, if you now type <dnn:, you will see IntelliSense information on all available controls.
The following sections take a look at the implementation of a few controls.
CAPTCHA Control

One of the most commonly used DotNetNuke Web controls is the CAPTCHA control. (The word “CAPTCHA” is actually an acronym standing for “completely automated public Turing test to tell computers and humans apart.”) This control provides a form of human verification, and in the case of the Guestbook module, it is designed to prevent bots (computer robots) from posting to the guestbook. The CAPTCHA control is very easy to implement after the Register tag has been added to the top of the SignGuestbook.ascx control.
Listing 12-1 shows the code that should be added to the control to define the row containing the CAPTCHA.
Listing 12-1 CAPTCHA Definition

asp Code:

</tr>
<tr runat="server" id="trCaptcha">
    <td class="SubHead">
        <dnn:Label ID="lblCaptcha" runat="server" 
              ControlName="ctlCaptcha"
            Suffix=":" />
    </td>
    <td>
        <dnn:CaptchaControl runat="server" CssClass="normal" 
              CaptchaLength="5"  />
    </td>
</tr>
<tr>
    <td colspan="2">&nbsp;</td>
</tr>

This code sample shows a very minimal configuration of the CAPTCHA control, with the specification of a total number of characters. Table 12-1 provides a list of other helpful properties that can be set on the CAPTCHA control.
Table 12-1
Property Name Description
CaptchaChars The set of characters that could be used to create the CAPTCHA
CaptchaHeight Height of the CAPTCHA
CaptchaLength Total number of characters to use in the CAPTCHA
CaptchaWidth Width of the CAPTCHA
CssClass The CSS class used by the control
Text The prompt Text used

With the CAPTCHA control added to the Guestbook module, you can now hook it up on the back end. Inside the Page_Load method of the SignGuestbook module, you must validate the CAPTCHA. Once you have established the settings, you set the visibility on the CAPTCHA control row.
To do this, add the following code to the Page_Load method. Listing 12-2 shows the C# implementation and Listing 12-3 shows the code additions for the VB module.
Listing 12-2 C# Code Addition for Page_Load

csharp Code:

bool allowAnonPosting = bool.Parse(allowAnon.ToString());
bool useCaptcha = 
     bool.Parse(Settings["WROX_Guestbook_EnableCaptcha"].ToString());
trCaptcha.Visible = useCaptcha;
 
if (UserId == -1 && !allowAnonPosting)

Listing 12-3 VB Code Addition for Page_Load

vbnet Code:

Dim allowAnon As Boolean
allowAnon = Boolean.Parse(CType(Settings
     ("WROX_Guestbook_AllowAnon"), String))
Dim useCaptcha As Boolean
useCaptcha = Boolean.Parse
     (CType(Settings("WROX_Guestbook_EnableCaptcha"), String))
trCaptcha.Visible = useCaptcha
 
If UserId = -1 AndAlso Not allowAnon Then

The final step of the process is to modify the code inside the btnSign_Click event to check for the CAPTCHA’s IsValid property (in addition to Page.IsValid) if the CAPTCHA is enabled. This is done by adding the code shown in Listing 12-4 (C#) or Listing 12-5 (VB) to the modules. This is a simple conditional check. Now the module can be secured from malicious use.
Listing 12-4 C# CAPTCHA Check Code

csharp Code:

bool useCaptcha = bool.Parse
     (Settings["WROX_Guestbook_EnableCaptcha"].ToString());
 
if (Page.IsValid && 
     (!useCaptcha  || (useCaptcha && ctlCaptcha.IsValid)))
{

Listing 12-5 VB CAPTCHA Check Code

vbnet Code:

Dim useCaptcha As Boolean
useCaptcha = Boolean.Parse
     (CType(Settings("WROX_Guestbook_EnableCaptcha"), String))
 
If Page.IsValid AndAlso (Not useCaptcha Or 
     (useCaptcha And ctlCaptcha.IsValid)) Then

Overall, this is a very simple control to use. After building the changes and enabling the CAPTCHA for the guestbook, you can see a new control on the page prompting for the input of the code. This control must be used for any system that accepts input from unauthenticated users.