Improved API integration for reCAPTCHA. Closes #8

Author: benkeen

code/FormGenerator.class.php

@@ -347,6 +347,7 @@ public static function processFormBuilderPage($params)
         $finalize       = isset($params["finalize"]) ? $params["finalize"] : false;
 
         $failed_validation = false;
+        $update_successful = true;
         $validation_error = "";
         if ($page_type == "form") {
             $tabs = ViewTabs::getViewTabs($view_id, true);
@@ -384,29 +385,35 @@ public static function processFormBuilderPage($params)
             }
         }
 
-        // TODO. This is insufficient - can be bypassed!
-        $has_captcha = isset($form_data["g-recaptcha-response"]) ? true : false;
+        // reCAPTCHA just adds a "g-recaptcha-response" key to the POST form values. Looking for that isn't sufficient
+        // because a hacker could just simulate the request without the property and bypass it. So instead the {{captcha}}
+        // function makes a note in sessions that the page contains a CAPTCHA - which can't be bypassed
+        $has_captcha = isset($_SESSION[$namespace]["has_captcha"]) ? $_SESSION[$namespace]["has_captcha"] : false;
 
         // the reCAPTCHA can be placed on the form or review page only
         if ($has_captcha && ($page_type == "form" || $page_type == "review")) {
+            $recaptcha_error_msg = "•  Sorry, you didn't enter the reCAPTCHA correctly. Please try again.";
 
-            // was there a reCAPTCHA response? If so, a recaptcha was just submitted, check it was entered correctly
-            $resp = $api->validateRecaptcha($params["form_data"]["g-recaptcha-response"]);
-
-            if ($resp->isSuccess()) {
-                $_SESSION[$namespace]["passed_captcha"] = true;
-            } else {
-                // if the main update was successful, but they failed validation, just display the single "wrong captcha" error
-                if ($update_successful) {
-                    $validation_error = "•  Sorry, you didn't enter the reCAPTCHA correctly. Please try again.";
+            if (isset($params["form_data"]["g-recaptcha-response"])) {
+                $resp = $api->validateRecaptcha($params["form_data"]["g-recaptcha-response"]);
+                if ($resp->isSuccess()) {
+                    $_SESSION[$namespace]["passed_captcha"] = true;
                 } else {
-                    $br = (!empty($validation_error)) ? "<br />" : "";
-                    $validation_error .= $br . "&bull;&nbsp; Sorry, you didn't enter the reCAPTCHA correctly. Please try again.";
+                    // if the main update was successful, but they failed validation, just display the single "wrong captcha" error
+                    if ($update_successful) {
+                        $validation_error = $recaptcha_error_msg;
+                    } else {
+                        $br = (!empty($validation_error)) ? "<br />" : "";
+                        $validation_error .= $br . $recaptcha_error_msg;
+                    }
+                    $failed_validation = true;
                 }
-                $failed_validation = true;
             }
         }
 
+        // always reset the has_captcha flag for the next page load
+        $_SESSION[$namespace]["has_captcha"] = false;
+
         // this automatically sends any emails set to the on_submission trigger.
         if (!$failed_validation) {
             if ($finalize) {

code/Forms.class.php

@@ -874,7 +874,7 @@ public static function getGeneratedFormContent($published_form_id, $filename)
  */
 require_once("$root_dir/global/library.php");
 use FormTools\Core;
-Core::init(array("start_sessions" => false));
+Core::init(array("auto_logout" => false));
 \$root_dir = Core::getRootDir();
 \$published_form_id = $published_form_id;
 \$filename  = "$filename";

form.php

@@ -37,7 +37,7 @@
 $module = Modules::getModuleInstance("form_builder");
 $namespace = "form_builder_{$published_form_id}";
 
-// find out about the page: form / review / thanks. That determines what values we pass to ft_api_process_form_builder_page()
+// find out about the page: form / review / thanks. That determines what values we pass to processFormBuilderPage
 $config = Forms::getFormConfiguration($published_form_id);
 
 $form_id = $config["form_id"];

preview.php

@@ -1,12 +1,10 @@
 <?php
 
-//require_once("../../global/session_start.php");
 require_once("../../global/library.php");
 
 use FormTools\Modules;
 use FormTools\Modules\FormBuilder\Forms;
 use FormTools\Modules\FormBuilder\General;
-use FormTools\Modules\FormBuilder\FormGenerator;
 use FormTools\Modules\FormBuilder\Placeholders;
 use FormTools\Modules\FormBuilder\TemplateSets;
 use FormTools\Views;

preview_form.php

@@ -8,11 +8,17 @@
 
 require_once("../../global/library.php");
 
+use FormTools\Core;
 use FormTools\Modules;
 use FormTools\Modules\FormBuilder\FormGenerator;
 
 $module = Modules::initModulePage("admin");
 
+if (Core::isAPIAvailable()) {
+    require_once(__DIR__ . "/../../global/api/API.class.php");
+    $api = new FormTools\API(array("init_core" => false));
+}
+
 // convert the placeholder info in the request into a simple hash of placeholder_id => value
 $placeholders = array();
 $placeholder_ids = isset($request["placeholder_ids"]) ? $request["placeholder_ids"] : array();
@@ -25,7 +31,6 @@
 // pulled from the database
 $_SESSION["ft"]["form_builder"]["placeholders"] = $placeholders;
 
-
 // creating a new array here isn't strictly needed, since we COULD just tweak and pass along the POST request,
 // but it helps to see precisely what info is being sent
 $settings = array(

smarty_plugins/function.captcha.php

@@ -12,8 +12,8 @@
 function smarty_function_captcha($params, &$smarty)
 {
     if (!Core::isAPIAvailable()) {
-        echo "API not available.";
-        exit;
+        echo "<div class=\"error\"><div style=\"padding: 8px\">You need to install the Form Tools API to use the {{captcha}} tag.</div></div>";
+        return;
     }
 
     require_once(__DIR__ . "/../../../global/api/API.class.php");
@@ -28,14 +28,5 @@ function smarty_function_captcha($params, &$smarty)
     $_SESSION[$form_namespace]["has_captcha"] = true;
 
     $api = $smarty->getTemplateVars("api");
-    $response = $api->displayCaptcha();
-
-//    $error_message = "";
-//    if (is_array($response) && $response[0] === false) {
-//        $error_message = "You need to define the reCAPTCHA public and private keys.";
-//    }
-//
-//    if (!empty($error_message)) {
-//        echo "<div class=\"ft_error\">$error_message</div>";
-//    }
+    $api->displayCaptcha();
 }