Edit File by line

<?php

[0] Fix | Delete

[1] Fix | Delete

namespace WordfenceLS;

[2] Fix | Delete

[3] Fix | Delete

class Controller_CAPTCHA {

[4] Fix | Delete

const RESPONSE_MODE_ALLOW = 'allow';

[5] Fix | Delete

const RESPONSE_MODE_REQUIRE_VERIFICATION = 'verify';

[6] Fix | Delete

[7] Fix | Delete

const RECAPTCHA_ENDPOINT = 'https://www.google.com/recaptcha/api/siteverify';

[8] Fix | Delete

[9] Fix | Delete

/**

[10] Fix | Delete

* Returns the singleton Controller_CAPTCHA.

[11] Fix | Delete

[12] Fix | Delete

* @return Controller_CAPTCHA

[13] Fix | Delete

[14] Fix | Delete

public static function shared() {

[15] Fix | Delete

static $_shared = null;

[16] Fix | Delete

if ($_shared === null) {

[17] Fix | Delete

$_shared = new Controller_CAPTCHA();

[18] Fix | Delete

}

[19] Fix | Delete

return $_shared;

[20] Fix | Delete

}

[21] Fix | Delete

[22] Fix | Delete

/**

[23] Fix | Delete

* Returns whether or not the authentication CAPTCHA is enabled.

[24] Fix | Delete

[25] Fix | Delete

* @return bool

[26] Fix | Delete

[27] Fix | Delete

public function enabled() {

[28] Fix | Delete

$key = $this->site_key();

[29] Fix | Delete

$secret = $this->_secret();

[30] Fix | Delete

return Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_ENABLE_AUTH_CAPTCHA) && !empty($key) && !empty($secret);

[31] Fix | Delete

}

[32] Fix | Delete

[33] Fix | Delete

/**

[34] Fix | Delete

* Returns the public reCAPTCHA key if set.

[35] Fix | Delete

[36] Fix | Delete

* @return string|bool

[37] Fix | Delete

[38] Fix | Delete

public function site_key() {

[39] Fix | Delete

return Controller_Settings::shared()->get(Controller_Settings::OPTION_RECAPTCHA_SITE_KEY);

[40] Fix | Delete

}

[41] Fix | Delete

[42] Fix | Delete

/**

[43] Fix | Delete

* Returns the private reCAPTCHA secret if set.

[44] Fix | Delete

[45] Fix | Delete

* @return string|bool

[46] Fix | Delete

[47] Fix | Delete

protected function _secret() {

[48] Fix | Delete

return Controller_Settings::shared()->get(Controller_Settings::OPTION_RECAPTCHA_SECRET);

[49] Fix | Delete

}

[50] Fix | Delete

[51] Fix | Delete

/**

[52] Fix | Delete

* Returns the bot/human threshold for comparing the score against, defaulting to 0.5.

[53] Fix | Delete

[54] Fix | Delete

* @return float

[55] Fix | Delete

[56] Fix | Delete

public function threshold() {

[57] Fix | Delete

return max(0.1, Controller_Settings::shared()->get_float(Controller_Settings::OPTION_RECAPTCHA_THRESHOLD, 0.5));

[58] Fix | Delete

}

[59] Fix | Delete

[60] Fix | Delete

/**

[61] Fix | Delete

* Determine whether or not test mode for reCAPTCHA is enabled

[62] Fix | Delete

[63] Fix | Delete

* @return bool

[64] Fix | Delete

[65] Fix | Delete

public function test_mode() {

[66] Fix | Delete

return Controller_Settings::shared()->get_bool(\WordfenceLS\Controller_Settings::OPTION_CAPTCHA_TEST_MODE);

[67] Fix | Delete

}

[68] Fix | Delete

[69] Fix | Delete

/**

[70] Fix | Delete

* Queries the reCAPTCHA endpoint with the given token, verifies the action matches, and returns the corresponding

[71] Fix | Delete

* score. If validation fails, false is returned. Any other failure (e.g., mangled response or connection dropped) returns 0.0.

[72] Fix | Delete

[73] Fix | Delete

* @param string $token

[74] Fix | Delete

* @param string $action

[75] Fix | Delete

* @param int $timeout

[76] Fix | Delete

* @return float|false

[77] Fix | Delete

[78] Fix | Delete

public function score($token, $action = 'login', $timeout = 10) {

[79] Fix | Delete

try {

[80] Fix | Delete

$payload = array(

[81] Fix | Delete

'secret' => $this->_secret(),

[82] Fix | Delete

'response' => $token,

[83] Fix | Delete

'remoteip' => Model_Request::current()->ip(),

[84] Fix | Delete

);

[85] Fix | Delete

[86] Fix | Delete

$response = wp_remote_post(self::RECAPTCHA_ENDPOINT,

[87] Fix | Delete

array(

[88] Fix | Delete

'body' => $payload,

[89] Fix | Delete

'headers' => array(

[90] Fix | Delete

'Referer' => false,

[91] Fix | Delete

[92] Fix | Delete

'timeout' => $timeout,

[93] Fix | Delete

'blocking' => true,

[94] Fix | Delete

));

[95] Fix | Delete

[96] Fix | Delete

if (!is_wp_error($response)) {

[97] Fix | Delete

$jsonResponse = wp_remote_retrieve_body($response);

[98] Fix | Delete

$decoded = @json_decode($jsonResponse, true);

[99] Fix | Delete

if (is_array($decoded) && isset($decoded['success'])) {

[100] Fix | Delete

if ($decoded['success']) {

[101] Fix | Delete

if (isset($decoded['score']) && isset($decoded['action']) && $decoded['action'] == $action) {

[102] Fix | Delete

return (float) $decoded['score'];

[103] Fix | Delete

}

[104] Fix | Delete

}

[105] Fix | Delete

return false;

[106] Fix | Delete

}

[107] Fix | Delete

}

[108] Fix | Delete

}

[109] Fix | Delete

catch (\Exception $e) {

[110] Fix | Delete

//Fall through

[111] Fix | Delete

}

[112] Fix | Delete

[113] Fix | Delete

return 0.0;

[114] Fix | Delete

}

[115] Fix | Delete

[116] Fix | Delete

/**

[117] Fix | Delete

* Returns true if the score is >= the threshold to be considered a human request.

[118] Fix | Delete

[119] Fix | Delete

* @param float $score

[120] Fix | Delete

* @return bool

[121] Fix | Delete

[122] Fix | Delete

public function is_human($score) {

[123] Fix | Delete

if ($this->test_mode()) {

[124] Fix | Delete

return true;

[125] Fix | Delete

}

[126] Fix | Delete

[127] Fix | Delete

$threshold = $this->threshold();

[128] Fix | Delete

return ($score >= $threshold || abs($score - $threshold) < 0.0001);

[129] Fix | Delete

}

[130] Fix | Delete

[131] Fix | Delete

/**

[132] Fix | Delete

* Check if the current request is an XML RPC request

[133] Fix | Delete

* @return bool

[134] Fix | Delete

[135] Fix | Delete

private static function is_xml_rpc() {

[136] Fix | Delete

return defined('XMLRPC_REQUEST') && XMLRPC_REQUEST;

[137] Fix | Delete

}

[138] Fix | Delete

[139] Fix | Delete

/**

[140] Fix | Delete

* Check if captcha is required for the current request

[141] Fix | Delete

* @return bool

[142] Fix | Delete

[143] Fix | Delete

public function is_captcha_required() {

[144] Fix | Delete

$required = $this->enabled() && !self::is_xml_rpc();

[145] Fix | Delete

return apply_filters('wordfence_ls_require_captcha', $required);

[146] Fix | Delete

}

[147] Fix | Delete

[148] Fix | Delete

/**

[149] Fix | Delete

* Get the captcha token provided with the current request

[150] Fix | Delete

* @param string $key if specified, override the default token parameter

[151] Fix | Delete

* @return string|null the captcha token, if present, null otherwise

[152] Fix | Delete

[153] Fix | Delete

public function get_token($key = 'wfls-captcha-token') {

[154] Fix | Delete

return (isset($_POST[$key]) && is_string($_POST[$key]) && !empty($_POST[$key]) ? $_POST[$key] : null);

[155] Fix | Delete

}

[156] Fix | Delete

}

[157] Fix | Delete