fabianwennink / IconCaptcha-PHP

A self-hosted, customizable, easy-to-implement and user-friendly captcha for PHP.
https://www.fabianwennink.nl/projects/IconCaptcha/
MIT License
134 stars 25 forks source link

[Bug]: Driver Session not working #45

Open Quetlo opened 5 months ago

Quetlo commented 5 months ago

Bug report requirements

IconCaptcha version

4.0.3

PHP version

8.0

Browsers affected

Google Chrome

Expectation

When we click on an image, the backend should not retrieve an error 500.

Actual behaviour

The backend crashes on a division by zero after a click on an image. I suppose count($this->session->icons) should never be 0. Implementation was done using tutorial steps, except that the domain of the backend is different from the frontend.

Here is the trace :

Array ( [0] => Array ( [file] => vendor/fabianwennink/iconcaptcha/src/Challenge/Challenge.php [line] => 232 [function] => determineClickedIcon [class] => IconCaptcha\Challenge\Challenge [type] => -> )

[1] => Array
    (
        [file] => vendor/fabianwennink/iconcaptcha/src/Request.php
        [line] => 119
        [function] => makeSelection
        [class] => IconCaptcha\Challenge\Challenge
        [type] => ->
    )

Relevant log information

It appears that the session id returned in the first captcha load response header is not used for the verification request; so the session is simply not working. The problem is that the first php session id is only returned through the first call via XHR. Thus the browser does not use it as main session cookies for the next XHR. A very good solution would be a hook to retrieve the php session id from the load call, and an option to set the session id to use for the next calls.

Additional information

No response

fabianwennink commented 5 months ago

Hi @Quetlo! Thanks for the report! I will look into this, as well as your other issue report, as soon as possible.

ba77osai commented 3 months ago

It seems like we are running into the same issue on our production environment. It would also help in the meanwhile if it was a catchable exception and not a fatal error, so we can at least handle the error gracefully.

Best regards