Explaining why the hell Captcha API changed...
Thilo Wawrzik has been a great committer/user/reviewer from Captcha/Textimage modules for almost a year.
Today I was replying his issue about Captcha v2 then I figured out that I hadn't documented/explained to my users why the hell I did change the Captcha API.
Early this year, some security flaws was discovered in Captcha and Textimage, it's was a quite simple bug related with an trim() that was used to verify if the form was submitted. Note that captcha 4.6, captcha 4.7 and captcha 5.1 are basically the same module.
Removing that trim lead us to a big problem, how discover if the user already submitted the form?
The question for this answer cause the warning "The captcha response you entered was incorrect." every time you visited a form with captcha enabled.
Considering the way the code was coded there was none elegant way to fixes that warning, not even a consistent kludge.
There as too much code repetition, so I decided to rewrite the whole thing.
And now this is what we have, and 100% new Captcha module, with a simple Captcha API that needs just one simple function, hook_captcha.



