defender-security / src / component / captcha / class-turnstile.php

class-turnstile.php in Defender Security – Malware Scanner, Login Security & Firewall 5.9.0, at src/component/captcha/class-turnstile.php

250 lines 5.5 KB

Raw Download Zip

1	<?php
2	/**
3	* Turnstile provider implementation.
4	*
5	* @package WP_Defender\Component\Captcha
6	*/
7
8	namespace WP_Defender\Component\Captcha;
9
10	use WP_Defender\Integrations\Buddypress;
11	use WP_Defender\Integrations\Woocommerce;
12
13	/**
14	* Cloudflare Turnstile provider.
15	*/
16	class Turnstile extends Provider {
17
18	/**
19	* Get provider settings from model.
20	*
21	* @return array
22	*/
23	protected function get_data(): array {
24	$defaults = $this->model->get_default_values();
25	$data = $this->model->data_turnstile ?? array();
26
27	$data = wp_parse_args(
28	$data,
29	array(
30	'key' => '',
31	'secret' => '',
32	'style' => '',
33	'size' => 'normal',
34	'message' => '',
35	)
36	);
37
38	$data['message'] = '' !== $data['message'] ? $data['message'] : $defaults['turnstile_message'];
39
40	return $data;
41	}
42
43	/**
44	* Get the request field name for responses.
45	*
46	* @return string
47	*/
48	protected function get_response_field(): string {
49	return 'wpdef-turnstile-response';
50	}
51
52	/**
53	* Get script handle name.
54	*
55	* @return string
56	*/
57	public function get_script_handle(): string {
58	return 'wpdef_turnstile_script';
59	}
60
61	/**
62	* Get frontend script URL.
63	*
64	* @return string
65	*/
66	public function get_script_url(): string {
67	return 'assets/js/turnstile.js';
68	}
69
70	/**
71	* Get widget options.
72	*
73	* @return array
74	*/
75	public function get_options(): array {
76	return array(
77	'sitekey' => $this->key,
78	'theme' => $this->theme,
79	'lang' => $this->language,
80	'size' => $this->size,
81	'error' => $this->get_duplicate_captcha_warning(),
82	// For default comment form.
83	'disable' => '',
84	);
85	}
86
87	/**
88	* Get provider name.
89	*
90	* @param bool $is_type Get provider name by type.
91	*
92	* @return string
93	*/
94	public function get_name( bool $is_type = false ): string {
95	return __( 'Turnstile', 'defender-security' );
96	}
97
98	/**
99	* Get widget content HTML.
100	*
101	* @param int $id Unique widget id.
102	*
103	* @return string
104	*/
105	protected function get_widget_content( int $id ): string {
106	$content = sprintf(
107	'<div id="wpdef_turnstile_%s" class="wpdef_recaptcha"></div>',
108	esc_attr( $id )
109	);
110	$content .= '<noscript>';
111	$content .= '<div style="padding: 10px; border: 1px solid #cccccc; background-color: #f9f9f9; margin-top: 10px;">';
112	$content .= sprintf(
113	'<p>%s</p>',
114	esc_html__( 'Please enable JavaScript to complete the security verification.', 'defender-security' )
115	);
116	$content .= '</div>';
117	$content .= '</noscript>';
118
119	return $content;
120	}
121
122	/**
123	* Get API script configuration.
124	*
125	* @return array
126	*/
127	public function get_api_script(): array {
128	return array(
129	'url' => $this->get_api_url(),
130	'deps' => array(),
131	'version' => null,
132	);
133	}
134
135	/**
136	* Get API script URL.
137	*
138	* @return string
139	*/
140	public function get_api_url(): string {
141	return 'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit&onload=wpdefTurnstileCallback';
142	}
143
144	/**
145	* Get verification URL.
146	*
147	* @return string
148	*/
149	public function get_verify_url(): string {
150	return 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
151	}
152
153	/**
154	* Get list of excluded requests.
155	*
156	* @return array
157	*/
158	public function get_excluded_requests(): array {
159	/**
160	* Filters request slugs to exclude from Turnstile checks.
161	*
162	* @param array $requests Request slugs to exclude.
163	*
164	* @since 4.7.0
165	* @deprecated 5.9.0 Use wd_captcha_excluded_requests instead.
166	*/
167	$requests = apply_filters_deprecated(
168	'wd_cloudflare_turnstile_excluded_requests',
169	array( $this->filter_excluded_requests() ),
170	'5.9.0',
171	'wd_captcha_excluded_requests',
172	__( 'Use wd_captcha_excluded_requests to filter excluded requests for all captcha providers.', 'defender-security' )
173	);
174
175	return is_array( $requests ) ? $requests : (array) $requests;
176	}
177
178	/**
179	* Get list of duplicate script handles.
180	*
181	* @return array
182	*/
183	public function get_duplicate_script_handles(): array {
184	$handles = $this->filter_excluded_handles(
185	array(
186	'wpdef_captcha_api',
187	'forminator-turnstile',
188	)
189	);
190
191	/**
192	* Filters script handles to exclude from Turnstile duplication checks.
193	*
194	* @param array $handles Script handles to ignore when checking for duplicates.
195	*
196	* @since 4.7.0
197	* @deprecated 5.9.0 Use wd_captcha_excluded_handles instead.
198	*/
199	$handles = apply_filters_deprecated(
200	'wd_turnstile_excluded_handles',
201	array( $handles ),
202	'5.9.0',
203	'wd_captcha_excluded_handles',
204	__( 'Use wd_captcha_excluded_handles to filter excluded script handles for all captcha providers.', 'defender-security' )
205	);
206
207	return is_array( $handles ) ? $handles : (array) $handles;
208	}
209
210	/**
211	* Get regex pattern for duplicate scripts.
212	*
213	* @return string
214	*/
215	public function get_duplicate_script_pattern(): string {
216	return '\|challenges\.cloudflare\.com/turnstile/v0/api\.js\|';
217	}
218
219	/**
220	* Determine whether to skip checks for this form.
221	*
222	* @param Woocommerce $woo WooCommerce integration.
223	* @param Buddypress $buddypress BuddyPress integration.
224	*
225	* @return bool
226	*/
227	public function should_skip_check( Woocommerce $woo, Buddypress $buddypress ): bool {
228	return false;
229	}
230
231	/**
232	* Verify response for a specific form.
233	*
234	* @param string $form Form identifier.
235	*
236	* @return bool
237	*/
238	public function verify_response( string $form ): bool {
239	$response = $this->verify_response_token(
240	$this->get_response(),
241	$this->get_verify_url(),
242	array(
243	'remoteip' => $this->get_primary_ip(),
244	)
245	);
246
247	return $this->filter_check_result( (bool) ( $response['success'] ?? false ), $form );
248	}
249	}
250