For display of the generated captcha image it's not use to protect it via drupals hook_menu() user_access() calls IMO.

Just set the 'access' => TRUE when defining the menu array in hook_menu().

Comments

arnabdotorg’s picture

arnabdotorg commented
Status: Active » Closed (works as designed)

This is a security property, won't fix. The menu permission is specifically for image modules. Image generation is a CPU / memory intensive task. Hence, if we were to enable image captchas _only_ for registered users on an intranet (small www server), we could easily DDOS the system by calling the image captcha repeatedly. Then again, I've decided to move this to captcha.image specifically, so it does not apply to captcha.module from next revision on.

arnabdotorg’s picture

arnabdotorg commented
Status: Closed (works as designed) » Closed (fixed)