recaptcha.php 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576
  1. <?php
  2. add_action( 'wpcf7_init', 'wpcf7_recaptcha_register_service', 10, 0 );
  3. function wpcf7_recaptcha_register_service() {
  4. $integration = WPCF7_Integration::get_instance();
  5. $integration->add_category( 'captcha',
  6. __( 'CAPTCHA', 'contact-form-7' )
  7. );
  8. $integration->add_service( 'recaptcha',
  9. WPCF7_RECAPTCHA::get_instance()
  10. );
  11. }
  12. add_action( 'wp_enqueue_scripts', 'wpcf7_recaptcha_enqueue_scripts', 10, 0 );
  13. function wpcf7_recaptcha_enqueue_scripts() {
  14. $service = WPCF7_RECAPTCHA::get_instance();
  15. if ( ! $service->is_active() ) {
  16. return;
  17. }
  18. $url = add_query_arg(
  19. array(
  20. 'render' => $service->get_sitekey(),
  21. ),
  22. 'https://www.google.com/recaptcha/api.js'
  23. );
  24. wp_enqueue_script( 'google-recaptcha', $url, array(), '3.0', true );
  25. }
  26. add_filter( 'wpcf7_form_hidden_fields',
  27. 'wpcf7_recaptcha_add_hidden_fields', 100, 1 );
  28. function wpcf7_recaptcha_add_hidden_fields( $fields ) {
  29. $service = WPCF7_RECAPTCHA::get_instance();
  30. if ( ! $service->is_active() ) {
  31. return $fields;
  32. }
  33. return array_merge( $fields, array(
  34. 'g-recaptcha-response' => '',
  35. ) );
  36. }
  37. add_action( 'wp_footer', 'wpcf7_recaptcha_onload_script', 40, 0 );
  38. function wpcf7_recaptcha_onload_script() {
  39. $service = WPCF7_RECAPTCHA::get_instance();
  40. if ( ! $service->is_active() ) {
  41. return;
  42. }
  43. if ( ! wp_script_is( 'google-recaptcha', 'done' ) ) {
  44. return;
  45. }
  46. $actions = apply_filters( 'wpcf7_recaptcha_actions',
  47. array(
  48. 'homepage' => 'homepage',
  49. 'contactform' => 'contactform',
  50. )
  51. );
  52. ?>
  53. <script type="text/javascript">
  54. ( function( grecaptcha, sitekey, actions ) {
  55. var wpcf7recaptcha = {
  56. execute: function( action ) {
  57. grecaptcha.execute(
  58. sitekey,
  59. { action: action }
  60. ).then( function( token ) {
  61. var forms = document.getElementsByTagName( 'form' );
  62. for ( var i = 0; i < forms.length; i++ ) {
  63. var fields = forms[ i ].getElementsByTagName( 'input' );
  64. for ( var j = 0; j < fields.length; j++ ) {
  65. var field = fields[ j ];
  66. if ( 'g-recaptcha-response' === field.getAttribute( 'name' ) ) {
  67. field.setAttribute( 'value', token );
  68. break;
  69. }
  70. }
  71. }
  72. } );
  73. },
  74. executeOnHomepage: function() {
  75. wpcf7recaptcha.execute( actions[ 'homepage' ] );
  76. },
  77. executeOnContactform: function() {
  78. wpcf7recaptcha.execute( actions[ 'contactform' ] );
  79. },
  80. };
  81. grecaptcha.ready(
  82. wpcf7recaptcha.executeOnHomepage
  83. );
  84. document.addEventListener( 'change',
  85. wpcf7recaptcha.executeOnContactform, false
  86. );
  87. document.addEventListener( 'wpcf7submit',
  88. wpcf7recaptcha.executeOnHomepage, false
  89. );
  90. } )(
  91. grecaptcha,
  92. '<?php echo esc_js( $service->get_sitekey() ); ?>',
  93. <?php echo json_encode( $actions ), "\n"; ?>
  94. );
  95. </script>
  96. <?php
  97. }
  98. add_filter( 'wpcf7_spam', 'wpcf7_recaptcha_verify_response', 9, 1 );
  99. function wpcf7_recaptcha_verify_response( $spam ) {
  100. if ( $spam ) {
  101. return $spam;
  102. }
  103. $service = WPCF7_RECAPTCHA::get_instance();
  104. if ( ! $service->is_active() ) {
  105. return $spam;
  106. }
  107. $submission = WPCF7_Submission::get_instance();
  108. $token = isset( $_POST['g-recaptcha-response'] )
  109. ? trim( $_POST['g-recaptcha-response'] ) : '';
  110. if ( $service->verify( $token ) ) { // Human
  111. $spam = false;
  112. } else { // Bot
  113. $spam = true;
  114. if ( '' === $token ) {
  115. $submission->add_spam_log( array(
  116. 'agent' => 'recaptcha',
  117. 'reason' => __( 'reCAPTCHA response token is empty.', 'contact-form-7' ),
  118. ) );
  119. } else {
  120. $submission->add_spam_log( array(
  121. 'agent' => 'recaptcha',
  122. 'reason' => sprintf(
  123. __( 'reCAPTCHA score (%1$.2f) is lower than the threshold (%2$.2f).', 'contact-form-7' ),
  124. $service->get_last_score(),
  125. $service->get_threshold()
  126. ),
  127. ) );
  128. }
  129. }
  130. return $spam;
  131. }
  132. add_action( 'wpcf7_init', 'wpcf7_recaptcha_add_form_tag_recaptcha', 10, 0 );
  133. function wpcf7_recaptcha_add_form_tag_recaptcha() {
  134. $service = WPCF7_RECAPTCHA::get_instance();
  135. if ( ! $service->is_active() ) {
  136. return;
  137. }
  138. wpcf7_add_form_tag( 'recaptcha',
  139. '__return_empty_string', // no output
  140. array( 'display-block' => true )
  141. );
  142. }
  143. add_action( 'wpcf7_upgrade', 'wpcf7_upgrade_recaptcha_v2_v3', 10, 2 );
  144. function wpcf7_upgrade_recaptcha_v2_v3( $new_ver, $old_ver ) {
  145. if ( version_compare( '5.1-dev', $old_ver, '<=' ) ) {
  146. return;
  147. }
  148. $service = WPCF7_RECAPTCHA::get_instance();
  149. if ( ! $service->is_active() ) {
  150. return;
  151. }
  152. // Maybe v2 keys are used now. Warning necessary.
  153. WPCF7::update_option( 'recaptcha_v2_v3_warning', true );
  154. WPCF7::update_option( 'recaptcha', null );
  155. }
  156. add_action( 'wpcf7_admin_menu', 'wpcf7_admin_init_recaptcha_v2_v3', 10, 0 );
  157. function wpcf7_admin_init_recaptcha_v2_v3() {
  158. if ( ! WPCF7::get_option( 'recaptcha_v2_v3_warning' ) ) {
  159. return;
  160. }
  161. add_filter( 'wpcf7_admin_menu_change_notice',
  162. 'wpcf7_admin_menu_change_notice_recaptcha_v2_v3', 10, 1 );
  163. add_action( 'wpcf7_admin_warnings',
  164. 'wpcf7_admin_warnings_recaptcha_v2_v3', 5, 3 );
  165. }
  166. function wpcf7_admin_menu_change_notice_recaptcha_v2_v3( $counts ) {
  167. $counts['wpcf7-integration'] += 1;
  168. return $counts;
  169. }
  170. function wpcf7_admin_warnings_recaptcha_v2_v3( $page, $action, $object ) {
  171. if ( 'wpcf7-integration' !== $page ) {
  172. return;
  173. }
  174. $message = sprintf(
  175. esc_html( __( "API keys for reCAPTCHA v3 are different from those for v2; keys for v2 don&#8217;t work with the v3 API. You need to register your sites again to get new keys for v3. For details, see %s.", 'contact-form-7' ) ),
  176. wpcf7_link(
  177. __( 'https://contactform7.com/recaptcha/', 'contact-form-7' ),
  178. __( 'reCAPTCHA (v3)', 'contact-form-7' )
  179. )
  180. );
  181. echo sprintf(
  182. '<div class="notice notice-warning"><p>%s</p></div>',
  183. $message
  184. );
  185. }
  186. if ( ! class_exists( 'WPCF7_Service' ) ) {
  187. return;
  188. }
  189. class WPCF7_RECAPTCHA extends WPCF7_Service {
  190. private static $instance;
  191. private $sitekeys;
  192. private $last_score;
  193. public static function get_instance() {
  194. if ( empty( self::$instance ) ) {
  195. self::$instance = new self;
  196. }
  197. return self::$instance;
  198. }
  199. private function __construct() {
  200. $this->sitekeys = WPCF7::get_option( 'recaptcha' );
  201. }
  202. public function get_title() {
  203. return __( 'reCAPTCHA', 'contact-form-7' );
  204. }
  205. public function is_active() {
  206. $sitekey = $this->get_sitekey();
  207. $secret = $this->get_secret( $sitekey );
  208. return $sitekey && $secret;
  209. }
  210. public function get_categories() {
  211. return array( 'captcha' );
  212. }
  213. public function icon() {
  214. }
  215. public function link() {
  216. echo wpcf7_link(
  217. 'https://www.google.com/recaptcha/intro/index.html',
  218. 'google.com/recaptcha'
  219. );
  220. }
  221. public function get_global_sitekey() {
  222. static $sitekey = '';
  223. if ( $sitekey ) {
  224. return $sitekey;
  225. }
  226. if ( defined( 'WPCF7_RECAPTCHA_SITEKEY' ) ) {
  227. $sitekey = WPCF7_RECAPTCHA_SITEKEY;
  228. }
  229. $sitekey = apply_filters( 'wpcf7_recaptcha_sitekey', $sitekey );
  230. return $sitekey;
  231. }
  232. public function get_global_secret() {
  233. static $secret = '';
  234. if ( $secret ) {
  235. return $secret;
  236. }
  237. if ( defined( 'WPCF7_RECAPTCHA_SECRET' ) ) {
  238. $secret = WPCF7_RECAPTCHA_SECRET;
  239. }
  240. $secret = apply_filters( 'wpcf7_recaptcha_secret', $secret );
  241. return $secret;
  242. }
  243. public function get_sitekey() {
  244. if ( $this->get_global_sitekey() && $this->get_global_secret() ) {
  245. return $this->get_global_sitekey();
  246. }
  247. if ( empty( $this->sitekeys )
  248. or ! is_array( $this->sitekeys ) ) {
  249. return false;
  250. }
  251. $sitekeys = array_keys( $this->sitekeys );
  252. return $sitekeys[0];
  253. }
  254. public function get_secret( $sitekey ) {
  255. if ( $this->get_global_sitekey() && $this->get_global_secret() ) {
  256. return $this->get_global_secret();
  257. }
  258. $sitekeys = (array) $this->sitekeys;
  259. if ( isset( $sitekeys[$sitekey] ) ) {
  260. return $sitekeys[$sitekey];
  261. } else {
  262. return false;
  263. }
  264. }
  265. protected function log( $url, $request, $response ) {
  266. wpcf7_log_remote_request( $url, $request, $response );
  267. }
  268. public function verify( $token ) {
  269. $is_human = false;
  270. if ( empty( $token ) or ! $this->is_active() ) {
  271. return $is_human;
  272. }
  273. $endpoint = 'https://www.google.com/recaptcha/api/siteverify';
  274. $sitekey = $this->get_sitekey();
  275. $secret = $this->get_secret( $sitekey );
  276. $request = array(
  277. 'body' => array(
  278. 'secret' => $secret,
  279. 'response' => $token,
  280. ),
  281. );
  282. $response = wp_remote_post( esc_url_raw( $endpoint ), $request );
  283. if ( 200 != wp_remote_retrieve_response_code( $response ) ) {
  284. if ( WP_DEBUG ) {
  285. $this->log( $endpoint, $request, $response );
  286. }
  287. return $is_human;
  288. }
  289. $response_body = wp_remote_retrieve_body( $response );
  290. $response_body = json_decode( $response_body, true );
  291. $this->last_score = $score = isset( $response_body['score'] )
  292. ? $response_body['score']
  293. : 0;
  294. $threshold = $this->get_threshold();
  295. $is_human = $threshold < $score;
  296. $is_human = apply_filters( 'wpcf7_recaptcha_verify_response',
  297. $is_human, $response_body );
  298. if ( $submission = WPCF7_Submission::get_instance() ) {
  299. $submission->recaptcha = array(
  300. 'version' => '3.0',
  301. 'threshold' => $threshold,
  302. 'response' => $response_body,
  303. );
  304. }
  305. return $is_human;
  306. }
  307. public function get_threshold() {
  308. return apply_filters( 'wpcf7_recaptcha_threshold', 0.50 );
  309. }
  310. public function get_last_score() {
  311. return $this->last_score;
  312. }
  313. protected function menu_page_url( $args = '' ) {
  314. $args = wp_parse_args( $args, array() );
  315. $url = menu_page_url( 'wpcf7-integration', false );
  316. $url = add_query_arg( array( 'service' => 'recaptcha' ), $url );
  317. if ( ! empty( $args) ) {
  318. $url = add_query_arg( $args, $url );
  319. }
  320. return $url;
  321. }
  322. protected function save_data() {
  323. WPCF7::update_option( 'recaptcha', $this->sitekeys );
  324. }
  325. protected function reset_data() {
  326. $this->sitekeys = null;
  327. $this->save_data();
  328. }
  329. public function load( $action = '' ) {
  330. if ( 'setup' == $action and 'POST' == $_SERVER['REQUEST_METHOD'] ) {
  331. check_admin_referer( 'wpcf7-recaptcha-setup' );
  332. if ( ! empty( $_POST['reset'] ) ) {
  333. $this->reset_data();
  334. $redirect_to = $this->menu_page_url( 'action=setup' );
  335. } else {
  336. $sitekey = isset( $_POST['sitekey'] ) ? trim( $_POST['sitekey'] ) : '';
  337. $secret = isset( $_POST['secret'] ) ? trim( $_POST['secret'] ) : '';
  338. if ( $sitekey and $secret ) {
  339. $this->sitekeys = array( $sitekey => $secret );
  340. $this->save_data();
  341. $redirect_to = $this->menu_page_url( array(
  342. 'message' => 'success',
  343. ) );
  344. } else {
  345. $redirect_to = $this->menu_page_url( array(
  346. 'action' => 'setup',
  347. 'message' => 'invalid',
  348. ) );
  349. }
  350. }
  351. if ( WPCF7::get_option( 'recaptcha_v2_v3_warning' ) ) {
  352. WPCF7::update_option( 'recaptcha_v2_v3_warning', false );
  353. }
  354. wp_safe_redirect( $redirect_to );
  355. exit();
  356. }
  357. }
  358. public function admin_notice( $message = '' ) {
  359. if ( 'invalid' == $message ) {
  360. echo sprintf(
  361. '<div class="error notice notice-error is-dismissible"><p><strong>%1$s</strong>: %2$s</p></div>',
  362. esc_html( __( "ERROR", 'contact-form-7' ) ),
  363. esc_html( __( "Invalid key values.", 'contact-form-7' ) ) );
  364. }
  365. if ( 'success' == $message ) {
  366. echo sprintf( '<div class="updated notice notice-success is-dismissible"><p>%s</p></div>',
  367. esc_html( __( 'Settings saved.', 'contact-form-7' ) ) );
  368. }
  369. }
  370. public function display( $action = '' ) {
  371. echo '<p>' . sprintf(
  372. esc_html( __( 'reCAPTCHA protects you against spam and other types of automated abuse. With Contact Form 7&#8217;s reCAPTCHA integration module, you can block abusive form submissions by spam bots. For details, see %s.', 'contact-form-7' ) ),
  373. wpcf7_link(
  374. __( 'https://contactform7.com/recaptcha/', 'contact-form-7' ),
  375. __( 'reCAPTCHA (v3)', 'contact-form-7' )
  376. )
  377. ) . '</p>';
  378. if ( $this->is_active() ) {
  379. echo sprintf(
  380. '<p class="dashicons-before dashicons-yes">%s</p>',
  381. esc_html( __( "reCAPTCHA is active on this site.", 'contact-form-7' ) )
  382. );
  383. }
  384. if ( 'setup' == $action ) {
  385. $this->display_setup();
  386. } else {
  387. echo sprintf(
  388. '<p><a href="%1$s" class="button">%2$s</a></p>',
  389. esc_url( $this->menu_page_url( 'action=setup' ) ),
  390. esc_html( __( 'Setup Integration', 'contact-form-7' ) )
  391. );
  392. }
  393. }
  394. private function display_setup() {
  395. $sitekey = $this->is_active() ? $this->get_sitekey() : '';
  396. $secret = $this->is_active() ? $this->get_secret( $sitekey ) : '';
  397. ?>
  398. <form method="post" action="<?php echo esc_url( $this->menu_page_url( 'action=setup' ) ); ?>">
  399. <?php wp_nonce_field( 'wpcf7-recaptcha-setup' ); ?>
  400. <table class="form-table">
  401. <tbody>
  402. <tr>
  403. <th scope="row"><label for="sitekey"><?php echo esc_html( __( 'Site Key', 'contact-form-7' ) ); ?></label></th>
  404. <td><?php
  405. if ( $this->is_active() ) {
  406. echo esc_html( $sitekey );
  407. echo sprintf(
  408. '<input type="hidden" value="%1$s" id="sitekey" name="sitekey" />',
  409. esc_attr( $sitekey )
  410. );
  411. } else {
  412. echo sprintf(
  413. '<input type="text" aria-required="true" value="%1$s" id="sitekey" name="sitekey" class="regular-text code" />',
  414. esc_attr( $sitekey )
  415. );
  416. }
  417. ?></td>
  418. </tr>
  419. <tr>
  420. <th scope="row"><label for="secret"><?php echo esc_html( __( 'Secret Key', 'contact-form-7' ) ); ?></label></th>
  421. <td><?php
  422. if ( $this->is_active() ) {
  423. echo esc_html( wpcf7_mask_password( $secret ) );
  424. echo sprintf(
  425. '<input type="hidden" value="%1$s" id="secret" name="secret" />',
  426. esc_attr( $secret )
  427. );
  428. } else {
  429. echo sprintf(
  430. '<input type="text" aria-required="true" value="%1$s" id="secret" name="secret" class="regular-text code" />',
  431. esc_attr( $secret )
  432. );
  433. }
  434. ?></td>
  435. </tr>
  436. </tbody>
  437. </table>
  438. <?php
  439. if ( $this->is_active() ) {
  440. if ( $this->get_global_sitekey() && $this->get_global_secret() ) {
  441. // nothing
  442. } else {
  443. submit_button(
  444. _x( 'Remove Keys', 'API keys', 'contact-form-7' ),
  445. 'small', 'reset'
  446. );
  447. }
  448. } else {
  449. submit_button( __( 'Save Changes', 'contact-form-7' ) );
  450. }
  451. ?>
  452. </form>
  453. <?php
  454. }
  455. }