There was a change on the 23 may #2474959: CAPTCHA session reuse attack detected.

It changed code in _captcha_get_posted_captcha_info to "Invalidate CAPTCHA token to avoid reuse", adding execute to the database update call. This has resulted in the testPersistenceAlways test in CaptchaPersistenceTestCase to fail.

        // Invalidate CAPTCHA token to avoid reuse.
        \Drupal::database()->update('captcha_sessions')
          ->fields(['token' => NULL])
          ->condition('csid', $posted_captcha_sid)
          ->execute();
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

elachlan created an issue. See original summary.

elachlan’s picture

Priority: Normal » Critical

set to critical because HEAD is failing.

elachlan’s picture

  • elachlan committed e8ea687 on 8.x-1.x
    #2474959, #2992697 Fix for failing test
    
elachlan’s picture

Status: Active » Needs review
FileSize
685 bytes

Status: Needs review » Needs work

The last submitted patch, 5: 2992697-5.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

  • elachlan committed 294c1a2 on 8.x-1.x
    Issue #2992697 by elachlan: Testing failing on 8.x Branch
    
elachlan’s picture

Status: Needs work » Needs review
FileSize
1.2 KB

I found mention to the #executes_submit_callback in the other issue.

Status: Needs review » Needs work

The last submitted patch, 8: 2992697-7.patch, failed testing. View results

elachlan’s picture

Status: Needs work » Needs review
FileSize
1.2 KB

Status: Needs review » Needs work

The last submitted patch, 10: 2992697-9.patch, failed testing. View results

elachlan’s picture

Status: Needs work » Needs review
Related issues: +#810534: Fix CAPTCHA session reuse
FileSize
1.57 KB

I think that the code to invalidate the token is not needed if the session is invalidated.

Previously some code related to the token was commented out, which is related to this. That was done in #810534: Fix CAPTCHA session reuse.

  • elachlan committed 83f4bbc on 8.x-1.x
    Issue #2992697 by elachlan: Testing failing on 8.x Branch
    
elachlan’s picture

Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.