Add Recaptcha functionality to Gitea #4044

ghost · 2018-05-25T01:44:15Z

This PR adds recaptcha functionality to Gitea.

Old captcha functionality remains the same, this just gives options to the user

codecov-io · 2018-05-25T02:32:27Z

Codecov Report

Merging #4044 into master will decrease coverage by 0.02%.
The diff coverage is 0%.

@@            Coverage Diff             @@
##           master    #4044      +/-   ##
==========================================
- Coverage   20.09%   20.06%   -0.03%     
==========================================
  Files         153      153              
  Lines       30728    30766      +38     
==========================================
  Hits         6174     6174              
- Misses      23611    23649      +38     
  Partials      943      943

Impacted Files	Coverage Δ
routers/user/auth.go	`0% <0%> (ø)`	⬆️
routers/user/auth_openid.go	`0% <0%> (ø)`	⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 54fedd4...1812cd0. Read the comment docs.

lafriks · 2018-05-25T03:41:35Z

custom/conf/app.ini.sample

@@ -299,7 +299,12 @@ ENABLE_NOTIFY_MAIL = false
 ENABLE_REVERSE_PROXY_AUTHENTICATION = false
 ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = false
 ; Enable captcha validation for registration
-ENABLE_CAPTCHA = true
+ENABLE_CAPTCHA = false


Do not change default as this way it will be breaking change

The default value is actually false but the documentation is wrong

Hi. Yes false is the default, and I changed it to be correct like @JonasFranzDEV said.

I would like you use a captcha type and currently you have three options: disabled, image and recaptcha and default is disabled.

jonasfranz · 2018-05-25T09:36:37Z

modules/templates/helper.go

@@ -186,6 +186,12 @@ func NewFuncMap() []template.FuncMap {
 		"ParseDeadline": func(deadline string) []string {
 			return strings.Split(deadline, "|")
 		},
+		"EnableRecaptcha": func() bool {


Why do you need a helper function for that? Please use ctx.Data.

jonasfranz · 2018-05-25T09:37:41Z

routers/user/auth.go

@@ -760,6 +767,16 @@ func LinkAccountPostRegister(ctx *context.Context, cpt *captcha.Captcha, form au
 		return
 	}

+	if setting.Service.EnableRecaptcha {
+		ctx.Req.ParseForm()
+		valid, _ := recaptcha.Verify(ctx.Req.Form.Get("g-recaptcha-response"))


Add g-recaptcha-response as form field to form.

jonasfranz · 2018-05-25T09:38:23Z

routers/user/auth.go

@@ -887,6 +910,16 @@ func SignUpPost(ctx *context.Context, cpt *captcha.Captcha, form auth.RegisterFo
 		return
 	}

+	if setting.Service.EnableRecaptcha {
+		ctx.Req.ParseForm()
+		valid, _ := recaptcha.Verify(ctx.Req.Form.Get("g-recaptcha-response"))


Add g-recaptcha-response as form field to auth.RegisterForm.

jonasfranz · 2018-05-25T09:38:45Z

routers/user/auth_openid.go

@@ -341,6 +346,16 @@ func RegisterOpenIDPost(ctx *context.Context, cpt *captcha.Captcha, form auth.Si
 		return
 	}

+	if setting.Service.EnableRecaptcha {
+		ctx.Req.ParseForm()
+		valid, _ := recaptcha.Verify(ctx.Req.Form.Get("g-recaptcha-response"))


Same as above.

jonasfranz · 2018-05-25T09:39:20Z

templates/user/auth/signup_inner.tmpl

@@ -40,6 +40,13 @@
 							</div>
 						{{end}}

+						{{if .EnableRecaptcha}}
+							<div class="inline field required">
+								<div class="g-recaptcha" data-sitekey="{{ .RecaptchaSitekey }}" style="margin: 0 auto; width: 304px; padding-left: 30px"></div>


Do not use inline css. Please add the style to the .less files.

jonasfranz · 2018-05-25T09:39:43Z

templates/user/auth/signup_inner.tmpl

+						{{if .EnableRecaptcha}}
+							<div class="inline field required">
+								<div class="g-recaptcha" data-sitekey="{{ .RecaptchaSitekey }}" style="margin: 0 auto; width: 304px; padding-left: 30px"></div>
+								<script src="https://www.google.com/recaptcha/api.js" async></script>


Scripts should be placed in footer.

jonasfranz · 2018-05-25T09:39:57Z

templates/user/auth/signup_openid_register.tmpl

+					{{if .EnableRecaptcha}}
+						<div class="inline field required">
+							<div class="g-recaptcha" data-sitekey="{{ .RecaptchaSitekey }}" style="margin: 0 auto; width: 304px; padding-left: 30px"></div>
+							<script src="https://www.google.com/recaptcha/api.js" async></script>


Same as above.

jonasfranz · 2018-05-25T09:40:32Z

modules/recaptcha/recaptcha.go

+	}
+
+	return jsonResponse.Success, nil
+


Remove empty line

jonasfranz · 2018-05-25T09:41:12Z

modules/recaptcha/recaptcha.go

+	if err != nil {
+		return false, fmt.Errorf("Failed to read CAPTCHA response: %s", err)
+	}
+	jsonResponse := Response{Success: false} // set a default of fail for CAPTCHA


The default value of Success is false => No need for initializing it.

ghost · 2018-05-25T14:34:12Z

Hi @lafriks and @JonasFranzDEV I made changes as requested. When you have chance please review. Thank you.

jonasfranz · 2018-05-25T19:28:27Z

Please run make generate-stylesheets and commit the result.
The position of the reCAPTCHA is not inline with the other fields. And on mobile devices it overlaps.

ghost · 2018-05-25T19:58:00Z

Thank you @JonasFranzDEV I've updated the CSS ta make it responsive for recaptcha. Please see the following screenshots:

ghost · 2018-05-26T01:18:28Z

Thank you for feedback @cezar97. This only shows on sign up page, not on login.

jonasfranz

LGTM, but this PR could just be merged after the 1.5.0 release because we're in feature freeze currently. It also requires the approval of @lafriks .

axifive · 2018-05-26T21:30:24Z

Maybe need to use compact size option for mobile view?

techknowlogick · 2018-07-03T22:11:30Z

@flufmonster please resolve conflict.

lunny · 2018-07-04T11:50:52Z

custom/conf/app.ini.sample

@@ -299,7 +299,12 @@ ENABLE_NOTIFY_MAIL = false
 ENABLE_REVERSE_PROXY_AUTHENTICATION = false
 ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = false
 ; Enable captcha validation for registration
-ENABLE_CAPTCHA = true
+ENABLE_CAPTCHA = false


I would like you use a captcha type and currently you have three options: disabled, image and recaptcha and default is disabled.

ghost · 2018-07-04T20:37:52Z

@lunny to keep backwards compatibility for people who have ENABLE_CAPTCHA=true I add another option to change type of recaptcha instead of being able to have both at same time.

lunny · 2018-07-05T02:31:20Z

routers/user/auth.go

@@ -755,12 +762,21 @@ func LinkAccountPostRegister(ctx *context.Context, cpt *captcha.Captcha, form au
 		return
 	}

-	if setting.Service.EnableCaptcha && !cpt.VerifyReq(ctx.Req) {
+	if setting.Service.EnableCaptcha && setting.Service.CaptchaType == "image" && !cpt.VerifyReq(ctx.Req) {


Could you save "image" and "recaptcha" as a const strings and only reference the const variables?

ok. I changed this.

Prepare for wild/v1.6 branch * BREAKING * Respect email privacy option in user search via API (go-gitea#4512) * Simply remove tidb and deps (go-gitea#3993) * Swagger.v1.json template (go-gitea#3572) * FEATURE * Pull request review/approval and comment on code (go-gitea#3748) * Added dependencies for issues (go-gitea#2196) (go-gitea#2531) * Add the ability to have built in themes in Gitea and provide dark theme arc-green (go-gitea#4198) * Add sudo functionality to the API (go-gitea#4809) * Add oauth providers via cli (go-gitea#4591) * Disable merging a WIP Pull request (go-gitea#4529) * Force user to change password (go-gitea#4489) * Add letsencrypt to Gitea (go-gitea#4189) * Add push webhook support for mirrored repositories (go-gitea#4127) * Add csv file render support defaultly (go-gitea#4105) * Add Recaptcha functionality to Gitea (go-gitea#4044) * BUGFIXES * Fix release creation via API (go-gitea#5076) * Remove links from topics in edit mode (go-gitea#5026) * Fix missing AppSubUrl in few more templates (fixup) (go-gitea#5021) * Fix missing AppSubUrl in some templates (go-gitea#5020) * Hide outdated comments in file view (go-gitea#5017) * Upgrade gopkg.in/testfixtures.v2 (go-gitea#4999) * Disable debug routes unless PPROF is enabled in configuration (go-gitea#4995) * Fix user menu item styling (go-gitea#4985) * Fix layout of the topics editing form (go-gitea#4971) * Fix null pointer dereference in ParseCommitWithSignature (go-gitea#4962) * Fix url in discord webhook (go-gitea#4953) * Detect charset and convert non UTF-8 files for display (go-gitea#4950) * Make sure to catch the right error so it is displayed on the UI (go-gitea#4945) * Fix(topics): don't redirect to explore page. (go-gitea#4938) * Fix bug forget to remove Stopwatch when remove repository (go-gitea#4928) * Fix bug when repo remained bare if multiple branches pushed in single push (go-gitea#4923) * Fix: Let's Encrypt configuration settings (go-gitea#4911) * Fix: Crippled diff (go-gitea#4726) (go-gitea#4900) * Fix trimming of markup section names (go-gitea#4863) * Issues api allow pulls and fix go-gitea#4832 (go-gitea#4852) * Do not autocreate directory for new users/orgs (go-gitea#4828) (go-gitea#4849) * Fix redirect with non-ascii branch names (go-gitea#4764) (go-gitea#4810) * Fix missing release title in webhook (go-gitea#4783) (go-gitea#4796) * User shouldn't be able to approve or reject his/her own PR (go-gitea#4729) * Make sure to reset commit count in the cache on mirror syncing (go-gitea#4720) * Fixed bug where team with admin privelege type doesn't get any unit (go-gitea#4719) * Fix incorrect caption of webhook setting (go-gitea#4701) (go-gitea#4717) * Allow WIP marker to contains < or > (go-gitea#4709) * Hide org/create menu item in Dashboard if user has no rights (go-gitea#4678) (go-gitea#4680) * Site admin could create repos even MAX_CREATION_LIMIT=0 (go-gitea#4645) * Fix custom templates being ignored (go-gitea#4638) * Fix starring icon after semantic ui update (go-gitea#4628) * Fix Split-View line adjustment (go-gitea#4622) * Fix integer constant overflows in tests (go-gitea#4616) * Push whitelist now doesn't apply to branch deletion (go-gitea#4601) (go-gitea#4607) * Fix bugs when too many IN variables (go-gitea#4594) * Fix failure on creating pull request with assignees (go-gitea#4419) (go-gitea#4583) * Fix panic issue on update avatar email (go-gitea#4580) (go-gitea#4581) * Fix status code label for a successful webhook (go-gitea#4540) * An inactive user shouldn't be able to be added as a collaborator (go-gitea#4535) * Don't fail silently if trying to add a collaborator twice (go-gitea#4533) * Fix incorrect MergeWhitelistTeamIDs check in CanUserMerge function (go-gitea#4519) (go-gitea#4525) * Fix out-of-transaction query in removeOrgUser (go-gitea#4521) (go-gitea#4522) * Fix migration from older releases (go-gitea#4495) * Accept 'Data:' in commit graph (go-gitea#4487) * Update xorm to latest version and fix correct `user` table referencing in sql (go-gitea#4473) * Relative URLs for LibreJS page (go-gitea#4460) * Redirect to correct page after using scratch token (go-gitea#4458) * Fix column droping for MSSQL that need new transaction for that (go-gitea#4440) * Replace src with raw to fix image paths (go-gitea#4377) * Add default merge options when creating new repository (go-gitea#4369) * Fix docker build (go-gitea#4358) * Fixes repo membership check in API (go-gitea#4341) * Dep upgrade mysql lib (go-gitea#4161) * Fix some issues with special chars in branch names (go-gitea#3767) * Responsive design fixes (go-gitea#4508) * ENHANCEMENT * Fix milestones sorted wrongly (go-gitea#4987) * Allow api to create tags for releases if they don't exist (go-gitea#4890) * Fix go-gitea#4877 to follow the OpenID Connect Audiences spec (go-gitea#4878) * Enforce token on api routes [fixed critical security issue go-gitea#4357] (go-gitea#4840) * Update legacy branch and tag URLs in dashboard to new format (go-gitea#4812) * Slack webhook channel name cannot be empty or just contain an hashtag (go-gitea#4786) * Add whitespace handling to PR-comparsion (go-gitea#4683) * Make reverse proxy auth optional (go-gitea#4643) * MySQL TLS (go-gitea#4642) * Make sure to set PR split view when creating/previewing a pull request (go-gitea#4617) * Log user in after a successful sign up (go-gitea#4615) * Fix typo IsPullReuqestBroken -> IsPullRequestBroken (go-gitea#4578) * Allow admin toggle forcing a password change for newly created users (go-gitea#4563) * Update jQuery to v1.12.4 (go-gitea#4551) * Env var GITEA_PUSHER_EMAIL (go-gitea#4516) * Feat(repo): support search repository by topic name (go-gitea#4505) * Small improvements to dependency UI (go-gitea#4503) * Make max commits in graph configurable (go-gitea#4498) * Add valid for lfs oid (go-gitea#4461) * Add shortcut to save wiki page (go-gitea#4452) * Allow administrator to create repository for any organization (go-gitea#4368) * Fix repository last updated time update when delete a user who watched the repo (go-gitea#4363) * Switch plaintext scratch tokens to use hash instead (go-gitea#4331) * Increase default TOTP secret size to 320 bits (go-gitea#4287) * Keep preseeded database password (go-gitea#4284) * Implemented hover text showing user FullName (go-gitea#4261) * Add ability to delete a token (go-gitea#4235) * Fix typos in i18n variable names. (go-gitea#4080) * Api: repos/search: add parameters to control the sort order (go-gitea#3964) * Add missing path in the Docker app.ini template (go-gitea#2181) * Add file name and branch to page title (go-gitea#4902) * Offline use of google fonts (go-gitea#4872) * Add missing History link to directory listings v2 (go-gitea#4829) * Locale for Edit and Remove due date issue (go-gitea#4802) * Disable 'May Import Local Repository' when is disabled by setting (Is… (go-gitea#4780) * API /admin/users/{username} missing parameter (go-gitea#4775) * Display error when adding a user to a team twice (go-gitea#4746) * Remove UsePrivilegeSeparation from the Docker sshd_config, see go-gitea#2876 (go-gitea#4722) * Focus title input when clicking helper link (go-gitea#4696) * Add vendor to user reserved words and format words list according alphabet (go-gitea#4685) * Add gitea/issues link to 500 page (go-gitea#4654) * Hide home button when landing page is not set to home (go-gitea#4651) * Remove link to GitHub issues in 404 template (go-gitea#4639) * Cmd/serve: pprof cpu and memory profile dumps to disk (go-gitea#4560) * Add flash message after an account has been successfully activated (go-gitea#4510) * Prevent html entity escaping on delete branch (go-gitea#4471) * Locale for button Edit on protected branch (go-gitea#4442) * Update notification icon (go-gitea#4343) * Added front-end topics validation (go-gitea#4316) * Don't display buttons if there are no system notifications (go-gitea#4280) * Issue due date api (go-gitea#3890) * SECURITY * Improve URL validation for external wiki and external issues (go-gitea#4710) * Make cookies HttpOnly and obey COOKIE_SECURE flag (go-gitea#4706) * Don't disclose emails of all users when sending out emails (go-gitea#4664) * Check that repositories can only be migrated to own user or organizations (go-gitea#4366) * TRANSLATION * Fix punctuation in English translation (go-gitea#4958) * Fix translation (go-gitea#4355)

flynnnnnnnnnn and others added 4 commits May 25, 2018 01:48

Add Recaptcha functionality to Gitea

a467186

Add comment to struct

55bbfac

Add comment to function

76b57f1

Fix import order

0b12d2a

appleboy approved these changes May 25, 2018

View reviewed changes

bkcsoft added the lgtm/need 1 This PR needs approval from one additional maintainer to be merged. label May 25, 2018

techknowlogick added the type/feature Completely new functionality. Can only be merged if feature freeze is not active. label May 25, 2018

techknowlogick added this to the 1.5.0 milestone May 25, 2018

lafriks requested changes May 25, 2018

View reviewed changes

jonasfranz suggested changes May 25, 2018

View reviewed changes

Fluf and others added 12 commits May 25, 2018 08:57

Remove helper functions

f6d9d2b

Remove empty line and initialize Response differently

a39289d

Move script to footer

22d6265

Remove script from body

02ac7e3

Remove script from body

f203c2f

Add styles to Less

7e6a60a

Remove inline styles

e787c7f

Remove inline styles

1effea1

add field to form

b49c864

Switch to form field

313e7dd

Switch to form field

d9e4392

add built stylesheet

5039fe1

lunny modified the milestones: 1.5.0, 1.x.x May 25, 2018

techknowlogick modified the milestones: 1.x.x, 1.6.0 May 25, 2018

Update built stylesheet

f4ddfa1

Responsive recaptcha styles

f2199d1

jonasfranz approved these changes May 26, 2018

View reviewed changes

bkcsoft added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels May 26, 2018

lafriks approved these changes May 26, 2018

View reviewed changes

Merge branch 'master' into recaptcha

59cba2c

lunny requested changes Jul 4, 2018

View reviewed changes

Fluf and others added 6 commits July 4, 2018 15:58

Merge branch 'master' into recaptcha

5aa9afb

change to captcha type to change between captchas

628ca1b

Delete signup_inner.tmpl.save

8357eb5

Delete signup_openid_register.tmpl.save

7ff8e14

update changes to css

3239fad

Merge branch 'master' into recaptcha

795019c

Fluf added 2 commits July 4, 2018 16:43

type issues

6786290

conflicting types

d32a204

lafriks added the type/changelog Adds the changelog for a new Gitea version label Jul 4, 2018

lunny requested changes Jul 5, 2018

View reviewed changes

flynnnnnnnnnn and others added 2 commits July 5, 2018 02:45

use const

93b4909

Merge branch 'master' into recaptcha

a2b9ba2

lunny approved these changes Jul 5, 2018

View reviewed changes

Merge branch 'master' into recaptcha

1812cd0

techknowlogick merged commit f035dcd into go-gitea:master Jul 5, 2018

go-gitea locked and limited conversation to collaborators Nov 24, 2020

delvh removed the type/changelog Adds the changelog for a new Gitea version label Oct 7, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Recaptcha functionality to Gitea #4044

Add Recaptcha functionality to Gitea #4044

ghost commented May 25, 2018

codecov-io commented May 25, 2018 •

edited

Loading

lafriks May 25, 2018

jonasfranz May 25, 2018

ghost May 25, 2018

lunny Jul 4, 2018

jonasfranz May 25, 2018

jonasfranz May 25, 2018

jonasfranz May 25, 2018

jonasfranz May 25, 2018

jonasfranz May 25, 2018

jonasfranz May 25, 2018

jonasfranz May 25, 2018

jonasfranz May 25, 2018

jonasfranz May 25, 2018

ghost commented May 25, 2018

jonasfranz commented May 25, 2018

ghost commented May 25, 2018

ghost commented May 26, 2018

jonasfranz left a comment

axifive commented May 26, 2018

techknowlogick commented Jul 3, 2018

lunny Jul 4, 2018

ghost commented Jul 4, 2018

lunny Jul 5, 2018

ghost Jul 5, 2018

Add Recaptcha functionality to Gitea #4044

Add Recaptcha functionality to Gitea #4044

Conversation

ghost commented May 25, 2018

codecov-io commented May 25, 2018 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ghost commented May 25, 2018

jonasfranz commented May 25, 2018

ghost commented May 25, 2018

ghost commented May 26, 2018

jonasfranz left a comment

Choose a reason for hiding this comment

axifive commented May 26, 2018

techknowlogick commented Jul 3, 2018

Choose a reason for hiding this comment

ghost commented Jul 4, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov-io commented May 25, 2018 •

edited

Loading