Allow captchas on admin forms

I'm not really convinced that it would be a good idea to add this to the "official" version.

If you let untrusted user poke around in administrative pages, I don't know what CAPTCHA could protect, as will only keep bots out, while evil human are not stopped. It could only prevent automated nuking of the demosite.

There are some usability issues with the current CAPTCHA admin, generally people not getting the concept of the CAPTCHA adminstrative links. Adding this patch would only make the admin interface harder and more bloated. So I think the patch would make it worse for more people than it would be good for the (only the exotic use case of demo sites).

Moreover I think the elseif condition in the patch is wrong and should be something like

  elseif (user_access('administer CAPTCHA settings') && (variable_get('captcha_administration_admin_mode', FALSE) || variable_get('captcha_administration_mode', FALSE) && arg(0) != 'admin')) {

There is actually already sort of a workaround.
It's only the CAPTCHA administration links that do not show up on the admin pages. If a challenge is however is set on an admin page, it will show up for untrusted users. The only tricky thing is how to enable a challenge on an admin page if there are no adminsitration links. It's possible, but not obvious. You need at least the form_id of the form you want to add a CAPTCHA to. Then you have two options (for version 5.x-3.x):

• Add it to the database in the captcha_point table (this could be done programmatically in the Demo module). For example, in captcha.install:
  

    $form_ids = array('comment_form', 'contact_mail_user', 'contact_mail_page',  'user_register', 'user_pass', 'user_login', 'user_login_block');
    foreach ($form_ids as $form_id) {
      db_query("INSERT INTO {captcha_points} (form_id, module, type) VALUES ('%s', NULL, NULL)", $form_id);
    }
  

• visit ?q=admin/user/captcha/$form_id/enable on your site with $form_id replaced with the actual form_id and the form_id will also be added to the captcha_points table.

in the 6.x-1.x and HEAD version there is also an extra form for adding arbitrary form_id's (see http://drupal.org/node/214557).

Hope this gives some inspiration on how to solve this

Another solution I can think of is that the demo module adds the CAPTCHA administration links to the admin forms.
To make this easier, I could refactor the CAPTCHA administration link adding code into a function so you only need to call one function.

I still think you forgot a check for arg(0) != 'admin' in the patch from #4
see attached patch

FYI
the patches at http://drupal.org/node/214557#comment-777749 make it possible to add arbitrary form_id's with a simple form (http://drupal.org/files/issues/captcha_point_add_snapshot6.png)

would this be of any help or is obtaining a form_id from a form too difficult for your intended users?

duplicate of #287907: admin CAPTCHA preview, CAPTCHAs for admins, demo site CAPTCHAs and #445026: Allow CAPTCHAs on Admin Pages