Dolibarr/dolibarr · warning

ErrorBadValueForCode

Error message

ErrorBadValueForCode

What it means

The submitted captcha code failed validation ($ok false after validateCodeAfterLoginSubmit), so Dolibarr refuses the login attempt and stores the translated ErrorBadValueForCode message in the session. A USER_LOGIN_FAILED trigger and security log entry ('Bad value for code, connection refused') are also fired.

Solutions

1. Re-enter the captcha code carefully and resubmit the login form.
2. Reload the login page to get a fresh captcha if the old one expired.
3. Check browser cookies/session support if valid codes are repeatedly rejected.
4. Verify the captcha module backend (e.g. reCAPTCHA keys/domain) is correctly configured if users are broadly locked out.
5. Bots/integrations must solve the captcha or use an alternative auth flow.

if (empty($_POST['captcha_code'])) { /* prompt user for code before submitting login */ }

When it happens

Trigger: User types a wrong captcha code on the login form; captcha session data expired between page load and submit; a bot posts credentials without solving the captcha.

Common situations: Users mistyping codes; long-idle login pages whose captcha session state expired; automated tooling hitting the login endpoint without captcha handling; cookie issues losing the captcha session.

Related errors

• Error, the captcha handler
• Error, the captcha handler class
• Error, the captcha handler
• ErrorBadLoginPassword
• ErrorCantLoadUserFromDolibarrDatabase

AI-assisted analysis of Dolibarr/dolibarr@598aa4bdad (2026-09-14). Data as JSON: /api/errors/a33114f42d346142. Report an issue: GitHub.

Appendix: source

Thrown at htdocs/main.inc.php:675

					}
				} else {
					$_SESSION["dol_loginmesg"] =  'Error, the captcha handler class '.$classname.' was not found after the include';
					$test = false;
					$error++;
				}
			} else {
				$_SESSION["dol_loginmesg"] = 'Error, the captcha handler '.$captcha.' has no class file found modCaptcha'.ucfirst($captcha);
				$test = false;
				$error++;
			}

			// Process error of captcha validation
			if (!$ok) {
				dol_syslog('--- Security warning: Bad value for code, connection refused', LOG_NOTICE);
				// Load translation files required by page
				$langs->loadLangs(array('main', 'errors'));

				$_SESSION["dol_loginmesg"] = (empty($_SESSION["dol_loginmesg"]) ? "" : $_SESSION["dol_loginmesg"]."<br>\n").$langs->transnoentitiesnoconv("ErrorBadValueForCode");
				$test = false;

				// Call trigger for the "security events" log
				$user->context['audit'] = 'ErrorBadValueForCode - login='.GETPOST("username", "alpha", 2);

				// Call trigger
				$result = $user->call_trigger('USER_LOGIN_FAILED', $user);
				if ($result < 0) {
					$error++;
				}
				// End call triggers

				// Hooks on failed login
				$action = '';
				$hookmanager->initHooks(array('login'));
				$parameters = array('dol_authmode' => $authmode, 'dol_loginmesg' => $_SESSION["dol_loginmesg"]);
				$reshook = $hookmanager->executeHooks('afterLoginFailed', $parameters, $user, $action); // Note that $action and $object may have been modified by some hooks
				if ($reshook < 0) {

View on GitHub (pinned to 598aa4bdad)