Captcha request replay

hey @Anybody sorry I missed your messages
I am running Drupal 9 and Captcha version 1.10 , I have selected "Always add a challenge." in Settings page and still I can replay the requests , node gets created once more.

murat_kekic → made their first commit to this issue’s fork.

I'm encountering this issue with a webform that uses a confirmation step and one of my custom forms. In both cases, after submission, the CAPTCHA element is not being rebuilt --either because it’s no longer included in the form or because $form_state->setRebuild() is not being called.

This causes the issue because the solution is updated in preRenderProcess. If the element is not rebuilt/rerendered, the solution remains unchanged, allowing the same solution to be reused as many times as possible.

In my opinion, @anybody's approach was correct but incomplete. The CAPTCHA status also needs to be updated to 'unsolved' whenever the solution is updated.

I have updated the _captcha_update_captcha_session function to always set 'status' to 'unsolved'

From captcha.inc:

function _captcha_update_captcha_session($captcha_sid, $solution) {
  \Drupal::database()->update('captcha_sessions')
    ->condition('csid', $captcha_sid)
    ->fields([
      'timestamp' => \Drupal::time()->getRequestTime(),
      'solution' => $solution,
      'status' => CaptchaConstants::CAPTCHA_STATUS_UNSOLVED,
    ])
    ->execute();
}

I'll try to add a test case for this soon.

For now, this patch is working for me.

@murat_kekic thank you very very much, this sounds promising. Having a test for this is most important. Very much looking forward.

murat_kekic → closed merge request !106

I was going to add some tests. While doing that, I noticed there's already a test very similar to the one I wrote. I checked why that test was passing and found out the helper function getCaptchaTokenFromForm wasn't working properly. It was assuming the CAPTCHA token to be an integer, which is not true. This caused some of the tests in CaptchaSessionReuseAttackTestCase to pass even though they should've failed.

I fixed the getCaptchaTokenFromForm function so it works as expected now. After fixing it, the tests actually failed without the initial changes. Then I applied the changes, and the tests passed. So there were some broken tests that went unnoticed before.