Account is created even if Captcha validation fails

[GoogleCodeExporter]

What steps will reproduce the problem?
1. Install GD2 and enable captcha security code
2. Create a user account

What is the expected output? What do you see instead?
If the captcha image is invalid, yet the username and password validate,
the user account is created and the user is prompted to re-enter the
captcha image.  After reentering the captcha image, the user is presented
with "The username you've chosen has already been taken by another user".

The account is created though, and users are able to log in.

What version of the product are you using? On what operating system?
Rev 254 on Ubuntu 8.04, Apache 2.2.8, PHP 5.5

Please provide any additional information below.

Original issue reported on code.google.com by neve...@gmail.com on 16 Sep 2008 at 1:30

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

[deleted comment]

[GoogleCodeExporter]

I can't seem to duplicate this issue.  Registering with a correct security code 
creates the account successfully 
and logs the account creation in the cp_createlog table.

Failing to enter a valid security code results in an error message like below:
“Please enter the security code as it is, case-sensitively.”

I will investigate further, but if any new information comes to mind, please 
share it.

Thanks.

Original comment by shugoten...@gmail.com on 16 Sep 2008 at 8:44

[GoogleCodeExporter]

Yes, it fails and displays the error message, but if you try to create the 
account
again then you get a "The username you've chosen has already been taken by 
another
user" message.

Following the steps you described by entering an invalid security code DOES 
display
the error message.  I am then able to click "Login", and use the credentials 
that
seemingly failed validation.  I'll see if I can shed any more light on it.

Original comment by neve...@gmail.com on 17 Sep 2008 at 12:51

[GoogleCodeExporter]

I've tried, and also recorded a screencast of me trying… but I can't seem to 
reproduce this issue.

http://www.screencast.com/users/kuja/folders/Jing/media/4ece1c6d-b998-4b95-8222-
785f260a4ed8

Original comment by shugoten...@gmail.com on 17 Sep 2008 at 1:24

[GoogleCodeExporter]

I tried it as well. Same thing - it was non-reproducible.
I assume the error must still exist for you, so could we get a screencast of it?

Original comment by Paradox924X on 17 Sep 2008 at 1:32

[GoogleCodeExporter]

I've just tested on Ubuntu 8.04 with Apache 2.2.8/PHP 5.2.4/MySQL 5.0.51a.

Still the same, I cannot reproduce the issue.

Original comment by shugoten...@gmail.com on 17 Sep 2008 at 2:25

[GoogleCodeExporter]

Cannot reproduce on Ubuntu 7.10 with Apache 2.2.4/PHP 5.2.3/MySQL 5.0.45 either.

Original comment by shugoten...@gmail.com on 17 Sep 2008 at 4:06

[GoogleCodeExporter]

Ok I've followed the steps in the screencast, and it creates the account as 
shown.
Inserted debugging info around the captcha check and user creation, and it 
seems to
be creating fine after a valid captcha code is inserted, but either the user 
seems to
be getting the wrong message, or there's an exception thrown somewhere that 
shouldn't
be, maybe a configuration error or something else.  Close this issue off in the
meantime and I'll try find the cause of the problem.

JUST checked it again, if you enter the captcha valid first time around, you're
presented with a blank screen because a child process of Apache is seg faulting,
which I believe to be the cause of some exception being thrown (this also is
preventing my "Account" view from being rendered... byteflux and I talked about 
this
yesterday, and narrowed it down to possibly the ubuntu repo's packaged 
products? Are
you using the distribution build or a version compiled from source?

I've tested on both 32 and 64 bit Ubuntu 8.04 with the same versions of Apache 
& MySQL.

Original comment by neve...@gmail.com on 17 Sep 2008 at 11:35

[GoogleCodeExporter]

I installed Ubuntu 8.04 in a virtual machine under VMware, and simply installed 
Apache2, PHP5 and MySQL5 
from the standard repositories (nothing from backports and nothing unstable).

All seemed to work correctly for me, in all cases.

Original comment by shugoten...@gmail.com on 17 Sep 2008 at 12:55

[GoogleCodeExporter]

Original comment by shugoten...@gmail.com on 19 Sep 2008 at 6:57

• Added labels: Security

[GoogleCodeExporter]

I tried on different PCs and different VMs with fresh installs, but was unable 
to fix.

I managed to fix the problem though - had to install the threaded version of 
Apache2
(apache2-mpm-worker) and compile PHP with thread support; this was the only it 
would
work.  Close the bug off for now; if someone else runs into the same issue I can
provide some steps for the workaround.

Cheers guys

Original comment by neve...@gmail.com on 23 Sep 2008 at 8:49

[GoogleCodeExporter]

Alright, I'm going to leave this closed for uncertain investigation.

If and when I get the chance to try this, I'll re-open it if there's a problem.

Original comment by shugoten...@gmail.com on 24 Sep 2008 at 8:43

• Changed state: WontFix