My site's form or captcha stopped working after upgrading to Joomla 3.9.15

Question

After upgrading to Joomla 3.9.15, my site / extension / custom form captcha stopped working. I get "Please complete the CAPTCHA" or "invalid-input-response" or something like "Invalid Captcha". What happened?

Answer 1

Answer for Joomla Users

An update of the Captcha - ReCaptcha plugin changed the existing functionality and many of the extension developers need to update the way their extensions handled Captcha responses.

So, a first step is to be 100% sure that you are using the latest version available!

If you are sure about that, please contact the extension developer and include a link to this page. It may help them.

Answer for Extension Developers

The Captcha - ReCaptcha plugin changed the way they handled the onCheckAnswer event. A similar change happened back in 2016, where we had to change the way we included captcha plugins.

Your code may look something like this:

$captcha = JCaptcha::getInstance(JFactory::getConfig()->get('captcha'));
if (!$captcha->checkAnswer('my-recaptcha-id')) {
  // handle captcha not answered
}

Up until now, the onCheckAnswer event completely ignored our input. Instead, it loaded the correct response for Google ReCaptcha by calling:

$input->get('g-recaptcha-response', '', 'string');

This changed on 25 Dec 2019. Now, our input is used to directly validate the captcha response. So, an easy way to bypass this is to do the following:

if (!$captcha->checkAnswer(null)) {
  // handle captcha not answered
}

If you want your code to be 100% consistent, then assuming you have:

print JCaptcha::getInstance(JFactory::getConfig()->get('captcha'))->display('my_field_id', 'my_field_id', 'g-recaptcha');

You would write:

$input = JFactory::getApplication()->input;
if (!$captcha->checkAnswer($input->get('my_field_id', null, 'string')) {
  // handle captcha not answered
}

BUT! You have to remember that the ReCaptcha plugin ignores our Captcha ID input anyway, so the above currently serves as a nice wrapper around null anyway.