Problem with CAPTCHA and fmbadhandler

[Nisitiiapi]

When I was upgrading my formmail scripts to the newest version and testing, I discovered an error between verifyimg and fmbadhandler. However, apparently, it happened with the old version, too, but I know at some point it used to work just fine.

What is happening is, when the user input does not match the CAPTCHA image, fmbadhandler returns the error "insession specified, but no data found in session." If the CAPTCHA is left blank or matches, everything is great.

This error DOES NOT happen if there is a different error in the form, such as leaving a required field empty. (Which leads me to think it's not a problem with my server handling sessions, but I could be wrong).

It seems the session variables are somehow lost when there's a CAPTCHA error. If I set PUT_DATA_IN_URL to true, then the CAPTCHA works fine on error. Even though I am using a customized verifyimg.php, the same problem occurs with the standard, uncustomized verifyimg.php. Also, the message does get sent through to me even with the CAPTCHA error, so that works fine.

The form is at http://www.sjndnlaw.com/contact.php. There is a javascript controlling general error handling, so you have to disable javascript in your browser to see errors other than the verifyimg one.

The server's PHP version is 5.2.5 running as CGI (not Apache). Any help would be greatly appreciated.

[crabtree]

its too complicated to figure out

create a simple form to test - looks like ur site is breaking sessions in some way

if its a windows server, maybe its broken coz u have some of the stuff in subfolders

i know that some windows servers break php sessions when u change folders

[Nisitiiapi]

I did try a more simplified setup with a plain html error page before I posted, but it made no difference. And our server is not Windows based (thank goodness), it is Linux.

I can't seem to track down where the session variables are lost, but I find it peculiar that they are not lost for errors related to required fields, etc., only for CAPTCHA validation and, then, only a mismatched entry.

I wonder if formmail is clearing the session variables or destroying the session because the message is sent and all is done, even though the CAPTCHA didn't match. In other words, everything is good, so the message is sent and the session destroyed, but then when it gets to comparing the $aSessionVars["VerifyImgString"] and finds it doesn't match the entry, it goes to the error page, but all the variables are gone. But, if I comment out the unsetting of variables and session_destroy in the ZapSession function, it makes no difference, so it seems more of a failure to pass the session variables or something.

One thing I may try is to use the CAPTCHA as a requirement for sending the message, not just autorespond and see if I get the same error.

[Nisitiiapi]

I tested where the CAPTCHA image is required and, interestingly, it works absolutely fine. If you don't match the image, it goes to the error page. So, it seems to be a problem related solely to use of the CAPTCHA for autoresponse.