Changeset 9167

Timestamp:

10/09/2019 07:07:07 AM (5 years ago)

Author:

dd32

Message:

Login: Require a valid reCaptcha v3 score during registration, add reCaptcha to the account confirmation screen as well.

See #4739.

Location:

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login

Files:

• functions-registration.php (modified) (2 diffs)
• functions.php (modified) (4 diffs)
• pending-create.php (modified) (3 diffs)
• register.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/functions-registration.php

@@ -1 +1 @@
 <?php
 
-function wporg_login_check_recapcha_status() {
+function wporg_login_check_recapcha_status( $check_v3_action = false ) {
+
+    // reCaptcha V3 Checks
+    if ( $check_v3_action ) {
+        if ( empty( $_POST['_reCaptcha_v3_token'] ) ) {
+            return false;
+        }
+        $result = wporg_login_recaptcha_api(
+            $_POST['_reCaptcha_v3_token'],
+            RECAPTCHA_V3_PRIVKEY
+        );
+
+        if (
+            ! $result ||
+            ! $result['success'] ||
+            $check_v3_action !== $result['action']
+        ) {
+            return false;
+        }
+
+        // Block super-low scores.
+        if ( (float)$result['score'] < (float) get_option( 'recaptcha_v3_threshold', 0.2 ) ) {
+            return false;
+        }
+    }
+
+    // reCaptcha V2 Checks
     if ( empty( $_POST['g-recaptcha-response'] ) ) {
         return false;
@@ -14 +40 @@
         return false;
     }
+
     return (bool) $result['success'];
 }

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/functions.php

@@ -75 +75 @@
 function wporg_login_register_scripts() {
     wp_register_script( 'recaptcha-api', 'https://www.google.com/recaptcha/api.js', array(), '2' );
-    wp_add_inline_script( 'recaptcha-api', 'function onSubmit(token) { document.getElementById("registerform").submit(); }' );
+    wp_add_inline_script(
+        'recaptcha-api',
+        'function onSubmit(token) {
+            var form = document.getElementById("registerform");
+
+            if ( form.dataset.submitReady ) {
+                form.submit();
+            } else {
+                // Still waiting on reCaptcha V3, disable/please wait the submit button.
+                form.dataset.submitReady = true;
+                document.getElementById("wp-submit").disabled = true;
+                document.getElementById("wp-submit").value = ' . json_encode( __( 'Please Wait..', 'wporg') ) . ';
+            }
+        }'
+    );
 
     wp_register_script( 'wporg-registration', get_template_directory_uri() . '/js/registration.js', array( 'recaptcha-api', 'jquery' ), '20170219' );
@@ -99 +113 @@
             ).then( function( token ) {
                 // Add the token to the "primary" form
-                var input = document.createElement( "input" );
+                var input = document.createElement( "input" ),
+                    form = document.getElementsByTagName("form")[0];
+
                 input.setAttribute( "type", "hidden" );
                 input.setAttribute( "name", "_reCaptcha_v3_token" );
                 input.setAttribute( "value", token );
 
-                document.getElementsByTagName("form")[0].appendChild( input );
+                form.appendChild( input );
+
+                if ( form.dataset.submitReady ) {
+                    form.submit();
+                } else {
+                    form.dataset.submitReady = true;
+                }
             });
         }'
@@ -305 +327 @@
  */
 function wporg_login_recaptcha_api( $token, $key ) {
+    // Just a basic cache for multiple calls on the same token on the same pageload.
+    static $cache = array();
+
     $verify = array(
         'secret'   => $key,
@@ -310 +335 @@
         'response' => $token,
     );
-
-    $resp = wp_remote_post( 'https://www.google.com/recaptcha/api/siteverify', array( 'body' => $verify ) );
-    if ( is_wp_error( $resp ) || 200 != wp_remote_retrieve_response_code( $resp ) ) {
-        return false;
-    }
-
-    return json_decode( wp_remote_retrieve_body( $resp ), true );
-}
+    $cache_key = implode( ':', $verify );
+
+    if ( ! isset( $cache[ $cache_key ] ) ) {
+        $resp = wp_remote_post( 'https://www.google.com/recaptcha/api/siteverify', array( 'body' => $verify ) );
+        if ( is_wp_error( $resp ) || 200 != wp_remote_retrieve_response_code( $resp ) ) {
+            $cache[ $cache_key ] = false;
+            return false;
+        }
+
+        $cache[ $cache_key ] = json_decode( wp_remote_retrieve_body( $resp ), true );
+    }
+
+    return $cache[ $cache_key ];
+}

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/pending-create.php

@@ -42 +42 @@
 }
 
+// Check reCaptcha status
+$error_recapcha_status = false;
+if ( isset( $_POST['user_pass'] ) ) {
+    if ( ! wporg_login_check_recapcha_status( 'pending_create' ) ) {
+        // No no. "Please try again."
+        $error_recapcha_status = true;
+        unset( $_POST['user_pass'] );
+    }
+}
+
+if ( wporg_login_save_profile_fields( $pending_user ) ) {
+    // re-fetch the user, it's probably changed.
+    $pending_user = wporg_get_pending_user( $activation_user );
+}
+
 if ( isset( $_POST['user_pass'] ) ) {
     $user_pass = wp_unslash( $_POST['user_pass'] );
@@ -52 +67 @@
         }
     }
-
-    wporg_login_save_profile_fields();
 
     wp_safe_redirect( 'https://wordpress.org/support/' );
@@ -91 +104 @@
         include __DIR__ . '/partials/register-profilefields.php';
     ?>
+    <?php
+        if ( $error_recapcha_status ) {
+            echo '<div class="message error"><p>' . __( 'Please try again.', 'wporg' ) . '</p></div>';
+        }
+    ?>
 
     <p class="login-submit">
-        <input type="submit" name="wp-submit" id="wp-submit" class="button button-primary" value="<?php esc_attr_e( 'Create Account', 'wporg' ); ?>" />
+        <input data-sitekey="<?php echo esc_attr( RECAPTCHA_INVIS_PUBKEY ); ?>" data-callback='onSubmit' type="submit" name="wp-submit" id="wp-submit" class="g-recaptcha button button-primary button-large" value="<?php esc_attr_e( 'Create Account', 'wporg' ); ?>" />
     </p>
 

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/register.php

@@ -25 +25 @@
     // handle user registrations.
     if ( ! $error_user_login && ! $error_user_email ) {
-        if ( ! wporg_login_check_recapcha_status() ) {
+        if ( ! wporg_login_check_recapcha_status( 'register' ) ) {
             $error_recapcha_status = true;
         } else {