' . $p1 . '
'; $html .= '' . $p2 . '
'; $html .= ''; $html .= '%1$s.', 'it-l10n-ithemes-security-pro' ), $code ) );
} else {
ITSEC_Modules::set_setting( 'recaptcha', 'last_error', sprintf( esc_html__( 'The reCAPTCHA server reported the following errors: %1$s.', 'it-l10n-ithemes-security-pro' ), implode( ', ', $status['error-codes'] ) ) );
}
}
$GLOBALS['__itsec_recaptcha_cached_result'] = true;
return $GLOBALS['__itsec_recaptcha_cached_result'];
}
$GLOBALS['__itsec_recaptcha_cached_result'] = $validation_error;
$this->log_failed_validation( $GLOBALS['__itsec_recaptcha_cached_result'], $args );
return $GLOBALS['__itsec_recaptcha_cached_result'];
}
/**
* Is the reCAPTCHA response from Google valid.
*
* @param array $response
*
* @return bool
*/
private function is_valid_response_format( $response ) {
if ( ! is_array( $response ) ) {
return false;
}
if ( ! isset( $response['success'] ) ) {
return false;
}
if ( 'v3' === $this->settings['type'] && ! isset( $response['score'], $response['action'] ) ) {
return false;
}
return true;
}
/**
* Validate the response.
*
* @param array $response The response from Google.
* @param array $args The args passed by the user.
*
* @return WP_Error|null
*/
private function validate_response( $response, $args ) {
ITSEC_Log::add_debug( 'recaptcha', 'validate-response', compact( 'response', 'args' ) );
$error = new WP_Error( 'itsec-recaptcha-incorrect', esc_html__( 'The captcha response you submitted does not appear to be valid. Please try again.', 'it-l10n-ithemes-security-pro' ) );
if ( ! $response['success'] ) {
$error->add_data( array( 'validate_error' => 'invalid-token', 'args' => $args ) );
return $error;
}
if ( ! $this->validate_host( $response ) ) {
$error->add_data( array( 'validate_error' => 'host-mismatch', 'args' => $args ) );
return $error;
}
if ( ! $this->validate_action( $response, $args ) ) {
$error->add_data( array( 'validate_error' => 'action-mismatch', 'args' => $args ) );
return $error;
}
if ( ! $this->validate_score( $response, $args ) ) {
$error->add_data( array( 'validate_error' => 'insufficient_score', 'args' => $args ) );
return $error;
}
return null;
}
/**
* Validate the hostname the Recaptcha was filled on.
*
* This allows the user to disable "Domain Name Validation" on large multisite installations because Google
* limits the number of sites a recaptcha key can be used on.
*
* @since 4.2.0
*
* @param array $status
*
* @return bool
*/
private function validate_host( $status ) {
if ( ! apply_filters( 'itsec_recaptcha_validate_host', false ) ) {
return true;
}
if ( ! isset( $status['hostname'] ) ) {
return true;
}
$site_parsed = parse_url( site_url() );
if ( ! is_array( $site_parsed ) || ! isset( $site_parsed['host'] ) ) {
return true;
}
return $site_parsed['host'] === $status['hostname'];
}
/**
* Validate that the action matches and the score is above the threshold..
*
* @param array $status Response from Google.
* @param array $args Validation args.
*
* @return bool
*/
private function validate_action( $status, $args ) {
if ( 'v3' !== $this->settings['type'] ) {
return true;
}
return empty( $args['action'] ) || $status['action'] === $args['action'];
}
/**
* Validate that the action matches and the score is above the threshold..
*
* @param array $status Response from Google.
* @param array $args Validation args.
*
* @return bool
*/
private function validate_score( $status, $args ) {
if ( 'v3' !== $this->settings['type'] ) {
return true;
}
$threshold = isset( $args['v3_threshold'] ) ? $args['v3_threshold'] : $this->settings['v3_threshold'];
return $status['score'] >= $threshold;
}
/**
* Log when Recaptcha fails to validate.
*
* @param WP_Error $error
* @param array $args
*/
private function log_failed_validation( $error, $args ) {
/** @var ITSEC_Lockout $itsec_lockout */
global $itsec_lockout;
/**
* Fires when a user fails the reCAPTCHA test.
*
* @param WP_Error $error
* @param array $args
*/
do_action( 'itsec_failed_recaptcha', $error, $args );
ITSEC_Log::add_notice( 'recaptcha', 'failed-validation', $error );
$data = $error->get_error_data();
$context = new Host_Context( 'recaptcha' );
if ( ! empty( $data['args']['user'] ) ) {
$context->set_login_user_id( $data['args']['user'] );
} elseif ( ! empty( $data['args']['username'] ) ) {
$context->set_login_username( $data['args']['username'] );
}
$itsec_lockout->do_lockout( $context );
if ( 'itsec-recaptcha-form-not-submitted' === $error->get_error_code() ) {
ITSEC_Dashboard_Util::record_event( 'recaptcha-empty' );
} else {
ITSEC_Dashboard_Util::record_event( 'recaptcha-invalid' );
}
}
/**
* Set the login error if captcha wasn't validated
*
* @since 1.13
*
* @param WP_User|WP_Error|null $user WP_User if the user is authenticated, WP_Error or null otherwise.
* @param string $username
*
* @return WP_User|WP_Error|null
*/
public function filter_authenticate( $user, $username ) {
if ( empty( $_POST ) || ITSEC_Core::is_api_request() ) {
return $user;
}
ITSEC_Lib::load( 'login' );
$args = array( 'action' => self::A_LOGIN );
if ( $user instanceof WP_User ) {
$args['user'] = $user->ID;
} elseif ( $found_user = ITSEC_Lib_Login::get_user( $username ) ) {
$args['user'] = $found_user->ID;
} else {
$args['username'] = $username;
}
$result = $this->validate_captcha( $args );
if ( is_wp_error( $result ) ) {
return $result;
}
return $user;
}
/**
* Register recaptcha for lockout
*
* @since 1.13
*
* @param array $lockout_modules array of lockout modules
*
* @return array array of lockout modules
*/
public function register_lockout_module( $lockout_modules ) {
$lockout_modules['recaptcha'] = array(
'type' => 'recaptcha',
'reason' => __( 'too many failed captcha submissions.', 'it-l10n-ithemes-security-pro' ),
'label' => __( 'reCAPTCHA', 'it-l10n-ithemes-security-pro' ),
'host' => isset( $this->settings['error_threshold'] ) ? absint( $this->settings['error_threshold'] ) : 7,
'period' => isset( $this->settings['check_period'] ) ? absint( $this->settings['check_period'] ) : 5,
);
return $lockout_modules;
}
}