convertkit / includes / class-convertkit-recaptcha.php

class-convertkit-recaptcha.php in Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages 3.3.4, at includes/class-convertkit-recaptcha.php

134 lines 3.0 KB

Raw Download Zip

1	<?php
2	/**
3	* ConvertKit reCAPTCHA class.
4	*
5	* @package ConvertKit
6	* @author ConvertKit
7	*/
8
9	/**
10	* Handles reCAPTCHA verification.
11	*
12	* @since 3.0.0
13	*/
14	class ConvertKit_Recaptcha {
15
16	/**
17	* Holds the settings class.
18	*
19	* @since 3.0.0
20	*
21	* @var bool\|ConvertKit_Settings
22	*/
23	private $settings = false;
24
25	/**
26	* Constructor.
27	*
28	* @since 3.0.0
29	*/
30	public function __construct() {
31
32	$this->settings = new ConvertKit_Settings();
33
34	}
35
36	/**
37	* Enqueues the reCAPTCHA scripts if reCAPTCHA site and secret keys are set,
38	* and scripts are enabled.
39	*
40	* @since 3.0.0
41	*/
42	public function enqueue_scripts() {
43
44	// Don't run if the reCAPTCHA or scripts are disabled.
45	if ( ! $this->settings->has_recaptcha_site_and_secret_keys() \|\| $this->settings->scripts_disabled() ) {
46	return;
47	}
48
49	// Enqueue Google reCAPTCHA JS.
50	add_filter(
51	'convertkit_output_scripts_footer',
52	function ( $scripts ) {
53
54	$scripts[] = array(
55	'src' => 'https://www.google.com/recaptcha/api.js?',
56	);
57
58	return $scripts;
59
60	}
61	);
62
63	}
64
65	/**
66	* Verifies the reCAPTCHA response, if reCAPTCHA site and secret keys are set,
67	* and scripts are enabled.
68	*
69	* @since 3.0.0
70	*
71	* @param string $recaptcha_response The reCAPTCHA response.
72	* @param string $plugin_action The action to verify the reCAPTCHA response for.
73	* @return bool\|WP_Error
74	*/
75	public function verify_recaptcha( $recaptcha_response, $plugin_action ) {
76
77	// Don't run if the reCAPTCHA or scripts are disabled.
78	if ( ! $this->settings->has_recaptcha_site_and_secret_keys() \|\| $this->settings->scripts_disabled() ) {
79	return true;
80	}
81
82	// Check if the submission is spam.
83	$response = wp_remote_post(
84	'https://www.google.com/recaptcha/api/siteverify',
85	array(
86	'body' => array(
87	'secret' => $this->settings->recaptcha_secret_key(),
88	'response' => $recaptcha_response,
89	'remoteip' => ( isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '' ),
90	),
91	)
92	);
93
94	// Bail if an error occurred.
95	if ( is_wp_error( $response ) ) {
96	return $response;
97	}
98
99	// Inspect response.
100	$body = json_decode( wp_remote_retrieve_body( $response ), true );
101
102	// If the request wasn't successful, return an error.
103	if ( ! $body['success'] ) {
104	return new WP_Error(
105	'convertkit_recaptcha_failed',
106	sprintf(
107	/* translators: Error codes */
108	__( 'Google reCAPTCHA failure: %s', 'convertkit' ),
109	implode( ', ', $body['error-codes'] )
110	)
111	);
112	}
113
114	// Return if the action doesn't match the Plugin action, this might not be a reCAPTCHA request
115	// for this request.
116	if ( $body['action'] !== $plugin_action ) {
117	return true;
118	}
119
120	// If the score is less than the required minimum score, it's likely a spam submission.
121	if ( $body['score'] < $this->settings->recaptcha_minimum_score() ) {
122	return new WP_Error(
123	'convertkit_recaptcha_failed',
124	__( 'Google reCAPTCHA failed', 'convertkit' )
125	);
126	}
127
128	// If here, the submission looks genuine. Continue the request.
129	return true;
130
131	}
132
133	}
134