/q/ - TRR Meta

There's a very important vulnerability I'd like to report about the Trumpflare Captcha.

One thing I've noticed is that the letters that are used are very easily to manipulate. By malforming the GET request's "extra" parameter, I can make it only return the numbers "1488", the letter "q", or anything of that sort. Here's an example:

>A soicuck makes the captcha only return the letter "ö"
>Thus, every single captcha will have the result "ööööö"
>Captcha is bypassed and the soicuck will now spam /qa2/

My solution to this, is to stop any sort of tampering with the parameters. The default Captcha letters are "abcdefghijklmnopqrstuvwxyz", and every time a request is sent to the captcha entrypoint, compare the extras parameter from the request and the string "abcdefghijklmnopqrstuvwxyz".