What particular spam scenarios should this module solve?

It is trivial to bypass the captcha:

  • after one correct answer, the captcha "result" in $_SESSION is not cleared. This allows a user to create large amounts of comments or accounts without ever having to answer another captcha. All the user has to do is to remove the disable attribute from the submit button
  • the captcha can be "answered" by visiting the URL motion_captcha/captcha/[form-id] eg motion_captcha/captcha/comment-node-article-form

A CAPTCHA should be a task that discerns humans from bots. Visiting a URL isn't particularly hard for bots and is not suitable to make any distinction on the nature of the poster.

(I tested the module after changing line 56 to return drupal_get_form('secure_motion_captcha_get_form_ids_form'); to enable the admin interface).

Comments

Anonymous’s picture

Anonymous (not verified) commented

would like to see this working.

compujohnny’s picture

compujohnny commented
Status: Active » Fixed

These security issues should be fixed in the latest dev, I am currently doing server side validation of the captcha score as well as token validation to address all the issues you mentioned, as well as clearing the session

Thank you for reporting these issues!

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.