Changeset 9147

Timestamp:

09/23/2019 06:26:14 AM (6 years ago)

Author:

dd32

Message:

Login: Add reCaptcha v3 in logging-only mode for registration.

See #4739.

Location:

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login

Files:

• functions-registration.php (modified) (3 diffs)
• functions.php (modified) (2 diffs)

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/functions-registration.php

@@ -6 +6 @@
     }
 
-    $verify = array(
-        'secret'   => RECAPTCHA_INVIS_PRIVKEY,
-        'remoteip' => $_SERVER['REMOTE_ADDR'],
-        'response' => $_POST['g-recaptcha-response'],
-    );
-
-    $resp = wp_remote_post( 'https://www.google.com/recaptcha/api/siteverify', array( 'body' => $verify ) );
-    if ( is_wp_error( $resp ) || 200 != wp_remote_retrieve_response_code( $resp ) ) {
-        return false;
-    }
-
-    $result = json_decode( wp_remote_retrieve_body( $resp ), true );
-
+    $result = wporg_login_recaptcha_api(
+        $_POST['g-recaptcha-response'],
+        RECAPTCHA_INVIS_PRIVKEY
+    );
+
+    if ( ! $result ) {
+        return false;
+    }
     return (bool) $result['success'];
 }
@@ -55 +50 @@
     );
 
+    // reCaptcha v3 logging.
+    if ( isset( $_POST['_reCaptcha_v3_token'] ) ) {
+        $recaptcha_api = wporg_login_recaptcha_api(
+            $_POST['_reCaptcha_v3_token'],
+            RECAPTCHA_V3_PRIVKEY
+        );
+        $pending_user['scores']['pending'] = -1;
+        if ( $recaptcha_api && $recaptcha_api['success'] && 'register' == $recaptcha_api['action'] ) {
+            $pending_user['scores']['pending'] = $recaptcha_api['score'];
+        }
+        
+    }
+
     $inserted = wporg_update_pending_user( $pending_user );
     if ( ! $inserted ) {
@@ -168 +176 @@
     $pending_user['created_date'] = gmdate( 'Y-m-d H:i:s' );
     $pending_user['meta']['confirmed_ip'] = $_SERVER['REMOTE_ADDR']; // Spam/Fraud purposes, will be deleted once not needed.
+
+    // reCaptcha v3 logging.
+    if ( isset( $_POST['_reCaptcha_v3_token'] ) ) {
+        $recaptcha_api = wporg_login_recaptcha_api(
+            $_POST['_reCaptcha_v3_token'],
+            RECAPTCHA_V3_PRIVKEY
+        );
+        $pending_user['scores']['create'] = -1;
+        if ( $recaptcha_api && $recaptcha_api['success'] && 'pending_create' == $recaptcha_api['action'] ) {
+            $pending_user['scores']['create'] = $recaptcha_api['score'];
+        }
+    }
+
     wporg_update_pending_user( $pending_user );
 

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/functions.php

@@ -81 +81 @@
         'rest_url' => esc_url_raw( rest_url( "wporg/v1" ) )
     ) );
+
+    // reCaptcha v3 is loaded on all login pages, not just the registration flow.
+    wp_enqueue_script( 'recaptcha-api-v3', 'https://www.google.com/recaptcha/api.js?onload=reCaptcha_v3_init&render=' . RECAPTCHA_V3_PUBKEY, array(), '3' );
+    wp_add_inline_script(
+        'recaptcha-api-v3',
+        'function reCaptcha_v3_init() {
+            grecaptcha.execute(' .
+                json_encode( RECAPTCHA_V3_PUBKEY ) .
+                ', {action: ' . json_encode(
+                    str_replace( '-', '_', WP_WPOrg_SSO::$matched_route ?: 'login' ) // Must match ^[a-Z_ ]$, but we use -
+                ) .' }
+            ).then( function( token ) {
+                // Add the token to the "primary" form
+                var input = document.createElement( "input" );
+                input.setAttribute( "type", "hidden" );
+                input.setAttribute( "name", "_reCaptcha_v3_token" );
+                input.setAttribute( "value", token );
+
+                document.getElementsByTagName("form")[0].appendChild( input );
+            });
+        }'
+    );
 }
 add_action( 'init', 'wporg_login_register_scripts' );
@@ -273 +295 @@
 add_action( 'wp_footer', 'wporg_login_language_switcher', 1 );
 add_action( 'login_footer', 'wporg_login_language_switcher', 1 );
+
+/**
+ * Simple API for accessing the reCaptcha verify api.
+ */
+function wporg_login_recaptcha_api( $token, $key ) {
+    $verify = array(
+        'secret'   => $key,
+        'remoteip' => $_SERVER['REMOTE_ADDR'],
+        'response' => $token,
+    );
+
+    $resp = wp_remote_post( 'https://www.google.com/recaptcha/api/siteverify', array( 'body' => $verify ) );
+    if ( is_wp_error( $resp ) || 200 != wp_remote_retrieve_response_code( $resp ) ) {
+        return false;
+    }
+
+    return json_decode( wp_remote_retrieve_body( $resp ), true );
+}