Bug 41548

Summary: Unauthenticated request captcha is only validated after optional workflow steps
Product: Koha Reporter: Pedro Amorim <pedro.amorim>
Component: ILLAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: lisette, pedro.amorim, richard.bridgen, tomascohen
Version: Main   
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Pedro Amorim 2026-01-08 16:20:12 UTC
To reproduce:
1) Enable ILLModule, ILLOpacUnauthenticatedRequest and ILLModuleDisclaimerByType by pasting the sample value from the pref description.
2) Place an unauthenticated request, log out and visit:
<opac_url>/cgi-bin/koha/opac-illrequests.pl?op=create&backend=Standard
3) Enter the mandatory fields, pick a type other than Journal article
4) Purposely enter the captcha wrong e.g. 123
5) Notice you're shown the type disclaimer step. Submit that.
6) Notice you're shown the form with the message:
"You typed in the wrong characters in the box before submitting. Please try again."

Step 6 should happen before step 5.