Require a captcha for visitor submissions and for login.

Without the form field, the check was skipped. A solved captcha lasts
30 minutes in the session.

publish/post.lib.php

@@ -115,6 +115,10 @@ function save_data($id = NULL) {
   if (!$is_admin && $action == 'submit')
     $_SESSION['allow_queue_image'] = $id;
 
+  // A visitor's next story needs a new captcha
+  if (!$is_admin)
+    captcha_used();
+
   // Prune filesystem
   if ($image_file)
     prune_images($image_file);
@@ -189,7 +193,7 @@ function prune_images($image_file) {
  */
 $validate = array();
 function validate_data() {
-  global $validate;
+  global $validate, $is_admin;
   // extract POST variables
   $result = get_post_data(TRUE);
   // assign their keys and values to the symbol table
@@ -197,6 +201,10 @@ function validate_data() {
   $upload_error = $_FILES['upload']['error']    ?? UPLOAD_ERR_NO_FILE;
   $upload_tmp   = $_FILES['upload']['tmp_name'] ?? '';
 
+  // Visitors must solve the captcha before a preview or a save
+  if (!$is_admin && !captcha_check()) {
+    $validate['captcha'] = 'Please complete the captcha.';
+  }
 
   if (!$author) {
     $validate['author'] = "You have not submitted an author.";