If the account creation form has an image field, the site will display "CAPTCHA session reuse attack detected." when the account is created.

Steps to reproduce:

  1. Install and configure captcha and recaptcha, including API keys
  2. Add recaptcha to the registration page (form id: user_register_form)
  3. At admin/config/people/accounts, uncheck "Enable user pictures." in the Personalization section
  4. At admin/config/people/accounts/fields, add an image field to the account creation form
  5. As an anonymous user, fill out all fields at user/register and upload an image
  6. Do the recaptcha test and click "Create new account"

The error message will be displayed to the user, either on the homepage or on the user page, depending on whether email verification is turned on at admin/config/people/accounts.

I realize that it's triggering this because the image upload widget reloads the page after the upload is complete. An easy "fix" is to not use recaptcha at all on the registration form and just require email verification. But can anything else be done that will still allow the recaptcha to be used on the registration form? That would be for situations where the site owner wants people to be able to log in right away.

Comments

Lord Pachelbel created an issue. See original summary.

hass’s picture

hass’s picture

Status: Active » Closed (cannot reproduce)
issa.haddadin’s picture

Version: 7.x-2.0 » 7.x-2.1
Category: Support request » Bug report
Status: Closed (cannot reproduce) » Active

Hello,

I'm reopening this as i have exactly the same issue, the user will get the same error if he uploaded an image withing the form.

Thank you.

issa.haddadin’s picture

Status: Active » Closed (fixed)

Actually updating Captcha module to 7.x-1.x-dev solved my problem.