search

metacpan / metacpan-web

Web interface for MetaCPAN
http://metacpan.org
Other
412 stars 234 forks source link

Post-CAPTCHA "Continue browsing" link is not useful #3126

Open esabol opened 2 weeks ago

esabol commented 2 weeks ago

After completing the CAPTCHA, you get a "Success" message. Underneath that, there's a link to "Continue browsing". I would expect this link to take me to back to the web page of the module where I clicked the "++" button. It doesn't. It takes me to another CAPTCHA instead. Not very useful.

oalders commented 2 weeks ago

If you have a look at the HTML is there actually a target URL in the "Continue browsing" link?

esabol commented 2 weeks ago

If you have a look at the HTML is there actually a target URL in the "Continue browsing" link?

Good question, but I'm not sure how to get the website to ask me to enter the CAPTCHA again. I can't seem to reproduce it right now.

oalders commented 2 weeks ago

You'd probably need a new session to hit that requirement. So, either logging out or an incognito window might be enough.

esabol commented 2 weeks ago

Yeah, that's what I thought, and I tried it an incognito window yesterday. It prompted me to login when I clicked on the "++" button, but it didn't give me a CAPTCHA after I logged in.

I found the "Continue browsing" HTML in the repository. It links to a variable, $referer, but I don't see where that's defined. But I think what's really needed is the page before $referer since $referer is the CAPTCHA page.

https://github.com/metacpan/metacpan-web/blob/f4f04880d709e4e3797f04472c13363fb40b3953/root/account/turing.tx#L14

oalders commented 1 week ago

I believe it's supposed to be set via https://github.com/metacpan/metacpan-web/blob/master/lib/MetaCPAN/Web/Controller/Account/Turing.pm#L20

It's possible that this parameter is not being included in the POST.