0
  1. On the registration form page, you take note of the captcha code and fill the form with errors (i.e.: unmatched passwords).
  2. Reload the page , you now have a new captcha image.
  3. Fill the form correctly (i.e.: matching passwords) and enter the old captcha code you got in step 1
  4. submit the form

The form submits, while it should not. The security guys don't like that and I need a way to fix this.

Any ideas ?


Side note : I'm using freemember extension and reCaptcha extension does not seem to play nicely with free member. (the problem occurs even on default EE install)

  • I have same issue without any extensions and using channel:form. In my case the captcha field does not validating at all. You can submit the form with blank value for captcha. – Vladyn Jun 28 '16 at 7:36
  • Just posted what I did, it's a hack, but had no other solution. – laurent Jun 28 '16 at 10:59
0

What I've done is delete all existing captchas for current IP before creating new one. Drawbacks are minors, except it's a hack...

I post here as it might help others.

Around line 1530 in expressionengine/libraries/Functions.php

add following line

ee()->db->query("DELETE FROM exp_captcha WHERE ip_address = '".ee()->input->ip_address()."' OR date < UNIX_TIMESTAMP()-1200");

before

ee()->db->query("INSERT INTO exp_captcha (date, ip_address, word) VALUES (UNIX_TIMESTAMP(), '".ee()->input->ip_address()."', '".ee()->db->escape_str($word)."')");
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.