Registration on another.im (captcha_pow) works again: the submit sends what the person answers and no hidden field, as anotherim-js and master do. Since 5b49046e the form's hidden fields went with every submit, SHA-256 among them: libtacky hands the … #34
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/registration-pow"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
…proof-of-work field out as hidden and solves it only when that key is not among the values (register.tcl Submit), so it went empty and ejabberd answered "The CAPTCHA verification has failed" to every submit, the first included, and Try again fetched a form that failed the same way.
5b49046ewas checked live on conversations.im, which offers only the picture, where libtacky drops SHA-256 from the form. A CAPTCHA'schallengeandsidneed not be sent either: forms::apply keeps the latest form's own value for every field the values leave out. Reported against master as #31 (PR #32), whose cause there is another one (the alert's OK resubmitting a spent form) and which feat/ui-redesign does not have.Tests: noHiddenFieldIsSentSoLibtackySolvesTheProofOfWork replaces aRetryAnswersTheNewChallengeNotTheOld, and the submit test no longer expects FORM_TYPE; FeatureOnboarding's 34 tests pass. Not checked by a live sign-up on another.im (one registration per IP per 600 s).
Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com
5b49046ethe form's hidden fields went with every submit,SHA-256among them: libtacky hands the proof-of-work field out as hidden and solves it only when that key is not among the values (register.tcl Submit), so it went empty and ejabberd answered "The CAPTCHA verification has failed" to every submit, the first included, and Try again fetched a form that failed the same way.5b49046ewas checked live on conversations.im, which offers only the picture, where libtacky drops SHA-256 from the form. A CAPTCHA'schallengeandsidneed not be sent either: forms::apply keeps the latest form's own value for every field the values leave out. Reported against master as #31 (PR #32), whose cause there is another one (the alert's OK resubmitting a spent form) and which feat/ui-redesign does not have. dc5b0cf947