OpenCart Securimage PhpCaptcha weird behavior - php

Question

I have downloaded securimage library from phpcaptcha, unzippped it into system/library/securimage and done the following:
index.php:
require_once(DIR_SYSTEM . 'library/securimage/securimage.php');
$registry->set('securimage', new Securimage($registry));
catalog\view\theme\my_theme\template\information\contact.tpl:
<form action="<?php echo $action; ?>" method="post" enctype="multipart/form-data">
...
<img id="captcha_img" src="index.php?route=information/contact/securimage" alt="CAPTCHA Image" />
<a href="#" onclick="document.getElementById('captcha_img').src = 'system/library/securimage/securimage_show.php?' + Math.random(); return false">
<img src="system/library/securimage/images/refresh.png" height="25" width="25" alt="Reload Image" onclick="this.blur()" align="bottom" border="0"></a>
<label for="captcha" class="required"><?php echo $entry_captcha; ?></label>
<input type="text" id="captcha" name="captcha" size="31" maxlength="6" value="" onblur="check('captcha');" />
<span class="txt"><?php echo $entry_captcha_tip; ?></span>
<br />
<?php if ($error_captcha) { ?><span class="error_txt"><?php echo $error_captcha; ?></span><?php } ?>
...
catalog\controller\information\contact.php:
protected function validate() {
$this->log->write('SESSION CODE: ' . $this->session->data['captcha']);// 2nd variable in log
$this->log->write('REQUEST CODE: ' . $this->request->post['captcha']);// 3rd variable in log
...
if (empty($this->session->data['captcha']) || ($this->session->data['captcha'] != $this->request->post['captcha'])) {
$this->error['captcha'] = $this->language->get('error_captcha');
}
}
public function securimage() {
$this->session->data['captcha'] = $this->securimage->getCode();
$this->log->write('IMAGE CODE: ' . $this->session->data['captcha']); // 1st variable in log
$this->securimage->show();
}
...
Now, this is how it works:
Image loads fine, and reloads fine as well
Say, the first image code is abc123
I enter abc123 into captcha field, press submit
The error['name'] shows abc123, while error['email'] shows some other code
Now say, the image shows def456, I enter def456 into the captcha field and press submit
Now the error['name'] shows def456, but the error['email'] shows abc123!
Can anyone explain what's going on? How is it possible that the $this->session->data['captcha']; is 2 steps behind? Please help me fix it. How can I actually get the correct image code before the submit. Thank you.
[EDIT]
The weird behavior continues... (considering the logged variables):
The first time I visit the contact page, 1st variable IMAGE CODE = kzycbc, 2nd and 3rd are empty, the image on the page shows code eslmmg
I reload the page (without filling in the form), 1st variable IMAGE CODE = *eslmmg, 2nd and 3rd are empty, the image on the page shows code cnsf6u
I fill in the form and enter cnsf6u in the captcha field and press submit, the log shows SESSION CODE = eslmmg, REQUEST CODE = cnsf6u, IMAGE CODE = cnsf6u, image on the page has zvkht7
I enter zvkht7 in the captcha field and press submit, the log shows SESSION CODE = cnsf6u, REQUEST CODE = zvkht7, IMAGE CODE = zvkht7, image on the page has a new code
It looks to me, first, the IMAGE CODE is loaded twice on the first page load, the getCode() takes the first code, while the image on the page loads again, which is then stored in the session variable and shown as IMAGE CODE. This only happens on the very first load of the page. Then, after the second submit, the session takes the value from the previous submit, not from the one just made, while the request code is correct.
What does this tell you? Can anyone help please? The IMAGE CODE and SESSION CODE should be the same. Why do these value differ in securimage() and validate()? As the REQUEST CODE = IMAGE CODE, looks like the image code is correctly taken by the securimage() session, but as the SESSION CODE != IMAGE CODE, where does validate() session takes its value from? Why does it only update the value on the next submit?
[SOLVED]
The solution is much simpler than one might think. All it needs is simply this:
protected function validate() {
...
if (!$this->securimage->check($this->request->post['captcha'])) {
$this->error['captcha'] = $this->language->get('error_captcha');
}
}
public function securimage() {
$this->securimage->show();
}
And no need to use the session! Looks like Securimage handles that itself. Huge thank to drew0!