defender-security / src / component / captcha / class-turnstile.php

class-turnstile.php in Defender Security – Malware Scanner, Login Security & Firewall 6.2.2, at src/component/captcha/class-turnstile.php

251 lines 5.5 KB

Raw Download Zip

1	<?php
2	/**
3	* Turnstile provider implementation.
4	*
5	* @package WP_Defender\Component\Captcha
6	*/
7
8	namespace WP_Defender\Component\Captcha;
9
10	use WP_Defender\Integrations\Buddypress;
11	use WP_Defender\Integrations\Woocommerce;
12
13	/**
14	* Cloudflare Turnstile provider.
15	*/
16	class Turnstile extends Provider {
17
18	/**
19	* Get provider settings from model.
20	*
21	* @return array
22	*/
23	protected function get_data(): array {
24	$defaults = $this->model->get_default_values();
25	$data = $this->model->data_turnstile ?? array();
26
27	$data = wp_parse_args(
28	$data,
29	array(
30	'key' => '',
31	'secret' => '',
32	'style' => '',
33	'size' => 'normal',
34	'message' => '',
35	'language' => 'auto',
36	)
37	);
38
39	$data['message'] = '' !== $data['message'] ? $data['message'] : $defaults['turnstile_message'];
40
41	return $data;
42	}
43
44	/**
45	* Get the request field name for responses.
46	*
47	* @return string
48	*/
49	protected function get_response_field(): string {
50	return 'wpdef-turnstile-response';
51	}
52
53	/**
54	* Get script handle name.
55	*
56	* @return string
57	*/
58	public function get_script_handle(): string {
59	return 'wpdef_turnstile_script';
60	}
61
62	/**
63	* Get frontend script URL.
64	*
65	* @return string
66	*/
67	public function get_script_url(): string {
68	return 'assets/js/turnstile.js';
69	}
70
71	/**
72	* Get widget options.
73	*
74	* @return array
75	*/
76	public function get_options(): array {
77	return array(
78	'sitekey' => $this->key,
79	'theme' => $this->theme,
80	'lang' => $this->language,
81	'size' => $this->size,
82	'error' => $this->get_duplicate_captcha_warning(),
83	// For default comment form.
84	'disable' => '',
85	);
86	}
87
88	/**
89	* Get provider name.
90	*
91	* @param bool $is_type Get provider name by type.
92	*
93	* @return string
94	*/
95	public function get_name( bool $is_type = false ): string {
96	return __( 'Turnstile', 'defender-security' );
97	}
98
99	/**
100	* Get widget content HTML.
101	*
102	* @param int $id Unique widget id.
103	*
104	* @return string
105	*/
106	protected function get_widget_content( int $id ): string {
107	$content = sprintf(
108	'<div id="wpdef_turnstile_%s" class="wpdef_recaptcha"></div>',
109	esc_attr( $id )
110	);
111	$content .= '<noscript>';
112	$content .= '<div style="padding: 10px; border: 1px solid #cccccc; background-color: #f9f9f9; margin-top: 10px;">';
113	$content .= sprintf(
114	'<p>%s</p>',
115	esc_html__( 'Please enable JavaScript to complete the security verification.', 'defender-security' )
116	);
117	$content .= '</div>';
118	$content .= '</noscript>';
119
120	return $content;
121	}
122
123	/**
124	* Get API script configuration.
125	*
126	* @return array
127	*/
128	public function get_api_script(): array {
129	return array(
130	'url' => $this->get_api_url(),
131	'deps' => array(),
132	'version' => null,
133	);
134	}
135
136	/**
137	* Get API script URL.
138	*
139	* @return string
140	*/
141	public function get_api_url(): string {
142	return 'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit&onload=wpdefTurnstileCallback';
143	}
144
145	/**
146	* Get verification URL.
147	*
148	* @return string
149	*/
150	public function get_verify_url(): string {
151	return 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
152	}
153
154	/**
155	* Get list of excluded requests.
156	*
157	* @return array
158	*/
159	public function get_excluded_requests(): array {
160	/**
161	* Filters request slugs to exclude from Turnstile checks.
162	*
163	* @param array $requests Request slugs to exclude.
164	*
165	* @since 4.7.0
166	* @deprecated 5.9.0 Use wd_captcha_excluded_requests instead.
167	*/
168	$requests = apply_filters_deprecated(
169	'wd_cloudflare_turnstile_excluded_requests',
170	array( $this->filter_excluded_requests() ),
171	'5.9.0',
172	'wd_captcha_excluded_requests',
173	__( 'Use wd_captcha_excluded_requests to filter excluded requests for all captcha providers.', 'defender-security' )
174	);
175
176	return is_array( $requests ) ? $requests : (array) $requests;
177	}
178
179	/**
180	* Get list of duplicate script handles.
181	*
182	* @return array
183	*/
184	public function get_duplicate_script_handles(): array {
185	$handles = $this->filter_excluded_handles(
186	array(
187	'wpdef_captcha_api',
188	'forminator-turnstile',
189	)
190	);
191
192	/**
193	* Filters script handles to exclude from Turnstile duplication checks.
194	*
195	* @param array $handles Script handles to ignore when checking for duplicates.
196	*
197	* @since 4.7.0
198	* @deprecated 5.9.0 Use wd_captcha_excluded_handles instead.
199	*/
200	$handles = apply_filters_deprecated(
201	'wd_turnstile_excluded_handles',
202	array( $handles ),
203	'5.9.0',
204	'wd_captcha_excluded_handles',
205	__( 'Use wd_captcha_excluded_handles to filter excluded script handles for all captcha providers.', 'defender-security' )
206	);
207
208	return is_array( $handles ) ? $handles : (array) $handles;
209	}
210
211	/**
212	* Get regex pattern for duplicate scripts.
213	*
214	* @return string
215	*/
216	public function get_duplicate_script_pattern(): string {
217	return '\|challenges\.cloudflare\.com/turnstile/v0/api\.js\|';
218	}
219
220	/**
221	* Determine whether to skip checks for this form.
222	*
223	* @param Woocommerce $woo WooCommerce integration.
224	* @param Buddypress $buddypress BuddyPress integration.
225	*
226	* @return bool
227	*/
228	public function should_skip_check( Woocommerce $woo, Buddypress $buddypress ): bool {
229	return false;
230	}
231
232	/**
233	* Verify response for a specific form.
234	*
235	* @param string $form Form identifier.
236	*
237	* @return bool
238	*/
239	public function verify_response( string $form ): bool {
240	$response = $this->verify_response_token(
241	$this->get_response(),
242	$this->get_verify_url(),
243	array(
244	'remoteip' => $this->get_primary_ip(),
245	)
246	);
247
248	return $this->filter_check_result( (bool) ( $response['success'] ?? false ), $form );
249	}
250	}
251