"Invisible" reCaptcha no longer works (prototype 1.7.0)

Question

"Invisible" reCaptcha no longer works (prototype 1.7.0)

durzel opened this issue 3 years ago · 62 comments

Hi,

I am running Magento CE 1.9.4.5 and as of about 17/06/2021 the "invisible" reCaptcha no longer works on my website. It does not appear in the bottom right (as configured), and attempting to log in to the backend with a known good username/password combination just results in an error, as if the reCaptcha part is missing.

When the reCaptcha is set to "Invisible", I get the following error in my browser web console:

Uncaught (in promise) TypeError: this.each is not a function
    findAll https://www.magento-website.com/js/prototype/prototype.js:883
    V https://www.gstatic.com/recaptcha/releases/FDTCuNjXhn1sV0lk31aK53uB/recaptcha__en_gb.js:175
    render https://www.gstatic.com/recaptcha/releases/FDTCuNjXhn1sV0lk31aK53uB/recaptcha__en_gb.js:683
    e https://www.gstatic.com/recaptcha/releases/FDTCuNjXhn1sV0lk31aK53uB/recaptcha__en_gb.js:195
    V https://www.gstatic.com/recaptcha/releases/FDTCuNjXhn1sV0lk31aK53uB/recaptcha__en_gb.js:152
    h https://www.gstatic.com/recaptcha/releases/FDTCuNjXhn1sV0lk31aK53uB/recaptcha__en_gb.js:62
    nM https://www.gstatic.com/recaptcha/releases/FDTCuNjXhn1sV0lk31aK53uB/recaptcha__en_gb.js:438
    h https://www.gstatic.com/recaptcha/releases/FDTCuNjXhn1sV0lk31aK53uB/recaptcha__en_gb.js:115
    bind https://www.magento-website.com/js/prototype/prototype.js:391
    reCaptchaCallback https://www.magento-website.com/index.php/admin/index/index/key/08be8904c12af90cc2b7cc0c4a7d8a09/:57
    each https://www.magento-website.com/js/prototype/prototype.js:825
    each https://www.magento-website.com/js/prototype/prototype.js:824
    reCaptchaCallback https://www.magento-website.com/index.php/admin/index/index/key/08be8904c12af90cc2b7cc0c4a7d8a09/:50
prototype.js:883:10

Changing the reCaptcha to "I am not a robot" eliminates the above error, and the user can log in - with the visual "I am not a robot" click required.

I have experienced the same behaviour on a development Magento website which has not been changed in over a year, so I'm convinced that something is no longer playing nicely together.

Anyone else experienced this?

Answer 1 · 2021-06-21T13:22:51.000Z

Yes, Iam getting very same error message. I can not figure out so far what is going on.

Answer 2 · 2021-06-21T13:35:39.000Z

Same thing:

==> recapctha.log <==
2021-06-21T13:13:12+00:00 DEBUG (7): Form ID: backend_login=>No 'g-recaptcha-response' in request! - building
2021-06-21T13:13:12+00:00 DEBUG (7): Form ID: backend_login=>sending to verify params of Array
(
    [privatekey] => 
    [challenge] =>
    [response] =>
)

2021-06-21T13:13:12+00:00 DEBUG (7): Form ID: backend_login=>Bad response from captcha gateway. we got 404
2021-06-21T13:13:12+00:00 DEBUG (7): Form ID: backend_login=>Exception fail : Bad response from captcha gateway. we got 404

Also it is impossible to login from admin backend:

Answer 3 · 2021-06-21T13:47:43.000Z

In the short term you can disable the module in etc/modules/ProxiBlue_Recaptcha.xml which will make Magento fall back to the built in CAPTCHA, log in, re-enable it, and then whilst logged in change it to “I’m not a robot”, or disable CAPTCHAs entirely.

Answer 4 · 2021-06-21T15:41:28.000Z

Hello, I will ave a look into this soon, thanks for reporting.

Answer 5 · 2021-06-21T15:43:34.000Z

Did any of you update the module recently? can you check versions installed please.

latest is 2.5.0

Answer 6 · 2021-06-21T15:59:47.000Z

FWIW, checked a few of the site I know uses this, and seems to be working there:

However, they are not running the latest

"proxiblue/recaptcha": "2.3.8",
"proxiblue/recaptcha": "2.3.10",
"proxiblue/recaptcha": "2.1.4",

So could be an issue on latest version.

Answer 7 · 2021-06-21T16:12:30.000Z

Is this all admin/backend related?

I am not seeing issue on frontend with latest

Updating proxiblue/recaptcha (2.3.8 => 2.5.0): Loading from cache

Answer 8 · 2021-06-21T16:13:58.000Z

I tested it on the following versions and unfortunately it doesn't work: 2.1.1, 2.5.0

Answer 9 · 2021-06-21T16:14:56.000Z

I am also fine on backend:

Answer 10 · 2021-06-21T16:15:19.000Z

@indrisepos

Magento version?

Answer 11 · 2021-06-21T16:16:15.000Z

I'm on the latest currently, per config.xml - 2.5.0

I'm seeing the same web console error on both backend and frontend, when trying to use "Invisible" CAPTCHA type.

Answer 12 · 2021-06-21T16:16:51.000Z

Magetno 1.9.4.2 2021. 06. 21. 18:15 keltezéssel, Lucas van Staden írta:

…

@indrisepos <https://github.com/indrisepos> Magento version? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#56 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABTRWGVRTIZ5NHQ2JIBL673TT5QSRANCNFSM47BMDHDQ>.

Answer 13 · 2021-06-21T16:17:39.000Z

anyone have a site that I can have a look at? obviously a test / uat site is prefered.

I cannot reproduce.

Answer 14 · 2021-06-21T16:18:17.000Z

I am on latest openmage, so will get a standard Magetno 1.9.4.2 setup to see.

Answer 15 · 2021-06-21T16:21:01.000Z

I have 2.0.1 and its not working.

Answer 16 · 2021-06-21T16:28:19.000Z

I can confirm that the same bug exists in 2.3.10, 2.4.0, 2.4.1 and 2.5.0. The same error is produced in the web console when using "Invisible" reCaptcha type. I get the error - and failure of reCaptcha - on backend and frontend.

The fact that it spontaneously stopped working on or around 17/06 makes me think the problem is external.. something relied upon that is no longer the case? Parameter(s) changed, etc?

@ProxiBlue do those versions you are testing have a newer Prototype version? I am on 1.7 according to js/prototype/prototype.js

Answer 17 · 2021-06-21T16:35:03.000Z

Ok I've made progress...

Replacing js/prototype/prototype.js with 1.7.3 immediately fixes the problem with no other changes.

I don't know what if any compatibility issues there are with Magento 1.9+ using Prototype 1.7.3 instead of 1.7....

EDIT: OpenMage ships with 1.7.3 so I'm inclined to think it might be ok. Not sure how you'd debug this one @ProxiBlue - it seems the problem is localised to Prototype which is outside the scope of your module.

Answer 18 · 2021-06-21T16:46:00.000Z

    {
        $this->_debug(ProxiBlue_ReCaptcha_Helper_Data::RECAPTCHA_API_SERVER.'/'.ProxiBlue_ReCaptcha_Helper_Data::RECAPTCHA_API_PATH.'/'.$path);
        $httpRequest = new Zend_Http_Client(
            ProxiBlue_ReCaptcha_Helper_Data::RECAPTCHA_API_SERVER
            . '/'
            . ProxiBlue_ReCaptcha_Helper_Data::RECAPTCHA_API_PATH
            . '/'
            . $path
        );
        $httpRequest->setParameterPost(array_merge(array('remoteip' => $_SERVER['REMOTE_ADDR']), $params));
        $response = $httpRequest->request('POST');
        if ($response->getStatus() != 200) {
            $this->_debug('Bad response from captcha gateway. we got ' . $response->getStatus());
            Mage::throwException('Bad response from captcha gateway. we got ' . $response->getStatus());
        }

        return $response->getBody();

    }

gives https://www.google.com//recaptcha/api/verify which gives 404.

Answer 19 · 2021-06-21T16:49:37.000Z

gives https://www.google.com//recaptcha/api/verify which gives 404.

I have seen this before, let me check my changelog

Answer 20 · 2021-06-21T16:52:44.000Z

The 404 is expected:

#46 (comment)

It requires POST data

Answer 21 · 2021-06-21T16:54:24.000Z

no, I was wrong, a few commenst down:

#46 (comment)

Answer 22 · 2021-06-21T16:55:12.000Z

it should be siteverify not verify

Answer 23 · 2021-06-21T16:55:25.000Z

Yeah I was wrong too - it's https://www.google.com/recaptcha/api/siteverify

I don't see the old URL with just "verify" in the source..

app/code/community/ProxiBlue/ReCaptcha/Helper/Data.php: const RECAPTCHA_SITEVERIFY_PATH = "siteverify";

Answer 24 · 2021-06-21T16:57:17.000Z

ok, is 1am here now, I need to go get some sleep. I will investigate on a clean m1924 when I wake up again.

It is installed already, will check module in that next.

Sofar all my local tests work fine, no issues

Answer 25 · 2021-06-21T16:59:29.000Z

ok, is 1am here now, I need to go get some sleep. I will investigate on a clean m1924 when I wake up again.

It is installed already, will check module in that next.

Sofar all my local tests work fine, no issues

👍

Upgrading prototype.js to 1.7.3 fixed the problem for me, and hasn't caused any other obvious issues that I've seen. Obviously I can't recommend this as a solution for heavy production sites, but it worked for me.

I suspect if all your local tests are fine you're using OpenMage, which ships with Prototype 1.7.3. Magento 1.9.4.5 and below ships with 1.7.

Answer 26 · 2021-06-21T17:01:05.000Z

Ok, so is likely why mine works on openmage, as they upgraded that.

Thanks for that, I will have to check the code and make it backwards compatible, OR, is code on google side with their js that's no longer compatible (which seems likely reason)

Answer 27 · 2021-06-21T17:04:51.000Z

Ok, so is likely why mine works on openmage, as they upgraded that.

Thanks for that, I will have to check the code and make it backwards compatible, OR, is code on google side with their js that's no longer compatible (which seems likely reason)

Yes, the fact that it just spontaneously stopped working - and the fact that earlier versions don't work either - point to Google changing something on their end that makes Prototype 1.7 incompatible.

Answer 28 · 2021-06-21T17:06:09.000Z

Upgrading prototype.js to 1.7.3 fixed the problem for me, and hasn't caused any other obvious issues that I've seen. Obviously I can't recommend this as a solution for heavy production sites, but it worked for me.

Confirm. It is working with 1.7.3, however I am not sure if other services are not affected.

Answer 29 · 2021-06-21T17:11:04.000Z

EDIT: OpenMage ships with 1.7.3 so I'm inclined to think it might be ok. Not sure how you'd debug this one @ProxiBlue - it seems the problem is localised to Prototype which is outside the scope of your module.

I will still have a gander, see what I can figure out, but yeah, likely not going to be an issue I can solve. Things move on. That's life

Answer 30 · 2021-06-21T19:08:00.000Z

For what it's worth. I'm experiencing the login problem with a 3rd party recaptcha extension. My store is on CE 1.9.4.5

Customers see this error on the login page"• The response parameter is invalid or malformed.". On my store, the last successful order where a customer logged in was June 17th. So not sure if this started later in that day or started in the 18th. Fortunately a customer called me the next day to get help login in so that's what tipped me off. Keeping my extension disabled and following this topic. Will certainly be switching to your module hopefully soon.

Answer 31 · 2021-06-21T21:08:37.000Z

@ZenMasta I confirm, I have installed it on OpenMage 1.9.4.13 and I had a lot of issues with customers not able to create accounts. So I have disabled it. So far Cloudflare is coping to keep spammers away. I guess Honeyspam is also doing its job
https://github.com/magento-hackathon/HoneySpam

Answer 32 · 2021-06-22T01:13:00.000Z

Openmage 1.9.4.13 i beleive is essentially still vanilla m1. Using from OpenMage 20.x up is the more updated version ( which i use ) with updated 1.7.3 prototype

…

On Tue, 22 Jun 2021, 05:08 LuizSantos22, ***@***.***> wrote: @ZenMasta <https://github.com/ZenMasta> I confirm, I have installed it on OpenMage 1.9.4.13 and I had a lot of issues with customers not able to create accounts. So I have disabled it. So far Cloudflare is coping to keep spammers away. I guess Honeyspam is also doing its job https://github.com/magento-hackathon/HoneySpam — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#56 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGDJVFDG7DK47XTOQEPSITTT6S6HANCNFSM47BMDHDQ> .

Answer 33 · 2021-06-22T01:17:45.000Z

@ProxiBlue Actually, OpenMage 1.9.4.13 is a fork which is more compatible with Magento 1.9 than the version 2x...
The have two OpenMage versions... The ones with 1.9 are more compatible with original Magento 1.9 than OpenMage 2x, which has more modifications.

So in order to avoid issues with plugins, I have chosen OpenMage 1.9 flavor

Answer 34 · 2021-06-22T01:48:21.000Z

OpenMage 1.9.4.13 is a fork which is more compatible with Magento 1.9 than the version 2x..

Ah, did not know this. I migrated my clients that prefers to stay on m1 to the full OpenMage version quite some time ago, and not experienced any major 3rd party module issues, but then 90% of their functions I coded, rather than loading multiple 3rd party modules.

Answer 35 · 2021-06-22T06:21:14.000Z

I can now reproduce on vanilla 1.9.2.4

Answer 36 · 2021-06-22T06:22:27.000Z

Confirmed that I am not a robot still works

Answer 37 · 2021-06-22T09:57:20.000Z

anyone stuck can run these sql queries to swap to 'I am not a robot'

update core_config_data set value = 'robot' where path = 'customer/captcha/theme';
update core_config_data set value = 'robot' where path = 'admin/captcha/theme';

Answer 38 · 2021-06-22T14:41:53.000Z

I can confirm that the fix by @empiricompany fixes the issue. (Thank you very much for that effort, I have been stick on a paid client job)

It is really the only way as the issue is outside this modules functionality/scope.

I will update the readme accordingly, as this fix introduces a new version of prototype, which can potentially cause (but unlikely) issues with other parts of the magento framework

Answer 39 · 2021-06-22T14:51:25.000Z

I can confirm that the fix by @empiricompany fixes the issue. (Thank you very much for that effort, I have been stick on a paid client job)

It is really the only way as the issue is outside this modules functionality/scope.

I will update the readme accordingly, as this fix introduces a new version of prototype, which can potentially cause (but unlikely) issues with other parts of the magento framework

It appears to fix the frontend, but the backend is still pulling prototype.js from js/prototype/prototype.js, on my 1.9.4.5 CE install at least.

Answer 40 · 2021-06-22T14:53:59.000Z

ProxiBlue commented 3 years ago

Answer 41 · 2021-06-22T14:54:23.000Z

It appears to fix the frontend, but the backend is still pulling prototype.js from js/prototype/prototype.js, on my 1.9.4.5 CE install at least.

I will have a look at that, thanks for letting me know, did not check admin.

Answer 42 · 2021-06-22T15:21:38.000Z

@durzel

Check new version 1.5.2

Answer 43 · 2021-06-22T15:22:29.000Z

It appears to fix the frontend, but the backend is still pulling prototype.js from js/prototype/prototype.js, on my 1.9.4.5 CE install at least.

yes we have fixed only frontend because we not use captcha in admin, but if we want to cover also admin i think we can simply just register the observer into section in config.xml

<globals> <events> <controller_action_layout_render_before> <observers> <fixPrototypeVersion> <class>proxiblue_recaptcha/observer</class> <method>fixPrototypeVersion</method> </fixPrototypeVersion> </observers> </controller_action_layout_render_before> <controller_action_predispatch_contacts_index_post> .. ..

Answer 44 · 2021-06-22T15:23:03.000Z

Yep, I have adjusted the the event to the global section

Answer 45 · 2021-06-22T15:27:52.000Z

No joy for me, I'm still getting the standard Magento prototype.js on the backend, even on 2.5.2. Have wiped cache and am using an incognito browser. Are you not getting that?

Answer 46 · 2021-06-22T15:29:57.000Z

Not in my local. let me check the release, see if it released correct code

Answer 47 · 2021-06-22T15:40:56.000Z

@durzel

You are correct. I tested that on the 1.7.3 based magento (as my debugger is not working on the docker environment I quickly brought up for the 1.9.4.5 test)

Although the code actions

the end result is still the wrong (core) prototype loading in head, so admin is somewhere replacing that again with the default)

Fixing my debugger so I can dig into this

Answer 48 · 2021-06-22T15:46:11.000Z

It actually works INSIDE admin, not on login

There must be separated head templates for admin login (ugh magento 1)

so the given event doe snot do teh job

Answer 49 · 2021-06-22T15:47:13.000Z

does not help I am now so used to m2, I forget how parts of m1 works!

Answer 50 · 2021-06-22T15:49:00.000Z

does not help I am now so used to m2, I forget how parts of m1 works!

it's hardcoded in adminhtml/default/default/template/login.phtml

Answer 51 · 2021-06-22T15:49:41.000Z

it's hardcoded in adminhtml/default/default/template/login.phtml

Oh FFS, yes I just found it as well

Answer 52 · 2021-06-22T15:50:34.000Z

does not help I am now so used to m2, I forget how parts of m1 works!

it's hardcoded in adminhtml/default/default/template/login.phtml

Well spotted.

Answer 53 · 2021-06-22T15:51:29.000Z

At this point I think a patch will need to suffice to make that template work on the module supplied 1.7.1

Its just one of those things.

Answer 54 · 2021-06-22T15:51:50.000Z

I have work waiting that I need to get to

Answer 55 · 2021-06-22T15:53:03.000Z

At this point I think a patch will need to suffice to make that template work on the module supplied 1.7.1

Its just one of those things.

Indeed. To be honest given how many places this might be the case, it might even be worth just telling people they need to stick prototype.js 1.7.1 in js/prototype themselves.

It's hardcoded in adminhtml/default/default/template/forgotpassword.phtmltoo.

Answer 56 · 2021-06-22T15:53:08.000Z

i think there is not a clean solution to fix it in backend login, you have to manually update original js/prototype.js or we have to rewrite entire login.phtml template

Answer 57 · 2021-06-22T15:53:32.000Z

So, the fix will be to move the provided fix back to just on a frontend event, and supply a patch for login.phtml that can be applied

Answer 58 · 2021-06-22T15:54:21.000Z

if composer is used for site deploy via a composer patch, it can be applied cleanly-ish via pipeline deploys and composer udpates

I will supply instructions in README

Answer 59 · 2021-06-22T15:58:22.000Z

app/design/adminhtml/default/default/template/resetforgottenpassword.phtml
app/design/adminhtml/default/default/template/login.phtml
app/design/adminhtml/default/default/template/forgotpassword.phtml

...are the affected files for the backend, for what it's worth.

I wonder if there is any mileage in trying to patch the incompatible functionality in prototype.js 1.7 instead of replacing it? Will do some investigating...

Answer 60 · 2021-06-22T16:25:38.000Z

Ok, I have reverted the event back to frontend only on version https://github.com/ProxiBlue/reCaptcha/releases/tag/2.5.3

I need to move on to paid work, with deadlines.

I have updated readme.

When I get time (unless someone beats me to it) patches will be supplied via a GIST to apply these changes manuall, or via composer patches

Answer 61 · 2021-06-24T12:20:11.000Z

if you are stuck with admin login you can disable captcha with:

update core_config_data set value = '0' where path like 'admin/captcha/enable';

for admin, then clear cache

Answer 62 · 2021-06-24T13:10:36.000Z

ATTENTION:

I am currently considering archiving this module, as I no longer have the free time to continue supporting this code.
as per ticket: #43, it seems there are issues in checkout with the validation of the invisible recapctha, which could be related to the usage of prototype 1.7.1

I simply don;t have teh time due to paid works with deadlines to work on this at present.