Support AJAX request/file upload without refreshing the captcha [#2223219]

On AJAX calls CAPTCHA token gets regenerated even if the CAPTCHA element in not updated in the form

On a node form with plupload field, after you press UPLOAD the captcha token is regenerated during AJAX request, but the CAPTCHA image/element is not updated afterwards. So even if the user fills in the correct captcha (the one he sees), he will get an error message.

Tried the following:

First time this was fixed with image_captcha_refresh module and javascript. After the AJAX request the captcha was refreshed automatically. But this introduced an UX problem: if the captcha field was already filled by the user then the user has to fill it again and most of the times he will not see that the image was refreshed.
jay.dansand's sandbox: CAPTCHA AJAX Fix. With this the AJAX request returned HTTP STATUS 500 (probably some incompatibility with other modules or this version of captcha). It also looks a little bit hacky.

Proposed resolution

The patch attached to this ticked fixes that by checking $form_state['triggering_element']['#limit_validation_errors']. If the form is submitted and validation is limited to certain elements then it checks if the captcha is not in that list. If captcha shouldn't be validated, then the token it's not regenerated.

To do

For the problem mentioned in the beginning this patch did the trick, but I'm not sure if this will break other use cases or if it breaks security. Any feedback would be much appreciated.

Comment	File	Size	Author
#6	captcha-upload-issue.gif	28.45 KB	crutch
#1	captcha-ajax-fix-2223219-1.txt	658 bytes	Luxian
#1	captcha-ajax-fix-2223219-1.patch	2.71 KB	Luxian
#1
	captcha-ajax-fix.patch	2.68 KB	Luxian

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

Luxian

he/him

Romanian

Zurich Area

CreditAttribution: Luxian commented 24 March 2014 at 11:59

File	Size
captcha-ajax-fix-2223219-1.patch	2.71 KB

captcha-ajax-fix-2223219-1.txt	658 bytes

Wrong variable used in foreach. New patch attached.

Comment #2

podarok

🇺🇦 he/him/his

Ukrainian

Ukraine

CreditAttribution: podarok commented 21 June 2014 at 15:44

1: captcha-ajax-fix-2223219-1.patch queued for re-testing.

Comment #3

sic CreditAttribution: sic commented 23 June 2014 at 09:43

thanks for the fix!

Comment #4

burnsjeremy CreditAttribution: burnsjeremy commented 29 June 2014 at 02:42

Hi,

Thanks for the fix! I have made a few notes on using this patch and the CAPTCHA module just incase anyone else runs across this until it is fixed.

I came across this issue while trying to use CAPTCHA/reCAPTCHA along with a webform with an AJAX file upload.

I initially had the setting "Use AJAX API" turned on and with that reCAPTCHA disappears when the file upload happens even with the patch.
So turning off the "Use AJAX API" setting on reCAPTCHA and not using the patch gives the session reuse attack detected message still (it seems that the form submitted still).
Applying the patch with the "Use AJAX API" turned off everything works correctly with the AJAX file upload and reCAPTCHA, no messages, no errors.

I will try to update this with more detail later and a possible root cause but with this info hopefully other users can navigate around them until they are completely fixed.

Thanks again for the patch.

Jeremy

Comment #5

Luxian

he/him

Romanian

Zurich Area

CreditAttribution: Luxian commented 21 August 2014 at 08:46

1 file was hidden/shown/deleted

File	Size
captcha-ajax-fix.patch	2.68 KB

Comment #6

crutch CreditAttribution: crutch commented 21 November 2014 at 20:13

File	Size
captcha-upload-issue.gif	28.45 KB

encountered with captcha & draggable captcha

error message just after upload and captcha solution doesn't pass have to manual refresh. Would this patch also fix this?

error message also seems out of place

Comment #7

Luxian

he/him

Romanian

Zurich Area

CreditAttribution: Luxian commented 21 November 2014 at 23:19

@burnsjeremy seems more like a webform integration issue.

@crutch: the error message usually appears after the first element rendered by ajax, that means the file uploaded triggered the issue, but I can't see any draggable element in your print screen.

Comment #8

divined CreditAttribution: divined commented 3 December 2014 at 08:39

#6 the same.

Patch not work. I see the message after uploading an image.

Comment #9

divined CreditAttribution: divined commented 3 December 2014 at 08:45

And captcha can't be validated after an image is uploaded.

Comment #10

crutch CreditAttribution: crutch commented 3 December 2014 at 17:54

@Luxian - the draggable items are the geometric shapes in the print screen to solve the riddle. The riddle can't be solved because the error is given directly after the upload of the file.

using the https://www.drupal.org/project/draggable_captcha add-on module

Comment #11

Luxian

he/him

Romanian

Zurich Area

CreditAttribution: Luxian commented 3 December 2014 at 22:47

@crutch: Aha! Yes, this patch should fix this. The message is there because only the file element is refresh during AJAX and that's why the message is there.

Comment #12

wundo CreditAttribution: wundo commented 8 December 2014 at 04:57

Status:

Needs review

» Needs work

@Luxian, which patch are you talking about?
I think you forgot to attach something.

Comment #13

divined CreditAttribution: divined commented 9 December 2014 at 15:39

We are using it:
https://www.drupal.org/project/draggable_captcha add-on module

Apply patch #1

And get this error.

Comment #14

Luxian

he/him

Romanian

Zurich Area

CreditAttribution: Luxian commented 12 December 2014 at 09:37

@wundo I'm talking about about #1 patch

@divined Unfortunately I have no time to check this at the moment. I suggest to look at the module that implements that file field. I think your file upload doesn't set #limit_validation_errors and after the file is uploaded the whole form is validated (including captcha). In that case the fix should be applied on the file field.

Is that the default file upload field?