VirtueMart Forum

Hello,

I wanted to replace Google reCAPTCHA with Cloudflare Turnstile for customer registration, aiming to maintain protection against automated submissions while making the verification process easier for customers.

However, after switching to Turnstile, I encountered a validation problem that prevented new customers from registering.

Environment

- Joomla 5.4.10
- VirtueMart 4.8.2
- Captcha – Cloudflare Turnstile 1.5.2 by SharkyKZ

Problem

The Turnstile widget completes successfully, but submitting the VirtueMart registration form results in the following message:

QuoteCaptcha verification failed. Note that JavaScript is required to submit this form.

Registration fails despite the completed verification.

What we found

In `components/com_virtuemart/helpers/shopfunctionsf.php`, the `checkCaptcha()` function passes a null value to the CAPTCHA validation event:

$recaptcha = null;
JPluginHelper::importPlugin('captcha');

$res = vDispatcher::trigger(
    'onCheckAnswer',
    array($recaptcha)
);

In this integration, the Turnstile response is submitted in a POST field named `turnstile`. However, VirtueMart does not pass that response to the plugin's `onCheckAnswer()` method.

The plugin rejects the empty argument before it can verify the response with Cloudflare.

Temporary workaround

We replaced the `$recaptcha = null;` assignment with:

$recaptcha = null;

if (JFactory::getConfig()->get('captcha') === 'turnstile') {
    $recaptcha = JFactory::getApplication()
        ->input->post->getString('turnstile', '');
}

The existing validation code was retained; CAPTCHA verification was not disabled or bypassed.

After this change, registration succeeded.

However, this is a provider-specific workaround that modifies a VirtueMart core file and can be overwritten by an update.

Feedback from the Turnstile plugin author

I reported the issue and these findings to the plugin author to determine whether a compatibility adjustment was needed in the plugin.

The author explained that the underlying problem should be fixed in VirtueMart. Besides not passing the CAPTCHA response, VirtueMart directly triggers CAPTCHA events instead of using Joomla's `Joomla\CMS\Captcha\Captcha` class.

According to the author, VirtueMart should use that class to ensure CAPTCHA plugins work correctly.

Plugin repository:
https://github.com/SharkyKZ/joomla-turnstile-plugin

Requested fix

Could you please review VirtueMart's CAPTCHA rendering and validation and implement the integration through Joomla's `Joomla\CMS\Captcha\Captcha` API?

We would appreciate an official fix as soon as possible, since this issue blocks customer registration with Turnstile unless a core-file workaround is applied.

Please let us know whether a fix is planned and which release will include it. I am available to provide further details and test a proposed patch.

Thank you!