CAPTCHA bypass with "undefined" [#995260]

Comment	File	Size	Author
#1	995260-undefined-hack-01.patch	1.6 KB	soxofaan

Comment #1

soxofaan commented 12 December 2010 at 01:05

Status	File	Size
new	995260-undefined-hack-01.patch	1.6 KB

Good catch! How did you find this?

attached patch should fix it

Log in or register to post comments

Comment #2

soxofaan commented 12 December 2010 at 01:05

Version:

6.x-2.3

» 6.x-2.x-dev

changing version to trigger test bot (hopefully)

Log in or register to post comments

Comment #3

soxofaan commented 12 December 2010 at 01:06

Status:

Active

» Needs review

status too

Log in or register to post comments

Comment #4

miopa commented 12 December 2010 at 06:13

I was wondering how many of the failed attempts were likely caused by human error as opposed to blocked spammers, and I noticed this in the dblog

comment_form post blocked by CAPTCHA module: challenge "Image" (by module "image_captcha"), user answered "", but the solution was "undefined".

The patch is fixing the bug, but now I get in the dblog

comment_form post blocked by CAPTCHA module: challenge "Image" (by module "image_captcha"), user answered "undefined", but the solution was "50af097255a6807dde16121aa7c05c36".

I think it would be better to have explanation that session reuse was detected in the log entry.

Log in or register to post comments

Comment #5

soxofaan commented 19 December 2010 at 00:41

Hi miopa,

I think it's best to commit the patch from #1 already.
You have a point about having more information about session reuse attacks in the log, but I think this fits nicely in this feature request of you: #998326: Separate log of wrong and empty responses