<?php
/**
 * reCAPTCHA v2 Validation
 *
 * Extends AccuaForm_Validation_CaptchaSpam: a failed verification follows the
 * per-form spam action (reject with a visible error, or accept silently and
 * flag the submission as spam - see the base class for the contract).
 *
 * @package Contact Forms
 */

// phpcs:disable WordPress.Security.NonceVerification, WordPress.Security.ValidatedSanitizedInput -- Server-side CAPTCHA validation requires POST data

class AccuaForm_Validation_Captcha2b extends AccuaForm_Validation_CaptchaSpam {
	protected $message = 'Error: The reCAPTCHA response provided was incorrect. Please retry.';

	public function isValid( $value ) {
		if ( ! isset( $_POST['g-recaptcha-response'] ) ) {
			return $this->failed();
		}

		$response = stripslashes_deep( $_POST['g-recaptcha-response'] );

		if ( '' === $response ) {
			return $this->failed();
		}

		$verify_url = 'https://www.google.com/recaptcha/api/siteverify';

		$verify_data = array(
			'secret'   => $this->privateKey,
			'response' => $response,
			'remoteip' => isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '',
		);

		$response_obj = wp_remote_post(
			$verify_url,
			array(
				'body'    => $verify_data,
				'timeout' => 20,
			)
		);

		if ( is_wp_error( $response_obj ) ) {
			return $this->failed();
		}

		$body   = wp_remote_retrieve_body( $response_obj );
		$result = json_decode( $body, true );

		if ( ! empty( $result['success'] ) ) {
			return true;
		}

		return $this->failed();
	}
}