FIX: Hcaptcha plugin was incompatible with login-required sites (#34181)

pmusaraj · pento · commit e059dcf61e11 · 2025-08-11T11:28:06.000+10:00
diff --git a/plugins/discourse-hcaptcha/app/controllers/discourse_hcaptcha/hcaptcha_controller.rb b/plugins/discourse-hcaptcha/app/controllers/discourse_hcaptcha/hcaptcha_controller.rb
@@ -5,6 +5,8 @@ class HcaptchaController < ::ApplicationController
     requires_plugin DiscourseHcaptcha::PLUGIN_NAME
 
     before_action :ensure_config
+    skip_before_action :redirect_to_login_if_required
+
     TOKEN_TTL = 2.minutes
     protect_from_forgery except: [:create]
 
diff --git a/plugins/discourse-hcaptcha/spec/lib/discourse_h_captcha/create_users_controller_patch_spec.rb b/plugins/discourse-hcaptcha/spec/lib/discourse_h_captcha/create_users_controller_patch_spec.rb
@@ -56,6 +56,16 @@
         post "/u.json", params: user_params
         expect(JSON.parse(response.body)["success"]).to be(true)
       end
+
+      context "when site is login-required" do
+        before { SiteSetting.login_required = true }
+
+        it "succeeds in registration" do
+          post "/hcaptcha/create.json", params: { token: "token-from-hCaptcha" }
+          post "/u.json", params: user_params
+          expect(JSON.parse(response.body)["success"]).to be(true)
+        end
+      end
     end
 
     context "when h_captcha is disabled" do
