Captcha - No image displayed

Same for me... it was working fine and now this message appears: Resource interpreted as Image but transferred with MIME type text/html: "http://example.org/?q=image_captcha&sid=38&ts=1427818537".

Same for me... what can I do if I can not login as administrator?

We are experiencing the same issue with 7.x-1.3.

Upon further examination, we have found that the image source looks like this:

<img typeof="foaf:Image" src="/?q=image_captcha&amp;amp;sid=20&amp;amp;ts=1427834487" width="252" height="60" alt="Image CAPTCHA" title="Image CAPTCHA">

The ampersand is being double-escaped.

Copying the source out, and correcting it in the browser, like so:

<site>/?q=image_captcha&sid=20&ts=1427834487

Does indeed show us the image.

Shanes right on the money there, its a double escape due to a 'check_url'.
Its line 248 of the 'image_captcha.module':
$img_src = check_url(url("image_captcha", $options));
For the sake of ease Ive change it to:
$img_src = url("image_captcha", $options);

Nothing earth-shattering but voila! It works again!

Solution in #4 may not be secure because without the call to check_url(), the URL is never sanitized.

This patch replaces the call to check_url() with drupal_strip_dangerous_protocols(). So, it is dropping a call to check_plain(), since check_url() is just return check_plain(drupal_strip_dangerous_protocols($uri));. Thought is that theme_image() performs the same operation as check_plain(). Not sure whether it is completely secure.

This problem only seems to occur for me if the site has clean URLs disabled. So, another solution besides patching the code may be to enable clean URLs (for those who can).

I can confirm that enabling clean URLs does resolve the issue for us. This was a migrated site, and we had clean URLs previously enabled, so enabling them again proved a viable solution.

Patch still needs review. Some sites will not be able to enable clean URLs.

I had the same problem and the clean url solution worked for me.

I have made a patch that introduces Simpletest tests to Image CAPTCHA (see #2468539: Image CAPTCHA test suite), and included a test for this issue. I confirm that the patch in #5 fix this issue. Image URL is now correct either with or without clean URLs.

Hi, I am not a developer. I added Captcha 7.x 1-3 and now I cannot even log in as an Administrator. I tried to disable it by renaming the module but it still ask me for the image code.

What can I do to disable it?

Edit: My mistake, I see now that your question is related to this issue.

hareshjhaveri, one way to disable the module is by directly changing its status in the database using SQL:

UPDATE system SET status=0 WHERE type='module' AND name='image_captcha';

Or if you have Drush installed:

drush pm-disable image_captcha

You may need to also disable the captcha module.

I have been chasing down this problem and arrived at the same check_url() call as the source of the issue, but I would like to comment on the proposed solutions, which (I believe) ignore the underlying issue.

The fundamental problem is that the call to htmlspecialchars() within check_url() should not be called on a full string with html parameters being passed since the ampersand used to separate the arguments is a special html character and not simply an ampersand in a piece of text that needs to be escaped.

The reason that enabling clean urls works is simply because it makes the sid the first html argument and therefore it has no '&' before it, but if you look at the generated url the second html argument is still getting the ampersand escaped. It is only because sid is the first argument *and* the second argument is non-critical that this solution works.

The committed solution by AohRveTPV appears to be the best straight forward fix. The only possible improvement on this, as far as I can see, would be to call check_url() on the address portion of the url and on the individual html arguments. I do not know Drupal well enough to see a simple way to do this.

clean urls enabled, problem solved...

# 5 worked for me (and without clean url's)

I had forgotten to renable clean URLs after an upgrade. Re-enabled clean URLs and it's working again.

was able to run

UPDATE drup_system SET status=0 WHERE type='module' AND name='image_captcha';

on my db, but still not able to log in.

found the table where all rendered challenges are store, found the last one and logged in.

noticed image captcha was disabled in drupal admin panel , in hind site a page refresh after executing sql command may have done the trick.

edit:
in hind hind site, even though disabled by SQL, image captcha was still selected as default captcha in the main captcha config, so even sending a kill command to the db prolly didn't work and IMHO the only way to get in is to copy and paste the last challenge code rendered