diff --git a/frontend/_includes/footer.html b/frontend/_includes/footer.html index 6b816e7483d005f8378485398b14c0b6904dc57a..a2db5a47d643376f3136a159b0a5325eb68479f2 100644 --- a/frontend/_includes/footer.html +++ b/frontend/_includes/footer.html @@ -1,8 +1,9 @@ \ No newline at end of file + +{% include friendly_captcha_deps.html %} diff --git a/frontend/_includes/friendly_captcha_deps.html b/frontend/_includes/friendly_captcha_deps.html new file mode 100644 index 0000000000000000000000000000000000000000..8edf7067eda6077835ceb37882d92635caed28d1 --- /dev/null +++ b/frontend/_includes/friendly_captcha_deps.html @@ -0,0 +1,2 @@ + + diff --git a/frontend/_includes/friendly_captcha_input.html b/frontend/_includes/friendly_captcha_input.html new file mode 100644 index 0000000000000000000000000000000000000000..e2ffa63b811197fa3a5ea1a8c995d951156bd568 --- /dev/null +++ b/frontend/_includes/friendly_captcha_input.html @@ -0,0 +1,4 @@ +
+
diff --git a/frontend/email_invite.html b/frontend/email_invite.html index 88d75254b6157e595a814d1d7a9586e8085e2b95..53be0b4dd14ac91ab9e0989ca0a7b296d9a84d9a 100644 --- a/frontend/email_invite.html +++ b/frontend/email_invite.html @@ -55,6 +55,8 @@ flags:
+ {% include friendly_captcha_input.html %} + {% comment%} + {% endcomment%}
+ {% comment%}
-
+
Code -
+
+ {% endcomment%} type = "secure_code"; - $result->key = "error_secure_code"; - respond_with_message(400, $result, false, $email); + if (isset($friendlyCaptchaAPIKey) && isset($friendlyCaptchaSiteKey)) { + // FriendlyCaptcha enabled + $solution = $_POST['frc-captcha-solution'] ?? ''; + $friendlyCaptchaResponse = curlPostJSON( + 'https://eu-api.friendlycaptcha.eu/api/v1/siteverify', + array( + 'solution' => $solution, + 'secret' => $friendlyCaptchaAPIKey, + 'sitekey' => $friendlyCaptchaSiteKey + ) + ); + if ($friendlyCaptchaResponse->statusCode === 200) { + if ($friendlyCaptchaResponse->output->success) { + error_log('Friendly Captcha PASSED!'); + } else { + // captcha puzzle was not solved, reason will be + // invalid or timeout/duplicate + error_log('Friendly Captcha check failed ' . print_r($friendlyCaptchaResponse->output)); + $result->type = "secure_code"; + $result->key = "error_secure_code"; + respond_with_message(400, $result, false, $email); + } + } else{ + error_log('WARNING, non-200 response from Friendly Captcha ' . $friendlyCaptchaResponse->statusCode); + // They recommend proceeding but for now we validate the implementation is good + $result->type = "secure_code"; + $result->key = "error_secure_code"; + respond_with_message(400, $result, false, $email); + } + } else { + // Use local captcha solution - selfhost? + $solution = isset($_POST['secure']) ? $_POST['secure'] : ''; + $solution = is_string($solution) ? strtolower($solution) : ''; + $isSessionCodeSet = isset($_SESSION['securecode']); + $isSecureCodeRight = ($solution == $_SESSION['securecode']); + if (!($isSessionCodeSet && $isSecureCodeRight)) { + unset($_SESSION['securecode']); + $result->type = "secure_code"; + $result->key = "error_secure_code"; + respond_with_message(400, $result, false, $email); + } } } }