Mailing Subscription form does not validate reCaptcha
To reproduce:
- Go to: https://civicrm.org/civicrm/mailing/subscribe?reset=1 (or setup any site with a reCaptcha key, it automatically enables on this form).
- Enter an email, select a newsletter
- Hit Submit, without answering the Captcha.
Result: captcha is not validated.
I tried debugging to the point where in CRM_Core_Utils_ReCAPTCHA::add()
, the call to isSubmitted
returns false, but that may have been a misleading, since removing this bit seems to fix it:
https://lab.civicrm.org/dev/core/-/blob/master/CRM/Mailing/Form/Subscribe.php#L123
// If this is POST request and came from a block,
// lets add recaptcha only if already present.
// Gross hack for now.
if (!empty($_POST) &&
!array_key_exists('recaptcha_challenge_field', $_POST)
) {
$addCaptcha = FALSE;
}
I don't know what "came from a block" means in this context. Mayeb an old Drupal block?
It was added in 2009: https://github.com/civicrm/civicrm-svn/commit/e745abc5114e644ef58712a42e73af9be100588c#diff-7e49ca39c25024fb4dbba97bee79be03
Related: infra/ops#946 (closed)