From 882c7a75975752a3bf86554eba0bfd290d5dc154 Mon Sep 17 00:00:00 2001
From: Victor Boctor <victor@mantishub.net>
Date: Mon, 24 Nov 2014 20:28:34 -0800
Subject: [PATCH] Use session rather than form key for captcha

Fixes #17811
---
 core/constant_inc.php | 4 ++++
 make_captcha_img.php  | 4 ++--
 signup.php            | 5 +++--
 signup_page.php       | 7 +++----
 4 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/core/constant_inc.php b/core/constant_inc.php
index 579bf81..e0c1c0d 100644
--- a/core/constant_inc.php
+++ b/core/constant_inc.php
@@ -540,3 +540,7 @@ define( 'DB_FIELD_SIZE_PASSWORD', 32);
 define( 'PASSWORD_MAX_SIZE_BEFORE_HASH', 1024 );
 
 define( 'SECONDS_PER_DAY', 86400 );
+
+define( 'CAPTCHA_KEY', 'captcha_key' );
+
+
diff --git a/make_captcha_img.php b/make_captcha_img.php
index 414e4a3..2bf3734 100644
--- a/make_captcha_img.php
+++ b/make_captcha_img.php
@@ -26,9 +26,9 @@
 	  */
 	require_once( 'core.php' );
 
-	$f_public_key = gpc_get_int( 'public_key' );
+	$t_form_key = session_get( CAPTCHA_KEY );
 
-	$t_key = utf8_strtolower( utf8_substr( md5( config_get( 'password_confirm_hash_magic_string' ) . $f_public_key ), 1, 5) );
+	$t_key = utf8_strtolower( utf8_substr( md5( config_get( 'password_confirm_hash_magic_string' ) . $t_form_key ), 1, 5) );
 	$t_system_font_folder = get_font_path();
 	$t_font_per_captcha = config_get( 'font_per_captcha' );
 
diff --git a/signup.php b/signup.php
index 486181a..37f3f27 100644
--- a/signup.php
+++ b/signup.php
@@ -32,7 +32,6 @@
 	$f_username		= strip_tags( gpc_get_string( 'username' ) );
 	$f_email		= strip_tags( gpc_get_string( 'email' ) );
 	$f_captcha		= gpc_get_string( 'captcha', '' );
-	$f_public_key	= gpc_get_int( 'public_key', '' );
 
 	$f_username = trim( $f_username );
 	$f_email = email_append_domain( trim( $f_email ) );
@@ -51,8 +50,10 @@
 
 	if( ON == config_get( 'signup_use_captcha' ) && get_gd_version() > 0 	&&
 				helper_call_custom_function( 'auth_can_change_password', array() ) ) {
+		$t_form_key = session_get( CAPTCHA_KEY );
+
 		# captcha image requires GD library and related option to ON
-		$t_key = utf8_strtolower( utf8_substr( md5( config_get( 'password_confirm_hash_magic_string' ) . $f_public_key ), 1, 5) );
+		$t_key = utf8_strtolower( utf8_substr( md5( config_get( 'password_confirm_hash_magic_string' ) . $t_form_key ), 1, 5) );
 
 		if ( $t_key != $f_captcha ) {
 			trigger_error( ERROR_SIGNUP_NOT_MATCHING_CAPTCHA, ERROR );
diff --git a/signup_page.php b/signup_page.php
index 9387611..784809a 100644
--- a/signup_page.php
+++ b/signup_page.php
@@ -35,8 +35,6 @@
 
 	html_page_top1();
 	html_page_top2a();
-
-	$t_key = mt_rand( 0,99999 );
 ?>
 
 <br />
@@ -68,6 +66,8 @@
 <?php
 	$t_allow_passwd = helper_call_custom_function( 'auth_can_change_password', array() );
 	if( ON == config_get( 'signup_use_captcha' ) && get_gd_version() > 0 && ( true == $t_allow_passwd ) ) {
+		session_set( CAPTCHA_KEY, mt_rand( 0,99999 ) );
+
 		# captcha image requires GD library and related option to ON
 ?>
 <tr class="row-1">
@@ -78,8 +78,7 @@
 		<?php print_captcha_input( 'captcha', '' ) ?>
 	</td>
 	<td>
-		<img src="make_captcha_img.php?public_key=<?php echo $t_key ?>" alt="visual captcha" />
-		<input type="hidden" name="public_key" value="<?php echo $t_key ?>" />
+		<img src="make_captcha_img.php" alt="visual captcha" />
 	</td>
 </tr>
 <?php
-- 
1.9.3 (Apple Git-50)