Skip to content

fix(sign_up): temporarily disable recaptcha on create_unauthenticated#8258

Draft
adi-herwana-nus wants to merge 1 commit intomasterfrom
user-signup-recaptcha-hotfix
Draft

fix(sign_up): temporarily disable recaptcha on create_unauthenticated#8258
adi-herwana-nus wants to merge 1 commit intomasterfrom
user-signup-recaptcha-hotfix

Conversation

@adi-herwana-nus
Copy link
Contributor

@adi-herwana-nus adi-herwana-nus commented Mar 11, 2026

Temporarily disable captcha check on unauthenticated user signup.

Preceding operation (creation of new user) is still protected by captcha.
To follow-up with long term solution (merging user creation & enrolment into single request) ASAP.

Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR disables the reCAPTCHA check for the unauthenticated enrol-request creation endpoint (Course::EnrolRequestsController#create_unauthenticated), which is part of the course enrolment request flow.

Changes:

  • Commented out the verify_recaptcha enforcement in create_unauthenticated.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +29 to +33
# unless verify_recaptcha
# render json: { errors: { recaptcha: t('errors.user.registrations.verify_recaptcha_alert') } },
# status: :unprocessable_entity
# return
# end
Copy link

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reCAPTCHA gate in create_unauthenticated has been commented out, which removes the only bot/abuse protection for a publicly accessible endpoint that creates enrol requests and sends emails. This is a security/operational regression (spam enrol requests, mail queue flooding). Please restore the verify_recaptcha check (or gate the bypass behind an explicit config/feature flag limited to non-production environments), and remove the commented-out block once the intended behavior is implemented.

Suggested change
# unless verify_recaptcha
# render json: { errors: { recaptcha: t('errors.user.registrations.verify_recaptcha_alert') } },
# status: :unprocessable_entity
# return
# end
if Rails.env.production? && !verify_recaptcha
render json: { errors: { recaptcha: t('errors.user.registrations.verify_recaptcha_alert') } },
status: :unprocessable_entity
return
end

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants