From 4095c4a068aed35e05ef39e34cd8321d5e32d37f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= Date: Wed, 30 Sep 2026 15:24:01 +0200 Subject: [PATCH] fix: stop malformed captcha requests from poisoning the page cache --- .../Configuration/TypoScript/Extensions/Form.typoscript | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/public/typo3conf/ext/ep_theme/Configuration/TypoScript/Extensions/Form.typoscript b/public/typo3conf/ext/ep_theme/Configuration/TypoScript/Extensions/Form.typoscript index 7cf9bf25..339880ca 100644 --- a/public/typo3conf/ext/ep_theme/Configuration/TypoScript/Extensions/Form.typoscript +++ b/public/typo3conf/ext/ep_theme/Configuration/TypoScript/Extensions/Form.typoscript @@ -22,3 +22,9 @@ plugin.tx_bwcaptcha.settings { width = 220 height = 60 } + +# Requests with a malformed type (e.g. ?type=03413) bypass the bw_captcha middleware's +# strict string check and get rendered as this empty PAGE. If it were cacheable, genuine +# ?type=3413 requests would hit that cache entry, TypoScript would never be parsed and +# the middleware would crash on empty settings. +captcha.config.no_cache = 1