From 7cc7a7162d89437526bb2e0b6e86c1325c5d0104 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Tim=20D=C3=BCsterhus?= <duesterhus@woltlab.com>
Date: Tue, 22 Aug 2017 15:45:22 +0200
Subject: [PATCH] Add form field specifying whether v2 or invisible reCAPTCHA
 was used

see #2242
---
 com.woltlab.wcf/templates/recaptcha.tpl            |  8 ++++++--
 wcfsetup/install/files/acp/templates/recaptcha.tpl |  8 ++++++--
 .../lib/system/captcha/RecaptchaHandler.class.php  |  3 ++-
 .../system/recaptcha/RecaptchaHandlerV2.class.php  | 14 ++++++++++++--
 4 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/com.woltlab.wcf/templates/recaptcha.tpl b/com.woltlab.wcf/templates/recaptcha.tpl
index a961aff429..1b5e9e8e46 100644
--- a/com.woltlab.wcf/templates/recaptcha.tpl
+++ b/com.woltlab.wcf/templates/recaptcha.tpl
@@ -102,6 +102,7 @@
 			<dl class="{if $errorField|isset && $errorField == 'recaptchaString'}formError{/if}">
 				<dt></dt>
 				<dd>
+					<input type="hidden" name="recaptcha-type" value="invisible">
 					<div id="recaptchaBucket{$recaptchaBucketID}"></div>
 					<noscript>
 						<div style="width: 302px; height: 473px;">
@@ -166,7 +167,8 @@
 										grecaptcha.execute(WCF.recaptcha.mapping['recaptchaBucket{$recaptchaBucketID}']);
 										return promise.then(function (token) {
 											return {
-												'g-recaptcha-response': token
+												'g-recaptcha-response': token,
+												'recaptcha-type': 'invisible'
 											};
 										});
 									});
@@ -221,6 +223,7 @@
 			<dl class="{if $errorField|isset && $errorField == 'recaptchaString'}formError{/if}">
 				<dt></dt>
 				<dd>
+				<input type="hidden" name="recaptcha-type" value="v2">
 					<div id="recaptchaBucket{$recaptchaBucketID}"></div>
 					<noscript>
 						<div style="width: 302px; height: 473px;">
@@ -281,7 +284,8 @@
 			{if $ajaxCaptcha|isset && $ajaxCaptcha}
 			WCF.System.Captcha.addCallback('{$captchaID}', function() {
 				return {
-					'g-recaptcha-response': grecaptcha.getResponse(WCF.recaptcha.mapping['recaptchaBucket{$recaptchaBucketID}'])
+					'g-recaptcha-response': grecaptcha.getResponse(WCF.recaptcha.mapping['recaptchaBucket{$recaptchaBucketID}']),
+					'type': 'v2'
 				};
 			});
 			{/if}
diff --git a/wcfsetup/install/files/acp/templates/recaptcha.tpl b/wcfsetup/install/files/acp/templates/recaptcha.tpl
index a961aff429..1b5e9e8e46 100644
--- a/wcfsetup/install/files/acp/templates/recaptcha.tpl
+++ b/wcfsetup/install/files/acp/templates/recaptcha.tpl
@@ -102,6 +102,7 @@
 			<dl class="{if $errorField|isset && $errorField == 'recaptchaString'}formError{/if}">
 				<dt></dt>
 				<dd>
+					<input type="hidden" name="recaptcha-type" value="invisible">
 					<div id="recaptchaBucket{$recaptchaBucketID}"></div>
 					<noscript>
 						<div style="width: 302px; height: 473px;">
@@ -166,7 +167,8 @@
 										grecaptcha.execute(WCF.recaptcha.mapping['recaptchaBucket{$recaptchaBucketID}']);
 										return promise.then(function (token) {
 											return {
-												'g-recaptcha-response': token
+												'g-recaptcha-response': token,
+												'recaptcha-type': 'invisible'
 											};
 										});
 									});
@@ -221,6 +223,7 @@
 			<dl class="{if $errorField|isset && $errorField == 'recaptchaString'}formError{/if}">
 				<dt></dt>
 				<dd>
+				<input type="hidden" name="recaptcha-type" value="v2">
 					<div id="recaptchaBucket{$recaptchaBucketID}"></div>
 					<noscript>
 						<div style="width: 302px; height: 473px;">
@@ -281,7 +284,8 @@
 			{if $ajaxCaptcha|isset && $ajaxCaptcha}
 			WCF.System.Captcha.addCallback('{$captchaID}', function() {
 				return {
-					'g-recaptcha-response': grecaptcha.getResponse(WCF.recaptcha.mapping['recaptchaBucket{$recaptchaBucketID}'])
+					'g-recaptcha-response': grecaptcha.getResponse(WCF.recaptcha.mapping['recaptchaBucket{$recaptchaBucketID}']),
+					'type': 'v2'
 				};
 			});
 			{/if}
diff --git a/wcfsetup/install/files/lib/system/captcha/RecaptchaHandler.class.php b/wcfsetup/install/files/lib/system/captcha/RecaptchaHandler.class.php
index 6d20889831..6028faa39f 100644
--- a/wcfsetup/install/files/lib/system/captcha/RecaptchaHandler.class.php
+++ b/wcfsetup/install/files/lib/system/captcha/RecaptchaHandler.class.php
@@ -63,6 +63,7 @@ class RecaptchaHandler implements ICaptchaHandler {
 		}
 		else {
 			// V2
+			if (isset($_POST['recaptcha-type'])) $this->challenge = $_POST['recaptcha-type'];
 			if (isset($_POST['g-recaptcha-response'])) $this->response = $_POST['g-recaptcha-response'];
 		}
 	}
@@ -86,7 +87,7 @@ class RecaptchaHandler implements ICaptchaHandler {
 		}
 		else {
 			// V2
-			RecaptchaHandlerV2::getInstance()->validate($this->response);
+			RecaptchaHandlerV2::getInstance()->validate($this->response, $this->challenge ?: 'v2');
 		}
 	}
 }
diff --git a/wcfsetup/install/files/lib/system/recaptcha/RecaptchaHandlerV2.class.php b/wcfsetup/install/files/lib/system/recaptcha/RecaptchaHandlerV2.class.php
index 4fef91ad58..642ec5740b 100644
--- a/wcfsetup/install/files/lib/system/recaptcha/RecaptchaHandlerV2.class.php
+++ b/wcfsetup/install/files/lib/system/recaptcha/RecaptchaHandlerV2.class.php
@@ -22,13 +22,23 @@ class RecaptchaHandlerV2 extends SingletonFactory {
 	 * @param	string		$response
 	 * @throws	UserInputException
 	 */
-	public function validate($response) {
+	public function validate($response, $type = 'v2') {
 		// fail if response is empty to avoid sending api requests
 		if (empty($response)) {
 			throw new UserInputException('recaptchaString', 'false');
 		}
 		
-		$request = new HTTPRequest('https://www.google.com/recaptcha/api/siteverify?secret='.rawurlencode(RECAPTCHA_PRIVATEKEY).'&response='.rawurlencode($response).'&remoteip='.rawurlencode(UserUtil::getIpAddress()), ['timeout' => 10]);
+		if ($type === 'v2') {
+			$key = RECAPTCHA_PRIVATEKEY;
+		}
+		else if ($type === 'invisible') {
+			$key = RECAPTCHA_PRIVATEKEY;
+		}
+		else {
+			throw new \InvalidArgumentException('$type must be either v2 or invisible.');
+		}
+		
+		$request = new HTTPRequest('https://www.google.com/recaptcha/api/siteverify?secret='.rawurlencode($key).'&response='.rawurlencode($response).'&remoteip='.rawurlencode(UserUtil::getIpAddress()), ['timeout' => 10]);
 		
 		try {
 			$request->execute();
-- 
2.20.1