This bug was uncovered as a result of the tests I posted at http://drupal.org/node/271123 ... go SimpleTest!

When you have Mollom enabled for the contact form (either per-user or site-wide) and submit a message there that triggers a CAPTCHA, solving the CAPTCHA does not allow you to submit the form. You simply get the form right back again (but with the CAPTCHA gone) and no indication of what happened... essentially, it acts like a "preview" button more than a submit button. Looks like this bug occurs for creating nodes too.

Oddly enough, when trying this out by hand I noticed that the behavior is different depending on whether you are using a "real" Mollom key pair vs running Mollom in testing mode. For a real key pair, the first submission acts like a "preview", but if you hit the submit button again, then your message is sent. For testing mode, however, you can never seem to submit the contact form with a message that is 'unsure'... it just goes back and forth between giving you a CAPTCHA and not giving you one. (So luckily, the bug is less severe for the real case, but why it would be different for the two I have no idea at the moment.)

Comments

vasi’s picture

vasi commented

I can confirm this. What occurs is this:

1. User submit form, analysis shows it may be spam, displays form with CAPTCHA.
2. User responds to CAPTCHA, mollom_validate_captcha calls _mollom_register_captcha($form_state, FALSE) to remove the CAPTCHA. This is turn sets $form_state['rebuild'], so the form is rebuilt and shown again.
3. If the user submits this latest incarnation of the form, it will be allowed through because the mollom knows this session_id is a human. However, there is no indication to the user that he should re-submit. If I was a user, I would expect that when I got here, my contact mail had already gone through.

To solve this, I think _mollom_register_captcha should NOT set $form_state['rebuild'] if the CAPTCHA is being removed, AND the operation being performed is not a preview. A quick hack would be to change the if statement to:

if ($mode == MOLLOM_MODE_ANALYSIS && ($captcha || $form_state['clicked_button']['#value'] == t('Preview'))) {

Longer term, it might be better to add a function to decide "does this look like a preview?"

dries’s picture

dries commented
Status: Active » Fixed

This problem is fixed in the HEAD of DRUPAL-6--1. The fix will be part of the next release.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.