diff --git a/frontend/_includes/footer.html b/frontend/_includes/footer.html
index 6b816e7483d005f8378485398b14c0b6904dc57a..a2db5a47d643376f3136a159b0a5325eb68479f2 100644
--- a/frontend/_includes/footer.html
+++ b/frontend/_includes/footer.html
@@ -1,8 +1,9 @@
\ No newline at end of file
+
+{% include friendly_captcha_deps.html %}
diff --git a/frontend/_includes/friendly_captcha_deps.html b/frontend/_includes/friendly_captcha_deps.html
new file mode 100644
index 0000000000000000000000000000000000000000..8edf7067eda6077835ceb37882d92635caed28d1
--- /dev/null
+++ b/frontend/_includes/friendly_captcha_deps.html
@@ -0,0 +1,2 @@
+
+
diff --git a/frontend/_includes/friendly_captcha_input.html b/frontend/_includes/friendly_captcha_input.html
new file mode 100644
index 0000000000000000000000000000000000000000..e2ffa63b811197fa3a5ea1a8c995d951156bd568
--- /dev/null
+++ b/frontend/_includes/friendly_captcha_input.html
@@ -0,0 +1,4 @@
+
+
diff --git a/frontend/email_invite.html b/frontend/email_invite.html
index 88d75254b6157e595a814d1d7a9586e8085e2b95..53be0b4dd14ac91ab9e0989ca0a7b296d9a84d9a 100644
--- a/frontend/email_invite.html
+++ b/frontend/email_invite.html
@@ -55,6 +55,8 @@ flags:
+ {% comment%}
-
+
-
+
+ {% endcomment%}
type = "secure_code";
- $result->key = "error_secure_code";
- respond_with_message(400, $result, false, $email);
+ if (isset($friendlyCaptchaAPIKey) && isset($friendlyCaptchaSiteKey)) {
+ // FriendlyCaptcha enabled
+ $solution = $_POST['frc-captcha-solution'] ?? '';
+ $friendlyCaptchaResponse = curlPostJSON(
+ 'https://eu-api.friendlycaptcha.eu/api/v1/siteverify',
+ array(
+ 'solution' => $solution,
+ 'secret' => $friendlyCaptchaAPIKey,
+ 'sitekey' => $friendlyCaptchaSiteKey
+ )
+ );
+ if ($friendlyCaptchaResponse->statusCode === 200) {
+ if ($friendlyCaptchaResponse->output->success) {
+ error_log('Friendly Captcha PASSED!');
+ } else {
+ // captcha puzzle was not solved, reason will be
+ // invalid or timeout/duplicate
+ error_log('Friendly Captcha check failed ' . print_r($friendlyCaptchaResponse->output));
+ $result->type = "secure_code";
+ $result->key = "error_secure_code";
+ respond_with_message(400, $result, false, $email);
+ }
+ } else{
+ error_log('WARNING, non-200 response from Friendly Captcha ' . $friendlyCaptchaResponse->statusCode);
+ // They recommend proceeding but for now we validate the implementation is good
+ $result->type = "secure_code";
+ $result->key = "error_secure_code";
+ respond_with_message(400, $result, false, $email);
+ }
+ } else {
+ // Use local captcha solution - selfhost?
+ $solution = isset($_POST['secure']) ? $_POST['secure'] : '';
+ $solution = is_string($solution) ? strtolower($solution) : '';
+ $isSessionCodeSet = isset($_SESSION['securecode']);
+ $isSecureCodeRight = ($solution == $_SESSION['securecode']);
+ if (!($isSessionCodeSet && $isSecureCodeRight)) {
+ unset($_SESSION['securecode']);
+ $result->type = "secure_code";
+ $result->key = "error_secure_code";
+ respond_with_message(400, $result, false, $email);
+ }
}
}
}