Default SimpleCaptcha configuration generates hard-to-read captcha images

• Type: Bug
• Status: Closed
• Resolution: Inactive
• Affects Version/s: 6.0.12 EE, 6.2.0 CE M4
• Fix Version/s: None
• Component/s: Accessibility, Application Security > Login/Sign in Portlet
• Labels:
  • community-verifier
  • security-filter-bugs
• Fix Priority: 3

When a user forgets their password, the default config uses SimpleCaptcha. Some of the images generated are difficult/impossible to read. Two examples are attached.

A simple fix would be to remove the following two renderers from the default captcha.engine.simplecaptcha.gimpy.renderers configuration in portal.properties, rather than expecting each deployment to do it in portal-ext.properties:

nl.captcha.gimpy.FishEyeGimpyRenderer
nl.captcha.gimpy.ShearGimpyRenderer

Perhaps provide two lines in portal.properties: (a) all options commented out and (b) recommended options uncommented as follows:
#captcha.engine.simplecaptcha.gimpy.renderers=nl.captcha.gimpy.BlockGimpyRenderer,nl.captcha.gimpy.DropShadowGimpyRenderer,nl.captcha.gimpy.FishEyeGimpyRenderer,nl.captcha.gimpy.RippleGimpyRenderer,nl.captcha.gimpy.ShearGimpyRenderer
captcha.engine.simplecaptcha.gimpy.renderers=nl.captcha.gimpy.BlockGimpyRenderer,nl.captcha.gimpy.DropShadowGimpyRenderer,nl.captcha.gimpy.RippleGimpyRenderer