{"record":{"id":"a33114f42d346142","repo":"Dolibarr/dolibarr","slug":"errorbadvalueforcode","errorCode":null,"errorMessage":"ErrorBadValueForCode","messagePattern":"ErrorBadValueForCode","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"htdocs/main.inc.php","lineNumber":675,"sourceCode":"\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\t$_SESSION[\"dol_loginmesg\"] =  'Error, the captcha handler class '.$classname.' was not found after the include';\n\t\t\t\t\t$test = false;\n\t\t\t\t\t$error++;\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t$_SESSION[\"dol_loginmesg\"] = 'Error, the captcha handler '.$captcha.' has no class file found modCaptcha'.ucfirst($captcha);\n\t\t\t\t$test = false;\n\t\t\t\t$error++;\n\t\t\t}\n\n\t\t\t// Process error of captcha validation\n\t\t\tif (!$ok) {\n\t\t\t\tdol_syslog('--- Security warning: Bad value for code, connection refused', LOG_NOTICE);\n\t\t\t\t// Load translation files required by page\n\t\t\t\t$langs->loadLangs(array('main', 'errors'));\n\n\t\t\t\t$_SESSION[\"dol_loginmesg\"] = (empty($_SESSION[\"dol_loginmesg\"]) ? \"\" : $_SESSION[\"dol_loginmesg\"].\"<br>\\n\").$langs->transnoentitiesnoconv(\"ErrorBadValueForCode\");\n\t\t\t\t$test = false;\n\n\t\t\t\t// Call trigger for the \"security events\" log\n\t\t\t\t$user->context['audit'] = 'ErrorBadValueForCode - login='.GETPOST(\"username\", \"alpha\", 2);\n\n\t\t\t\t// Call trigger\n\t\t\t\t$result = $user->call_trigger('USER_LOGIN_FAILED', $user);\n\t\t\t\tif ($result < 0) {\n\t\t\t\t\t$error++;\n\t\t\t\t}\n\t\t\t\t// End call triggers\n\n\t\t\t\t// Hooks on failed login\n\t\t\t\t$action = '';\n\t\t\t\t$hookmanager->initHooks(array('login'));\n\t\t\t\t$parameters = array('dol_authmode' => $authmode, 'dol_loginmesg' => $_SESSION[\"dol_loginmesg\"]);\n\t\t\t\t$reshook = $hookmanager->executeHooks('afterLoginFailed', $parameters, $user, $action); // Note that $action and $object may have been modified by some hooks\n\t\t\t\tif ($reshook < 0) {","sourceCodeStart":657,"sourceCodeEnd":693,"githubUrl":"https://github.com/Dolibarr/dolibarr/blob/598aa4bdada683d17ca04b1842548821ff0eb6c6/htdocs/main.inc.php#L657-L693","documentation":"The submitted captcha code failed validation ($ok false after validateCodeAfterLoginSubmit), so Dolibarr refuses the login attempt and stores the translated ErrorBadValueForCode message in the session. A USER_LOGIN_FAILED trigger and security log entry ('Bad value for code, connection refused') are also fired.","triggerScenarios":"User types a wrong captcha code on the login form; captcha session data expired between page load and submit; a bot posts credentials without solving the captcha.","commonSituations":"Users mistyping codes; long-idle login pages whose captcha session state expired; automated tooling hitting the login endpoint without captcha handling; cookie issues losing the captcha session.","solutions":["Re-enter the captcha code carefully and resubmit the login form.","Reload the login page to get a fresh captcha if the old one expired.","Check browser cookies/session support if valid codes are repeatedly rejected.","Verify the captcha module backend (e.g. reCAPTCHA keys/domain) is correctly configured if users are broadly locked out.","Bots/integrations must solve the captcha or use an alternative auth flow."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"if (empty($_POST['captcha_code'])) { /* prompt user for code before submitting login */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Render a fresh captcha on every login page load","Tell users the code is case/character sensitive","Monitor USER_LOGIN_FAILED triggers to detect brute-force patterns"],"tags":["dolibarr","captcha","login"],"backgroundTag":"invalid-captcha-code","analyzedSha":"598aa4bdada683d17ca04b1842548821ff0eb6c6","analyzedAt":"2026-09-14T11:12:15.309Z","contentChangedAt":"2026-09-14T11:12:15.309Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}