Private Captcha

Fixed

A widget that fails no longer posts its error sentinel and blames the visitor.

When the puzzle cannot be loaded — a network problem, a blocked request, an ad-blocker, or a property the site's domain is not allowed to use — the widget does not leave its solution field empty. It writes a short error sentinel (AQMAAAAAAA==.) into it.

solutionValue() only tested for a non-empty field, so the submit guard read that sentinel as "already solved", released the POST, and the server answered with a flat "Invalid Captcha." to a visitor who had ticked the box and done nothing wrong. Every retry produced the same sentinel and the same rejection, so there was no way out.

Solving is now judged by the widget's privatecaptcha:error event rather than by the field alone. A failed widget is held back on submit and shown a distinct message next to the widget instead of spending a round-trip to be told the solution was invalid. Ticking the box again clears the failure, so a widget that recovers is not held against the visitor.

The same check applies while a submission is being held: a widget that gives up mid-wait now stops the wait and shows the message, where before it released the sentinel as if it were a solution.

Scope

Present since the poll-and-release path landed in v1.1.1 — this is not a v2.0.0 regression and not specific to the click widgets introduced there. The v2.0.0 failed flag was consulted only inside the polling loop, which the submit guard short-circuited before ever reaching.

The timeout path is deliberately unchanged: when the wait budget genuinely runs out, an empty solution is still posted and the server decides. Only the error path changed.

Upgrading

Drop-in from v2.0.0 — no configuration or template changes required for most sites.

If you have published your own copy of resources/views/vendor/private-captcha/captcha.antlers.html, add the new message element or the submit is still blocked but silently:

#89DDFF;"><p#89DDFF;"> hidden#89DDFF;"> role#89DDFF;">=#89DDFF;">"alert#89DDFF;">"#89DDFF;"> style#89DDFF;">=#89DDFF;">"color: #dc2626; font-size: 0.875rem; margin-top: 0.5rem;#89DDFF;">"#89DDFF;"> data-captcha-error#89DDFF;">>{{ trans key="Verification is unavailable right now. Please reload the page and try again." }}#89DDFF;"></p#89DDFF;">>

Full changelog: https://github.com/Digisoul-nl/private-captcha/compare/v2.0.0...v2.0.1

Breaking

The default display mode changed from automatic solving to a required click.

{{ captcha }} previously defaulted to display="auto" — not a display mode the widget recognises. It rendered a visible widget that solved itself on page load, through a code path the widget does not test. The default is now display="widget", the widget's own default, which renders with data-start-mode="click": the visitor has to tick the checkbox before a solution is computed.

Every site that does not set display="hidden" gains an extra click on its forms. To keep the previous hands-off behavior, switch to:

{{ captcha display#89DDFF;">=#89DDFF;">"hidden#89DDFF;">" }}

This is why the release is a major: sites tracking ^1.0 will not pick it up on a routine composer update.

Why

A fully automatic widget computes its solution on page load, so a scripted client gets one without ever rendering the page. Requiring a tick means an automated submission needs real DOM interaction. That raises the cost — it does not rule one out.

Also in this release

• The submit hold waits for the proof-of-work that starts when the visitor ticks the box, instead of showing "please confirm you are not a robot" to someone who just did, and instead of making them press submit twice.
• Click widgets get a 30s hold budget rather than the 8s written for automatic widgets, which start solving far earlier. The hold is released immediately if the widget reports an error.
• Repeated submit clicks no longer stack polling timers.
• display="popup" stays on automatic solving; it only becomes visible via execute(), so click mode would leave the form unsubmittable.
• The hint is announced to screen readers (role="alert").

Full detail in CHANGELOG.md.

Note

The click path has not been exercised in a browser — this repo has no test suite. Worth a manual pass on a site with a real sitekey: tick-then-submit-immediately, submit-without-ticking, and display="hidden" as a control.

What's Changed

• fix: bind captcha verification to the configured sitekey by @mister-diels in https://github.com/Digisoul-nl/private-captcha/pull/8

Full Changelog: https://github.com/Digisoul-nl/private-captcha/compare/v1.1.1...v1.1.2

What's Changed

• chore: update-dependencies by @rocky9878 in https://github.com/Digisoul-nl/private-captcha/pull/5
• fix: hidden-widget outage and unchecked captcha verification by @mister-diels in https://github.com/Digisoul-nl/private-captcha/pull/6

Full Changelog: https://github.com/Digisoul-nl/private-captcha/compare/v1.1.0...v1.1.1

What's Changed

• add support for statamic 6 installation by @rocky9878 in https://github.com/Digisoul-nl/private-captcha/pull/4

New Contributors

• @rocky9878 made their first contribution in https://github.com/Digisoul-nl/private-captcha/pull/4

Full Changelog: https://github.com/Digisoul-nl/private-captcha/compare/v1.0.1...v1.1.0

Full Changelog: https://github.com/Digisoul-nl/private-captcha/compare/v1.0.0...v1.0.1

• N/A Changelog not available.