diff --git a/functions.inc.php b/functions.inc.php index 6e74f9c3..6237031a 100644 --- a/functions.inc.php +++ b/functions.inc.php @@ -2241,4 +2241,21 @@ function getRemoteAddr() { return $REMOTE_ADDR; } +function validate_recaptcha() +{ + global $CONF; + $response = $_POST['g-recaptcha-response']; + $recaptcha_check_url = 'https://www.google.com/recaptcha/api/siteverify?secret='; + + // Add the site private key to config.local.php + $verifyResponse = file_get_contents($recaptcha_check_url.$CONF['recaptcha_secret'].'&response='.$response); + + // Enable recaptchav2 in config.local.php + if ($CONF['recaptcha_enabled']) { + if (json_decode($verifyResponse)->success) return TRUE; + else return FALSE; + } else return TRUE; +} + + /* vim: set expandtab softtabstop=4 tabstop=4 shiftwidth=4: */ diff --git a/public/login.php b/public/login.php index 39a36330..eb779c7c 100644 --- a/public/login.php +++ b/public/login.php @@ -55,7 +55,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") { } $h = new AdminHandler(); - if ($h->login($fUsername, $fPassword)) { + if ($h->login($fUsername, $fPassword) && validate_recaptcha()) { init_session($fUsername, true); # they've logged in, so see if they are a domain admin, as well. diff --git a/templates/login.tpl b/templates/login.tpl index 01bddfd0..3b628c51 100644 --- a/templates/login.tpl +++ b/templates/login.tpl @@ -34,6 +34,16 @@