Validator
1 month ago
BehavioralSignals.php
1 month ago
CaptchaConstants.php
2 months ago
CaptchaFormRenderer.php
2 weeks ago
CaptchaHooks.php
2 months ago
CaptchaPhrase.php
1 year ago
CaptchaRenderer.php
4 months ago
CaptchaSession.php
1 year ago
CaptchaUrlFactory.php
4 months ago
PageRenderer.php
5 months ago
ReCaptchaHooks.php
2 months ago
ReCaptchaRenderer.php
1 year ago
ReCaptchaValidator.php
1 year ago
TurnstileHooks.php
2 months ago
TurnstileRenderer.php
2 months ago
TurnstileValidator.php
2 months ago
index.php
1 year ago
BehavioralSignals.php
75 lines
| 1 | <?php declare(strict_types = 1); |
| 2 | |
| 3 | namespace MailPoet\Captcha; |
| 4 | |
| 5 | if (!defined('ABSPATH')) exit; |
| 6 | |
| 7 | |
| 8 | use MailPoet\WP\Functions as WPFunctions; |
| 9 | |
| 10 | /** |
| 11 | * Evaluates client-side behavioral counters to decide whether a submission |
| 12 | * looks human. Used when no CAPTCHA is configured: silent pass when signals |
| 13 | * look human, escalate to the built-in CAPTCHA otherwise. |
| 14 | */ |
| 15 | class BehavioralSignals { |
| 16 | const FIELD_NAME = 'behavioral_signals'; |
| 17 | |
| 18 | const DEFAULT_MIN_TIME_MS = 2000; |
| 19 | const DEFAULT_MIN_INTERACTIONS = 3; |
| 20 | const DEFAULT_MIN_FIELD_FOCUS = 1; |
| 21 | |
| 22 | private WPFunctions $wp; |
| 23 | |
| 24 | public function __construct( |
| 25 | WPFunctions $wp |
| 26 | ) { |
| 27 | $this->wp = $wp; |
| 28 | } |
| 29 | |
| 30 | public function looksHuman(array $data): bool { |
| 31 | $rawSignals = $data[self::FIELD_NAME] ?? null; |
| 32 | $result = is_array($rawSignals); |
| 33 | $signals = is_array($rawSignals) ? $rawSignals : []; |
| 34 | |
| 35 | $thresholds = [ |
| 36 | 'min_time_ms' => self::DEFAULT_MIN_TIME_MS, |
| 37 | 'min_interactions' => self::DEFAULT_MIN_INTERACTIONS, |
| 38 | 'min_field_focus' => self::DEFAULT_MIN_FIELD_FOCUS, |
| 39 | ]; |
| 40 | $timeMs = $this->intSignal($signals, 'time_ms'); |
| 41 | $fieldFocusCount = $this->intSignal($signals, 'focus_count'); |
| 42 | |
| 43 | if ($timeMs < $thresholds['min_time_ms']) { |
| 44 | $result = false; |
| 45 | } |
| 46 | if ($fieldFocusCount < $thresholds['min_field_focus']) { |
| 47 | $result = false; |
| 48 | } |
| 49 | |
| 50 | $mousemoveCount = $this->intSignal($signals, 'mm_count'); |
| 51 | $keydownCount = $this->intSignal($signals, 'kd_count'); |
| 52 | $scrollCount = $this->intSignal($signals, 'scroll_count'); |
| 53 | $isTouch = !empty($signals['touch']); |
| 54 | |
| 55 | if ($result) { |
| 56 | // OR-logic across device-appropriate interaction channels handles |
| 57 | // password-manager autofill (no keydown), mobile (no mousemove), |
| 58 | // and pure-mouse users (no keydown). |
| 59 | if ($isTouch) { |
| 60 | $result = $scrollCount >= 1 || $keydownCount >= $thresholds['min_interactions']; |
| 61 | } else { |
| 62 | $result = $mousemoveCount >= $thresholds['min_interactions'] |
| 63 | || $keydownCount >= $thresholds['min_interactions']; |
| 64 | } |
| 65 | } |
| 66 | |
| 67 | return (bool)$this->wp->applyFilters('mailpoet_behavioral_signals_looks_human', $result, $rawSignals, $data); |
| 68 | } |
| 69 | |
| 70 | private function intSignal(array $signals, string $key): int { |
| 71 | $value = $signals[$key] ?? null; |
| 72 | return is_numeric($value) ? (int)$value : 0; |
| 73 | } |
| 74 | } |
| 75 |