Google recaptcha issue

Google is shutting down the reCAPTCHA v1 API on March 31, 2018 How to upgrade vtiger webform to use new recaptcha?

The google has stopped supporting reCAPTCHA v1. It is necessary to upgrade webform code.

1. The code in layouts/v7/modules/Settings/Webforms/resources/Detail.js Near Line 181, under function getCaptchaCode function, within both <script> and <noscript>. Use a new Sitekey generated from https://www.google.com/recaptcha/admin

2. In include/recaptcha/recaptchalib.php under recaptcha_check_answer change RECAPTCHA_VERIFY_SERVER from "/recaptcha/api/verify" to "/recaptcha/api/siteverify"

3. remove "challenge"

4. privateKey to secret

5. get the response from

    * $data = json_decode($response); 
   
     if ($data->sucess==true) { *

I think there needs to be done more than what you suggest @sutharsan .

I checked out the implementation and there are various issues:

The implementation, as it is with recaptcha v1, is wrong as far as I can tell. Upon submitting the form, there is javascript code (the one that gets generated by the Webforms module) that catches the onsubmit event and makes the recaptcha validation by calling the following url in vtiger https://your_vtiger_instance.com/modules/Settings/Webforms/actions/CheckCaptcha.php. If the js code gets a success response, then the form is submitted to https://your_vtiger_instance.com/modules/Webforms/capture.php. The capture.php script just assumes everything went ok. If someone makes a post directly to capture.php there is no validation at all.

On the other hand, in file modules/Settings/Webforms/actions/CheckCaptcha.php someone hardcoded the public and private keys like this:

// reCAPTCHA public and private keys to validate
$publickey = "6Lchg-wSAAAAAIkV51_LSksz6fFdD2vgy59jwa38";
$privatekey = "6Lchg-wSAAAAABUvZ57ogylowuv8SK0Hq4h2Yghs";

I don't understand the purpose of that, because in version 6.4 it wasn't hardcoded like that. Those values were previously taken from file modules/Webforms/config.captcha.php, which you were supposed to update with your own values.

@ruben.estrada Yes, I knew that and I fixed it in a way to submit the form and validating captcha at backend as per v2. I did it for vtextra advanced web form (https://vtextra.com/product/advanced-webform-for-vtiger/) extension with a feature to input keys at settings. If vtiger will accept, I shall provide same fix.

@sutharsan Have you done a pull request?

I also created a workaround on my own but there are things that would need to be cleaned up/fixed before I could consider making a pull request. But if you have already done it, maybe there's no point in duplicating efforts.

no news?

I have a fix for that, I just have not had the time to clean it up and do a pull request. Sorry.

@ruben.estrada Can I have a look into your branch? @remigio.ruberto Sorry, I didn't have time to do it by myself

mentioned in issue #1009 (closed)

mentioned in issue #1265

mentioned in issue #1266

mentioned in merge request !832 (merged)

I've finally sent MR !832 (merged) to fix this.

@ruben.estrada Good Thanks

+1

you're welcome! It only took me two years ;)

mentioned in commit 5041ffdb

mentioned in commit a11d9abf

mentioned in commit de70289c