Problem/Motivation

ALTCHA is broken without "Access content" (published) permission for Anonymous role!

In a closed application I was wondering why ALTCHA always showed "Verification failed" with a 403 AJAX result.

Finally I found the reason: The route it exposes relies on "Access published content" permission, which definitely makes no sense for exactly this case, where Anonymous roles should never see any content!

Steps to reproduce

See above

Proposed resolution

Remove the permission for the captcha URLs

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork altcha-3608725

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

anybody created an issue. See original summary.

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented
Title: ALTCHA is broken without "Access published content" permission for Guest » ALTCHA is broken without "Access content" permission for Guest
Issue summary: View changes
anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented
Status: Active » Needs review

Same issue in https://www.drupal.org/project/friendlycaptcha/issues/3577769 - for that reason I'm adding the same @todo here for the future. Think that makes sense.

anybody opened merge request !18

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented
Title: ALTCHA is broken without "Access content" permission for Guest » ALTCHA is broken without "Access content" permission for Anonymous
robindh’s picture

robindh commented

I don't see a direct issue with making the route accessible for everyone - but the added @todo is currently not clear to me. Can you elaborate?

robindh’s picture

robindh commented
Status: Needs review » Needs work
anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented

@robindh thanks. As written in #3 I copied that from #3577769: Access denied to /api/v1/puzzle

The idea is to only allow access to this route from the same origin, because no external resources should query the altcha route. Technically I'm not sure how to do it.

Any ideas? You decide if we should keep it as hint for the future. The idea behind makes sense to me. Maybe change the comment accordingly?

  • robindh committed 17e781c7 on 1.0.x authored by anybody 
    fix: #3608725 ALTCHA is broken without "Access content" permission for...
robindh’s picture

robindh commented
Status: Needs work » Fixed

Thanks! I've removed the todo since I think it would be very tricky to make it work on all possible drupal setups (multisite, multi-domain, ..).
Merged the access fix into 1.x and 2.x. Will make a new release soon

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • robindh committed 519e10ca on 2.0.x authored by anybody 
    fix: #3608725 ALTCHA is broken without "Access content" permission for...