Changeset 11631

Timestamp:

03/03/2022 07:56:16 AM (3 years ago)

Author:

dd32

Message:

Login: Properly block/require manual approval of signup attempts where reCaptcha v3 fails on the create step.

File:

• sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/pending-create.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/pending-create.php

@@ -69 +69 @@
         unset( $_POST['user_pass'] );
         $error_recapcha_status = true;
+    }
 
-        // Store for reference.
-        if ( isset( $_POST['_reCaptcha_v3_token'] ) ) {
-            $recaptcha_api = wporg_login_recaptcha_api(
-                $_POST['_reCaptcha_v3_token'],
-                RECAPTCHA_V3_PRIVKEY
-            );
-            if ( $recaptcha_api && $recaptcha_api['success'] && 'pending_create' == $recaptcha_api['action'] ) {
-                $pending_user['scores']['create_attempt'] = $recaptcha_api['score'];
-            } // else: probably `timeout-or-duplicate` or w.org network error.
-        }
+    // Store for reference.
+    if ( isset( $_POST['_reCaptcha_v3_token'] ) ) {
+        $recaptcha_api = wporg_login_recaptcha_api(
+            $_POST['_reCaptcha_v3_token'],
+            RECAPTCHA_V3_PRIVKEY
+        );
+        if ( $recaptcha_api && $recaptcha_api['success'] && 'pending_create' == $recaptcha_api['action'] ) {
+            $pending_user['scores']['create_attempt'] = $recaptcha_api['score'];
+        } // else: probably `timeout-or-duplicate` or w.org network error.
+    }
 
-        // Allow a recaptcha fail to try again, but if they're blocked due to low score, mark them as needing approval.
-        if (
-            ! empty( $pending_user['scores']['create_attempt'] ) &&
-            (float) $pending_user['scores']['create_attempt'] < (float) get_option( 'recaptcha_v3_threshold', 0.2 )
-        ) {
-            $pending_user['cleared'] = 0;
-        }
+    // Allow a recaptcha fail to try again, but if they're blocked due to low score, mark them as needing approval.
+    if (
+        $error_recapcha_status &&
+        ! empty( $pending_user['scores']['create_attempt'] ) &&
+        (float) $pending_user['scores']['create_attempt'] < (float) get_option( 'recaptcha_v3_threshold', 0.2 )
+    ) {
+        $pending_user['cleared'] = 0;
     }