Hi,

Perhaps a useful security issue would be to forbid many attempts... like for example we setup 10 attempts, and if a user makes 10 errors or so, he cannot access the captcha anymore until... let's say... 10 minutes...

Because if not, then someone who wants to hack our server can do thousands of attempts to crash the server.

And btw a link to reload another captcha could be useful, for example if we have an unreadable captcha...

Thanks

Comments

paul_gregory’s picture

paul_gregory commented

I second a maximum attempts feature as we've been having problems of mass spamming.

We use several webforms on our client's site and protected these with image CAPTCHA challenges. We then got bombarded with spam submissions one weekend that crashed the server - each one being flagged in the watchdog as an incorrect CAPTCHA response from the same IP. We thought we would be safe from this as we used the webform submission limits but it looks like Captcha jumps in before webform can log an attempted submission so the spam user never reaches the limit.

Cheers

soxofaan’s picture

soxofaan commented
Version: 6.x-1.x-dev » 6.x-2.x-dev

this feature would require an additional database table in the 6.x-1.x and 5.x-3.x branches.
In head there is a experimental 6.x-2.x branch in preparation where it could be included in the default table, I think

However, for the moment I don't have time (and I expect the other maintainers too) to work on this

so all I can say is: patches are welcome ;)

wundo’s picture

wundo commented
Issue summary: View changes
Status: Active » Closed (works as designed)