PATCH: change captcha after it validates

[muayyad-alsadi]

we want to change captcha after it validates correctly,
because a user might use the same captcha several times to post a spam comment or signup several fake accounts ..etc.

http://www.yiiframework.com/forum/index.php/topic/17638-captcha-code-not-changing/

[muayyad-alsadi]

here is a part of CCaptchaAction.php:validate

                if($valid || $session[$name] > $this->testLimit && $this->testLimit > 0)
                        $this->getVerifyCode(true);
                return $valid;

I've just added "$valid || "

[saada]

Thanks for this awesome post!

[taseenb]

Is it tested? It does not work with save() because the model will be validated twice (1 for the rule + 1 for save): getVerifyCode will be true after the first one and save() will fail. Even setting $testLimit to 0 will not help.

[cebe]

You can call 'save(false)' when you already validated a model.

[taseenb]

Sure, this is a workaround. Another solution (maybe safer and more clear to the user?) is to remove the captcha session after save(). Captcha behavior does not look consistent with other validators.

[muayyad-alsadi]

you should avoid two validations (wither use validate followed by save(false) or just "if ($model->save())" without validate as the default validate=true is implied

but I agree we need a fix that works even if two validations is done

this should work by just adding a flag and doing the actual regeneration of captcha in Controller::afterAction()

I can do this, but I guess it's better done by Yii's core team

[taseenb]

Yes, you could reset the session when it becomes useless (after a save for example) even if $testLimit is 0 or a high number. Another possibility: give the user a way to do that in a simple way. At the moment I only know this way, in the Controller or in ActiveRecord (to be used on afterSave):

 protected function removeCaptchaSession()
 {
    $session = Yii::app()->session;
    $prefixLen = strlen(CCaptchaAction::SESSION_VAR_PREFIX);
    foreach ($session->keys as $key)
    {
        if (strncmp(CCaptchaAction::SESSION_VAR_PREFIX, $key, $prefixLen) == 0)
        $session->remove($key);
    }
 }

[fazliddin]

Why is it not corrected in yii yet?