replace recaptcha with self-hosted captcha #281

chappjc · 2018-11-21T19:43:37Z

This replaces Google's reCAPTCHA with a self hosted captcha.

NOTE: This is needs review and testing. It works for me though.

Create controllers/captcha.go, where the captcha GET and POST handlers
are implemented for retrieving images and verifying responses.
Create CaptchaHandler type with image size spec, and add it as a field
of MainController.
Create ApplyCaptcha captcha middleware.
Add GET route for /captchas for serving the captcha images.
Add POST route for /verifyhuman for verifying captcha responses and
redirecting to the previous page with the session updated.
Modify http handlers to display new captcha: PasswordReset, SignUp, and
Settings.
Modify http handlers to check for captcha verification:
PasswordResetPost, SignUpPost, and SettingsPost.
Unrelated: remove unused empty responseHeaderMap.
Comment on how insane core/(*Application).Route is.

chappjc · 2018-11-23T04:16:07Z

Force pushed 996f7bf. Tested and working. The pages don't look very pretty, but's that's about the best I can do.

chappjc · 2018-11-23T04:21:55Z

Currently it looks a bit like this (showing Password Reset page before solving captcha):

Sign up:

The idea is the forms protected by captcha don't show up until the captcha is solved. It's not just the forms are not there, of course, but that the POST handler that deals with the usual forms does not process the other non-captcha data. This is the purpose of the ApplyCaptcha middleware.

chappjc · 2018-11-23T04:24:25Z

Setting the captcha length (now 6), characters (now just 10 numerals), captcha expiry (now 10 minutes), and other captcha parameters may be worth setting in the future. Although because of limitations in the captcha API, we may just want to fork the captcha repo.

chappjc

Annotated for other reviewers.

chappjc · 2018-11-23T04:41:20Z

controllers/captcha.go

+		session.Values["CaptchaDone"] = true
+		status = http.StatusFound
+	} else {
+		session.Values["CaptchaDone"] = false


Should probably do a session.AddFlash("Captcha verification failed. Try again.") here too

chappjc · 2018-11-23T04:41:56Z

controllers/captcha.go

+	"github.com/zenazn/goji/web"
+)
+
+type CaptchaHandler struct {


I need to doc all these exported things. And copyright the file.

chappjc · 2018-11-23T04:42:33Z

controllers/main.go

@@ -5,6 +5,7 @@ import (
 	"encoding/hex"
 	"errors"
 	"fmt"
+	"github.com/dchest/captcha"


This import should be with the other github imports, not with the std lib imports.

chappjc · 2018-11-23T04:43:23Z

controllers/main.go

@@ -145,6 +143,11 @@ func NewMainController(params *chaincfg.Params, adminIPs []string,
 		return nil, err
 	}

+	ch := &CaptchaHandler{
+		ImgHeight: 127,
+		ImgWidth:  257,


Pulled out of my ass and could be set in the config file, but that's not really needed now.

chappjc · 2018-11-23T04:44:04Z

controllers/main.go

 	if controller.smtpHost == "" {
 		c.Env["SMTPDisabled"] = true
 	}
+	c.Env["CaptchaID"] = captcha.New()


No reload button next to the captcha. To get a new one, all you have to do is reload the page with the protected forms.

chappjc · 2018-11-23T04:45:34Z

server.go

@@ -227,6 +227,10 @@ func runMain() int {
 	app.Get("/signup", application.Route(controller, "SignUp"))
 	app.Post("/signup", application.Route(controller, "SignUpPost"))

+	// Captcha
+	app.Get("/captchas/*", controller.CaptchaServe)
+	app.Post("/verifyhuman", controller.CaptchaVerify)


The application.Route function is a shit show. Not using it.

chappjc · 2018-11-23T04:46:16Z

system/core.go

 		if err := saveSession(c, w, r); err != nil {
 			log.Errorf("Can't save session: %v", err)
 		}

-		if respHeader, exists := c.Env["ResponseHeaderMap"]; exists {


This was a relic from a much older feature that was partially ripped out.

honeycrypto · 2018-11-24T16:02:32Z

Why to overcomplicate things? Recaptcha works great.

chappjc · 2018-11-24T16:03:11Z

@honeycrypto Please see #279

teknico · 2019-01-31T17:36:01Z

This branch works for me too.

Under a local deployment I was able to sign up with the captcha image: I got the confirmation email and activated the account. Looking at the database I confirmed that the account got id no. 1 (configured as admin), and logging in I was indeed able to see the low-fee ticket page.

(The local deployment consists of one dcrd instance, one dcrwallet for fees, two voting dcrwallet, two stakepoold, one dcrstakepool and one mysqld. To make all the daemons run in the same namespace without virtual machines nor containers, I changed the various listening ports in the daemons' configuration.)

chappjc · 2019-02-01T03:59:04Z

Thanks for the feedback @teknico.

dajohi · 2019-02-01T23:38:07Z

@chappjc please rebase on top of current master

chappjc · 2019-02-04T14:49:21Z

@dajohi rebased

Create controllers/captcha.go, where the captcha GET and POST handlers are implemented for retrieving images and verifying responses. Create CaptchaHandler type with image size spec, and add it as a field of MainController. Create ApplyCaptcha captcha middleware. Add GET route for /captchas for serving the captcha images. Add POST route for /verifyhuman for verifying captcha responses and redirecting to the previous page with the session udpated. Modify http handlers to display new captcha: PasswordReset, SignIn, and Settings. Modify http handlers to check for captcha verification: PasswordResetPost, SignInPost, and SettingsPost. Unrelated: remove unused empty responseHeaderMap. Comment on how insane core/(*Application).Route is.

Remove the old config file stuff.

chappjc · 2019-02-08T15:45:04Z

@dajohi rebased again

Add a flash message in the CaptchaVerify middleware.

dajohi

ok

* commit '9ec3776b1d9ed8f2a06d196ab072b8474e9bb6a9': replace recaptcha with self-hosted captcha (decred#281) # Conflicts: # controllers/main.go # views/settings.html

chappjc mentioned this pull request Nov 22, 2018

privacy: Self-host CAPTCHA #279

Closed

chappjc force-pushed the captcha-self-hosted branch from 4c49f36 to 996f7bf Compare November 23, 2018 04:15

chappjc commented Nov 23, 2018

View reviewed changes

chappjc force-pushed the captcha-self-hosted branch from 05d7cb4 to 9f33e7f Compare November 23, 2018 22:07

degeri mentioned this pull request Dec 10, 2018

Test Stake Pool signup broken #286

Closed

dajohi changed the title ~~replace recaptcha with self-hosted captcha~~ [WIP] replace recaptcha with self-hosted captcha Jan 11, 2019

chappjc changed the title ~~[WIP] replace recaptcha with self-hosted captcha~~ replace recaptcha with self-hosted captcha Jan 30, 2019

chappjc force-pushed the captcha-self-hosted branch from 9f33e7f to ed129c7 Compare February 4, 2019 14:48

chappjc added 2 commits February 8, 2019 09:44

remove the recaptcha.js script from the footer

04cc822

Remove the old config file stuff.

chappjc force-pushed the captcha-self-hosted branch from ed129c7 to 04cc822 Compare February 8, 2019 15:44

captcha: failure must redirect with StatusFound

3730024

Add a flash message in the CaptchaVerify middleware.

dajohi approved these changes Feb 8, 2019

View reviewed changes

dajohi merged commit 9ec3776 into decred:master Feb 8, 2019

chappjc deleted the captcha-self-hosted branch February 8, 2019 18:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

replace recaptcha with self-hosted captcha #281

replace recaptcha with self-hosted captcha #281

chappjc commented Nov 21, 2018 •

edited

Loading

chappjc commented Nov 23, 2018

chappjc commented Nov 23, 2018

chappjc commented Nov 23, 2018

chappjc left a comment

chappjc Nov 23, 2018

chappjc Nov 23, 2018

chappjc Nov 23, 2018

chappjc Nov 23, 2018

chappjc Nov 23, 2018

chappjc Nov 23, 2018

chappjc Nov 23, 2018

honeycrypto commented Nov 24, 2018

chappjc commented Nov 24, 2018

teknico commented Jan 31, 2019

chappjc commented Feb 1, 2019

dajohi commented Feb 1, 2019

chappjc commented Feb 4, 2019

chappjc commented Feb 8, 2019

dajohi left a comment

replace recaptcha with self-hosted captcha #281

replace recaptcha with self-hosted captcha #281

Conversation

chappjc commented Nov 21, 2018 • edited Loading

chappjc commented Nov 23, 2018

chappjc commented Nov 23, 2018

chappjc commented Nov 23, 2018

chappjc left a comment

Choose a reason for hiding this comment

chappjc Nov 23, 2018

Choose a reason for hiding this comment

chappjc Nov 23, 2018

Choose a reason for hiding this comment

chappjc Nov 23, 2018

Choose a reason for hiding this comment

chappjc Nov 23, 2018

Choose a reason for hiding this comment

chappjc Nov 23, 2018

Choose a reason for hiding this comment

chappjc Nov 23, 2018

Choose a reason for hiding this comment

chappjc Nov 23, 2018

Choose a reason for hiding this comment

honeycrypto commented Nov 24, 2018

chappjc commented Nov 24, 2018

teknico commented Jan 31, 2019

chappjc commented Feb 1, 2019

dajohi commented Feb 1, 2019

chappjc commented Feb 4, 2019

chappjc commented Feb 8, 2019

dajohi left a comment

Choose a reason for hiding this comment

chappjc commented Nov 21, 2018 •

edited

Loading