[ticket/17589] Check confirm id

When a login fails the qa captcha is reset and creates a new `confirm_id`.
However, the `confirm_id` is never checked for changes causing the captcha to
believe it's still solved and thus no need to generate a new captcha.

This commit checks the known `confirm_id` against the `confirm_id` given by the
user, marking the captcha solved accordingly.

PHPBB-17589

Author: Neo-CTC

phpBB/phpbb/captcha/plugins/qa.php

@@ -573,6 +573,7 @@ function check_answer()
 		global $db, $request;
 
 		$answer = ($this->question_strict) ? $request->variable('qa_answer', '', true) : utf8_clean_string($request->variable('qa_answer', '', true));
+		$confirm_id = $request->variable('qa_confirm_id', '');
 
 		$sql = 'SELECT answer_text
 			FROM ' . $this->table_captcha_answers . '
@@ -583,7 +584,7 @@ function check_answer()
 		{
 			$solution = ($this->question_strict) ? $row['answer_text'] : utf8_clean_string($row['answer_text']);
 
-			if ($solution === $answer)
+			if ($solution === $answer && $this->confirm_id === $confirm_id)
 			{
 				$this->solved = true;