Google reCaptcha Bypassed

Post by haxcop » Fri Oct 12, 2018 7:41 pm

Hi Guys,
Recently on a new installation in OC 3.0.2.0 Google reCaptcha I've notice is not being enforced and I'm able to bypass any of the scenarios were the captcha is required and not used.
I have also tried with the Basic Captcha and this one Works correctly.
The secret and the key are added correctly on the admin, the reCaptcha is selected correctly on the "system>settings>option>__" and selected all the checkboxes..
The reCaptacha shows accordingly and the Red * as a Mandatory but I can simply Bypass this verification without the thick on the checkbox and continue with the registration - email etc...

*UPDATE*
FYI
This is common is you are logged in the account from which you took the captcha credentials from and the same Browser (Chrome) - will automatically let you ByPass it (no user action).
As soon as you log out and clear all the cache and try again It won't happen and you will be enforce to reCaptcha to continue.


Regards,

Post by straightlight » Sat Oct 13, 2018 9:48 pm

Which is why, the CSRF Protection extension from the Marketplace is important to be used while using captcha / re-captcha.

https://www.opencart.com/index.php?rout ... on_id=4773

Dedication and passion goes to those who are able to push and merge a project.

Regards,
Straightlight
Programmer / Opencart Tester

Post by haxcop » Sun Oct 14, 2018 3:28 am

Hey Thanks for the heads up Regarding the Cross-Site Request Forgery (CSRF), Very Useful - and installed already

Post by straightlight » Sun Oct 14, 2018 7:03 am

Dedication and passion goes to those who are able to push and merge a project.

Regards,
Straightlight
Programmer / Opencart Tester

Post by rmullaney77 » Fri Oct 19, 2018 12:16 am

Located similar/same problem that "seemed" to be user bypassing Google's reCaptcha. Was actually due to the "gcapcha" session variable never being cleared.

Fixed by adding ocmod that unsets the var in google_captcha.php->index(). Added expire() function for use with "data-expired-callback" and javascript callback function in the template. Callback necessary to unset session var when on-page captcha expires prior to submitting form.

Issue persists in latest version. Cannot submit bug/solution via github (banned by Daniel, personality conflict )

Post by ADD Creative » Fri Oct 19, 2018 6:47 am

www.add-creative.co.uk

Post by annettek » Sat Jun 19, 2021 1:01 pm

Annette Kennedy
Thanks For Any Help In Advance

Post by ADD Creative » Sat Jun 19, 2021 5:40 pm

$this->session->data['gcapcha']	= false;

return $this->load->view('extension/captcha/google', $data);

www.add-creative.co.uk

Post by straightlight » Sat Jun 19, 2021 5:41 pm

$this->session->data['gcaptcha']	= false;

Dedication and passion goes to those who are able to push and merge a project.

Regards,
Straightlight
Programmer / Opencart Tester

Post by ADD Creative » Sat Jun 19, 2021 8:55 pm

www.add-creative.co.uk

Post by straightlight » Sat Jun 19, 2021 10:06 pm

Dedication and passion goes to those who are able to push and merge a project.

Regards,
Straightlight
Programmer / Opencart Tester

Post by EvolveWebHosting » Sun Jun 20, 2021 9:46 am

Opencart Hosting Plans, Domain Registration, Microsoft and Google Email and More
Visit our website for great deals and most importantly, fast and friendly support - www.evolvewebhosting.com

Post by annettek » Sun Jun 20, 2021 5:11 pm

Annette Kennedy
Thanks For Any Help In Advance

Post by tom327 » Tue Aug 03, 2021 4:34 am

Post by ADD Creative » Tue Aug 03, 2021 6:47 am

www.add-creative.co.uk

Post by BillT » Mon Feb 07, 2022 1:39 am