← All changes | back/Helpers/CaptchaHelper.php +26 -22 10.0.1 → 11.1.0 View file →

		@@ -5,17 +5,17 @@
5	5	use AcyMailing\Core\AcymObject;
6	6
7	7	class CaptchaHelper extends AcymObject
8	8	{
9		- public function display($formName = '', $loadJsModule = false)
	9	+ public function display(string $formName = '', bool $loadJsModule = false): void
10	10	{
11	11	if (!acym_level(ACYM_ESSENTIAL)) {
12		- return '';
	12	+ return;
13	13	}
14	14
15	15	$captchaPluginName = $this->config->get('captcha', 'none');
16	16	if ($captchaPluginName === 'none') {
17		- return '';
	17	+ return;
18	18	}
19	19
20	20	$id = empty($formName) ? 'acym-captcha' : $formName.'-captcha';
21	21
		@@ -20,43 +20,47 @@
20	20	$id = empty($formName) ? 'acym-captcha' : $formName.'-captcha';
21	21
22	22	if (in_array($captchaPluginName, ['acym_ireCaptcha', 'acym_reCaptcha_v3'])) {
23	23	$pubkey = $this->config->get('recaptcha_sitekey', '');
24		- if (empty($pubkey)) return '';
	24	+ if (empty($pubkey)) {
	25	+ return;
	26	+ }
25	27
26		- $return = '';
27	28	if ($captchaPluginName === 'acym_ireCaptcha') {
28	29	$jsScript = 'https://www.google.com/recaptcha/api.js?render=explicit&hl='.acym_getLanguageTag(true);
29	30	} else {
30		- $jsScript = 'https://www.google.com/recaptcha/api.js?render='.acym_escape($pubkey);
	31	+ $jsScript = 'https://www.google.com/recaptcha/api.js?render='.esc_attr($pubkey);
31	32	}
	33	+
32	34	if ($loadJsModule) {
33		- $return .= '<script src="'.$jsScript.'" type="text/javascript" defer async></script>';
	35	+ // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript -- Option to include the JS inside the module.
	36	+ echo '<script src="'.esc_url($jsScript).'" type="text/javascript" defer async></script>';
34	37	} else {
35	38	acym_addScript(false, $jsScript, ['defer' => true, 'async' => true]);
36	39	}
37	40
38		- return $return.'<div id="'.acym_escape($id).'" data-size="invisible" class="acyg-recaptcha" data-sitekey="'.acym_escape($pubkey).'"data-captchaname="'.acym_escape(
39		- $captchaPluginName
40		- ).'"></div>';
	41	+ echo '<div id="'.esc_attr($id).'"
	42	+ data-size="invisible"
	43	+ class="acyg-recaptcha"
	44	+ data-sitekey="'.esc_attr($pubkey).'"
	45	+ data-captchaname="'.esc_attr($captchaPluginName).'"></div>';
41	46	} elseif ($captchaPluginName === 'acym_hcaptcha') {
42	47	$siteKey = $this->config->get('hcaptcha_sitekey');
43		- $return = '<div class="h-captcha" data-sitekey="'.$siteKey.'"></div>';
	48	+ echo '<div class="h-captcha" data-sitekey="'.esc_attr($siteKey).'"></div>';
44	49	$jsScript = 'https://js.hcaptcha.com/1/api.js';
45	50
46	51	if ($loadJsModule) {
47		- $return .= '<script src="'.$jsScript.'" type="text/javascript" defer async></script>';
	52	+ // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript -- Option to include the JS inside the module.
	53	+ echo '<script src="'.esc_url($jsScript).'" type="text/javascript" defer async></script>';
48	54	} else {
49	55	acym_addScript(false, $jsScript, ['defer' => true, 'async' => true]);
50	56	}
51		-
52		- return $return;
53	57	} else {
54		- return acym_loadCaptcha($captchaPluginName, $id);
	58	+ acym_loadCaptcha($captchaPluginName, $id);
55	59	}
56	60	}
57	61
58		- public function check()
	62	+ public function check(): bool
59	63	{
60	64	if (!acym_level(ACYM_ESSENTIAL)) {
61	65	return true;
62	66	}
		@@ -65,10 +69,12 @@
65	69	if ($captchaPluginName === 'none') {
66	70	return true;
67	71	}
68	72
	73	+ // The security key can be used for direct subscription links
69	74	$secKey = acym_getVar('string', 'seckey', 'none');
70		- if ($secKey === $this->config->get('security_key')) {
	75	+ $securityKey = $this->config->get('security_key');
	76	+ if (!empty($securityKey) && hash_equals((string)$securityKey, (string)$secKey)) {
71	77	return true;
72	78	}
73	79
74	80	if (in_array($captchaPluginName, ['acym_ireCaptcha', 'acym_reCaptcha_v3'])) {
		@@ -99,9 +105,9 @@
99	105	}
100	106	} elseif ($captchaPluginName === 'acym_hcaptcha') {
101	107	$data = [
102	108	'secret' => $this->config->get('hcaptcha_secretkey'),
103		- 'response' => $_REQUEST['h-captcha-response'],
	109	+ 'response' => acym_getVar('string', 'h-captcha-response'),
104	110	];
105	111
106	112	$responseData = acym_makeCurlCall(
107	113	'https://hcaptcha.com/siteverify',
		@@ -108,13 +114,11 @@
108	114	['data' => $data, 'method' => 'POST']
109	115	);
110	116
111	117	return !empty($responseData['success']);
112		- } elseif ($captchaPluginName === 'turnstile') {
113		- $response = acym_getVar('string', 'cf-turnstile-response', '');
	118	+ } else {
	119	+ $response = acym_getVar('string', 'acym-captcha', '');
114	120
115	121	return acym_checkCaptcha($captchaPluginName, $response);
116		- } else {
117		- return acym_checkCaptcha($captchaPluginName);
118	122	}
119	123	}
120	124	}