I installed the image_captcha_refresh module and figured out, that if i refresh the captcha, the validation of this field fails, because of the fact, that the rules aren´t updated.

The fact, that the solution of the captcha is being rendered into the rules javascript object is not quite secure.
An idea of mine is, to replace the rendered code with an ajax function, which fetches the sid, user-solution and token of the captcha, sends it to the server and the server compares this data with the data from the database. Maybe you could implement this, or is this to module-specific?

Comments

jelle_s’s picture

Status: Active » Fixed

Fixed in latest dev version.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.