Subversion Repositories oidplus

Rev

Rev 1086 | Rev 1149 | Go to most recent revision | Blame | Compare with Previous | Last modification | View Log | RSS feed

  1. <?php
  2.  
  3. /*
  4.  * OIDplus 2.0
  5.  * Copyright 2019 - 2023 Daniel Marschall, ViaThinkSoft
  6.  *
  7.  * Licensed under the Apache License, Version 2.0 (the "License");
  8.  * you may not use this file except in compliance with the License.
  9.  * You may obtain a copy of the License at
  10.  *
  11.  *     http://www.apache.org/licenses/LICENSE-2.0
  12.  *
  13.  * Unless required by applicable law or agreed to in writing, software
  14.  * distributed under the License is distributed on an "AS IS" BASIS,
  15.  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16.  * See the License for the specific language governing permissions and
  17.  * limitations under the License.
  18.  */
  19.  
  20. namespace ViaThinkSoft\OIDplus;
  21.  
  22. // phpcs:disable PSR1.Files.SideEffects
  23. \defined('INSIDE_OIDPLUS') or die;
  24. // phpcs:enable PSR1.Files.SideEffects
  25.  
  26. class OIDplusCaptchaPluginHCaptcha extends OIDplusCaptchaPlugin {
  27.  
  28.         /**
  29.          * @return string
  30.          */
  31.         public static function id(): string {
  32.                 return 'hCaptcha';
  33.         }
  34.  
  35.         /**
  36.          * @return bool
  37.          */
  38.         public function isVisible(): bool {
  39.                 return true;
  40.         }
  41.  
  42.         /**
  43.          * @param string|null $header_text
  44.          * @param string|null $footer_text
  45.          * @return string
  46.          * @throws OIDplusException
  47.          */
  48.         public function captchaGenerate(string $header_text=null, string $footer_text=null): string {
  49.                 return ($header_text ? '<p>'.$header_text.'</p>' : '') .
  50.                        '<noscript>'.
  51.                        '<p><font color="red">'._L('You need to enable JavaScript to solve the CAPTCHA.').'</font></p>'.
  52.                        '</noscript>'.
  53.                        '<div id="h-captcha"></div>'.
  54.                        '<script src="https://js.hcaptcha.com/1/api.js"></script>'.
  55.                        '<script>'.
  56.                        'OIDplusCaptchaPluginHCaptcha.captchaShow('.js_escape(OIDplus::baseConfig()->getValue('HCAPTCHA_SITEKEY', '')).')'.
  57.                        '</script>'.
  58.                        ($footer_text ? '<p>'.$footer_text.'</p>' : '');
  59.         }
  60.  
  61.         /**
  62.          * @param string[] $params
  63.          * @param string|null $fieldname
  64.          * @return void
  65.          * @throws OIDplusException
  66.          */
  67.         public function captchaVerify(array $params, string $fieldname=null) {
  68.                 $sitekey=OIDplus::baseConfig()->getValue('HCAPTCHA_SITEKEY', '');
  69.                 $secret=OIDplus::baseConfig()->getValue('HCAPTCHA_SECRET', '');
  70.  
  71.                 if (!function_exists('curl_init')) {
  72.                         throw new OIDplusException(_L('hCaptcha plugin needs the PHP extension php_curl'));
  73.                 }
  74.  
  75.                 // Yes, it is really "g-recaptcha-response"!
  76.                 if (is_null($fieldname)) $fieldname = 'g-recaptcha-response'; // no individual field name (created by oidplus_captcha_response()) means that it is a plain POST event (e.g. by oobe.php)
  77.                 _CheckParamExists($params, $fieldname);
  78.                 $response=$params[$fieldname];
  79.  
  80.                 $ch = curl_init();
  81.                 if (ini_get('curl.cainfo') == '') curl_setopt($ch, CURLOPT_CAINFO, OIDplus::localpath() . 'vendor/cacert.pem');
  82.                 curl_setopt($ch, CURLOPT_URL, 'https://hcaptcha.com/siteverify');
  83.                 curl_setopt($ch, CURLOPT_USERAGENT, 'ViaThinkSoft-OIDplus/2.0');
  84.                 curl_setopt($ch, CURLOPT_POST, 1);
  85.                 curl_setopt($ch, CURLOPT_POSTFIELDS, "secret=".urlencode($secret)."&response=".urlencode($response)."&remoteip=".urlencode($_SERVER['REMOTE_ADDR'])."&sitekey=".urlencode($sitekey));
  86.                 curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  87.                 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
  88.                 curl_setopt($ch, CURLOPT_AUTOREFERER, true);
  89.                 if (!($res = @curl_exec($ch))) {
  90.                         throw new OIDplusException(_L('Communication with hCaptcha server failed: %1',curl_error($ch)));
  91.                 }
  92.                 curl_close($ch);
  93.  
  94.                 $captcha_success=@json_decode($res);
  95.                 if (!$captcha_success || ($captcha_success->success==false)) {
  96.                         throw new OIDplusException(_L('CAPTCHA not successfully verified').' ('.implode(", ",$captcha_success->{'error-codes'}).')');
  97.                 }
  98.         }
  99.  
  100.         /**
  101.          * @return string
  102.          */
  103.         public static function setupHTML(): string {
  104.                 $curl_status = function_exists('curl_init') ? 1 : 0;
  105.                 return '<div id="CAPTCHAPLUGIN_PARAMS_HCAPTCHA">'.
  106.                        '<p>(<a href="https://www.hcaptcha.com/" target="_blank">'._L('more information and obtain key').'</a>)</p>'.
  107.                        '<p>'._L('hCaptcha Site key').'<br><input id="hcaptcha_sitekey" type="text" onkeypress="rebuild()" onkeyup="rebuild()"> <span id="hcaptcha_sitekey_warn"></span></p>'.
  108.                        '<p>'._L('hCaptcha Secret').'<br><input id="hcaptcha_secret" type="text" onkeypress="rebuild()" onkeyup="rebuild()"> <span id="hcaptcha_secret_warn"></span></p>'.
  109.                        '<input id="hcaptcha_curl_status" value="'.$curl_status.'" type="hidden">'.
  110.                        (!$curl_status ? '<p><font color="red">'._L('hCaptcha plugin needs the PHP extension php_curl').'</font></p>' : '').
  111.                        '</div>';
  112.         }
  113.  
  114.         /**
  115.          * @param array $http_headers
  116.          * @return void
  117.          */
  118.         function httpHeaderCheck(array &$http_headers) {
  119.  
  120.                 // If you use CSP headers, please add the following to your configuration:
  121.                 // script-src should include https://hcaptcha.com, https://*.hcaptcha.com
  122.                 $http_headers["Content-Security-Policy"]["script-src"][] = "https://hcaptcha.com";
  123.                 $http_headers["Content-Security-Policy"]["script-src"][] = "https://*.hcaptcha.com";
  124.                 // frame-src should include https://hcaptcha.com, https://*.hcaptcha.com
  125.                 $http_headers["Content-Security-Policy"]["frame-src"][] = "https://hcaptcha.com";
  126.                 $http_headers["Content-Security-Policy"]["frame-src"][] = "https://*.hcaptcha.com";
  127.                 // style-src should include https://hcaptcha.com, https://*.hcaptcha.com
  128.                 $http_headers["Content-Security-Policy"]["style-src"][] = "https://hcaptcha.com";
  129.                 $http_headers["Content-Security-Policy"]["style-src"][] = "https://*.hcaptcha.com";
  130.                 // connect-src should include https://hcaptcha.com, https://*.hcaptcha.com
  131.                 $http_headers["Content-Security-Policy"]["connect-src"][] = "https://hcaptcha.com";
  132.                 $http_headers["Content-Security-Policy"]["connect-src"][] = "https://*.hcaptcha.com";
  133.  
  134.                 //If you are an enterprise customer and would like to enable additional verification to be performed, you can optionally choose the following CSP strategy:
  135.                 //unsafe-eval and unsafe-inline should include https://hcaptcha.com, https://*.hcaptcha.com
  136.                 //$http_headers["Content-Security-Policy"]["unsafe-eval"][] = "https://hcaptcha.com";
  137.                 //$http_headers["Content-Security-Policy"]["unsafe-eval"][] = "https://*.hcaptcha.com";
  138.                 //$http_headers["Content-Security-Policy"]["unsafe-inline"][] = "https://hcaptcha.com";
  139.                 //$http_headers["Content-Security-Policy"]["unsafe-inline"][] = "https://*.hcaptcha.com";
  140.  
  141.         }
  142.  
  143. }
  144.