We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
MODX Community Forums Archive

[FIXED] Login Captcha Bypassable

    • 18397
    • 3,250 Posts
    MARKSVIRTUALDESK Reply #1, 21 years ago
    If you enable captcha on your site and then logout, try to log back in and don’t type in a captcha (tabbing over the field to skip the javascript), and then submit you will go right into the manager without a captcha code!

    Flash video attached (view the HTML file in your browser)

      • 25663 MODX Staff
      • 12,272 Posts
      Ryan Thrash Reply #2, 21 years ago
      This sounds suspiciously like a JS error... as it’s not possible to skip in Safari.
        Ryan Thrash, MODX Co-Founder
        Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
        • 18397
        • 3,250 Posts
        MARKSVIRTUALDESK Reply #3, 21 years ago
        Ralph ( the new Etomite developer) came up with this fix thanks to an idea I gave him (Etomite is affected):

        To fix in manager/includes/accesscontrol.inc.php replace the current image code with:
        <?php echo $_SERVER['PHP_SELF'];?>"><img src="includes/veriword.php?dummy=<?php echo rand(); ?>" width="148" height="80" alt="<?php echo $_lang["login_captcha_message"]; ?>">

        Resolves the problem... wink


        CONFIRMED: It works in MODx 3.2!

        Thanks Ralph!
          • 18397
          • 3,250 Posts
          MARKSVIRTUALDESK Reply #4, 21 years ago
          Bugtacker URL: http://modxcms.com/bugs/?do=details&id=84