evoWeb / recaptcha

TYPO3 Extension to make use of googles nocaptcha
GNU General Public License v2.0
6 stars 18 forks source link

Development mode captcha validation #78

Closed npostnik closed 9 months ago

npostnik commented 1 year ago

I have recaptcha 12.0.1 installed in TYPO3 12.4. I did not provide a key, therefore the captcha is not rendered in the frontend. But the validation failes with the following message: Evoweb\Recaptcha\Services\CaptchaService::validateReCaptcha(): Argument #1 ($value) must be of type string, null given, called in /var/www/html/vendor/evoweb/recaptcha/Classes/Validation/RecaptchaValidator.php on line 35

I think this could help:

`class RecaptchaValidator extends AbstractValidator

public function isValid(mixed $value): void { if(!$this->captchaService->getShowCaptcha()) { return; }`

garbast commented 10 months ago

Wouldnt it be better to use a defined value in https://github.com/evoWeb/recaptcha/blob/30c2e76267ee473d8ed390403409c29e9617745e/Classes/Validation/RecaptchaValidator.php#L34

by changing it to

$status = $this->captchaService->validateReCaptcha((string)$value);

moritzkiehl commented 9 months ago

This change breaks the validation in case an empty string is passed to the validateRecaptcha() method. In PHP 8.2. an empty string will break this line https://github.com/evoWeb/recaptcha/blob/develop/Classes/Services/CaptchaService.php#L161 since it will never go into the fallbacks.

I patched this locally by using empty checks. But there is most likely a more elegant solution

$recaptchaResponse = $this->getRequest()->getParsedBody()['g-recaptcha-response'];
if (empty($value)) {
    if (!empty($recaptchaResponse)) {
        $value = $recaptchaResponse;
    }
}
$request = [
    'secret' => $this->configuration['private_key'] ?? '',
    'response' => trim($value),
    'remoteip' => GeneralUtility::getIndpEnv('REMOTE_ADDR'),
];

Edit: Now in the Morning. This could at least be optimized by combining the two if-Statements into one.