-
Notifications
You must be signed in to change notification settings - Fork 319
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add reCAPTCHA support and update captcha provider handling #647
Changes from 8 commits
3a2fab1
7945873
f0e065d
2d06841
dfc4825
60c720d
6b0c671
c649d8c
3cbfaaf
6cf551b
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -12,7 +12,7 @@ | |
use Illuminate\Http\Request; | ||
use Illuminate\Support\Facades\Validator; | ||
use Illuminate\Validation\Rule; | ||
use App\Rules\ValidHCaptcha; | ||
use App\Rules\ValidReCaptcha; | ||
|
||
class RegisterController extends Controller | ||
{ | ||
|
@@ -71,8 +71,8 @@ protected function validator(array $data) | |
'utm_data' => ['nullable', 'array'], | ||
]; | ||
|
||
if (config('services.h_captcha.secret_key')) { | ||
$rules['h-captcha-response'] = [new ValidHCaptcha()]; | ||
if (config('services.recaptcha.secret_key')) { | ||
$rules['g-recaptcha-response'] = [new ValidReCaptcha()]; | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 Codebase verification Configuration check is properly implemented The reCAPTCHA implementation is correctly configured:
Note: There's a minor discrepancy between the config key in the controller ( 🔗 Analysis chainVerify reCAPTCHA configuration in production The validation rule is only added when recaptcha.secret_key is configured. Ensure this configuration is properly set in production environments. 🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Check if reCAPTCHA configuration exists in environment files
echo "Checking for reCAPTCHA configuration..."
rg -l 'RE_CAPTCHA_SECRET_KEY|RECAPTCHA_SECRET_KEY' .env* config/*
Length of output: 255 Script: #!/bin/bash
# Let's check the config files and environment templates more thoroughly
echo "Checking for reCAPTCHA configuration in config files..."
fd -t f . config -x cat {} \; | rg -i 'recaptcha|captcha'
echo -e "\nChecking environment template files..."
fd -g ".env*" . -x cat {} \; | rg -i 'recaptcha|captcha'
echo -e "\nChecking for ValidReCaptcha class usage..."
rg -l "ValidReCaptcha" .
Length of output: 939 Script: #!/bin/bash
# Let's examine the ValidReCaptcha rule implementation and its usage
echo "Checking ValidReCaptcha rule implementation..."
cat ./api/app/Rules/ValidReCaptcha.php
echo -e "\nChecking reCAPTCHA configuration in services.php..."
cat ./api/config/services.php
echo -e "\nChecking .env.example for reCAPTCHA configuration..."
cat ./api/.env.example
Length of output: 5664 |
||
} | ||
|
||
return Validator::make($data, $rules, [ | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -8,6 +8,7 @@ | |
use App\Rules\StorageFile; | ||
use App\Rules\ValidHCaptcha; | ||
use App\Rules\ValidPhoneInputRule; | ||
use App\Rules\ValidReCaptcha; | ||
use App\Rules\ValidUrl; | ||
use App\Service\Forms\FormLogicPropertyResolver; | ||
use Illuminate\Foundation\Http\FormRequest; | ||
|
@@ -116,9 +117,13 @@ public function rules() | |
$this->requestRules[$propertyId] = $rules; | ||
} | ||
|
||
// Validate hCaptcha | ||
// Validate Captcha | ||
if ($this->form->use_captcha) { | ||
$this->requestRules['h-captcha-response'] = [new ValidHCaptcha()]; | ||
if ($this->form->captcha_provider === 'recaptcha') { | ||
$this->requestRules['g-recaptcha-response'] = [new ValidReCaptcha()]; | ||
} elseif ($this->form->captcha_provider === 'hcaptcha') { | ||
$this->requestRules['h-captcha-response'] = [new ValidHCaptcha()]; | ||
} | ||
Comment on lines
+122
to
+126
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add default case handling for captcha validation. While the current implementation handles both reCAPTCHA and hCaptcha, it lacks handling for unexpected Consider adding a default case: if ($this->form->use_captcha) {
if ($this->form->captcha_provider === 'recaptcha') {
$this->requestRules['g-recaptcha-response'] = [new ValidReCaptcha()];
} elseif ($this->form->captcha_provider === 'hcaptcha') {
$this->requestRules['h-captcha-response'] = [new ValidHCaptcha()];
+ } else {
+ // Default to hCaptcha if provider is invalid
+ $this->requestRules['h-captcha-response'] = [new ValidHCaptcha()];
}
}
|
||
} | ||
|
||
// Validate submission_id for edit mode | ||
|
Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
@@ -0,0 +1,51 @@ | ||||||||||||||||||||||||||||||||||||
<?php | ||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||
namespace App\Rules; | ||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||
use Closure; | ||||||||||||||||||||||||||||||||||||
use Illuminate\Contracts\Validation\ImplicitRule; | ||||||||||||||||||||||||||||||||||||
use Illuminate\Support\Facades\Http; | ||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||
class ValidReCaptcha implements ImplicitRule | ||||||||||||||||||||||||||||||||||||
{ | ||||||||||||||||||||||||||||||||||||
public const RECAPTCHA_VERIFY_URL = 'https://www.google.com/recaptcha/api/siteverify'; | ||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||
private $error = 'validation.invalid_captcha'; | ||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||
/** | ||||||||||||||||||||||||||||||||||||
* Determine if the validation rule passes. | ||||||||||||||||||||||||||||||||||||
* | ||||||||||||||||||||||||||||||||||||
* @param string $attribute | ||||||||||||||||||||||||||||||||||||
* @param mixed $value | ||||||||||||||||||||||||||||||||||||
* @return bool | ||||||||||||||||||||||||||||||||||||
*/ | ||||||||||||||||||||||||||||||||||||
public function passes($attribute, $value) | ||||||||||||||||||||||||||||||||||||
{ | ||||||||||||||||||||||||||||||||||||
if (empty($value)) { | ||||||||||||||||||||||||||||||||||||
$this->error = 'validation.complete_captcha'; | ||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||
return false; | ||||||||||||||||||||||||||||||||||||
} | ||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||
return Http::asForm()->post(self::RECAPTCHA_VERIFY_URL, [ | ||||||||||||||||||||||||||||||||||||
'secret' => config('services.re_captcha.secret_key'), | ||||||||||||||||||||||||||||||||||||
'response' => $value, | ||||||||||||||||||||||||||||||||||||
])->json('success'); | ||||||||||||||||||||||||||||||||||||
} | ||||||||||||||||||||||||||||||||||||
Comment on lines
+30
to
+34
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Enhance reCAPTCHA verification security and reliability The verification request should include additional security measures and error handling:
return Http::asForm()->post(self::RECAPTCHA_VERIFY_URL, [
'secret' => config('services.re_captcha.secret_key'),
'response' => $value,
+ 'remoteip' => request()->ip(),
- ])->json('success');
+ ])
+ ->timeout(5)
+ ->throw(function($response, $e) {
+ $this->error = 'CAPTCHA verification failed. Please try again.';
+ return false;
+ })
+ ->json('success'); 📝 Committable suggestion
Suggested change
|
||||||||||||||||||||||||||||||||||||
public function validate(string $attribute, mixed $value, Closure $fail): void | ||||||||||||||||||||||||||||||||||||
{ | ||||||||||||||||||||||||||||||||||||
if (!$this->passes($attribute, $value)) { | ||||||||||||||||||||||||||||||||||||
$fail($this->message()); | ||||||||||||||||||||||||||||||||||||
} | ||||||||||||||||||||||||||||||||||||
} | ||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||
/** | ||||||||||||||||||||||||||||||||||||
* Get the validation error message. | ||||||||||||||||||||||||||||||||||||
* | ||||||||||||||||||||||||||||||||||||
* @return string | ||||||||||||||||||||||||||||||||||||
*/ | ||||||||||||||||||||||||||||||||||||
public function message() | ||||||||||||||||||||||||||||||||||||
{ | ||||||||||||||||||||||||||||||||||||
return trans($this->error); | ||||||||||||||||||||||||||||||||||||
} | ||||||||||||||||||||||||||||||||||||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,21 @@ | ||
<?php | ||
|
||
use Illuminate\Database\Migrations\Migration; | ||
use Illuminate\Database\Schema\Blueprint; | ||
use Illuminate\Support\Facades\Schema; | ||
|
||
return new class () extends Migration { | ||
public function up() | ||
{ | ||
Schema::table('forms', function (Blueprint $table) { | ||
$table->string('captcha_provider')->default('hcaptcha')->after('use_captcha'); | ||
}); | ||
} | ||
|
||
public function down() | ||
{ | ||
Schema::table('forms', function (Blueprint $table) { | ||
$table->dropColumn('captcha_provider'); | ||
}); | ||
} | ||
}; |
Original file line number | Diff line number | Diff line change | ||||||||
---|---|---|---|---|---|---|---|---|---|---|
|
@@ -116,4 +116,6 @@ | |||||||||
'attributes' => [], | ||||||||||
|
||||||||||
'invalid_json' => 'অবৈধ ইনপুট। অনুগ্রহ করে সংশোধন করে আবার চেষ্টা করুন।', | ||||||||||
'invalid_captcha' => 'অবৈধ টিপস। অনুগ্রহ করে টিপস টিপুন।', | ||||||||||
'complete_captcha' => 'অনুগ্রহ করে টিপস টিপুন।', | ||||||||||
Comment on lines
+119
to
+120
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Translation needs improvement for clarity The current Bengali translations for CAPTCHA-related messages use "টিপস" (tips) which is incorrect. Consider using "ক্যাপচা" (captcha) instead for better clarity. Here are the suggested translations: - 'invalid_captcha' => 'অবৈধ টিপস। অনুগ্রহ করে টিপস টিপুন।',
- 'complete_captcha' => 'অনুগ্রহ করে টিপস টিপুন।',
+ 'invalid_captcha' => 'অবৈধ ক্যাপচা। অনুগ্রহ করে ক্যাপচা সম্পূর্ণ করুন।',
+ 'complete_captcha' => 'অনুগ্রহ করে ক্যাপচা সম্পূর্ণ করুন।', This will make it clearer to Bengali-speaking users that they need to complete a CAPTCHA verification. 📝 Committable suggestion
Suggested change
|
||||||||||
]; |
Original file line number | Diff line number | Diff line change | ||||
---|---|---|---|---|---|---|
|
@@ -115,5 +115,7 @@ | |||||
|
||||||
'attributes' => [], | ||||||
|
||||||
'invalid_json' => 'ਗਲਤ ਇਨਪੁਟ। ਕਿਰਪਾ ਕਰਕੇ ਸਹੀ ਕਰੋ ਅਤੇ ਦੁਬਾਰਾ ਕੋਸ਼ਿਸ਼ ਕਰੋ।', | ||||||
'invalid_json' => 'ਗਲਤ ਇਨਪੁਟ। ਕਿਰਪਾ ਕਰਕਕੇ ਸਹੀ ਕਰੋ ਅਤੇ ਦੁਬਾਰਾ ਕੋਸ਼ਿਸ਼ ਕਰੋ।', | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Consider reverting the spelling change in invalid_json message The change from "ਕਿਰਪਾ ਕਰਕੇ" to "ਕਿਰਪਾ ਕਰਕਕੇ" appears to be a typo. The original spelling "ਕਿਰਪਾ ਕਰਕੇ" is the correct form in Punjabi. - 'invalid_json' => 'ਗਲਤ ਇਨਪੁਟ। ਕਿਰਪਾ ਕਰਕਕੇ ਸਹੀ ਕਰੋ ਅਤੇ ਦੁਬਾਰਾ ਕੋਸ਼ਿਸ਼ ਕਰੋ।',
+ 'invalid_json' => 'ਗਲਤ ਇਨਪੁਟ। ਕਿਰਪਾ ਕਰਕੇ ਸਹੀ ਕਰੋ ਅਤੇ ਦੁਬਾਰਾ ਕੋਸ਼ਿਸ਼ ਕਰੋ।', 📝 Committable suggestion
Suggested change
|
||||||
'invalid_captcha' => 'ਗਲਤ ਕੈਪਚਾ। ਕਿਰਪਾ ਕਰੋ ਕੈਪਚਾ ਟੀਪ ਅਤੇ ਦੁਬਾਰਾ ਕੋਸ਼ਿਸ਼ ਕਰੋ।', | ||||||
'complete_captcha' => 'ਕਿਰਪਾ ਕਰੋ ਕੈਪਚਾ ਭਰੋ।', | ||||||
]; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 Codebase verification
Documentation needed for reCAPTCHA environment variables
The new reCAPTCHA environment variables are not documented in the environment variables configuration file (
docs/configuration/environment-variables.mdx
). Please add the following to the Configuration Environment Variables table:RE_CAPTCHA_SITE_KEY
: Site key for reCAPTCHA integrationRE_CAPTCHA_SECRET_KEY
: Secret key for reCAPTCHA integration🔗 Analysis chain
Verify documentation for new reCAPTCHA configuration
The environment variables are correctly added. Please ensure these new variables are documented in:
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
Length of output: 62
Script:
Length of output: 907
Script:
Length of output: 5373