Index: captcha.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/captcha/captcha.module,v
retrieving revision 1.42.2.37
diff -u -r1.42.2.37 captcha.module
--- captcha.module	24 Oct 2007 20:15:11 -0000	1.42.2.37
+++ captcha.module	27 Oct 2007 14:17:38 -0000
@@ -16,6 +16,10 @@
 define('CAPTCHA_PERSISTENCE_SKIP_ONCE_SUCCESSFUL_PER_FORM', 2);
 define('CAPTCHA_PERSISTENCE_SKIP_ONCE_SUCCESSFUL', 3);
 
+define('CAPTCHA_FAILURE_REACTION_FORM_ERROR', 1);
+define('CAPTCHA_FAILURE_REACTION_SPARTAN403', 2);
+define('CAPTCHA_FAILURE_REACTION_DRUPAL_ACCESS_DENIED', 3);
+
 /**
  * Implementation of hook_help().
  */
@@ -279,6 +283,18 @@
     '#description' => t('Report information about wrong responses to the !watchdoglog.', array('!watchdoglog' => l('log', 'admin/logs/watchdog'))),
     '#default_value' => variable_get('captcha_log_wrong_responses', FALSE),
   );
+  // option for how to react on a wrong answer
+  $form['captcha_reaction_on_wrong_response'] = array(
+    '#type' => 'radios',
+    '#title' => t('Reaction on wrong response'),
+    '#options' => array(
+      CAPTCHA_FAILURE_REACTION_FORM_ERROR => t('Reshow form with error message (default behavior).'),
+      CAPTCHA_FAILURE_REACTION_DRUPAL_ACCESS_DENIED => t('Show the <a href="!errorreporting">access denied error page</a>.', array('!errorreporting' => url('admin/settings/error-reporting'))),
+      CAPTCHA_FAILURE_REACTION_SPARTAN403 => t('Show bare error message (with HTTP status code 403).'),
+    ),
+    '#default_value' => variable_get('captcha_reaction_on_wrong_response', CAPTCHA_FAILURE_REACTION_FORM_ERROR),
+    '#description' => t('By changing the reaction on wrong responses, you can reduce the resources spent on processing wrong responses, presumably for spammers. Note, however, that this is less user friendly to human users, which can result in errors as well.'),
+  );
   // submit button
   $form['submit'] = array(
     '#type' => 'submit',
@@ -329,6 +345,7 @@
       variable_set('captcha_description', $form_values['captcha_description']);
     }
     variable_set('captcha_persistence', $form_values['captcha_persistence']);
+    variable_set('captcha_reaction_on_wrong_response', $form_values['captcha_reaction_on_wrong_response']);
     variable_set('captcha_log_wrong_responses', $form_values['captcha_log_wrong_responses']);
     drupal_set_message(t('The CAPTCHA settings were saved.'), 'status');
   }
@@ -542,6 +559,27 @@
 }
 
 /**
+ * Helper function for reacting on validate errors
+ */
+function _captcha_form_set_error($name, $message) {
+  switch (variable_get('captcha_reaction_on_wrong_response', CAPTCHA_FAILURE_REACTION_FORM_ERROR)) {
+    case CAPTCHA_FAILURE_REACTION_FORM_ERROR:
+      form_set_error($name, $message);
+      break;
+    case CAPTCHA_FAILURE_REACTION_SPARTAN403:
+      header('HTTP/1.1 403 Forbidden');
+      print $message;
+      // stop further validation, processing and subsequent form rendering
+      exit();
+      break;
+    case CAPTCHA_FAILURE_REACTION_DRUPAL_ACCESS_DENIED:
+      drupal_access_denied();
+      exit();
+      break;
+  }
+}
+
+/**
  * Implementation of form #validate.
  */
 function captcha_validate($form_values) {
@@ -555,7 +593,7 @@
   $captcha_token = $form_values['#post']['captcha_token'];
   // Check if captcha_token exists
   if (!isset($_SESSION['captcha'][$form_id][$captcha_token])) {
-    form_set_error('captcha_token', t('Invalid CAPTCHA token.'));
+    _captcha_form_set_error('captcha_token', t('Invalid CAPTCHA token.'));
   }
   // Check answer
   if ($captcha_response === $_SESSION['captcha'][$form_id][$captcha_token]) {
@@ -564,7 +602,7 @@
   }
   else {
     // set form error
-    form_set_error('captcha_response', t('The answer you entered for the CAPTCHA was not correct.'));
+    _captcha_form_set_error('captcha_response', t('The answer you entered for the CAPTCHA was not correct.'));
     // update wrong response counter
     variable_set('captcha_wrong_response_counter', variable_get('captcha_wrong_response_counter', 0) + 1);
     // log to watchdog if needed