convertkit / includes / class-convertkit-recaptcha.php

class-convertkit-recaptcha.php in Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages 3.3.9, at includes/class-convertkit-recaptcha.php

183 lines 4.9 KB

Raw Download Zip

1	<?php
2	/**
3	* ConvertKit reCAPTCHA class.
4	*
5	* @package ConvertKit
6	* @author ConvertKit
7	*/
8
9	/**
10	* Handles reCAPTCHA verification.
11	*
12	* @since 3.0.0
13	*/
14	class ConvertKit_Recaptcha {
15
16	/**
17	* Holds the settings class.
18	*
19	* @since 3.0.0
20	*
21	* @var bool\|ConvertKit_Settings
22	*/
23	private $settings = false;
24
25	/**
26	* Constructor.
27	*
28	* @since 3.0.0
29	*/
30	public function __construct() {
31
32	$this->settings = new ConvertKit_Settings();
33
34	}
35
36	/**
37	* Enqueues the reCAPTCHA scripts if reCAPTCHA site and secret keys are set,
38	* and scripts are enabled.
39	*
40	* @since 3.0.0
41	*/
42	public function enqueue_scripts() {
43
44	// Don't run if the reCAPTCHA or scripts are disabled.
45	if ( ! $this->settings->has_recaptcha_site_and_secret_keys() \|\| $this->settings->scripts_disabled() ) {
46	return;
47	}
48
49	// Enqueue Google reCAPTCHA JS.
50	add_filter(
51	'convertkit_output_scripts_footer',
52	function ( $scripts ) {
53
54	$scripts[] = array(
55	'src' => 'https://www.google.com/recaptcha/api.js?',
56	);
57
58	return $scripts;
59
60	}
61	);
62
63	}
64
65	/**
66	* Verifies the reCAPTCHA response, if reCAPTCHA site and secret keys are set,
67	* and scripts are enabled.
68	*
69	* @since 3.0.0
70	*
71	* @param string $recaptcha_response The reCAPTCHA response.
72	* @param string $plugin_action The action to verify the reCAPTCHA response for.
73	* @return bool\|WP_Error
74	*/
75	public function verify( $recaptcha_response, $plugin_action ) {
76
77	// Don't run if the reCAPTCHA or scripts are disabled.
78	if ( ! $this->settings->has_recaptcha_site_and_secret_keys() \|\| $this->settings->scripts_disabled() ) {
79	return true;
80	}
81
82	// Check if the submission is spam.
83	$response = wp_remote_post(
84	'https://www.google.com/recaptcha/api/siteverify',
85	array(
86	'body' => array(
87	'secret' => $this->settings->recaptcha_secret_key(),
88	'response' => $recaptcha_response,
89	'remoteip' => ( isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '' ),
90	),
91	)
92	);
93
94	// Bail if an error occurred.
95	if ( is_wp_error( $response ) ) {
96	return $response;
97	}
98
99	// Inspect response.
100	$body = json_decode( wp_remote_retrieve_body( $response ), true );
101
102	// If the request wasn't successful, return an error.
103	if ( ! $body['success'] ) {
104	return new WP_Error(
105	'convertkit_recaptcha_failed',
106	sprintf(
107	/* translators: Error codes */
108	__( 'Google reCAPTCHA failure: %s', 'convertkit' ),
109	implode( ', ', $body['error-codes'] )
110	)
111	);
112	}
113
114	// Return if the action doesn't match the Plugin action, this might not be a reCAPTCHA request
115	// for this request.
116	if ( $body['action'] !== $plugin_action ) {
117	return true;
118	}
119
120	// If the score is less than the required minimum score, it's likely a spam submission.
121	if ( $body['score'] < $this->settings->recaptcha_minimum_score() ) {
122	return new WP_Error(
123	'convertkit_recaptcha_failed',
124	__( 'Google reCAPTCHA failed', 'convertkit' )
125	);
126	}
127
128	// If here, the submission looks genuine. Continue the request.
129	return true;
130
131	}
132
133	/**
134	* Attaches the reCAPTCHA v3 invisible-badge attributes to the given submit
135	* button element within an existing DOM tree, so that the challenge is
136	* executed when the button is clicked and the form is submitted via the
137	* `convertKitRecaptchaFormSubmit` callback.
138	*
139	* @since 3.3.7
140	*
141	* @param ConvertKit_HTML_Parser $parser Parser wrapping the DOM (unused).
142	* @param DOMElement $button <button> element to attach attributes to.
143	* @param string $plugin_action Plugin action string.
144	*/
145	public function attach_to_form_button_dom( $parser, $button, $plugin_action ) {
146
147	unset( $parser );
148
149	$button->setAttribute( 'data-sitekey', esc_attr( $this->settings->recaptcha_site_key() ) );
150	$button->setAttribute( 'data-callback', 'convertKitRecaptchaFormSubmit' );
151	$button->setAttribute( 'data-action', $plugin_action );
152	$button->setAttribute( 'class', trim( $button->getAttribute( 'class' ) . ' g-recaptcha' ) );
153
154	}
155
156	/**
157	* Returns the HTML for a submit button with reCAPTCHA v3 invisible-badge
158	* attributes attached, used by templates that don't have a DOM parser
159	* available (e.g. the Restrict Content tag view).
160	*
161	* @since 3.3.7
162	*
163	* @param string $label Button's visible label.
164	* @param string $plugin_action Plugin action string.
165	* @param string[] $css_classes CSS classes for the button.
166	* @return string
167	*/
168	public function get_submit_button_html( $label, $plugin_action, $css_classes = array() ) {
169
170	$css_classes[] = 'g-recaptcha';
171
172	return sprintf(
173	'<input type="submit" class="%1$s" value="%2$s" data-sitekey="%3$s" data-callback="convertKitRecaptchaFormSubmit" data-action="%4$s" />',
174	esc_attr( implode( ' ', $css_classes ) ),
175	esc_attr( $label ),
176	esc_attr( $this->settings->recaptcha_site_key() ),
177	esc_attr( $plugin_action )
178	);
179
180	}
181
182	}
183