Problem/Motivation

This appears to have re-emerged more recently as an issue with the captcha-6.x-2.7 version. When Captcha is used it fails with the error:

  • CAPTCHA session reuse attack detected.
  • The answer you entered for the CAPTCHA was not correct.

A similar problem was reported before and committed on 2010-11-09 for version 2.3 #810534: Fix CAPTCHA session reuse. The work around described in comment #12 to change settings and enable "Always add a challenge" does not solve the problem.

There is also another issue #2474959: CAPTCHA session reuse attack detected with a patch for D7 in comment #19 that may need to be back ported.

Steps to reproduce

Use captcha on a site where it is enabled with PHP 7.4.x

Proposed resolution

Develop and test back port from #2474959: CAPTCHA session reuse attack detected

Remaining tasks

User interface changes

API changes

Data model changes

Comments

izmeez created an issue. See original summary.

izmeez’s picture

izmeez commented
Title: D6 Captcha Session Reuse Issue » D6 Captcha session reuse attack detected

Updated title.

izmeez’s picture

izmeez commented
Status: Active » Fixed

The cause of this has been identified to be the result of adding a patch to the site from the github d6lts issues, https://github.com/d6lts/drupal/pull/61

The patch was reversed and everything is working fine as it was before.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

roderik’s picture

roderik
Primary language Dutch
Location Amsterdam,NL / Budapest,HU
commented
Related issues: +#2474959: CAPTCHA session reuse attack detected

When I was seeing this message, I concluded that it was introduced in captcha version 2.6.

Patch is uploaded to #2463125-3: CAPTCHA Session Reuse message on Node Add with preview before save. See the patch: the return value from db_result() is either the value from the query or FALSE, so the code since 2.6 (testing for !isset()) just doesn't make any sense.

izmeez’s picture

izmeez commented

@roderik Thanks for the reply. You make a good point and the patch you reference is quite simple. We will have to revisit this. It is curious that it continues to work until one hunk in your patch with the pull request exposes it.