Add optional hCaptcha support

Fixes #1649

This requires setting `HCAPTCHA_SECRET_KEY` and `HCAPTCHA_SITE_KEY`, then
enabling the admin setting at
`/admin/settings/edit#form_admin_settings_captcha_enabled`

Subsequently, a hCaptcha widget will be displayed on `/about` and
`/auth/sign_up` unless:
- the user is already signed-up already
- the user has used an invite link
- the user has already solved the captcha (and registration failed for another
  reason)

The Content-Security-Policy headers are altered automatically to allow the
third-party hCaptcha scripts on `/about` and `/auth/sign_up` following the same
rules as above.
signup-info-prompt
Claire 2022-01-24 19:06:19 +01:00
parent e58e0eb9aa
commit 1b493c9fee
15 changed files with 121 additions and 2 deletions

View File

@ -285,3 +285,7 @@ MAX_POLL_OPTION_CHARS=100
# Units are in bytes # Units are in bytes
MAX_EMOJI_SIZE=51200 MAX_EMOJI_SIZE=51200
MAX_REMOTE_EMOJI_SIZE=204800 MAX_REMOTE_EMOJI_SIZE=204800
# Optional hCaptcha support
# HCAPTCHA_SECRET_KEY=
# HCAPTCHA_SITE_KEY=

View File

@ -156,3 +156,5 @@ gem 'concurrent-ruby', require: false
gem 'connection_pool', require: false gem 'connection_pool', require: false
gem 'xorcist', '~> 1.1' gem 'xorcist', '~> 1.1'
gem "hcaptcha", "~> 7.1"

View File

@ -271,6 +271,8 @@ GEM
railties (>= 4.0.1) railties (>= 4.0.1)
hashdiff (1.0.1) hashdiff (1.0.1)
hashie (4.1.0) hashie (4.1.0)
hcaptcha (7.1.0)
json
highline (2.0.3) highline (2.0.3)
hiredis (0.6.3) hiredis (0.6.3)
hkdf (0.3.0) hkdf (0.3.0)
@ -719,6 +721,7 @@ DEPENDENCIES
fog-openstack (~> 0.3) fog-openstack (~> 0.3)
fuubar (~> 2.5) fuubar (~> 2.5)
hamlit-rails (~> 0.2) hamlit-rails (~> 0.2)
hcaptcha (~> 7.1)
hiredis (~> 0.6) hiredis (~> 0.6)
htmlentities (~> 4.3) htmlentities (~> 4.3)
http (~> 5.0) http (~> 5.0)

View File

@ -2,6 +2,7 @@
class AboutController < ApplicationController class AboutController < ApplicationController
include RegistrationSpamConcern include RegistrationSpamConcern
include CaptchaConcern
before_action :set_pack before_action :set_pack
@ -12,6 +13,7 @@ class AboutController < ApplicationController
before_action :set_instance_presenter before_action :set_instance_presenter
before_action :set_expires_in, only: [:more, :terms] before_action :set_expires_in, only: [:more, :terms]
before_action :set_registration_form_time, only: :show before_action :set_registration_form_time, only: :show
before_action :extend_csp_for_captcha!, only: :show
skip_before_action :require_functional!, only: [:more, :terms] skip_before_action :require_functional!, only: [:more, :terms]

View File

@ -1,6 +1,8 @@
# frozen_string_literal: true # frozen_string_literal: true
class Api::V1::AccountsController < Api::BaseController class Api::V1::AccountsController < Api::BaseController
include CaptchaConcern
before_action -> { authorize_if_got_token! :read, :'read:accounts' }, except: [:create, :follow, :unfollow, :remove_from_followers, :block, :unblock, :mute, :unmute] before_action -> { authorize_if_got_token! :read, :'read:accounts' }, except: [:create, :follow, :unfollow, :remove_from_followers, :block, :unblock, :mute, :unmute]
before_action -> { doorkeeper_authorize! :follow, :'write:follows' }, only: [:follow, :unfollow, :remove_from_followers] before_action -> { doorkeeper_authorize! :follow, :'write:follows' }, only: [:follow, :unfollow, :remove_from_followers]
before_action -> { doorkeeper_authorize! :follow, :'write:mutes' }, only: [:mute, :unmute] before_action -> { doorkeeper_authorize! :follow, :'write:mutes' }, only: [:mute, :unmute]
@ -83,7 +85,7 @@ class Api::V1::AccountsController < Api::BaseController
end end
def check_enabled_registrations def check_enabled_registrations
forbidden if single_user_mode? || omniauth_only? || !allowed_registrations? forbidden if single_user_mode? || omniauth_only? || !allowed_registrations? || captcha_enabled?
end end
def allowed_registrations? def allowed_registrations?

View File

@ -2,6 +2,7 @@
class Auth::RegistrationsController < Devise::RegistrationsController class Auth::RegistrationsController < Devise::RegistrationsController
include RegistrationSpamConcern include RegistrationSpamConcern
include CaptchaConcern
layout :determine_layout layout :determine_layout
@ -15,6 +16,8 @@ class Auth::RegistrationsController < Devise::RegistrationsController
before_action :require_not_suspended!, only: [:update] before_action :require_not_suspended!, only: [:update]
before_action :set_cache_headers, only: [:edit, :update] before_action :set_cache_headers, only: [:edit, :update]
before_action :set_registration_form_time, only: :new before_action :set_registration_form_time, only: :new
before_action :extend_csp_for_captcha!, only: [:new, :create]
before_action :check_captcha!, only: :create
skip_before_action :require_functional!, only: [:edit, :update] skip_before_action :require_functional!, only: [:edit, :update]
@ -135,4 +138,18 @@ class Auth::RegistrationsController < Devise::RegistrationsController
def set_cache_headers def set_cache_headers
response.headers['Cache-Control'] = 'no-cache, no-store, max-age=0, must-revalidate' response.headers['Cache-Control'] = 'no-cache, no-store, max-age=0, must-revalidate'
end end
def sign_up(resource_name, resource)
clear_captcha!
super
end
def check_captcha!
super do |error|
build_resource(sign_up_params)
resource.validate
resource.errors.add(:base, error)
respond_with resource
end
end
end end

View File

@ -0,0 +1,66 @@
# frozen_string_literal: true
module CaptchaConcern
extend ActiveSupport::Concern
include Hcaptcha::Adapters::ViewMethods
CAPTCHA_TIMEOUT = 2.hours.freeze
included do
helper_method :render_captcha_if_needed
end
def captcha_available?
ENV['HCAPTCHA_SECRET_KEY'].present? && ENV['HCAPTCHA_SITE_KEY'].present?
end
def captcha_enabled?
captcha_available? && Setting.captcha_enabled
end
def captcha_recently_passed?
session[:captcha_passed_at].present? && session[:captcha_passed_at] >= CAPTCHA_TIMEOUT.ago
end
def captcha_required?
captcha_enabled? && !current_user && !(@invite.present? && @invite.valid_for_use? && !@invite.max_uses.nil?) && !captcha_recently_passed?
end
def clear_captcha!
session.delete(:captcha_passed_at)
end
def check_captcha!
return true unless captcha_required?
if verify_hcaptcha
session[:captcha_passed_at] = Time.now.utc
return true
else
if block_given?
message = flash[:hcaptcha_error]
flash.delete(:hcaptcha_error)
yield message
end
return false
end
end
def extend_csp_for_captcha!
policy = request.content_security_policy
return unless captcha_required? && policy.present?
%w(script_src frame_src style_src connect_src).each do |directive|
values = policy.send(directive)
values << 'https://hcaptcha.com' unless values.include?('https://hcaptcha.com') || values.include?('https:')
values << 'https://*.hcaptcha.com' unless values.include?('https://*.hcaptcha.com') || values.include?('https:')
policy.send(directive, *values)
end
end
def render_captcha_if_needed
return unless captcha_required?
hcaptcha_tags
end
end

View File

@ -8,4 +8,8 @@ module Admin::SettingsHelper
link = link_to t('admin.site_uploads.delete'), admin_site_upload_path(upload), data: { method: :delete } link = link_to t('admin.site_uploads.delete'), admin_site_upload_path(upload), data: { method: :delete }
safe_join([hint, link], '<br/>'.html_safe) safe_join([hint, link], '<br/>'.html_safe)
end end
def captcha_available?
ENV['HCAPTCHA_SECRET_KEY'].present? && ENV['HCAPTCHA_SITE_KEY'].present?
end
end end

View File

@ -1058,3 +1058,7 @@ code {
display: none; display: none;
} }
} }
.simple_form .h-captcha {
text-align: center;
}

View File

@ -40,6 +40,7 @@ class Form::AdminSettings
noindex noindex
outgoing_spoilers outgoing_spoilers
require_invite_text require_invite_text
captcha_enabled
).freeze ).freeze
BOOLEAN_KEYS = %i( BOOLEAN_KEYS = %i(
@ -58,6 +59,7 @@ class Form::AdminSettings
trendable_by_default trendable_by_default
noindex noindex
require_invite_text require_invite_text
captcha_enabled
).freeze ).freeze
UPLOAD_KEYS = %i( UPLOAD_KEYS = %i(

View File

@ -21,6 +21,9 @@
.fields-group .fields-group
= f.input :agreement, as: :boolean, wrapper: :with_label, label: t('auth.checkbox_agreement_html', rules_path: about_more_path, terms_path: terms_path), required: true, disabled: closed_registrations? = f.input :agreement, as: :boolean, wrapper: :with_label, label: t('auth.checkbox_agreement_html', rules_path: about_more_path, terms_path: terms_path), required: true, disabled: closed_registrations?
.fields-group
= render_captcha_if_needed
.actions .actions
= f.button :button, sign_up_message, type: :submit, class: 'button button-primary', disabled: closed_registrations? = f.button :button, sign_up_message, type: :submit, class: 'button button-primary', disabled: closed_registrations?

View File

@ -42,7 +42,10 @@
.fields-group .fields-group
= f.input :require_invite_text, as: :boolean, wrapper: :with_label, label: t('admin.settings.registrations.require_invite_text.title'), hint: t('admin.settings.registrations.require_invite_text.desc_html'), disabled: !approved_registrations? = f.input :require_invite_text, as: :boolean, wrapper: :with_label, label: t('admin.settings.registrations.require_invite_text.title'), hint: t('admin.settings.registrations.require_invite_text.desc_html'), disabled: !approved_registrations?
- if captcha_available?
.fields-group .fields-group
= f.input :captcha_enabled, as: :boolean, wrapper: :with_label, label: t('admin.settings.captcha_enabled.title'), hint: t('admin.settings.captcha_enabled.desc_html')
%hr.spacer/ %hr.spacer/

View File

@ -38,6 +38,9 @@
.fields-group .fields-group
= f.input :agreement, as: :boolean, wrapper: :with_label, label: whitelist_mode? ? t('auth.checkbox_agreement_without_rules_html', terms_path: terms_path) : t('auth.checkbox_agreement_html', rules_path: about_more_path, terms_path: terms_path), required: true = f.input :agreement, as: :boolean, wrapper: :with_label, label: whitelist_mode? ? t('auth.checkbox_agreement_without_rules_html', terms_path: terms_path) : t('auth.checkbox_agreement_html', rules_path: about_more_path, terms_path: terms_path), required: true
.field-group
= render_captcha_if_needed
.actions .actions
= f.button :button, @invite.present? ? t('auth.register') : sign_up_message, type: :submit = f.button :button, @invite.present? ? t('auth.register') : sign_up_message, type: :submit

View File

@ -2,6 +2,9 @@
en: en:
admin: admin:
settings: settings:
captcha_enabled:
desc_html: Enable hCaptcha integration, requiring new users to solve a challenge when signing up. Note that this disables app-based registration, and requires third-party scripts from hCaptcha to be embedded in the registration pages. This may have security and privacy concerns.
title: Require new users to go through a CAPTCHA to sign up
enable_keybase: enable_keybase:
desc_html: Allow your users to prove their identity via keybase desc_html: Allow your users to prove their identity via keybase
title: Enable keybase integration title: Enable keybase integration

View File

@ -77,6 +77,7 @@ defaults: &defaults
show_domain_blocks_rationale: 'disabled' show_domain_blocks_rationale: 'disabled'
outgoing_spoilers: '' outgoing_spoilers: ''
require_invite_text: false require_invite_text: false
captcha_enabled: false
development: development:
<<: *defaults <<: *defaults