diff --git a/2017-02-10_reCAPTCHA_config.sql b/2017-02-10_reCAPTCHA_config.sql new file mode 100644 index 00000000000..01272892aff --- /dev/null +++ b/2017-02-10_reCAPTCHA_config.sql @@ -0,0 +1,15 @@ +SET @parentID = (SELECT ID FROM ConfigSettings WHERE Name = 'APIKeys'); + +-- Cleanup +DELETE FROM ConfigSettings WHERE Name='reCAPTCHAPrivate'; +DELETE FROM ConfigSettings WHERE Name='reCAPTCHAPublic'; +DELETE FROM Config WHERE ConfigID=(SELECT ID FROM ConfigSettings WHERE Name='reCAPTCHAPrivate'); +DELETE FROM Config WHERE ConfigID=(SELECT ID FROM ConfigSettings WHERE Name='reCAPTCHAPublic'); + +-- Insert +INSERT INTO ConfigSettings (`Name`, `Description`, `Visible`, `AllowMultiple`, `DataType`, `Parent`, `Label`, `OrderNumber`) VALUES ( + 'reCAPTCHAPrivate', 'Private Key for Google reCAPTCHA', 1, 0, 'text', @parentID, 'reCAPTCHA Private Key', 2 +); +INSERT INTO ConfigSettings (`Name`, `Description`, `Visible`, `AllowMultiple`, `DataType`, `Parent`, `Label`, `OrderNumber`) VALUES ( + 'reCAPTCHAPublic', 'Public Key for Google reCAPTCHA', 1, 0, 'text', @parentID, 'reCAPTCHA Public Key', 3 +); diff --git a/SQL/0000-00-03-ConfigTables.sql b/SQL/0000-00-03-ConfigTables.sql index c491fb37b74..5172d572dcf 100644 --- a/SQL/0000-00-03-ConfigTables.sql +++ b/SQL/0000-00-03-ConfigTables.sql @@ -106,7 +106,9 @@ INSERT INTO ConfigSettings (Name, Description, Visible, AllowMultiple, DataType, -- API keys INSERT INTO ConfigSettings (Name, Description, Visible, AllowMultiple, Label, OrderNumber) VALUES ('APIKeys', 'Specify any API keys required for LORIS', 1, 0, 'API Keys', 10); -INSERT INTO ConfigSettings (Name, Description, Visible, AllowMultiple, DataType, Parent, Label, OrderNumber) SELECT 'JWTKey', 'Secret key for signing JWT tokens on this server. This should be unique and never shared with anyone. ', 1, 0, 'text', ID, 'JWT Secret Key', 9 FROM ConfigSettings WHERE Name="APIKeys"; +INSERT INTO ConfigSettings (Name, Description, Visible, AllowMultiple, DataType, Parent, Label, OrderNumber) SELECT 'JWTKey', 'Secret key for signing JWT tokens on this server. This should be unique and never shared with anyone. ', 1, 0, 'text', ID, 'JWT Secret Key', 1 FROM ConfigSettings WHERE Name="APIKeys"; +INSERT INTO ConfigSettings (Name, Description, Visible, AllowMultiple, DataType, Parent, Label, OrderNumber) SELECT 'reCAPTCHAPrivate', 'Private Key for Google reCAPTCHA', 1, 0, 'text', ID, 'reCAPTCHA Private Key', 2 FROM ConfigSettings WHERE Name="APIKeys"; +INSERT INTO ConfigSettings (Name, Description, Visible, AllowMultiple, DataType, Parent, Label, OrderNumber) SELECT 'reCAPTCHAPublic', 'Public Key for Google reCaptcha', 1, 0, 'text', ID, 'reCAPTCHA Public Key', 3 FROM ConfigSettings WHERE Name="APIKeys"; -- -- Filling Config table with default values diff --git a/composer.json b/composer.json index ee2843c5343..6f1f07b5f48 100644 --- a/composer.json +++ b/composer.json @@ -6,7 +6,8 @@ "smarty/smarty" : "~3.1", "PHPOffice/PHPExcel": "1.8.*", "firebase/php-jwt" : "~3.0", - "pear-pear.php.net/HTML_QuickForm" : "~3.2" + "pear-pear.php.net/HTML_QuickForm" : "~3.2", + "google/recaptcha": "~1.1" }, "require-dev" : { "squizlabs/php_codesniffer" : "2.5.*", diff --git a/composer.lock b/composer.lock index 291b3cfe500..a0c49a6fc5c 100644 --- a/composer.lock +++ b/composer.lock @@ -4,8 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file", "This file is @generated automatically" ], - "hash": "e4974305d0eca3e4b2dcd82e2d06b2b9", - "content-hash": "372f4a88b3cab0928f9645701be8067f", + "hash": "38ac94a386e5b31694e49064e9756a16", "packages": [ { "name": "firebase/php-jwt", @@ -50,6 +49,51 @@ "homepage": "https://github.com/firebase/php-jwt", "time": "2015-07-22 18:31:08" }, + { + "name": "google/recaptcha", + "version": "1.1.2", + "source": { + "type": "git", + "url": "https://github.com/google/recaptcha.git", + "reference": "2b7e00566afca82a38a1d3adb8e42c118006296e" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/google/recaptcha/zipball/2b7e00566afca82a38a1d3adb8e42c118006296e", + "reference": "2b7e00566afca82a38a1d3adb8e42c118006296e", + "shasum": "" + }, + "require": { + "php": ">=5.3.2" + }, + "require-dev": { + "phpunit/phpunit": "4.5.*" + }, + "type": "library", + "extra": { + "branch-alias": { + "dev-master": "1.1.x-dev" + } + }, + "autoload": { + "psr-4": { + "ReCaptcha\\": "src/ReCaptcha" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "BSD-3-Clause" + ], + "description": "Client library for reCAPTCHA, a free service that protect websites from spam and abuse.", + "homepage": "http://www.google.com/recaptcha/", + "keywords": [ + "Abuse", + "captcha", + "recaptcha", + "spam" + ], + "time": "2015-09-02 17:23:59" + }, { "name": "pear-pear.php.net/HTML_Common", "version": "1.2.5", diff --git a/htdocs/request_account/process_new_account.php b/htdocs/request_account/process_new_account.php index e011d0afd43..5a4b86c7668 100755 --- a/htdocs/request_account/process_new_account.php +++ b/htdocs/request_account/process_new_account.php @@ -48,6 +48,15 @@ $site_list[$elt["CenterID"]] = $elt["Name"]; } +// Get reCATPCHA keys +$reCAPTCHAPrivate = $config->getSetting('reCAPTCHAPrivate'); +$reCAPTCHAPublic = $config->getSetting('reCAPTCHAPublic'); + +// Display reCAPTCHA if both private and public keys are set +if ($reCAPTCHAPrivate && $reCAPTCHAPublic) { + $tpl_data['captcha_key'] = $reCAPTCHAPublic; +} + $tpl_data['baseurl'] = $config->getSetting('url'); $tpl_data['css'] = $config->getSetting('css'); $tpl_data['rand'] = rand(0, 9999); @@ -83,6 +92,18 @@ $err = array(); if ($_SERVER['REQUEST_METHOD'] == "POST") { + // Verify reCAPTCHA + if (isset($_POST['g-recaptcha-response']) && isset($reCAPTCHAPrivate)) { + $recaptcha = new \ReCaptcha\ReCaptcha($reCAPTCHAPrivate); + $resp = $recaptcha->verify( + $_POST['g-recaptcha-response'], $_SERVER['REMOTE_ADDR'] + ); + if (!$resp->isSuccess()) { + $errors = $resp->getErrorCodes(); + $err['captcha'] = 'Please complete the reCaptcha!'; + } + } + if (!checkLen('name')) { $err[] = 'The minimum length for First Name field is 3 characters'; } diff --git a/smarty/templates/request_account.tpl b/smarty/templates/request_account.tpl new file mode 100644 index 00000000000..507f4360d03 --- /dev/null +++ b/smarty/templates/request_account.tpl @@ -0,0 +1,98 @@ + +
+
+

+ {if $success} + Account requested! + {else} + {$page_title} + {/if} +

+
+
+ {if $success} +
+

Thank you!

+

Your request for an account has been received successfully.

+ + Return to Login Page + +
+ {else} +

+ Please fill in the form below to request a LORIS account.
+ We will contact you once your account has been approved. +

+
+
+ + + {$error_message['name']} + +
+
+ + + {$error_message['lastname']} + +
+
+ + + {$error_message['from']} + +
+
+ + + {$error_message['site']} + +
+
+ + +
+ {if $captcha_key} +
+ {* Google reCaptcha *} +
+ + {$error_message['captcha']} + +
+ {/if} +
+ +
+
+ Back to login page +
+ {/if} +
+
\ No newline at end of file