Changeset 9167

Timestamp:

10/09/2019 07:07:07 AM (7 years ago)

Author:

dd32

Message:

Login: Require a valid reCaptcha v3 score during registration, add reCaptcha to the account confirmation screen as well.

See #4739.

Location:

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login

Files:

• functions-registration.php (modified) (2 diffs)
• functions.php (modified) (4 diffs)
• pending-create.php (modified) (3 diffs)
• register.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/functions-registration.php

@@ -1 +1 @@
 <?php
 
-function wporg_login_check_recapcha_status() {
+function wporg_login_check_recapcha_status( $check_v3_action = false ) {
+
+        // reCaptcha V3 Checks
+        if ( $check_v3_action ) {
+                if ( empty( $_POST['_reCaptcha_v3_token'] ) ) {
+                        return false;
+                }
+                $result = wporg_login_recaptcha_api(
+                        $_POST['_reCaptcha_v3_token'],
+                        RECAPTCHA_V3_PRIVKEY
+                );
+
+                if (
+                        ! $result ||
+                        ! $result['success'] ||
+                        $check_v3_action !== $result['action']
+                ) {
+                        return false;
+                }
+
+                // Block super-low scores.
+                if ( (float)$result['score'] < (float) get_option( 'recaptcha_v3_threshold', 0.2 ) ) {
+                        return false;
+                }
+        }
+
+        // reCaptcha V2 Checks
         if ( empty( $_POST['g-recaptcha-response'] ) ) {
                 return false;
@@ -14 +40 @@
                 return false;
         }
+
         return (bool) $result['success'];
 }

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/functions.php

@@ -75 +75 @@
 function wporg_login_register_scripts() {
         wp_register_script( 'recaptcha-api', 'https://www.google.com/recaptcha/api.js', array(), '2' );
-        wp_add_inline_script( 'recaptcha-api', 'function onSubmit(token) { document.getElementById("registerform").submit(); }' );
+        wp_add_inline_script(
+                'recaptcha-api',
+                'function onSubmit(token) {
+                        var form = document.getElementById("registerform");
+
+                        if ( form.dataset.submitReady ) {
+                                form.submit();
+                        } else {
+                                // Still waiting on reCaptcha V3, disable/please wait the submit button.
+                                form.dataset.submitReady = true;
+                                document.getElementById("wp-submit").disabled = true;
+                                document.getElementById("wp-submit").value = ' . json_encode( __( 'Please Wait..', 'wporg') ) . ';
+                        }
+                }'
+        );
 
         wp_register_script( 'wporg-registration', get_template_directory_uri() . '/js/registration.js', array( 'recaptcha-api', 'jquery' ), '20170219' );
@@ -99 +113 @@
                         ).then( function( token ) {
                                 // Add the token to the "primary" form
-                                var input = document.createElement( "input" );
+                                var input = document.createElement( "input" ),
+                                        form = document.getElementsByTagName("form")[0];
+
                                 input.setAttribute( "type", "hidden" );
                                 input.setAttribute( "name", "_reCaptcha_v3_token" );
                                 input.setAttribute( "value", token );
 
-                                document.getElementsByTagName("form")[0].appendChild( input );
+                                form.appendChild( input );
+
+                                if ( form.dataset.submitReady ) {
+                                        form.submit();
+                                } else {
+                                        form.dataset.submitReady = true;
+                                }
                         });
                 }'
@@ -305 +327 @@
  */
 function wporg_login_recaptcha_api( $token, $key ) {
+        // Just a basic cache for multiple calls on the same token on the same pageload.
+        static $cache = array();
+
         $verify = array(
                 'secret'   => $key,
@@ -310 +335 @@
                 'response' => $token,
         );
-
-        $resp = wp_remote_post( 'https://www.google.com/recaptcha/api/siteverify', array( 'body' => $verify ) );
-        if ( is_wp_error( $resp ) || 200 != wp_remote_retrieve_response_code( $resp ) ) {
-                return false;
-        }
-
-        return json_decode( wp_remote_retrieve_body( $resp ), true );
-}
+        $cache_key = implode( ':', $verify );
+
+        if ( ! isset( $cache[ $cache_key ] ) ) {
+                $resp = wp_remote_post( 'https://www.google.com/recaptcha/api/siteverify', array( 'body' => $verify ) );
+                if ( is_wp_error( $resp ) || 200 != wp_remote_retrieve_response_code( $resp ) ) {
+                        $cache[ $cache_key ] = false;
+                        return false;
+                }
+
+                $cache[ $cache_key ] = json_decode( wp_remote_retrieve_body( $resp ), true );
+        }
+
+        return $cache[ $cache_key ];
+}

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/pending-create.php

@@ -42 +42 @@
 }
 
+// Check reCaptcha status
+$error_recapcha_status = false;
+if ( isset( $_POST['user_pass'] ) ) {
+        if ( ! wporg_login_check_recapcha_status( 'pending_create' ) ) {
+                // No no. "Please try again."
+                $error_recapcha_status = true;
+                unset( $_POST['user_pass'] );
+        }
+}
+
+if ( wporg_login_save_profile_fields( $pending_user ) ) {
+        // re-fetch the user, it's probably changed.
+        $pending_user = wporg_get_pending_user( $activation_user );
+}
+
 if ( isset( $_POST['user_pass'] ) ) {
         $user_pass = wp_unslash( $_POST['user_pass'] );
@@ -52 +67 @@
                 }
         }
-
-        wporg_login_save_profile_fields();
 
         wp_safe_redirect( 'https://wordpress.org/support/' );
@@ -91 +104 @@
                 include __DIR__ . '/partials/register-profilefields.php';
         ?>
+        <?php
+                if ( $error_recapcha_status ) {
+                        echo '<div class="message error"><p>' . __( 'Please try again.', 'wporg' ) . '</p></div>';
+                }
+        ?>
 
         <p class="login-submit">
-                <input type="submit" name="wp-submit" id="wp-submit" class="button button-primary" value="<?php esc_attr_e( 'Create Account', 'wporg' ); ?>" />
+                <input data-sitekey="<?php echo esc_attr( RECAPTCHA_INVIS_PUBKEY ); ?>" data-callback='onSubmit' type="submit" name="wp-submit" id="wp-submit" class="g-recaptcha button button-primary button-large" value="<?php esc_attr_e( 'Create Account', 'wporg' ); ?>" />
         </p>
 

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/register.php

@@ -25 +25 @@
         // handle user registrations.
         if ( ! $error_user_login && ! $error_user_email ) {
-                if ( ! wporg_login_check_recapcha_status() ) {
+                if ( ! wporg_login_check_recapcha_status( 'register' ) ) {
                         $error_recapcha_status = true;
                 } else {