Random CAPTCHA apparently validates users' responses with a newly randomized module, rather than the one that generates it.

For example, a form challenging user with a word-list CAPTCHA can give a response like "Math CAPTCHA accepts no more than 3 character inputs", and a new math CAPTCHA challenge is provided in the form instead. And the fun begins. Not just being intelligent, the human user has to be lucky enough to get the same randomized CAPTCHA to check his/her answer.

CommentFileSizeAuthor
#2 random_validation_bug.patch1.93 KBsoxofaan

Comments

soxofaan’s picture

soxofaan commented
Assigned: Unassigned » soxofaan

good catch

At first sight, this issue will be very hard to solve and will involve some changes to the base CAPTCHA module too.

I think it's best to drop the random CAPTCHA type submodule or at least to warn the site administrator about possible issues when e.g. the match CAPTCHA is selected as possible challenge.

soxofaan’s picture

soxofaan commented
Status: Active » Fixed
StatusFileSize
new random_validation_bug.patch1.93 KB

fixed by http://drupal.org/cvs?commit=82154 (patch in attachment)

mattie-1’s picture

mattie-1 commented

It's funny, when trying the random captcha, I must have been lucky ;) So, if I understand correctly, this is not included yet in the dev snapshot, only in CVS right now? Also, if I want to keep using the stable branch, I should not use the random module, right?

soxofaan’s picture

soxofaan commented

So, if I understand correctly, this is not included yet in the dev snapshot, only in CVS right now?

At the time of your writing it was indeed only in CVS, at the time of this writing it is in the dev snapshot ;)
(dev snapshots are only taken every 12 hours)

Also, if I want to keep using the stable branch, I should not use the random module, right?

Technically, there is no stable branch (yet) because CAPTCHA pack depends on the base CAPTCHA module which is still in Release Candidate state currently. That's why there are only a RC2 and dev release of CAPTCHA pack.
Moreover, I think the dev version is more stable than the RC2 because some bugs are fixed (for random CAPTCHA). Nothing special or experimental was added (beside addition of ASCII art CAPTCHA).
Anyway, the random CAPTCHA from RC2 should not be used, indeed.

thanks for testing

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)