hCaptcha Support (#12594)

* Initial work on hCaptcha

Signed-off-by: jolheiser <john.olheiser@gmail.com>

* Use module

Signed-off-by: jolheiser <john.olheiser@gmail.com>

* Format

Signed-off-by: jolheiser <john.olheiser@gmail.com>

* At least return and debug log a captcha error

Signed-off-by: jolheiser <john.olheiser@gmail.com>

* Pass context to hCaptcha

Signed-off-by: jolheiser <john.olheiser@gmail.com>

* Add context to recaptcha

Signed-off-by: jolheiser <john.olheiser@gmail.com>

* fix lint

Signed-off-by: Andrew Thornton <art27@cantab.net>

* Finish hcaptcha

Signed-off-by: jolheiser <john.olheiser@gmail.com>

* Update example config

Signed-off-by: jolheiser <john.olheiser@gmail.com>

* Apply error fix for recaptcha

Signed-off-by: jolheiser <john.olheiser@gmail.com>

* Change recaptcha ChallengeTS to string

Signed-off-by: jolheiser <john.olheiser@gmail.com>

Co-authored-by: Andrew Thornton <art27@cantab.net>
This commit is contained in:
John Olheiser 2020-10-02 22:37:53 -05:00 committed by GitHub
parent 5460bf8903
commit 72636fd664
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
25 changed files with 345 additions and 21 deletions

View File

@ -585,12 +585,15 @@ ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = false
ENABLE_REVERSE_PROXY_EMAIL = false ENABLE_REVERSE_PROXY_EMAIL = false
; Enable captcha validation for registration ; Enable captcha validation for registration
ENABLE_CAPTCHA = false ENABLE_CAPTCHA = false
; Type of captcha you want to use. Options: image, recaptcha ; Type of captcha you want to use. Options: image, recaptcha, hcaptcha
CAPTCHA_TYPE = image CAPTCHA_TYPE = image
; Enable recaptcha to use Google's recaptcha service ; Enable recaptcha to use Google's recaptcha service
; Go to https://www.google.com/recaptcha/admin to sign up for a key ; Go to https://www.google.com/recaptcha/admin to sign up for a key
RECAPTCHA_SECRET = RECAPTCHA_SECRET =
RECAPTCHA_SITEKEY = RECAPTCHA_SITEKEY =
; For hCaptcha, create an account at https://accounts.hcaptcha.com/login to get your keys
HCAPTCHA_SECRET =
HCAPTCHA_SITEKEY =
; Change this to use recaptcha.net or other recaptcha service ; Change this to use recaptcha.net or other recaptcha service
RECAPTCHA_URL = https://www.google.com/recaptcha/ RECAPTCHA_URL = https://www.google.com/recaptcha/
; Default value for KeepEmailPrivate ; Default value for KeepEmailPrivate

View File

@ -429,10 +429,12 @@ relation to port exhaustion.
- `ENABLE_CAPTCHA`: **false**: Enable this to use captcha validation for registration. - `ENABLE_CAPTCHA`: **false**: Enable this to use captcha validation for registration.
- `REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA`: **false**: Enable this to force captcha validation - `REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA`: **false**: Enable this to force captcha validation
even for External Accounts (i.e. GitHub, OpenID Connect, etc). You must `ENABLE_CAPTCHA` also. even for External Accounts (i.e. GitHub, OpenID Connect, etc). You must `ENABLE_CAPTCHA` also.
- `CAPTCHA_TYPE`: **image**: \[image, recaptcha\] - `CAPTCHA_TYPE`: **image**: \[image, recaptcha, hcaptcha\]
- `RECAPTCHA_SECRET`: **""**: Go to https://www.google.com/recaptcha/admin to get a secret for recaptcha. - `RECAPTCHA_SECRET`: **""**: Go to https://www.google.com/recaptcha/admin to get a secret for recaptcha.
- `RECAPTCHA_SITEKEY`: **""**: Go to https://www.google.com/recaptcha/admin to get a sitekey for recaptcha. - `RECAPTCHA_SITEKEY`: **""**: Go to https://www.google.com/recaptcha/admin to get a sitekey for recaptcha.
- `RECAPTCHA_URL`: **https://www.google.com/recaptcha/**: Set the recaptcha url - allows the use of recaptcha net. - `RECAPTCHA_URL`: **https://www.google.com/recaptcha/**: Set the recaptcha url - allows the use of recaptcha net.
- `HCAPTCHA_SECRET`: **""**: Sign up at https://www.hcaptcha.com/ to get a secret for hcaptcha.
- `HCAPTCHA_SITEKEY`: **""**: Sign up at https://www.hcaptcha.com/ to get a sitekey for hcaptcha.
- `DEFAULT_KEEP_EMAIL_PRIVATE`: **false**: By default set users to keep their email address private. - `DEFAULT_KEEP_EMAIL_PRIVATE`: **false**: By default set users to keep their email address private.
- `DEFAULT_ALLOW_CREATE_ORGANIZATION`: **true**: Allow new users to create organizations by default. - `DEFAULT_ALLOW_CREATE_ORGANIZATION`: **true**: Allow new users to create organizations by default.
- `DEFAULT_ENABLE_DEPENDENCIES`: **true**: Enable this to have dependencies enabled by default. - `DEFAULT_ENABLE_DEPENDENCIES`: **true**: Enable this to have dependencies enabled by default.

1
go.mod
View File

@ -101,6 +101,7 @@ require (
github.com/yuin/goldmark v1.2.1 github.com/yuin/goldmark v1.2.1
github.com/yuin/goldmark-highlighting v0.0.0-20200307114337-60d527fdb691 github.com/yuin/goldmark-highlighting v0.0.0-20200307114337-60d527fdb691
github.com/yuin/goldmark-meta v0.0.0-20191126180153-f0638e958b60 github.com/yuin/goldmark-meta v0.0.0-20191126180153-f0638e958b60
go.jolheiser.com/hcaptcha v0.0.4
go.jolheiser.com/pwn v0.0.3 go.jolheiser.com/pwn v0.0.3
golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a
golang.org/x/net v0.0.0-20200904194848-62affa334b73 golang.org/x/net v0.0.0-20200904194848-62affa334b73

4
go.sum
View File

@ -933,6 +933,8 @@ github.com/ziutek/mymysql v1.5.4/go.mod h1:LMSpPZ6DbqWFxNCHW77HeMg9I646SAhApZ/wK
go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU= go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
go.etcd.io/bbolt v1.3.5 h1:XAzx9gjCb0Rxj7EoqcClPD1d5ZBxZJk0jbuoPHenBt0= go.etcd.io/bbolt v1.3.5 h1:XAzx9gjCb0Rxj7EoqcClPD1d5ZBxZJk0jbuoPHenBt0=
go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ= go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
go.jolheiser.com/hcaptcha v0.0.4 h1:RrDERcr/Tz/kWyJenjVtI+V09RtLinXxlAemiwN5F+I=
go.jolheiser.com/hcaptcha v0.0.4/go.mod h1:aw32WQOxnQZ6E06C0LypCf+sxNxPACyOnq+ZGnrIYho=
go.jolheiser.com/pwn v0.0.3 h1:MQowb3QvCL5r5NmHmCPxw93SdjfgJ0q6rAwYn4i1Hjg= go.jolheiser.com/pwn v0.0.3 h1:MQowb3QvCL5r5NmHmCPxw93SdjfgJ0q6rAwYn4i1Hjg=
go.jolheiser.com/pwn v0.0.3/go.mod h1:/j5Dl8ftNqqJ8Dlx3YTrJV1wIR2lWOTyrNU3Qe7rk6I= go.jolheiser.com/pwn v0.0.3/go.mod h1:/j5Dl8ftNqqJ8Dlx3YTrJV1wIR2lWOTyrNU3Qe7rk6I=
go.mongodb.org/mongo-driver v1.0.3/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM= go.mongodb.org/mongo-driver v1.0.3/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM=
@ -1085,7 +1087,6 @@ golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7w
golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200413165638-669c56c373c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200413165638-669c56c373c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae h1:Ih9Yo4hSPImZOpfGuA4bR/ORKTAbhZo2AbWNRCnevdo=
golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200918174421-af09f7315aff h1:1CPUrky56AcgSpxz/KfgzQWzfG09u5YOL8MvPYBlrL8= golang.org/x/sys v0.0.0-20200918174421-af09f7315aff h1:1CPUrky56AcgSpxz/KfgzQWzfG09u5YOL8MvPYBlrL8=
golang.org/x/sys v0.0.0-20200918174421-af09f7315aff/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200918174421-af09f7315aff/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@ -1136,7 +1137,6 @@ golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8T
golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

View File

@ -83,6 +83,7 @@ type RegisterForm struct {
Password string `binding:"MaxSize(255)"` Password string `binding:"MaxSize(255)"`
Retype string Retype string
GRecaptchaResponse string `form:"g-recaptcha-response"` GRecaptchaResponse string `form:"g-recaptcha-response"`
HcaptchaResponse string `form:"h-captcha-response"`
} }
// Validate validates the fields // Validate validates the fields

View File

@ -25,6 +25,7 @@ type SignUpOpenIDForm struct {
UserName string `binding:"Required;AlphaDashDot;MaxSize(40)"` UserName string `binding:"Required;AlphaDashDot;MaxSize(40)"`
Email string `binding:"Required;Email;MaxSize(254)"` Email string `binding:"Required;Email;MaxSize(254)"`
GRecaptchaResponse string `form:"g-recaptcha-response"` GRecaptchaResponse string `form:"g-recaptcha-response"`
HcaptchaResponse string `form:"h-captcha-response"`
} }
// Validate validates the fields // Validate validates the fields

View File

@ -0,0 +1,34 @@
// Copyright 2020 The Gitea Authors. All rights reserved.
// Use of this source code is governed by a MIT-style
// license that can be found in the LICENSE file.
package hcaptcha
import (
"context"
"code.gitea.io/gitea/modules/setting"
"go.jolheiser.com/hcaptcha"
)
// Verify calls hCaptcha API to verify token
func Verify(ctx context.Context, response string) (bool, error) {
client, err := hcaptcha.New(setting.Service.HcaptchaSecret, hcaptcha.WithContext(ctx))
if err != nil {
return false, err
}
resp, err := client.Verify(response, hcaptcha.PostOptions{
Sitekey: setting.Service.HcaptchaSitekey,
})
if err != nil {
return false, err
}
var respErr error
if len(resp.ErrorCodes) > 0 {
respErr = resp.ErrorCodes[0]
}
return resp.Success, respErr
}

View File

@ -5,12 +5,13 @@
package recaptcha package recaptcha
import ( import (
"context"
"encoding/json" "encoding/json"
"fmt" "fmt"
"io/ioutil" "io/ioutil"
"net/http" "net/http"
"net/url" "net/url"
"time" "strings"
"code.gitea.io/gitea/modules/setting" "code.gitea.io/gitea/modules/setting"
"code.gitea.io/gitea/modules/util" "code.gitea.io/gitea/modules/util"
@ -18,18 +19,29 @@ import (
// Response is the structure of JSON returned from API // Response is the structure of JSON returned from API
type Response struct { type Response struct {
Success bool `json:"success"` Success bool `json:"success"`
ChallengeTS time.Time `json:"challenge_ts"` ChallengeTS string `json:"challenge_ts"`
Hostname string `json:"hostname"` Hostname string `json:"hostname"`
ErrorCodes []string `json:"error-codes"` ErrorCodes []ErrorCode `json:"error-codes"`
} }
const apiURL = "api/siteverify" const apiURL = "api/siteverify"
// Verify calls Google Recaptcha API to verify token // Verify calls Google Recaptcha API to verify token
func Verify(response string) (bool, error) { func Verify(ctx context.Context, response string) (bool, error) {
resp, err := http.PostForm(util.URLJoin(setting.Service.RecaptchaURL, apiURL), post := url.Values{
url.Values{"secret": {setting.Service.RecaptchaSecret}, "response": {response}}) "secret": {setting.Service.RecaptchaSecret},
"response": {response},
}
// Basically a copy of http.PostForm, but with a context
req, err := http.NewRequestWithContext(ctx, http.MethodPost,
util.URLJoin(setting.Service.RecaptchaURL, apiURL), strings.NewReader(post.Encode()))
if err != nil {
return false, fmt.Errorf("Failed to create CAPTCHA request: %v", err)
}
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
resp, err := http.DefaultClient.Do(req)
if err != nil { if err != nil {
return false, fmt.Errorf("Failed to send CAPTCHA response: %s", err) return false, fmt.Errorf("Failed to send CAPTCHA response: %s", err)
} }
@ -43,6 +55,36 @@ func Verify(response string) (bool, error) {
if err != nil { if err != nil {
return false, fmt.Errorf("Failed to parse CAPTCHA response: %s", err) return false, fmt.Errorf("Failed to parse CAPTCHA response: %s", err)
} }
var respErr error
return jsonResponse.Success, nil if len(jsonResponse.ErrorCodes) > 0 {
respErr = jsonResponse.ErrorCodes[0]
}
return jsonResponse.Success, respErr
}
// ErrorCode is a reCaptcha error
type ErrorCode string
// String fulfills the Stringer interface
func (e ErrorCode) String() string {
switch e {
case "missing-input-secret":
return "The secret parameter is missing."
case "invalid-input-secret":
return "The secret parameter is invalid or malformed."
case "missing-input-response":
return "The response parameter is missing."
case "invalid-input-response":
return "The response parameter is invalid or malformed."
case "bad-request":
return "The request is invalid or malformed."
case "timeout-or-duplicate":
return "The response is no longer valid: either is too old or has been used previously."
}
return string(e)
}
// Error fulfills the error interface
func (e ErrorCode) Error() string {
return e.String()
} }

View File

@ -35,6 +35,8 @@ var Service struct {
RecaptchaSecret string RecaptchaSecret string
RecaptchaSitekey string RecaptchaSitekey string
RecaptchaURL string RecaptchaURL string
HcaptchaSecret string
HcaptchaSitekey string
DefaultKeepEmailPrivate bool DefaultKeepEmailPrivate bool
DefaultAllowCreateOrganization bool DefaultAllowCreateOrganization bool
EnableTimetracking bool EnableTimetracking bool
@ -76,6 +78,8 @@ func newService() {
Service.RecaptchaSecret = sec.Key("RECAPTCHA_SECRET").MustString("") Service.RecaptchaSecret = sec.Key("RECAPTCHA_SECRET").MustString("")
Service.RecaptchaSitekey = sec.Key("RECAPTCHA_SITEKEY").MustString("") Service.RecaptchaSitekey = sec.Key("RECAPTCHA_SITEKEY").MustString("")
Service.RecaptchaURL = sec.Key("RECAPTCHA_URL").MustString("https://www.google.com/recaptcha/") Service.RecaptchaURL = sec.Key("RECAPTCHA_URL").MustString("https://www.google.com/recaptcha/")
Service.HcaptchaSecret = sec.Key("HCAPTCHA_SECRET").MustString("")
Service.HcaptchaSitekey = sec.Key("HCAPTCHA_SITEKEY").MustString("")
Service.DefaultKeepEmailPrivate = sec.Key("DEFAULT_KEEP_EMAIL_PRIVATE").MustBool() Service.DefaultKeepEmailPrivate = sec.Key("DEFAULT_KEEP_EMAIL_PRIVATE").MustBool()
Service.DefaultAllowCreateOrganization = sec.Key("DEFAULT_ALLOW_CREATE_ORGANIZATION").MustBool(true) Service.DefaultAllowCreateOrganization = sec.Key("DEFAULT_ALLOW_CREATE_ORGANIZATION").MustBool(true)
Service.EnableTimetracking = sec.Key("ENABLE_TIMETRACKING").MustBool(true) Service.EnableTimetracking = sec.Key("ENABLE_TIMETRACKING").MustBool(true)

View File

@ -59,6 +59,7 @@ const (
const ( const (
ImageCaptcha = "image" ImageCaptcha = "image"
ReCaptcha = "recaptcha" ReCaptcha = "recaptcha"
HCaptcha = "hcaptcha"
) )
// settings // settings

View File

@ -17,6 +17,7 @@ import (
"code.gitea.io/gitea/modules/base" "code.gitea.io/gitea/modules/base"
"code.gitea.io/gitea/modules/context" "code.gitea.io/gitea/modules/context"
"code.gitea.io/gitea/modules/eventsource" "code.gitea.io/gitea/modules/eventsource"
"code.gitea.io/gitea/modules/hcaptcha"
"code.gitea.io/gitea/modules/log" "code.gitea.io/gitea/modules/log"
"code.gitea.io/gitea/modules/password" "code.gitea.io/gitea/modules/password"
"code.gitea.io/gitea/modules/recaptcha" "code.gitea.io/gitea/modules/recaptcha"
@ -896,15 +897,21 @@ func LinkAccountPostRegister(ctx *context.Context, cpt *captcha.Captcha, form au
if setting.Service.EnableCaptcha && setting.Service.RequireExternalRegistrationCaptcha { if setting.Service.EnableCaptcha && setting.Service.RequireExternalRegistrationCaptcha {
var valid bool var valid bool
var err error
switch setting.Service.CaptchaType { switch setting.Service.CaptchaType {
case setting.ImageCaptcha: case setting.ImageCaptcha:
valid = cpt.VerifyReq(ctx.Req) valid = cpt.VerifyReq(ctx.Req)
case setting.ReCaptcha: case setting.ReCaptcha:
valid, _ = recaptcha.Verify(form.GRecaptchaResponse) valid, err = recaptcha.Verify(ctx.Req.Context(), form.GRecaptchaResponse)
case setting.HCaptcha:
valid, err = hcaptcha.Verify(ctx.Req.Context(), form.HcaptchaResponse)
default: default:
ctx.ServerError("Unknown Captcha Type", fmt.Errorf("Unknown Captcha Type: %s", setting.Service.CaptchaType)) ctx.ServerError("Unknown Captcha Type", fmt.Errorf("Unknown Captcha Type: %s", setting.Service.CaptchaType))
return return
} }
if err != nil {
log.Debug("%s", err.Error())
}
if !valid { if !valid {
ctx.Data["Err_Captcha"] = true ctx.Data["Err_Captcha"] = true
@ -1040,6 +1047,7 @@ func SignUp(ctx *context.Context) {
ctx.Data["RecaptchaURL"] = setting.Service.RecaptchaURL ctx.Data["RecaptchaURL"] = setting.Service.RecaptchaURL
ctx.Data["CaptchaType"] = setting.Service.CaptchaType ctx.Data["CaptchaType"] = setting.Service.CaptchaType
ctx.Data["RecaptchaSitekey"] = setting.Service.RecaptchaSitekey ctx.Data["RecaptchaSitekey"] = setting.Service.RecaptchaSitekey
ctx.Data["HcaptchaSitekey"] = setting.Service.HcaptchaSitekey
ctx.Data["PageIsSignUp"] = true ctx.Data["PageIsSignUp"] = true
//Show Disabled Registration message if DisableRegistration or AllowOnlyExternalRegistration options are true //Show Disabled Registration message if DisableRegistration or AllowOnlyExternalRegistration options are true
@ -1058,6 +1066,7 @@ func SignUpPost(ctx *context.Context, cpt *captcha.Captcha, form auth.RegisterFo
ctx.Data["RecaptchaURL"] = setting.Service.RecaptchaURL ctx.Data["RecaptchaURL"] = setting.Service.RecaptchaURL
ctx.Data["CaptchaType"] = setting.Service.CaptchaType ctx.Data["CaptchaType"] = setting.Service.CaptchaType
ctx.Data["RecaptchaSitekey"] = setting.Service.RecaptchaSitekey ctx.Data["RecaptchaSitekey"] = setting.Service.RecaptchaSitekey
ctx.Data["HcaptchaSitekey"] = setting.Service.HcaptchaSitekey
ctx.Data["PageIsSignUp"] = true ctx.Data["PageIsSignUp"] = true
//Permission denied if DisableRegistration or AllowOnlyExternalRegistration options are true //Permission denied if DisableRegistration or AllowOnlyExternalRegistration options are true
@ -1073,15 +1082,21 @@ func SignUpPost(ctx *context.Context, cpt *captcha.Captcha, form auth.RegisterFo
if setting.Service.EnableCaptcha { if setting.Service.EnableCaptcha {
var valid bool var valid bool
var err error
switch setting.Service.CaptchaType { switch setting.Service.CaptchaType {
case setting.ImageCaptcha: case setting.ImageCaptcha:
valid = cpt.VerifyReq(ctx.Req) valid = cpt.VerifyReq(ctx.Req)
case setting.ReCaptcha: case setting.ReCaptcha:
valid, _ = recaptcha.Verify(form.GRecaptchaResponse) valid, err = recaptcha.Verify(ctx.Req.Context(), form.GRecaptchaResponse)
case setting.HCaptcha:
valid, err = hcaptcha.Verify(ctx.Req.Context(), form.HcaptchaResponse)
default: default:
ctx.ServerError("Unknown Captcha Type", fmt.Errorf("Unknown Captcha Type: %s", setting.Service.CaptchaType)) ctx.ServerError("Unknown Captcha Type", fmt.Errorf("Unknown Captcha Type: %s", setting.Service.CaptchaType))
return return
} }
if err != nil {
log.Debug("%s", err.Error())
}
if !valid { if !valid {
ctx.Data["Err_Captcha"] = true ctx.Data["Err_Captcha"] = true

View File

@ -14,6 +14,7 @@ import (
"code.gitea.io/gitea/modules/base" "code.gitea.io/gitea/modules/base"
"code.gitea.io/gitea/modules/context" "code.gitea.io/gitea/modules/context"
"code.gitea.io/gitea/modules/generate" "code.gitea.io/gitea/modules/generate"
"code.gitea.io/gitea/modules/hcaptcha"
"code.gitea.io/gitea/modules/log" "code.gitea.io/gitea/modules/log"
"code.gitea.io/gitea/modules/recaptcha" "code.gitea.io/gitea/modules/recaptcha"
"code.gitea.io/gitea/modules/setting" "code.gitea.io/gitea/modules/setting"
@ -330,6 +331,7 @@ func RegisterOpenID(ctx *context.Context) {
ctx.Data["EnableCaptcha"] = setting.Service.EnableCaptcha ctx.Data["EnableCaptcha"] = setting.Service.EnableCaptcha
ctx.Data["CaptchaType"] = setting.Service.CaptchaType ctx.Data["CaptchaType"] = setting.Service.CaptchaType
ctx.Data["RecaptchaSitekey"] = setting.Service.RecaptchaSitekey ctx.Data["RecaptchaSitekey"] = setting.Service.RecaptchaSitekey
ctx.Data["HcaptchaSitekey"] = setting.Service.HcaptchaSitekey
ctx.Data["RecaptchaURL"] = setting.Service.RecaptchaURL ctx.Data["RecaptchaURL"] = setting.Service.RecaptchaURL
ctx.Data["OpenID"] = oid ctx.Data["OpenID"] = oid
userName, _ := ctx.Session.Get("openid_determined_username").(string) userName, _ := ctx.Session.Get("openid_determined_username").(string)
@ -359,24 +361,34 @@ func RegisterOpenIDPost(ctx *context.Context, cpt *captcha.Captcha, form auth.Si
ctx.Data["RecaptchaURL"] = setting.Service.RecaptchaURL ctx.Data["RecaptchaURL"] = setting.Service.RecaptchaURL
ctx.Data["CaptchaType"] = setting.Service.CaptchaType ctx.Data["CaptchaType"] = setting.Service.CaptchaType
ctx.Data["RecaptchaSitekey"] = setting.Service.RecaptchaSitekey ctx.Data["RecaptchaSitekey"] = setting.Service.RecaptchaSitekey
ctx.Data["HcaptchaSitekey"] = setting.Service.HcaptchaSitekey
ctx.Data["OpenID"] = oid ctx.Data["OpenID"] = oid
if setting.Service.EnableCaptcha { if setting.Service.EnableCaptcha {
var valid bool var valid bool
var err error
switch setting.Service.CaptchaType { switch setting.Service.CaptchaType {
case setting.ImageCaptcha: case setting.ImageCaptcha:
valid = cpt.VerifyReq(ctx.Req) valid = cpt.VerifyReq(ctx.Req)
case setting.ReCaptcha: case setting.ReCaptcha:
err := ctx.Req.ParseForm() if err := ctx.Req.ParseForm(); err != nil {
if err != nil {
ctx.ServerError("", err) ctx.ServerError("", err)
return return
} }
valid, _ = recaptcha.Verify(form.GRecaptchaResponse) valid, err = recaptcha.Verify(ctx.Req.Context(), form.GRecaptchaResponse)
case setting.HCaptcha:
if err := ctx.Req.ParseForm(); err != nil {
ctx.ServerError("", err)
return
}
valid, err = hcaptcha.Verify(ctx.Req.Context(), form.HcaptchaResponse)
default: default:
ctx.ServerError("Unknown Captcha Type", fmt.Errorf("Unknown Captcha Type: %s", setting.Service.CaptchaType)) ctx.ServerError("Unknown Captcha Type", fmt.Errorf("Unknown Captcha Type: %s", setting.Service.CaptchaType))
return return
} }
if err != nil {
log.Debug("%s", err.Error())
}
if !valid { if !valid {
ctx.Data["Err_Captcha"] = true ctx.Data["Err_Captcha"] = true

View File

@ -28,6 +28,9 @@
{{if eq .CaptchaType "recaptcha"}} {{if eq .CaptchaType "recaptcha"}}
<script src='{{ URLJoin .RecaptchaURL "api.js"}}' async></script> <script src='{{ URLJoin .RecaptchaURL "api.js"}}' async></script>
{{end}} {{end}}
{{if eq .CaptchaType "hcaptcha"}}
<script src='https://hcaptcha.com/1/api.js' async></script>
{{end}}
{{end}} {{end}}
<script src="{{StaticUrlPrefix}}/js/index.js?v={{MD5 AppVer}}"></script> <script src="{{StaticUrlPrefix}}/js/index.js?v={{MD5 AppVer}}"></script>
{{template "custom/footer" .}} {{template "custom/footer" .}}

View File

@ -51,6 +51,11 @@
<div class="g-recaptcha" data-sitekey="{{ .RecaptchaSitekey }}"></div> <div class="g-recaptcha" data-sitekey="{{ .RecaptchaSitekey }}"></div>
</div> </div>
{{end}} {{end}}
{{if and .EnableCaptcha (eq .CaptchaType "hcaptcha")}}
<div class="inline field required">
<div class="h-captcha" data-sitekey="{{ .HcaptchaSitekey }}"></div>
</div>
{{end}}
<div class="inline field"> <div class="inline field">
<label></label> <label></label>

View File

@ -35,6 +35,11 @@
<div class="g-recaptcha" data-sitekey="{{ .RecaptchaSitekey }}"></div> <div class="g-recaptcha" data-sitekey="{{ .RecaptchaSitekey }}"></div>
</div> </div>
{{end}} {{end}}
{{if and .EnableCaptcha (eq .CaptchaType "hcaptcha")}}
<div class="inline field required">
<div class="h-captcha" data-sitekey="{{ .HcaptchaSitekey }}"></div>
</div>
{{end}}
<div class="inline field"> <div class="inline field">
<label for="openid">OpenID URI</label> <label for="openid">OpenID URI</label>
<input id="openid" value="{{ .OpenID }}" readonly> <input id="openid" value="{{ .OpenID }}" readonly>

2
vendor/go.jolheiser.com/hcaptcha/.gitignore generated vendored Normal file
View File

@ -0,0 +1,2 @@
# GoLand
.idea/

7
vendor/go.jolheiser.com/hcaptcha/LICENSE generated vendored Normal file
View File

@ -0,0 +1,7 @@
Copyright 2020 John Olheiser
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

13
vendor/go.jolheiser.com/hcaptcha/Makefile generated vendored Normal file
View File

@ -0,0 +1,13 @@
GO ?= go
.PHONY: fmt
fmt:
$(GO) fmt ./...
.PHONY: test
test:
$(GO) test -race ./...
.PHONY: vet
vet:
$(GO) vet ./...

9
vendor/go.jolheiser.com/hcaptcha/README.md generated vendored Normal file
View File

@ -0,0 +1,9 @@
# hCaptcha
This library was based on the hCaptcha server-side verification [docs](https://docs.hcaptcha.com/#server).
[Example](example_test.go)
## License
[MIT](LICENSE)

41
vendor/go.jolheiser.com/hcaptcha/error.go generated vendored Normal file
View File

@ -0,0 +1,41 @@
package hcaptcha
const (
ErrMissingInputSecret ErrorCode = "missing-input-secret"
ErrInvalidInputSecret ErrorCode = "invalid-input-secret"
ErrMissingInputResponse ErrorCode = "missing-input-response"
ErrInvalidInputResponse ErrorCode = "invalid-input-response"
ErrBadRequest ErrorCode = "bad-request"
ErrInvalidOrAlreadySeenResponse ErrorCode = "invalid-or-already-seen-response"
ErrSitekeySecretMismatch ErrorCode = "sitekey-secret-mismatch"
)
// ErrorCode is any possible error from hCaptcha
type ErrorCode string
// String fulfills the Stringer interface
func (err ErrorCode) String() string {
switch err {
case ErrMissingInputSecret:
return "Your secret key is missing."
case ErrInvalidInputSecret:
return "Your secret key is invalid or malformed."
case ErrMissingInputResponse:
return "The response parameter (verification token) is missing."
case ErrInvalidInputResponse:
return "The response parameter (verification token) is invalid or malformed."
case ErrBadRequest:
return "The request is invalid or malformed."
case ErrInvalidOrAlreadySeenResponse:
return "The response parameter has already been checked, or has another issue."
case ErrSitekeySecretMismatch:
return "The sitekey is not registered with the provided secret."
default:
return ""
}
}
// Error fulfills the error interface
func (err ErrorCode) Error() string {
return err.String()
}

3
vendor/go.jolheiser.com/hcaptcha/go.mod generated vendored Normal file
View File

@ -0,0 +1,3 @@
module go.jolheiser.com/hcaptcha
go 1.15

105
vendor/go.jolheiser.com/hcaptcha/hcaptcha.go generated vendored Normal file
View File

@ -0,0 +1,105 @@
package hcaptcha
import (
"context"
"encoding/json"
"io/ioutil"
"net/http"
"net/url"
"strings"
)
const verifyURL = "https://hcaptcha.com/siteverify"
// Client is an hCaptcha client
type Client struct {
ctx context.Context
http *http.Client
secret string
}
// PostOptions are optional post form values
type PostOptions struct {
RemoteIP string
Sitekey string
}
// ClientOption is a func to modify a new Client
type ClientOption func(*Client)
// WithHTTP sets the http.Client of a Client
func WithHTTP(httpClient *http.Client) func(*Client) {
return func(hClient *Client) {
hClient.http = httpClient
}
}
// WithContext sets the context.Context of a Client
func WithContext(ctx context.Context) func(*Client) {
return func(hClient *Client) {
hClient.ctx = ctx
}
}
// New returns a new hCaptcha Client
func New(secret string, options ...ClientOption) (*Client, error) {
if strings.TrimSpace(secret) == "" {
return nil, ErrMissingInputSecret
}
client := &Client{
ctx: context.Background(),
http: http.DefaultClient,
secret: secret,
}
for _, opt := range options {
opt(client)
}
return client, nil
}
// Verify checks the response against the hCaptcha API
func (c *Client) Verify(token string, opts PostOptions) (*Response, error) {
if strings.TrimSpace(token) == "" {
return nil, ErrMissingInputResponse
}
post := url.Values{
"secret": []string{c.secret},
"response": []string{token},
}
if strings.TrimSpace(opts.RemoteIP) != "" {
post.Add("remoteip", opts.RemoteIP)
}
if strings.TrimSpace(opts.Sitekey) != "" {
post.Add("sitekey", opts.Sitekey)
}
// Basically a copy of http.PostForm, but with a context
req, err := http.NewRequestWithContext(c.ctx, http.MethodPost, verifyURL, strings.NewReader(post.Encode()))
if err != nil {
return nil, err
}
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
resp, err := c.http.Do(req)
if err != nil {
return nil, err
}
body, err := ioutil.ReadAll(resp.Body)
if err != nil {
return nil, err
}
defer resp.Body.Close()
var response *Response
if err := json.Unmarshal(body, &response); err != nil {
return nil, err
}
return response, nil
}

10
vendor/go.jolheiser.com/hcaptcha/response.go generated vendored Normal file
View File

@ -0,0 +1,10 @@
package hcaptcha
// Response is an hCaptcha response
type Response struct {
Success bool `json:"success"`
ChallengeTS string `json:"challenge_ts"`
Hostname string `json:"hostname"`
Credit bool `json:"credit,omitempty"`
ErrorCodes []ErrorCode `json:"error-codes"`
}

3
vendor/modules.txt vendored
View File

@ -761,6 +761,9 @@ github.com/yuin/goldmark-highlighting
github.com/yuin/goldmark-meta github.com/yuin/goldmark-meta
# go.etcd.io/bbolt v1.3.5 # go.etcd.io/bbolt v1.3.5
go.etcd.io/bbolt go.etcd.io/bbolt
# go.jolheiser.com/hcaptcha v0.0.4
## explicit
go.jolheiser.com/hcaptcha
# go.jolheiser.com/pwn v0.0.3 # go.jolheiser.com/pwn v0.0.3
## explicit ## explicit
go.jolheiser.com/pwn go.jolheiser.com/pwn

View File

@ -99,7 +99,8 @@
} }
@media only screen and (min-width: 768px) { @media only screen and (min-width: 768px) {
.g-recaptcha { .g-recaptcha,
.h-captcha {
margin: 0 auto !important; margin: 0 auto !important;
width: 304px; width: 304px;
padding-left: 30px; padding-left: 30px;
@ -108,7 +109,8 @@
@media screen and (max-height: 575px) { @media screen and (max-height: 575px) {
#rc-imageselect, #rc-imageselect,
.g-recaptcha { .g-recaptcha,
.h-captcha {
transform: scale(.77); transform: scale(.77);
transform-origin: 0 0; transform-origin: 0 0;
} }