Greetings fellow mollomites.

I had the strangest issue with mollom on every site we have. When I goto a form protected by mollom and i write down the code from the Image Captcha and then request the Audio capture I can still input the Image Captcha code and proceed.

To explain further the Image capture code was "ff26u". I then clicked on the Audio capture and it pronounced "wurxm". I entered "wurxm" the capture failed. I because this happened because the back-end is not getting updated when the request for the audio capture is made.

In my second test I copied the Image Capture code down as "m42cr" then requested the Audio Captcha but entered the Image Capture in to test my theory and the Image Capture code inserted into the Audio Capture worked!

So, eh, Houston I think we have a problem...

Has anyone else had this problem? It seems like a big bug to go unnoticed.

Thanks guys!

Jon

Comments

dave reid’s picture

Version: 6.x-1.2 » 6.x-1.10
Priority: Critical » Normal
Status: Active » Postponed (maintainer needs more info)

Please test with the lastest module version and re-confirm this still happens. I haven't been able to reproduce this locally.

nymo’s picture

Version: 6.x-1.10 » 6.x-1.11

I'm having the same problem on 6.x-1.11, whatever audio plays, it's the image answer that works. Tested on the drupal's user registration form.

sun’s picture

Title: Audio capture failing » Audio CAPTCHA not accepting correct response
Priority: Normal » Critical
Status: Postponed (maintainer needs more info) » Needs review
StatusFileSize
new4.23 KB

Sounds like a confirmation then.

Actually, I'm not sure how this was able to work in the past. Probably some magic involved...

Attached patch - untested - should hopefully do the trick.

sun’s picture

Status: Needs review » Reviewed & tested by the community
StatusFileSize
new6.56 KB

Alright - tested that patch on a production site, fixed a conflict caused by my custom theme, and can confirm that this patch is working.

dries’s picture

Version: 6.x-1.11 » 7.x-1.x-dev
Status: Reviewed & tested by the community » Patch (to be ported)

Committed to DRUPAL-6--1. Thanks a lot, sun.

sun’s picture

Status: Patch (to be ported) » Reviewed & tested by the community
StatusFileSize
new8.01 KB

Ported to D7. Required a couple of adjustments, because we no longer use {cache_mollom} but native form caching there, so we additionally need the $form_build_id to update the Mollom session id in the cached form state.

At some point in the future, this entire code should probably be updated to use the new AJAX framework instead (i.e. invoke a real form submission, limiting validation errors, etc.), but that's way too much for now.

Note that this patch "should work", but I don't have a production site running on D7 with Mollom yet ;)

I'd therefore recommend to commit this patch and defer in-production testing to when D7 can actually be used for production sites.

dries’s picture

I don't understand this part. Looks like a hack?

+++ mollom.pages.inc	9 Mar 2010 16:58:26 -0000
@@ -47,14 +61,30 @@ function mollom_captcha_js($type, $sessi
+  // Update cached session id for the form.
+  if (!empty($response['session_id'])) {
+    if ($cache = cache_get('form_state_' . $form_build_id, 'cache_form')) {
+      $form_state = $cache->data;
+      $form_state['mollom']['session_id'] = $response['session_id'];
+      cache_set('form_state_' . $form_build_id, $form_state, 'cache_form', REQUEST_TIME + 21600);
+      // After successfully updating the cache, replace the original session id.
+      $mollom_session_id = $response['session_id'];
+    }
+  }

This makes sense but it would be great to have a better code comment because one might expect the form API to handle that more gracefully -- instead of having to fiddle with the form cache ourselves.

+++ mollom.js	9 Mar 2010 16:51:57 -0000
@@ -20,47 +20,58 @@ Drupal.behaviors.mollomPrivacy = {
+    // @todo Pass local behavior settings.

I don't understand this todo. Maybe you could expand the code comment a bit?

+++ mollom.js	9 Mar 2010 16:51:57 -0000
@@ -20,47 +20,58 @@ Drupal.behaviors.mollomPrivacy = {
+      if (!(data && data.content)) {
+        return;
+      }

I don't understand this part. Looks like a hack.

Status: Reviewed & tested by the community » Needs work

The last submitted patch, mollom-HEAD.audio-captcha.6.patch, failed testing.

sun’s picture

Status: Needs work » Needs review
StatusFileSize
new8.84 KB

Added plenty of docs. :)

re 3): righto, that was only remotely possible in D6, removed that condition.

Status: Needs review » Needs work

The last submitted patch, mollom-HEAD.audio-captcha.9.patch, failed testing.

sun’s picture

Status: Needs work » Needs review

Those test fails are caused by something else, very odd.

dries’s picture

Status: Needs review » Fixed

Committed to CVS HEAD. Thanks.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

  • Commit 297d94d on master, fai6, 8.x-2.x, fbajs, actions by Dries:
    - Patch #640450 by sun: fixed audio CAPTCHA not accepting correct...

  • Commit 297d94d on master, fai6, 8.x-2.x, fbajs, actions by Dries:
    - Patch #640450 by sun: fixed audio CAPTCHA not accepting correct...