I didn't report this as a bug because it may be by design. If you have a drupal site set up such that the anonymous user cannot view content (doesnt have "access content") the captcha will not display on the registration form.

It seems like it would be a good idea to uncouple this *if possible* so sites could hide content from users until they register.

Comments

arnabdotorg’s picture

arnabdotorg commented
Assigned: Unassigned » arnabdotorg

Thanks for pointing this out. This is because of:


  $items[] = array('path' => 'captcha/image'.$suffix, 'title' => t('captcha image'),
    'callback' => '_captcha_image', 'access' => user_access('access content'),
    'type' => MENU_CALLBACK);

The problem is that giving this 100% public access would mean opening up a potential DOS attack point, since image generation is an expensive task. Would be nice to hear more opinions about this before I replace user_access with a generic TRUE value.

arnabdotorg’s picture

arnabdotorg commented

I'm adding another permission using the _perms hook; you'll now need to enable access for captcha for every role via admin > access control.
This makes things more complex, but it's a safer way to do things.

Marking as fixed, committing to all tested versions (4.6, 4.5, HEAD)

Anonymous’s picture

(not verified) commented