From 1a36aa89041b6813c1cb5d9e87f859fb648bdc1e Mon Sep 17 00:00:00 2001 From: slawkens Date: Thu, 15 Oct 2020 19:55:12 +0200 Subject: [PATCH] [WIP] New GoogleReCAPTCHA code Support for v3 v2-invisible doesn't work yet --- config.php | 4 + system/functions.php | 6 +- system/libs/GoogleReCAPTCHA.php | 83 +++++++++++++++++++ system/login.php | 8 ++ system/pages/createaccount.php | 13 +-- system/templates/account.create.html.twig | 36 +++++--- system/templates/account.login.html.twig | 22 ++++- .../templates/google_recaptcha_v3.html.twig | 11 +++ templates/tibiacom/account.login.html.twig | 20 +++++ 9 files changed, 178 insertions(+), 25 deletions(-) create mode 100644 system/libs/GoogleReCAPTCHA.php create mode 100644 system/templates/google_recaptcha_v3.html.twig diff --git a/config.php b/config.php index 376fad1d..75057068 100644 --- a/config.php +++ b/config.php @@ -127,9 +127,13 @@ $config = array( // reCAPTCHA (prevent spam bots) 'recaptcha_enabled' => false, // enable recaptcha verification code + 'recaptcha_type' => 'v3', // 'v2-checkbox', 'v2-invisible', 'v3' 'recaptcha_site_key' => '', // get your own site and secret keys at https://www.google.com/recaptcha 'recaptcha_secret_key' => '', 'recaptcha_theme' => 'light', // light, dark + // min score for validation, between 0 - 1.0 + // https://developers.google.com/recaptcha/docs/v3#interpreting_the_score + 'recaptcha_v3_min_score' => 1.1, // 'generate_new_reckey' => true, // let player generate new recovery key, he will receive e-mail with new rec key (not display on page, hacker can't generate rec key) diff --git a/system/functions.php b/system/functions.php index 903570db..891a2ab3 100644 --- a/system/functions.php +++ b/system/functions.php @@ -496,8 +496,10 @@ function template_header($is_admin = false) '; - if($config['recaptcha_enabled']) - $ret .= ""; + if(config('recaptcha_enabled')) { + $ret .= ''; + } + return $ret; } diff --git a/system/libs/GoogleReCAPTCHA.php b/system/libs/GoogleReCAPTCHA.php new file mode 100644 index 00000000..d1799619 --- /dev/null +++ b/system/libs/GoogleReCAPTCHA.php @@ -0,0 +1,83 @@ +score . ', action:' . $json->action); + if (!isset($json->action) || $json->action !== $action) { + self::$errorType = self::ERROR_INVALID_ACTION; + self::$errorMessage = 'Google ReCaptcha returned invalid action.'; + return false; + } + + if (!isset($json->score) || $json->score < config('recaptcha_v3_min_score')) { + self::$errorType = self::ERROR_LOW_SCORE; + self::$errorMessage = 'Your Google ReCaptcha score was too low.'; + return false; + } + } + + if (!isset($json->success) || !$json->success) { + self::$errorType = self::ERROR_NO_SUCCESS; + self::$errorMessage = "Please confirm that you're not a robot."; + return false; + } + + return true; + } + + /** + * @return string + */ + public static function getErrorMessage() { + return self::$errorMessage; + } + + /** + * @return int + */ + public static function getErrorType() { + return self::$errorType; + } +} diff --git a/system/login.php b/system/login.php index 330efd13..452974cb 100644 --- a/system/login.php +++ b/system/login.php @@ -84,6 +84,14 @@ else $t = isset($tmp[$ip]) ? $tmp[$ip] : NULL; } + if(config('recaptcha_enabled')) + { + require LIBS . 'GoogleReCAPTCHA.php'; + if (!GoogleReCAPTCHA::verify('login')) { + $errors[] = GoogleReCAPTCHA::getErrorMessage(); + } + } + $account_logged = new OTS_Account(); if(USE_ACCOUNT_NAME) $account_logged->find($login_account); diff --git a/system/pages/createaccount.php b/system/pages/createaccount.php index 8af31629..49971e97 100644 --- a/system/pages/createaccount.php +++ b/system/pages/createaccount.php @@ -68,17 +68,12 @@ if($save) $errors['country'] = 'Country is invalid.'; } - if($config['recaptcha_enabled']) + if(config('recaptcha_enabled')) { - if(isset($_POST['g-recaptcha-response']) && !empty($_POST['g-recaptcha-response'])) - { - $verifyResponse = file_get_contents('https://www.google.com/recaptcha/api/siteverify?secret='.$config['recaptcha_secret_key'].'&response='.$_POST['g-recaptcha-response']); - $responseData = json_decode($verifyResponse); - if(!$responseData->success) - $errors['verification'] = "Please confirm that you're not a robot."; + require LIBS . 'GoogleReCAPTCHA.php'; + if (!GoogleReCAPTCHA::verify('register')) { + $errors['verification'] = GoogleReCAPTCHA::getErrorMessage(); } - else - $errors['verification'] = "Please confirm that you're not a robot."; } // password diff --git a/system/templates/account.create.html.twig b/system/templates/account.create.html.twig index a52119b7..9f8e83b4 100644 --- a/system/templates/account.create.html.twig +++ b/system/templates/account.create.html.twig @@ -104,19 +104,25 @@ {{ hook('HOOK_ACCOUNT_CREATE_AFTER_PASSWORDS') }} - {% if config.recaptcha_enabled %} - - - Verification: - - -
- - - {% if errors.verification is defined %} - {{ errors.verification }} - {% endif %} - {% endif %} + {% if config.recaptcha_enabled %} + {% if config.recaptcha_type == 'v3' %} + + {% elseif config.recaptcha_type == 'v2-invisible' %} +
+ {% elseif config.recaptcha_type == 'v2-checkbox' %} + + + Verification: + + +
+ + + {% if errors.verification is defined %} + {{ errors.verification }} + {% endif %} + {% endif %} + {% endif %} {{ hook('HOOK_ACCOUNT_CREATE_AFTER_RECAPTCHA') }} @@ -334,3 +340,7 @@ {{ hook('HOOK_ACCOUNT_CREATE_AFTER_FORM') }} +{% if config.recaptcha_enabled and config.recaptcha_type == 'v3' %} + {% set action = 'register' %} + {{ include('google_recaptcha_v3.html.twig') }} +{% endif %} \ No newline at end of file diff --git a/system/templates/account.login.html.twig b/system/templates/account.login.html.twig index 2ac4f3f6..40cd0f9c 100644 --- a/system/templates/account.login.html.twig +++ b/system/templates/account.login.html.twig @@ -39,6 +39,22 @@ Please enter your account {{ account|lower }} and your password.
+ {% if config.recaptcha_enabled %} + {% if config.recaptcha_type == 'v3' %} + + {% elseif config.recaptcha_type == 'v2-invisible' %} +
+ {% elseif config.recaptcha_type == 'v2-checkbox' %} + + + Verification: + + +
+ + + {% endif %} + {% endif %} {% if error is not null %} {{ error }} {% endif %} @@ -73,4 +89,8 @@ Please enter your account {{ account|lower }} and your password.
 + {% if config.recaptcha_enabled %} + {% if config.recaptcha_type == 'v3' %} + + {% elseif config.recaptcha_type == 'v2-invisible' %} +
+ {% elseif config.recaptcha_type == 'v2-checkbox' %} + + + Verification: + + +
+ + + {% endif %} + {% endif %}
@@ -142,3 +158,7 @@
+{% if config.recaptcha_enabled and config.recaptcha_type == 'v3' %} + {% set action = 'login' %} + {{ include('google_recaptcha_v3.html.twig') }} +{% endif %} \ No newline at end of file