summaryrefslogtreecommitdiff
path: root/framework/Web/UI/WebControls/TCaptcha.php
diff options
context:
space:
mode:
Diffstat (limited to 'framework/Web/UI/WebControls/TCaptcha.php')
-rw-r--r--framework/Web/UI/WebControls/TCaptcha.php6
1 files changed, 5 insertions, 1 deletions
diff --git a/framework/Web/UI/WebControls/TCaptcha.php b/framework/Web/UI/WebControls/TCaptcha.php
index 9ca6aa76..7eff1294 100644
--- a/framework/Web/UI/WebControls/TCaptcha.php
+++ b/framework/Web/UI/WebControls/TCaptcha.php
@@ -4,7 +4,7 @@
*
* @author Qiang Xue <qiang.xue@gmail.com>
* @link http://www.pradosoft.com/
- * @copyright Copyright &copy; 2005-2011 PradoSoft
+ * @copyright Copyright &copy; 2005-2011 PradoSoft
* @license http://www.pradosoft.com/license/
* @version $Id$
* @package System.Web.UI.WebControls
@@ -15,6 +15,10 @@ Prado::using('System.Web.UI.WebControls.TImage');
/**
* TCaptcha class.
*
+ * Notice: while this class is easy to use and implement, it does not provide full security.
+ * In fact, it's easy to bypass the checks reusing old, already-validated tokens (reply attack).
+ * A better alternative is provided by {@link TReCaptcha}.
+ *
* TCaptcha displays a CAPTCHA (a token displayed as an image) that can be used
* to determine if the input is entered by a real user instead of some program.
*