Disable submit button while an invisible reCAPTCHA check runs

[vivi-the-going-merry]

What was broken

submitFormManual() only called showLoadingIndicator() on the invisible-reCAPTCHA path, so disableSubmitButton() (only reached via showSubmitLoading()) never ran. The submit button stayed clickable for the whole duration of the invisible reCAPTCHA check, allowing duplicate submissions.

What changed

• The invisible-recaptcha branch now calls showSubmitLoading(), same as the non-captcha path, disabling the button while the check runs.
• Added a 10s fallback (reenableSubmitIfRecaptchaStalls) that re-enables the button only if the check itself never resolved (hasInvisibleRecaptcha(object) still true) — the widget has no error-callback/expired-callback wired up, so a stalled or blocked check would otherwise leave the button disabled with no way to retry. Guarded so a real in-flight submission (recaptcha already resolved) is never touched.

How it was verified

No existing JS unit-test harness or Cypress coverage exists for this frontend module (no jest/mocha in package.json, no recaptcha spec in tests/cypress). Verified live instead with a minimal jQuery + formidable.js harness driven via playwright-cli, stubbing grecaptcha to control the invisible-recaptcha flow directly (no live Google dependency):

• Red (pre-fix): dispatching submit on a form with an invisible-recaptcha field left the submit button enabled.
• Green (post-fix): button is disabled immediately on submit.
• Stalled check (grecaptcha never resolves): button re-enables after 10s.
• Resolved check with a slow/in-flight real submission: button stays disabled past the 10s mark (fallback correctly no-ops).

Self-reviewed (reuse/simplification/efficiency/altitude/security lenses) before opening.

Closes #3368

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 2bf9f54d-6197-47a8-aee4-fc8de875e386

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in 2a2d8c1...6822504 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
PHP		Sep 16, 2026 6:43p.m.	Review ↗
JavaScript		Sep 16, 2026 6:43p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 28.51%. Comparing base (d0ffb93) to head (6822504).
⚠️ Report is 822 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #3343      +/-   ##
============================================
+ Coverage     28.36%   28.51%   +0.14%     
- Complexity     9806     9844      +38     
============================================
  Files           160      160              
  Lines         32921    33022     +101     
============================================
+ Hits           9339     9416      +77     
- Misses        23582    23606      +24     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.