Bug #66653 [Asn->Wfx]: "Incorrect CAPTCHA" trying to file or comment a bug report

Edit report at https://bugs.php.net/bug.php?id=66653&edit=1 ID: 66653 Updated by: cmb@php.net Reported by: chealer at gmail dot com Summary: "Incorrect CAPTCHA" trying to file or comment a bug report -Status: Assigned +Status: Wont fix Type: Bug Package: Website problem PHP Version: Irrelevant Assigned To: peehaa Block user comment: N Private report: N New Comment: Given that bugsnet has been superseded by GH issues, it sufficiently safe to assume that this issue won't be fixed. Previous Comments: ------------------------------------------------------------------------ [2021-09-29 16:33:54] cmb@php.net Related To: Bug #81291 ------------------------------------------------------------------------ [2021-09-18 22:16:58] ddpm at liscovius dot de You can also watch the entries of the currently existing user sessions server side when stored in file system: On Debian 10 the default location seems to be: /var/lib/php/sessions ------------------------------------------------------------------------ [2021-09-18 22:10:48] ddpm at liscovius dot de There are 2 potential reasons: 1. Session is timed out server side before user submits the form. Either by normal PHP session cleanup logic or server based cron job cleaner (Debian's sessionclean you naughty boy!, see /etc/cron.d/php ) This is a thing the maintainer of the web server has to take care. 2. The $_SESSION must be able to handle multiple browser tabs: Instead $_SESSION['answer'] use $_SESSION['form'][$formtoken]['captcha'] or $_SESSION['report'][$formtoken]['captcha'] $formtoken can either be random generated for each form loaded (session file storage grows with each page load) or be reused until the captcha was solved for the $formtoken. ( The forms could contain the formtoken as <input type="hidden" name="formtoken" value="<?= $formtoken ?>"/> Or the captcha only needs to be solved once for a user session and all following form submits do not need solve annoying captchas. ------------------------------------------------------------------------ [2021-07-11 14:51:52] cmb@php.net No, the issue has not been fixed. petk's analysis[1] is spot on. [1] <https://bugs.php.net/bug.php?id=66653#1545852651> ------------------------------------------------------------------------ [2021-07-11 14:13:59] chealer at gmail dot com I am under the impression that this has been fixed. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=66653 -- Edit this bug report at https://bugs.php.net/bug.php?id=66653&edit=1