Disable hCaptcha compatibility with reCAPTCHA

crates/handlers/src/captcha.rs

@@ -212,9 +212,7 @@ impl Form {
             }
 
             // hCaptcha
-            // XXX: this is also allowing g-recaptcha-response, because apparently hCaptcha thought
-            // it was a good idea to send both
-            (CaptchaService::HCaptcha, _, Some(response), None) => {
+            (CaptchaService::HCaptcha, None, Some(response), None) => {
                 Request::post(HCAPTCHA_VERIFY_URL)
                     .body(VerificationRequest {
                         secret,

templates/components/captcha.html

@@ -41,7 +41,7 @@ limitations under the License.
     {%- elif captcha.service == "cloudflare_turnstile" -%}
       <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
     {%- elif captcha.service == "hcaptcha" -%}
-      <script src="https://js.hcaptcha.com/1/api.js" async defer></script>
+      <script src="https://js.hcaptcha.com/1/api.js?recaptchacompat=off" async defer></script>
     {%- else -%}
       {{ throw(message="Invalid captcha service setup") }}
     {%- endif %}