Bug 41548 - Unauthenticated request captcha is only validated after optional workflow steps
Summary: Unauthenticated request captcha is only validated after optional workflow steps
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: ILL (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-01-08 16:20 UTC by Pedro Amorim
Modified: 2026-01-08 16:20 UTC (History)
4 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Pedro Amorim 2026-01-08 16:20:12 UTC
To reproduce:
1) Enable ILLModule, ILLOpacUnauthenticatedRequest and ILLModuleDisclaimerByType by pasting the sample value from the pref description.
2) Place an unauthenticated request, log out and visit:
<opac_url>/cgi-bin/koha/opac-illrequests.pl?op=create&backend=Standard
3) Enter the mandatory fields, pick a type other than Journal article
4) Purposely enter the captcha wrong e.g. 123
5) Notice you're shown the type disclaimer step. Submit that.
6) Notice you're shown the form with the message:
"You typed in the wrong characters in the box before submitting. Please try again."

Step 6 should happen before step 5.