hCaptcha secret key not saved when creating a new appointment page

[photoevents]

hCaptcha secret key not saved when creating a new appointment page

Environment

• Nextcloud: 34.0.0
• Appointments app: (latest version compatible with NC34, installed July 2026)
• Installation: Nextcloud AIO on Linux (ZimaOS/Docker)

Bug Description

When creating a new appointment booking page and configuring hCaptcha, the secret key field does not persist after saving. The site key saves correctly, but the secret key field appears empty again after leaving and returning to the settings screen.

Steps to Reproduce

1. Create a new appointment booking page
2. Go to hCaptcha settings, enter both a site key and a secret key
3. Save / leave the settings screen
4. Return to the hCaptcha settings for that same page
5. The site key is still present, but the secret key field is empty

Confirmed via database inspection

Comparing the raw data JSON column in oc_appointments_pref_v2 for two pages using the same hCaptcha site key and secret key (one page created earlier, one created more recently):

Working page (created earlier) — JSON includes:

"secHcapSiteKey":"...",
"secHcapSecret":"::hash::...",
"secHcapEnabled":true

Broken page (created later) — JSON is missing the secHcapSecret key entirely:

"secHcapSiteKey":"...",
"secHcapEnabled":true

(secHcapSecret simply does not exist in the JSON object, rather than being present with an empty value.)

Impact

Because secHcapEnabled is true but secHcapSecret is missing, the hCaptcha challenge does not appear at all on the public booking form — it fails silently rather than showing an error. Visitors can submit the booking form with no bot protection, and the site admin has no visual indication in the UI that anything is wrong (the site key is there, giving a false impression that hCaptcha is fully configured).

Workaround Used

Manually patched the missing field via direct database update, copying the encrypted secret value from a working page's data column using jsonb_set:

UPDATE oc_appointments_pref_v2 
SET data = jsonb_set(data::jsonb, '{secHcapSecret}', '"::hash::<value copied from working page>"')::text 
WHERE token = '<token of broken page>';

This worked and hCaptcha now appears correctly on the previously-broken page. This confirms the encrypted secret value is not tied to a specific database row/token, since it validated correctly on a different page's token than the one it was originally saved under.

Suggested Investigation

Something in the settings-save flow for the secret key field appears to fail specifically on some page creation paths (possibly related to creating a second/subsequent page, or a timing/session issue during save). Since the site key in the same form saves correctly while the secret key does not, the two fields likely go through different save handling — worth checking whether the secret key field has an issue with:

• Being cleared/not submitted correctly in the settings form's POST payload
• A silent validation failure specific to the secret key encryption step

Happy to provide additional details (full anonymized JSON, further DB inspection) if useful for debugging.

[SergeyMosin]

Captcha secret validation logic is here:

Appointments/lib/Backend/BackendUtils.php

Lines 1559 to 1565 in ec0b4c9

	} elseif ($key === self::SEC_HCAP_SECRET && !empty($value)) {
	if (str_starts_with($value, '::hash::')) {
	// already hashed
	return [200, ''];
	}
	$value = '::hash::' . $this->encrypt($value, $this->getLocalHash());
	}

Are you trying to re-enter a hashed key, a.k.a starting with ::hash:: ? If so, it is currently not supported, you would need the original secret key.