Require a captcha for visitor submissions and for login.

Without the form field, the check was skipped. A solved captcha lasts
30 minutes in the session.

publish/login.php

@@ -6,6 +6,7 @@ if ( ! isset($_SERVER['HTTPS'])) {
 require_once("../session.lib.php");
 $denied = NULL;
 $wait_minutes = 0;
+$captcha_failed = FALSE;
 $is_admin = NULL;
 if (isset($_SESSION['editor'])) {
   session_write_close();
@@ -16,6 +17,9 @@ if (isset($_SESSION['editor'])) {
 } else if (isset($_POST['login']) && ($wait = login_blocked_for((string)($_POST['username'] ?? ''))) > 0) {
   $denied = TRUE;
   $wait_minutes = (int)ceil($wait / 60);
+} else if (isset($_POST['login']) && !captcha_verify_response()) {
+  $denied = TRUE;
+  $captcha_failed = TRUE;
 } else if (isset($_POST['login'])) {
   include_once('../open_db.lib.php');
   $table = "editors";
@@ -76,6 +80,7 @@ if (isset($_SESSION['editor'])) {
     <link rel='stylesheet' type='text/css' href='../publish/style.css' />
     <script type="text/javascript" src="../utilities.js"></script>
     <link rel="alternate" type="application/rss+xml" title="xxx.org.za RSS feed" href="/feed" />
+    <?= captcha_script() ?>
   </head>
 <?php flush(); ?>
 <body>
@@ -89,6 +94,8 @@ if (isset($_SESSION['editor'])) {
 <?php 
 if ($wait_minutes)
   echo "<p><strong>Too many failed logins. Please try again in $wait_minutes minute".($wait_minutes == 1 ? "" : "s").".</strong></p>\n";
+else if ($captcha_failed)
+  echo "<p><strong>Please complete the captcha.</strong></p>\n";
 else if ($denied) 
   echo "<p><strong>Access denied. Please try again.</strong></p>\n";
 ?>
@@ -112,6 +119,8 @@ else if ($denied)
     <input type="checkbox" id="remember" name="remember" checked />
     </div>
 
+    <?= captcha_widget() ?>
+
     <div class="leftcolumn"></div>
     <div class="submission">
       <button type="submit" id="login" name="login" value="1">Login</button>