From 2404e6074c35a527d4792637a427526b9565b71e Mon Sep 17 00:00:00 2001
From: Benjamin Southall <applemansigloo@gmail.com>
Date: Sat, 10 Aug 2019 20:39:17 +1000
Subject: Fixes You look like a bot (reCaptcha window doesn't appear) #159,
 straight implementation of upstream
 https://github.com/vichan-devel/vichan/pull/241, but I bumped the jquery
 version.

---
 post.php | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

(limited to 'post.php')

diff --git a/post.php b/post.php
index a2eaa523..c59a57db 100644
--- a/post.php
+++ b/post.php
@@ -437,14 +437,15 @@ function handle_post(){
 	if (!$dropped_post) {
 		// Check for CAPTCHA right after opening the board so the "return" link is in there
 		if ($config['recaptcha']) {
-			if (!isset($_POST['recaptcha_challenge_field']) || !isset($_POST['recaptcha_response_field']))
+			if (!isset($_POST['g-recaptcha-response']))
 				error($config['error']['bot']);	
-				// Check what reCAPTCHA has to say...
-				$resp = recaptcha_check_answer($config['recaptcha_private'],
-				$_SERVER['REMOTE_ADDR'],
-				$_POST['recaptcha_challenge_field'],
-				$_POST['recaptcha_response_field']);
-			if (!$resp->is_valid) {
+			// Check what reCAPTCHA has to say...
+			$resp = json_decode(file_get_contents(sprintf('https://www.google.com/recaptcha/api/siteverify?secret=%s&response=%s&remoteip=%s',
+				$config['recaptcha_private'],
+				urlencode($_POST['g-recaptcha-response']),
+				$_SERVER['REMOTE_ADDR'])), true);
+
+			if (!$resp['success']) {
 				error($config['error']['captcha']);
 			}
 		}
@@ -455,15 +456,16 @@ function handle_post(){
 			if(empty($_POST['captcha'])){
 				error($config['error']['securimage']['empty']);
 			}
- 			$query=prepare('DELETE FROM captchas WHERE time<DATE_SUB(NOW(), INTERVAL 30 MINUTE)');
- 			$query=prepare('DELETE FROM captchas WHERE ip=:ip AND code=:code LIMIT 1');
+			$query=prepare('DELETE FROM captchas WHERE time<DATE_SUB(NOW(), INTERVAL 30 MINUTE)');
+			$query=prepare('DELETE FROM captchas WHERE ip=:ip AND code=:code LIMIT 1');
 			$query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
 			$query->bindValue(':code', $_POST['captcha']);
 			$query->execute();
- 			if($query->rowCount()==0){
+			if($query->rowCount()==0){
 				error($config['error']['securimage']['bad']);
 			}
 		}
+
 		if (!(($post['op'] && $_POST['post'] == $config['button_newtopic']) ||
 			(!$post['op'] && $_POST['post'] == $config['button_reply'])))
 			error($config['error']['bot']);
-- 
cgit v1.3