mirror of
https://github.com/mastodon/mastodon.git
synced 2024-12-13 06:35:08 +01:00
Add optional hCaptcha support
Fixes #1649 This requires setting `HCAPTCHA_SECRET_KEY` and `HCAPTCHA_SITE_KEY`, then enabling the admin setting at `/admin/settings/edit#form_admin_settings_captcha_enabled` Subsequently, a hCaptcha widget will be displayed on `/about` and `/auth/sign_up` unless: - the user is already signed-up already - the user has used an invite link - the user has already solved the captcha (and registration failed for another reason) The Content-Security-Policy headers are altered automatically to allow the third-party hCaptcha scripts on `/about` and `/auth/sign_up` following the same rules as above.
This commit is contained in:
parent
e58e0eb9aa
commit
1b493c9fee
@ -285,3 +285,7 @@ MAX_POLL_OPTION_CHARS=100
|
|||||||
# Units are in bytes
|
# Units are in bytes
|
||||||
MAX_EMOJI_SIZE=51200
|
MAX_EMOJI_SIZE=51200
|
||||||
MAX_REMOTE_EMOJI_SIZE=204800
|
MAX_REMOTE_EMOJI_SIZE=204800
|
||||||
|
|
||||||
|
# Optional hCaptcha support
|
||||||
|
# HCAPTCHA_SECRET_KEY=
|
||||||
|
# HCAPTCHA_SITE_KEY=
|
||||||
|
2
Gemfile
2
Gemfile
@ -156,3 +156,5 @@ gem 'concurrent-ruby', require: false
|
|||||||
gem 'connection_pool', require: false
|
gem 'connection_pool', require: false
|
||||||
|
|
||||||
gem 'xorcist', '~> 1.1'
|
gem 'xorcist', '~> 1.1'
|
||||||
|
|
||||||
|
gem "hcaptcha", "~> 7.1"
|
||||||
|
@ -271,6 +271,8 @@ GEM
|
|||||||
railties (>= 4.0.1)
|
railties (>= 4.0.1)
|
||||||
hashdiff (1.0.1)
|
hashdiff (1.0.1)
|
||||||
hashie (4.1.0)
|
hashie (4.1.0)
|
||||||
|
hcaptcha (7.1.0)
|
||||||
|
json
|
||||||
highline (2.0.3)
|
highline (2.0.3)
|
||||||
hiredis (0.6.3)
|
hiredis (0.6.3)
|
||||||
hkdf (0.3.0)
|
hkdf (0.3.0)
|
||||||
@ -719,6 +721,7 @@ DEPENDENCIES
|
|||||||
fog-openstack (~> 0.3)
|
fog-openstack (~> 0.3)
|
||||||
fuubar (~> 2.5)
|
fuubar (~> 2.5)
|
||||||
hamlit-rails (~> 0.2)
|
hamlit-rails (~> 0.2)
|
||||||
|
hcaptcha (~> 7.1)
|
||||||
hiredis (~> 0.6)
|
hiredis (~> 0.6)
|
||||||
htmlentities (~> 4.3)
|
htmlentities (~> 4.3)
|
||||||
http (~> 5.0)
|
http (~> 5.0)
|
||||||
|
@ -2,6 +2,7 @@
|
|||||||
|
|
||||||
class AboutController < ApplicationController
|
class AboutController < ApplicationController
|
||||||
include RegistrationSpamConcern
|
include RegistrationSpamConcern
|
||||||
|
include CaptchaConcern
|
||||||
|
|
||||||
before_action :set_pack
|
before_action :set_pack
|
||||||
|
|
||||||
@ -12,6 +13,7 @@ class AboutController < ApplicationController
|
|||||||
before_action :set_instance_presenter
|
before_action :set_instance_presenter
|
||||||
before_action :set_expires_in, only: [:more, :terms]
|
before_action :set_expires_in, only: [:more, :terms]
|
||||||
before_action :set_registration_form_time, only: :show
|
before_action :set_registration_form_time, only: :show
|
||||||
|
before_action :extend_csp_for_captcha!, only: :show
|
||||||
|
|
||||||
skip_before_action :require_functional!, only: [:more, :terms]
|
skip_before_action :require_functional!, only: [:more, :terms]
|
||||||
|
|
||||||
|
@ -1,6 +1,8 @@
|
|||||||
# frozen_string_literal: true
|
# frozen_string_literal: true
|
||||||
|
|
||||||
class Api::V1::AccountsController < Api::BaseController
|
class Api::V1::AccountsController < Api::BaseController
|
||||||
|
include CaptchaConcern
|
||||||
|
|
||||||
before_action -> { authorize_if_got_token! :read, :'read:accounts' }, except: [:create, :follow, :unfollow, :remove_from_followers, :block, :unblock, :mute, :unmute]
|
before_action -> { authorize_if_got_token! :read, :'read:accounts' }, except: [:create, :follow, :unfollow, :remove_from_followers, :block, :unblock, :mute, :unmute]
|
||||||
before_action -> { doorkeeper_authorize! :follow, :'write:follows' }, only: [:follow, :unfollow, :remove_from_followers]
|
before_action -> { doorkeeper_authorize! :follow, :'write:follows' }, only: [:follow, :unfollow, :remove_from_followers]
|
||||||
before_action -> { doorkeeper_authorize! :follow, :'write:mutes' }, only: [:mute, :unmute]
|
before_action -> { doorkeeper_authorize! :follow, :'write:mutes' }, only: [:mute, :unmute]
|
||||||
@ -83,7 +85,7 @@ class Api::V1::AccountsController < Api::BaseController
|
|||||||
end
|
end
|
||||||
|
|
||||||
def check_enabled_registrations
|
def check_enabled_registrations
|
||||||
forbidden if single_user_mode? || omniauth_only? || !allowed_registrations?
|
forbidden if single_user_mode? || omniauth_only? || !allowed_registrations? || captcha_enabled?
|
||||||
end
|
end
|
||||||
|
|
||||||
def allowed_registrations?
|
def allowed_registrations?
|
||||||
|
@ -2,6 +2,7 @@
|
|||||||
|
|
||||||
class Auth::RegistrationsController < Devise::RegistrationsController
|
class Auth::RegistrationsController < Devise::RegistrationsController
|
||||||
include RegistrationSpamConcern
|
include RegistrationSpamConcern
|
||||||
|
include CaptchaConcern
|
||||||
|
|
||||||
layout :determine_layout
|
layout :determine_layout
|
||||||
|
|
||||||
@ -15,6 +16,8 @@ class Auth::RegistrationsController < Devise::RegistrationsController
|
|||||||
before_action :require_not_suspended!, only: [:update]
|
before_action :require_not_suspended!, only: [:update]
|
||||||
before_action :set_cache_headers, only: [:edit, :update]
|
before_action :set_cache_headers, only: [:edit, :update]
|
||||||
before_action :set_registration_form_time, only: :new
|
before_action :set_registration_form_time, only: :new
|
||||||
|
before_action :extend_csp_for_captcha!, only: [:new, :create]
|
||||||
|
before_action :check_captcha!, only: :create
|
||||||
|
|
||||||
skip_before_action :require_functional!, only: [:edit, :update]
|
skip_before_action :require_functional!, only: [:edit, :update]
|
||||||
|
|
||||||
@ -135,4 +138,18 @@ class Auth::RegistrationsController < Devise::RegistrationsController
|
|||||||
def set_cache_headers
|
def set_cache_headers
|
||||||
response.headers['Cache-Control'] = 'no-cache, no-store, max-age=0, must-revalidate'
|
response.headers['Cache-Control'] = 'no-cache, no-store, max-age=0, must-revalidate'
|
||||||
end
|
end
|
||||||
|
|
||||||
|
def sign_up(resource_name, resource)
|
||||||
|
clear_captcha!
|
||||||
|
super
|
||||||
|
end
|
||||||
|
|
||||||
|
def check_captcha!
|
||||||
|
super do |error|
|
||||||
|
build_resource(sign_up_params)
|
||||||
|
resource.validate
|
||||||
|
resource.errors.add(:base, error)
|
||||||
|
respond_with resource
|
||||||
|
end
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
66
app/controllers/concerns/captcha_concern.rb
Normal file
66
app/controllers/concerns/captcha_concern.rb
Normal file
@ -0,0 +1,66 @@
|
|||||||
|
# frozen_string_literal: true
|
||||||
|
|
||||||
|
module CaptchaConcern
|
||||||
|
extend ActiveSupport::Concern
|
||||||
|
include Hcaptcha::Adapters::ViewMethods
|
||||||
|
|
||||||
|
CAPTCHA_TIMEOUT = 2.hours.freeze
|
||||||
|
|
||||||
|
included do
|
||||||
|
helper_method :render_captcha_if_needed
|
||||||
|
end
|
||||||
|
|
||||||
|
def captcha_available?
|
||||||
|
ENV['HCAPTCHA_SECRET_KEY'].present? && ENV['HCAPTCHA_SITE_KEY'].present?
|
||||||
|
end
|
||||||
|
|
||||||
|
def captcha_enabled?
|
||||||
|
captcha_available? && Setting.captcha_enabled
|
||||||
|
end
|
||||||
|
|
||||||
|
def captcha_recently_passed?
|
||||||
|
session[:captcha_passed_at].present? && session[:captcha_passed_at] >= CAPTCHA_TIMEOUT.ago
|
||||||
|
end
|
||||||
|
|
||||||
|
def captcha_required?
|
||||||
|
captcha_enabled? && !current_user && !(@invite.present? && @invite.valid_for_use? && !@invite.max_uses.nil?) && !captcha_recently_passed?
|
||||||
|
end
|
||||||
|
|
||||||
|
def clear_captcha!
|
||||||
|
session.delete(:captcha_passed_at)
|
||||||
|
end
|
||||||
|
|
||||||
|
def check_captcha!
|
||||||
|
return true unless captcha_required?
|
||||||
|
|
||||||
|
if verify_hcaptcha
|
||||||
|
session[:captcha_passed_at] = Time.now.utc
|
||||||
|
return true
|
||||||
|
else
|
||||||
|
if block_given?
|
||||||
|
message = flash[:hcaptcha_error]
|
||||||
|
flash.delete(:hcaptcha_error)
|
||||||
|
yield message
|
||||||
|
end
|
||||||
|
return false
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def extend_csp_for_captcha!
|
||||||
|
policy = request.content_security_policy
|
||||||
|
return unless captcha_required? && policy.present?
|
||||||
|
|
||||||
|
%w(script_src frame_src style_src connect_src).each do |directive|
|
||||||
|
values = policy.send(directive)
|
||||||
|
values << 'https://hcaptcha.com' unless values.include?('https://hcaptcha.com') || values.include?('https:')
|
||||||
|
values << 'https://*.hcaptcha.com' unless values.include?('https://*.hcaptcha.com') || values.include?('https:')
|
||||||
|
policy.send(directive, *values)
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def render_captcha_if_needed
|
||||||
|
return unless captcha_required?
|
||||||
|
|
||||||
|
hcaptcha_tags
|
||||||
|
end
|
||||||
|
end
|
@ -8,4 +8,8 @@ module Admin::SettingsHelper
|
|||||||
link = link_to t('admin.site_uploads.delete'), admin_site_upload_path(upload), data: { method: :delete }
|
link = link_to t('admin.site_uploads.delete'), admin_site_upload_path(upload), data: { method: :delete }
|
||||||
safe_join([hint, link], '<br/>'.html_safe)
|
safe_join([hint, link], '<br/>'.html_safe)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
def captcha_available?
|
||||||
|
ENV['HCAPTCHA_SECRET_KEY'].present? && ENV['HCAPTCHA_SITE_KEY'].present?
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
@ -1058,3 +1058,7 @@ code {
|
|||||||
display: none;
|
display: none;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
.simple_form .h-captcha {
|
||||||
|
text-align: center;
|
||||||
|
}
|
||||||
|
@ -40,6 +40,7 @@ class Form::AdminSettings
|
|||||||
noindex
|
noindex
|
||||||
outgoing_spoilers
|
outgoing_spoilers
|
||||||
require_invite_text
|
require_invite_text
|
||||||
|
captcha_enabled
|
||||||
).freeze
|
).freeze
|
||||||
|
|
||||||
BOOLEAN_KEYS = %i(
|
BOOLEAN_KEYS = %i(
|
||||||
@ -58,6 +59,7 @@ class Form::AdminSettings
|
|||||||
trendable_by_default
|
trendable_by_default
|
||||||
noindex
|
noindex
|
||||||
require_invite_text
|
require_invite_text
|
||||||
|
captcha_enabled
|
||||||
).freeze
|
).freeze
|
||||||
|
|
||||||
UPLOAD_KEYS = %i(
|
UPLOAD_KEYS = %i(
|
||||||
|
@ -21,6 +21,9 @@
|
|||||||
.fields-group
|
.fields-group
|
||||||
= f.input :agreement, as: :boolean, wrapper: :with_label, label: t('auth.checkbox_agreement_html', rules_path: about_more_path, terms_path: terms_path), required: true, disabled: closed_registrations?
|
= f.input :agreement, as: :boolean, wrapper: :with_label, label: t('auth.checkbox_agreement_html', rules_path: about_more_path, terms_path: terms_path), required: true, disabled: closed_registrations?
|
||||||
|
|
||||||
|
.fields-group
|
||||||
|
= render_captcha_if_needed
|
||||||
|
|
||||||
.actions
|
.actions
|
||||||
= f.button :button, sign_up_message, type: :submit, class: 'button button-primary', disabled: closed_registrations?
|
= f.button :button, sign_up_message, type: :submit, class: 'button button-primary', disabled: closed_registrations?
|
||||||
|
|
||||||
|
@ -42,7 +42,10 @@
|
|||||||
|
|
||||||
.fields-group
|
.fields-group
|
||||||
= f.input :require_invite_text, as: :boolean, wrapper: :with_label, label: t('admin.settings.registrations.require_invite_text.title'), hint: t('admin.settings.registrations.require_invite_text.desc_html'), disabled: !approved_registrations?
|
= f.input :require_invite_text, as: :boolean, wrapper: :with_label, label: t('admin.settings.registrations.require_invite_text.title'), hint: t('admin.settings.registrations.require_invite_text.desc_html'), disabled: !approved_registrations?
|
||||||
.fields-group
|
|
||||||
|
- if captcha_available?
|
||||||
|
.fields-group
|
||||||
|
= f.input :captcha_enabled, as: :boolean, wrapper: :with_label, label: t('admin.settings.captcha_enabled.title'), hint: t('admin.settings.captcha_enabled.desc_html')
|
||||||
|
|
||||||
%hr.spacer/
|
%hr.spacer/
|
||||||
|
|
||||||
|
@ -38,6 +38,9 @@
|
|||||||
.fields-group
|
.fields-group
|
||||||
= f.input :agreement, as: :boolean, wrapper: :with_label, label: whitelist_mode? ? t('auth.checkbox_agreement_without_rules_html', terms_path: terms_path) : t('auth.checkbox_agreement_html', rules_path: about_more_path, terms_path: terms_path), required: true
|
= f.input :agreement, as: :boolean, wrapper: :with_label, label: whitelist_mode? ? t('auth.checkbox_agreement_without_rules_html', terms_path: terms_path) : t('auth.checkbox_agreement_html', rules_path: about_more_path, terms_path: terms_path), required: true
|
||||||
|
|
||||||
|
.field-group
|
||||||
|
= render_captcha_if_needed
|
||||||
|
|
||||||
.actions
|
.actions
|
||||||
= f.button :button, @invite.present? ? t('auth.register') : sign_up_message, type: :submit
|
= f.button :button, @invite.present? ? t('auth.register') : sign_up_message, type: :submit
|
||||||
|
|
||||||
|
@ -2,6 +2,9 @@
|
|||||||
en:
|
en:
|
||||||
admin:
|
admin:
|
||||||
settings:
|
settings:
|
||||||
|
captcha_enabled:
|
||||||
|
desc_html: Enable hCaptcha integration, requiring new users to solve a challenge when signing up. Note that this disables app-based registration, and requires third-party scripts from hCaptcha to be embedded in the registration pages. This may have security and privacy concerns.
|
||||||
|
title: Require new users to go through a CAPTCHA to sign up
|
||||||
enable_keybase:
|
enable_keybase:
|
||||||
desc_html: Allow your users to prove their identity via keybase
|
desc_html: Allow your users to prove their identity via keybase
|
||||||
title: Enable keybase integration
|
title: Enable keybase integration
|
||||||
|
@ -77,6 +77,7 @@ defaults: &defaults
|
|||||||
show_domain_blocks_rationale: 'disabled'
|
show_domain_blocks_rationale: 'disabled'
|
||||||
outgoing_spoilers: ''
|
outgoing_spoilers: ''
|
||||||
require_invite_text: false
|
require_invite_text: false
|
||||||
|
captcha_enabled: false
|
||||||
|
|
||||||
development:
|
development:
|
||||||
<<: *defaults
|
<<: *defaults
|
||||||
|
Loading…
Reference in New Issue
Block a user