<?php // phpcs:ignore WordPress.Files.FileName.InvalidClassFileName

[0] Fix | Delete

/**

[1] Fix | Delete

* Google reCAPTCHA utilities, for use in the sharing feature.

[2] Fix | Delete

*

[3] Fix | Delete

* @package automattic/jetpack

[4] Fix | Delete

*/

[5] Fix | Delete

[6] Fix | Delete

if ( ! defined( 'ABSPATH' ) ) {

[7] Fix | Delete

exit( 0 );

[8] Fix | Delete

}

[9] Fix | Delete

[10] Fix | Delete

/**

[11] Fix | Delete

* Class that handles reCAPTCHA.

[12] Fix | Delete

*

[13] Fix | Delete

* @deprecated 11.0

[14] Fix | Delete

*/

[15] Fix | Delete

class Jetpack_ReCaptcha {

[16] Fix | Delete

[17] Fix | Delete

/**

[18] Fix | Delete

* URL to which requests are POSTed.

[19] Fix | Delete

*

[20] Fix | Delete

* @const string

[21] Fix | Delete

*/

[22] Fix | Delete

const VERIFY_URL = 'https://www.google.com/recaptcha/api/siteverify';

[23] Fix | Delete

[24] Fix | Delete

/**

[25] Fix | Delete

* Site key to use in HTML code.

[26] Fix | Delete

*

[27] Fix | Delete

* @var string

[28] Fix | Delete

*/

[29] Fix | Delete

private $site_key;

[30] Fix | Delete

[31] Fix | Delete

/**

[32] Fix | Delete

* Shared secret for the site.

[33] Fix | Delete

*

[34] Fix | Delete

* @var string

[35] Fix | Delete

*/

[36] Fix | Delete

private $secret_key;

[37] Fix | Delete

[38] Fix | Delete

/**

[39] Fix | Delete

* Config for reCAPTCHA instance.

[40] Fix | Delete

*

[41] Fix | Delete

* @var array

[42] Fix | Delete

*/

[43] Fix | Delete

private $config;

[44] Fix | Delete

[45] Fix | Delete

/**

[46] Fix | Delete

* Error codes returned from reCAPTCHA API.

[47] Fix | Delete

*

[48] Fix | Delete

* @see https://developers.google.com/recaptcha/docs/verify

[49] Fix | Delete

*

[50] Fix | Delete

* @var array

[51] Fix | Delete

*/

[52] Fix | Delete

private $error_codes;

[53] Fix | Delete

[54] Fix | Delete

/**

[55] Fix | Delete

* Create a configured instance to use the reCAPTCHA service.

[56] Fix | Delete

*

[57] Fix | Delete

* @param string $site_key Site key to use in HTML code.

[58] Fix | Delete

* @param string $secret_key Shared secret between site and reCAPTCHA server.

[59] Fix | Delete

* @param array $config Config array to optionally configure reCAPTCHA instance.

[60] Fix | Delete

*/

[61] Fix | Delete

public function __construct( $site_key, $secret_key, $config = array() ) {

[62] Fix | Delete

$this->site_key = $site_key;

[63] Fix | Delete

$this->secret_key = $secret_key;

[64] Fix | Delete

$this->config = wp_parse_args( $config, $this->get_default_config() );

[65] Fix | Delete

[66] Fix | Delete

$this->error_codes = array(

[67] Fix | Delete

'missing-input-secret' => __( 'The secret parameter is missing', 'jetpack' ),

[68] Fix | Delete

'invalid-input-secret' => __( 'The secret parameter is invalid or malformed', 'jetpack' ),

[69] Fix | Delete

'missing-input-response' => __( 'The response parameter is missing', 'jetpack' ),

[70] Fix | Delete

'invalid-input-response' => __( 'The response parameter is invalid or malformed', 'jetpack' ),

[71] Fix | Delete

'invalid-json' => __( 'Invalid JSON', 'jetpack' ),

[72] Fix | Delete

'unexpected-response' => __( 'Unexpected response', 'jetpack' ),

[73] Fix | Delete

'unexpected-hostname' => __( 'Unexpected hostname', 'jetpack' ),

[74] Fix | Delete

);

[75] Fix | Delete

}

[76] Fix | Delete

[77] Fix | Delete

/**

[78] Fix | Delete

* Get default config for this reCAPTCHA instance.

[79] Fix | Delete

*

[80] Fix | Delete

* @return array Default config

[81] Fix | Delete

*/

[82] Fix | Delete

public function get_default_config() {

[83] Fix | Delete

return array(

[84] Fix | Delete

'language' => get_locale(),

[85] Fix | Delete

'script_async' => false,

[86] Fix | Delete

'script_defer' => true,

[87] Fix | Delete

'script_lazy' => false,

[88] Fix | Delete

'tag_class' => 'g-recaptcha',

[89] Fix | Delete

'tag_attributes' => array(

[90] Fix | Delete

'theme' => 'light',

[91] Fix | Delete

'type' => 'image',

[92] Fix | Delete

'tabindex' => 0,

[93] Fix | Delete

),

[94] Fix | Delete

);

[95] Fix | Delete

}

[96] Fix | Delete

[97] Fix | Delete

/**

[98] Fix | Delete

* Calls the reCAPTCHA siteverify API to verify whether the user passes

[99] Fix | Delete

* CAPTCHA test.

[100] Fix | Delete

*

[101] Fix | Delete

* @param string $response The value of 'g-recaptcha-response' in the submitted

[102] Fix | Delete

* form.

[103] Fix | Delete

* @param string $remote_ip The end user's IP address.

[104] Fix | Delete

*

[105] Fix | Delete

* @return bool|WP_Error Returns true if verified. Otherwise WP_Error is returned.

[106] Fix | Delete

*/

[107] Fix | Delete

public function verify( $response, $remote_ip ) {

[108] Fix | Delete

// No need make a request if response is empty.

[109] Fix | Delete

if ( empty( $response ) ) {

[110] Fix | Delete

return new WP_Error( 'missing-input-response', $this->error_codes['missing-input-response'], 400 );

[111] Fix | Delete

}

[112] Fix | Delete

[113] Fix | Delete

$resp = wp_remote_post( self::VERIFY_URL, $this->get_verify_request_params( $response, $remote_ip ) );

[114] Fix | Delete

if ( is_wp_error( $resp ) ) {

[115] Fix | Delete

return $resp;

[116] Fix | Delete

}

[117] Fix | Delete

[118] Fix | Delete

$resp_decoded = json_decode( wp_remote_retrieve_body( $resp ), true );

[119] Fix | Delete

if ( ! $resp_decoded ) {

[120] Fix | Delete

return new WP_Error( 'invalid-json', $this->error_codes['invalid-json'], 400 );

[121] Fix | Delete

}

[122] Fix | Delete

[123] Fix | Delete

// Default error code and message.

[124] Fix | Delete

$error_code = 'unexpected-response';

[125] Fix | Delete

$error_message = $this->error_codes['unexpected-response'];

[126] Fix | Delete

[127] Fix | Delete

// Use the first error code if exists.

[128] Fix | Delete

if ( isset( $resp_decoded['error-codes'] ) && is_array( $resp_decoded['error-codes'] ) ) {

[129] Fix | Delete

if ( isset( $resp_decoded['error-codes'][0] ) && isset( $this->error_codes[ $resp_decoded['error-codes'][0] ] ) ) {

[130] Fix | Delete

$error_message = $this->error_codes[ $resp_decoded['error-codes'][0] ];

[131] Fix | Delete

$error_code = $resp_decoded['error-codes'][0];

[132] Fix | Delete

}

[133] Fix | Delete

}

[134] Fix | Delete

[135] Fix | Delete

if ( ! isset( $resp_decoded['success'] ) ) {

[136] Fix | Delete

return new WP_Error( $error_code, $error_message );

[137] Fix | Delete

}

[138] Fix | Delete

[139] Fix | Delete

if ( true !== $resp_decoded['success'] ) {

[140] Fix | Delete

return new WP_Error( $error_code, $error_message );

[141] Fix | Delete

}

[142] Fix | Delete

// Validate the hostname matches expected source

[143] Fix | Delete

if ( isset( $resp_decoded['hostname'] ) ) {

[144] Fix | Delete

$url = wp_parse_url( get_home_url() );

[145] Fix | Delete

[146] Fix | Delete

/**

[147] Fix | Delete

* Allow other valid hostnames.

[148] Fix | Delete

*

[149] Fix | Delete

* This can be useful in cases where the token hostname is expected to be

[150] Fix | Delete

* different from the get_home_url (ex. AMP recaptcha token contains a different hostname)

[151] Fix | Delete

*

[152] Fix | Delete

* @module sharedaddy

[153] Fix | Delete

*

[154] Fix | Delete

* @since 9.1.0

[155] Fix | Delete

*

[156] Fix | Delete

* @param array [ $url['host'] ] List of the valid hostnames to check against.

[157] Fix | Delete

*/

[158] Fix | Delete

$valid_hostnames = apply_filters( 'jetpack_recaptcha_valid_hostnames', array( $url['host'] ) );

[159] Fix | Delete

[160] Fix | Delete

if ( ! in_array( $resp_decoded['hostname'], $valid_hostnames, true ) ) {

[161] Fix | Delete

return new WP_Error( 'unexpected-host', $this->error_codes['unexpected-hostname'] );

[162] Fix | Delete

}

[163] Fix | Delete

}

[164] Fix | Delete

[165] Fix | Delete

return true;

[166] Fix | Delete

}

[167] Fix | Delete

[168] Fix | Delete

/**

[169] Fix | Delete

* Get siteverify request parameters.

[170] Fix | Delete

*

[171] Fix | Delete

* @param string $response The value of 'g-recaptcha-response' in the submitted

[172] Fix | Delete

* form.

[173] Fix | Delete

* @param string $remote_ip The end user's IP address.

[174] Fix | Delete

*

[175] Fix | Delete

* @return array

[176] Fix | Delete

*/

[177] Fix | Delete

public function get_verify_request_params( $response, $remote_ip ) {

[178] Fix | Delete

return array(

[179] Fix | Delete

'body' => array(

[180] Fix | Delete

'secret' => $this->secret_key,

[181] Fix | Delete

'response' => $response,

[182] Fix | Delete

'remoteip' => $remote_ip,

[183] Fix | Delete

),

[184] Fix | Delete

'sslverify' => true,

[185] Fix | Delete

);

[186] Fix | Delete

}

[187] Fix | Delete

[188] Fix | Delete

/**

[189] Fix | Delete

* Get reCAPTCHA HTML to render.

[190] Fix | Delete

*

[191] Fix | Delete

* @return string

[192] Fix | Delete

*/

[193] Fix | Delete

public function get_recaptcha_html() {

[194] Fix | Delete

$url = sprintf(

[195] Fix | Delete

'https://www.google.com/recaptcha/api.js?hl=%s',

[196] Fix | Delete

rawurlencode( $this->config['language'] )

[197] Fix | Delete

);

[198] Fix | Delete

[199] Fix | Delete

$html = sprintf(

[200] Fix | Delete

'

[201] Fix | Delete

<div

[202] Fix | Delete

class="%s"

[203] Fix | Delete

data-sitekey="%s"

[204] Fix | Delete

data-theme="%s"

[205] Fix | Delete

data-type="%s"

[206] Fix | Delete

data-tabindex="%s"

[207] Fix | Delete

data-lazy="%s"

[208] Fix | Delete

data-url="%s"></div>

[209] Fix | Delete

',

[210] Fix | Delete

esc_attr( $this->config['tag_class'] ),

[211] Fix | Delete

esc_attr( $this->site_key ),

[212] Fix | Delete

esc_attr( $this->config['tag_attributes']['theme'] ),

[213] Fix | Delete

esc_attr( $this->config['tag_attributes']['type'] ),

[214] Fix | Delete

esc_attr( $this->config['tag_attributes']['tabindex'] ),

[215] Fix | Delete

$this->config['script_lazy'] ? 'true' : 'false',

[216] Fix | Delete

esc_attr( $url )

[217] Fix | Delete

);

[218] Fix | Delete

[219] Fix | Delete

if ( ! $this->config['script_lazy'] ) {

[220] Fix | Delete

$html = $html . sprintf(

[221] Fix | Delete

// phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript

[222] Fix | Delete

'<script src="%s"%s%s></script>

[223] Fix | Delete

',

[224] Fix | Delete

$url,

[225] Fix | Delete

$this->config['script_async'] && ! $this->config['script_defer'] ? ' async' : '',

[226] Fix | Delete

$this->config['script_defer'] ? ' defer' : ''

[227] Fix | Delete

);

[228] Fix | Delete

}

[229] Fix | Delete

[230] Fix | Delete

return $html;

[231] Fix | Delete

}

[232] Fix | Delete

}

[233] Fix | Delete

[234] Fix | Delete