When testing 161572, I noticed that even though it does say it denies the user when logging in with the incorrect captcha information, it still starts the user session and the user is logged in. Try this:
After updating to the latest Captcha 3.x and running update.php, add a captcha to the user_login form. Now goto user, you'll see a Captcha form at the bottom. Put in your username and password, and the incorrect captcha. Press Submit, and you'll be "denied" access. Now goto ?q=user again in your browser and you'll see that you're now logged in. Strange? Yes.
| Comment | File | Size | Author |
|---|---|---|---|
| #7 | captcha_user_login_2.patch | 1.06 KB | soxofaan |
| #6 | captcha_user_login.patch | 1.09 KB | soxofaan |
| #2 | captcha.module.login_.patch | 932 bytes | robloach |
Comments
Comment #1
robloachThis issue has to be resolved before the code freeze. Sorry about sticking these two forms in by default guys. There are two solutions:
1) Remove the forms from the selection in the settings
2) Resolve the issue by making the user login work with Captcha
Comment #2
robloachThis patch works around the user login process before the Captcha stuff by forcing the user to logout if they entered the incorrect Captcha information. It makes Captcha work on both the user login block and the user login page.
Comment #3
robloachCould you guys please do a bit of testing with this?
1) Apply the patch
2) Logout and try to login with the right credentials, but incorrect captcha
3) Re-visit ?q=user
4) Repeat, testing with different methods
Comment #4
soxofaan commentedI think there is something wrong with the approach. In my test setup captcha_validate() is called before user_login_validate() (which logs the user in). In the patch you try to log the user out when the CAPTCHA was wrong, but the user is not logged in at that point. It can be seen in the watchdog messages like "Session closed for user." (note the absence of the user name).
Practically the user_logout() in captcha_validate() is equivalent with drupal_goto().
Comment #5
robloachIf user_login_validate() is called before captcha_validate(), couldn't we just than call drupal_goto() to skip the call to user_login_validate()?
We have to get user logins compatible with Captcha before 3.0 final.
Comment #6
soxofaan commentedHere is a patch which uses drupal_goto() instead of user_logout()
Comment #7
soxofaan commentedSorry, new version of patch (the trick with drupal_destination() from the patch at #6 was not needed).
Very simple solution and it works for me.
Even the error message "wrong CAPTCHA answer" still shows up on a wrong response.
The only remaining issue I still see is that the CAPTCHA form element is not highlighted (with the "error" CSS class) after a wrong response.
Comment #8
robloachTested and it works!
Comment #9
robloachExcellent. Thanks for helping with this one.
Comment #10
(not verified) commented