DarkGhostHunter/Captchavel

Recapcha appears everywhere

Closed this issue · 9 comments

Dimonka2 commented

Finally I managed to make it working (I hope so) on Auth.
But now the recaptcha's block appears everywhere even on a routes where it is not registered. Is it because of the auto-mode?

My routes look like:

Route::group(['middleware' => 'recaptcha'], function() {
    Auth::routes();
 });

Route::get('setlocale/{locale}', 'LangController@setLang');


Route::group(['middleware' => 'auth'], function() {
    // account
    Route::resource('accounts', 'AccountController');
....
}

Why does it appear on every route?

On a separate note. I put the following in the login form as it is suggested in documentation:
<input id="is_robot" type="checkbox" name="is_robot" checked>
and it does not influence anything..

DarkGhostHunter commented

Captchavel works with two middlewares: one to inject a convenience script on responses, and other to catch the challenge and validate it when it receives a POST Request. The latter must be added manually to the route or group.

Do you mean that the script appears everywhere? If you see the script from google loaded, but not the challenge, it's okay, it's designed to be that way so it can gather much more data (as google says).

If I remember correctly, the auto mode will put a script that will detect a form in each view and inject the challenge to it (via javascript). Manual will disable this, so you will have to manually put the convenience script yourself.

About the is_robot thing, It checks it on the query string. I don't know why I did that. I will change it to check if it exists on the query or as part of the input.

cjonstrup commented

maby check for data-recaptcha before injecting the script?

    /**
     * Injects the front-end Scripts
     *
     * @param \Illuminate\Http\Response $response
     * @return \Illuminate\Http\Response
     */
    protected function injectScript(Response $response)
    {
        // check for data-recaptcha 
        if (! $endHeadPosition = stripos($content = $response->content(), 'data-recaptcha')) {
            return $response;
        };

        // To inject the script automatically, we will do it before the ending
        // head tag. If it's not found, the response may not be valid HTML,
        // so we will bail out returning the original untouched content.
        if (! $endHeadPosition = stripos($content = $response->content(), '</head>')) {
            return $response;
        };

        $script = $this->view->make('captchavel::script', ['key' => $this->key])->render();

        return $response->setContent(
            substr_replace($content, $script, $endHeadPosition, 0)
        );
    }
DarkGhostHunter commented

maby check for data-recaptcha before injecting the script?

    /**
     * Injects the front-end Scripts
     *
     * @param \Illuminate\Http\Response $response
     * @return \Illuminate\Http\Response
     */
    protected function injectScript(Response $response)
    {
        // check for data-recaptcha 
        if (! $endHeadPosition = stripos($content = $response->content(), 'data-recaptcha')) {
            return $response;
        };

        // To inject the script automatically, we will do it before the ending
        // head tag. If it's not found, the response may not be valid HTML,
        // so we will bail out returning the original untouched content.
        if (! $endHeadPosition = stripos($content = $response->content(), '</head>')) {
            return $response;
        };

        $script = $this->view->make('captchavel::script', ['key' => $this->key])->render();

        return $response->setContent(
            substr_replace($content, $script, $endHeadPosition, 0)
        );
    }

There is no need since the script itself checks if there are forms worth of adding the reCAPTCHA token. Otherwise, your solution means traversing the whole response two times.

DarkGhostHunter commented

Why did i close this? I'm fixing it right now.

  • 👍1
DarkGhostHunter commented

Fixed the robot thing in 2.1.1. The recaptcha script appearing everywhere it's intended.

cjonstrup commented

It uses a lot of space for small devices. Is it required to be on every pages other that where it is used?

DarkGhostHunter commented

It uses a lot of space for small devices.

Can you explain? I don't think is a performance hog in any case, unless an expert comes and says so.

In any case, if you consider this works worse for your application, you can go full manual and inject it manually.

steveallinson commented

I think what the OP is getting at is the fact that the recaptcha logo appears on all pages across the site once installed (certainly for me). I only need it on the contact from page yet it appears on all pages even those in the admin area (using Nova - see image).

image

I would have though that most users would only want the Captcha JS (and logo) loading on the intended page.

  • 👍1