From e5f89165cb59702156473226f331c39ee4c43318 Mon Sep 17 00:00:00 2001 From: Eric Fawcett Date: Wed, 12 Aug 2020 19:55:48 -0400 Subject: [PATCH] replace random image captcha with Google reCaptcha v2 --- captcha/background1.jpg | Bin 1850 -> 0 bytes captcha/background2.jpg | Bin 1256 -> 0 bytes captcha/background3.jpg | Bin 1176 -> 0 bytes captcha/background4.jpg | Bin 3649 -> 0 bytes captcha/randomimage.php | 52 ---------------------------------------- sendform.php | 31 +++++++++++++++++++++--- 6 files changed, 28 insertions(+), 55 deletions(-) delete mode 100644 captcha/background1.jpg delete mode 100644 captcha/background2.jpg delete mode 100644 captcha/background3.jpg delete mode 100644 captcha/background4.jpg delete mode 100644 captcha/randomimage.php diff --git a/captcha/background1.jpg b/captcha/background1.jpg deleted file mode 100644 index dd81850997012115f35fa5b04f3d27db4768c594..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1850 zcmbW!c{H1e769dI+kgv;&{CG&b)KpU+=wp&;9G(bI<*qyEV4;8c=g$ zFc|;{g23tR1hyssI{=}epr`;xC@LxgnoWaX5W~`96I^ zQ#=kwq#B#EhyxjB_I-sL@A@RRaCUe1~>!q{~TMb02%@40tcX= zApk*xP&ByJ3FrX;2;aVT=iq+@2!X=j3W^A%lJfRIof-fEp->163WvjB+tUf#eE^1r zs~eCGD`>d+D;kDtl9RLVBJlLuw%zVSiv){+h!muf)@RxntkK?mL}L?*r4`lM#@6m@ zdxnD})5*ir%iG8IIO`1i?76`6K^G#UqGMv?INx1Ky_$CI`i+~soZGqly!-+|NoiU6 z4;A++s~$fQ*4004Xl!cl=FpB@kGy#KYIJN|BAt38o0iY~{&se0`Oo(sR#rc* zecEw>0Q8@%zhwX6LT|euFc=i3xZ?sLvD*bj!{7!a1@*&jivHmmhU8>~CO!LZZ5tAA z;l8*#AYw>Ki$IYYE$z_$A^Y!ODgT%3FWA3b5Sx1R?^1788Fw6$SvSB{w1Jf%Iw zR<$60F@5hc(uDhwEjxqPUGejqh^t^mBjU$~=Y_7!C?T59gkebqX8f~L*1Lw*l4MB@9?cPFhr)bfMtTMkgTn)<*P^vUDVyd84Ver1!rGI@ zD(ii*3O0vC(u_4My>+8Ew#DLB&d9~Nlj2!UVN+evjk3MPCck{szY+nY(}AnpO{K6&HYa9?%z>2;zj6{CrEa-Sd6F+fC6@(tb(6t{GpdT2!3xww%=i7k*01^q0=5cv_0{cmxY^4pZ)6ohi2I zj;)N!IZ#!Vwcit)@@ZJ|s$077?)`hg0!bud5xn3t*(cl8T+dEK5|3M4)1z9}g_w-^ z3{^PJzk5(o&waK&@iG3k!0PyccD6lZZ17aLhi=3v6t~_von2So^6L9VRgW*C3T1r3 z^GUNi{O^AM^uhM?Jgd*t%A1{ao}uq=^0Z6+2~HSaM(NC&GouGstg1o=pq^sIS{e9; z`W7D>eTP8P4)D5S)P>eSOq)#`2J(pVjwP9GCklpT_AUL_2PnK=T$j9=&@Aw1!f02B zs;zQqvBW)3g1ny&KXK+){vr}t^5)+}Z1NzloEQOArf zr1^)0WmkK9(0QBHXza7A8j&;(7sh^ETw>YtTc0F`{F`kbKk{=))e{ZueTLrcUe#3x zx9r9w>%rioWqy*N<+2$5P{G3GpQXt>D*>H6f8~5)L6hF0$vE#DH5G%Rk|5#4Mos<5 zH*dFq4qy2nl!U`|Z_bUfirasb<&isrwI&>2^N#>O{YWCGTa$_^JLY4JCMz2mnbA@q zr^cs0EhaVB!X!n621AvfBLYfcJV&Te&7Fmc$MzJH*>lNzdQA+D`LHjYAlFQLtTu-~ zou0TLIwd?B#u*sAhRxcPZ>+gXLu^b5zt(==l(Su8Q zu8|qa(F;8utGJ>8qv^K~gtG&0$`U$-tlgA;m9IK{s9CIPtJV-dzl*}&Bh8{rQn!4N z9a1Qg!J&lHD(l9l!^8MPungk@rWbhfC$a3zLvg3Z=IfXA?%;&Wl08LY9vujD`Bm#r z18;na;|bfMz%;kMR?C2+*mk+krGA><4}D`Jbe&umTCCMEsuo@wPy?o#^vj;>aA({- LVhcmQ-x~irKVmIw diff --git a/captcha/background2.jpg b/captcha/background2.jpg deleted file mode 100644 index a4d81a9bd4e0ca68730c019cf811ae5ad9b7f8d2..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1256 zcmex=^(PF6}rMnOeST|r4lSw=>~TvNxu(8R<BW=16jCP7AKLB{__7~~lk7+Ha?1vwZB7@3$^SlQS)IJvli z3bqO`FflSSGqEtUva+xMRo4RL8CV2ag%k}P*@OcV*_8@Kj2b5{ECr+Na zbot8FYu9hwy!G(W<0ns_J%91?)yGetzkL1n{m0K=Ab&A3Fhjfr_ZgbM1cClyVqsxs zVF&q(k*OSrnFU!`6%E;h90S=C3x$=88aYIqCNA7~kW<+>=!0ld(M2vX6_bamA3^ zHqMxJqrIuh>3nqds(t?%jPo>w%5DpQcoDyYQ{+%YJ>`_OGq5BIC-|ko(njteRWpw;V{k zeCuJ_9f^6uPZ|0a?)6ymo4sTI{=)wZjmrNSy4Fhjs_{O2Bo~?BUi|0$*8K4GEyn^v zeim%}9$x!?_p2&yQ7%uno^btn{~2aZuU`>$D`v*?>B#~Tyh}d*;HutSJI#7^nuBCf zbiNLs;jIldq5l~aJ@&uu_|I@*)|M>`zKfmY_PAX$^_ZW-G3#)XPd6Su`Y1B{`J~#l z>-JwgaU`&(;KQuDJrgP??f!D-$fHHs+}T^wc4WFwE7%t)`}w-P*R_9V{xdAQ|Kt6C zhPc)D`V}Xsa*1cCbFuj=n@;7r@l~>TZ|<`D3m*j@vNC-fH?24RW0+cBiF)A)E;mon zke_bq3PwAQU5K{)`ZlbGQ*O>VBkxs{=UsK%6V90^ukvW_*XzGNnXlLMEIM5+vOYgA zS1D3q%3`+TD_&GfE&tEJ$+q%8gMIu@-ugpZ{y64~RJjPPdU(tA^(PF6}rMnOeST|r4lSw=>~TvNxu(8R<BW=16jCP7AKLB{__7~~lk7+Ha?1vwZB7@3$^SlQS)IJvli z3bqO`FflSSGqEtUva+xMRo4RL8CV2ag%k}P*@OcV*_8@Kj2b5{ECr+Na zbot8FYu9hwy!G(W<0ns_J%91?)yGetzkL1n{m0K=Ab&A3Fhjfr_ZgbM1cClyVqsxs zVF&q(k*OSrnFU!`6%E;h90S=C3x$=88aYIqCNA7~kW<+>=!0ld(M2vX6_bamA3|Qfp*~eCYY)Nd$7P+joE3LVICOv+3K=PQ`*VUiSOkmaD{mj}S zRLApJ75~Cj;YF^+PZqluB=dPcl4O^TsH*N_sNK4B%f{U&^MyA~^VzJR^5@y4inY0F zTc^15D4$i>5wIsG?{>_CTOThC-PBcGy|u?V` zX~h#Ht5{#o+OYk?hEts#CuJP|x0uYN`Ruh;Vb+O{Tb pUcX@LmaV^?ZXa7_?siInUAo3IHI+W3_(;|5t&)3=l>pD2$nf^|+yy3jl){7{Cw)Mn(waxI66l9Du+Xxy9sl zn0QPapyEEf=*aX}Fo{dVRzB0g4M_z@-za7l{u2U%Cr?SCq)(qwR8m$^Ra3vLdqq#* z!0@WsEprP?D{C94JI*e5UES{a`3D3B1wROhj(PMrHZDFP1NY=tAI5jSGIv1%^NvAke>DAaKy}W`IK&#pIc|bxfcRK0M;+NEq*>^jE}IW(ft; z4L(QTK^A^V#o1Gvf6@L)_P+y*`hSuA3+&%q695|n=-504IG_dWRCBwMsk6Oy&bf!G zr0lK(|8|C&mkro5k#;AtyxC0Wgs;rhUgjpNuwKTgw`i4L=DL_?FW0J3wJv+F7wxk2 zMsx!WIdbKSZ*KIYde1xTC%lLAL{E%owIiT5p9Q#WFf6-`6ydycmVTAa10ovCMpNG>QwayfQ`NKZ&P`a zDVx3SJ#FLhHTO{ln-*Cf%CC;a<>Wjpd)}Vurx~NRok}S;7ICmsc<~mYO~CD`_smYX zc~;Tt1KED8X}&dB{-zDY9~G&1!;lfWCj;7+@J*|QyA*P#z$rOrxV!{nxxPd;B5v5; z^CpjE((?$J;Gt1ds>iNsLT)(8tALC;0;{Okl{b_jU=X+sSJfL$crQPps9QJzfsn-# zz-XAbr%t8D!?>zfhI#3y;yX=s?R(mW;jQK9;Gipb%S>Ad;|zVrzV&-CM3f{h#ZVEH zHJ2PXG}(4gp^|u^K&g=^(GQ0c&s;j%aAulM0_)Jgpt-7v`{(K8+f#%H@$c6_#4w8~x^qLxKn(Bs3uayB2CmNIXgX7MQekSU~J(og@3cH&b zjehCif84jw{HDruW<^X0Gg%YprsW?b(E|vi6Jt>tew{u}A9lB9T;*q$51vlJZzyi* zv$t4hu`8rE2Vyt$w0$UtKkn;W#a?@GR)Uy2Ght9wgjWg9xnnAu#E%x>d4zOsK_R4p zy7!q!vvNganKOakRK62`Zj$n`2kjAKgK`zO2cN%JNEE zbb3Sw%%`3FGPGg^X$*c>NBqACxS1J{D|Yj5pPp+-HgE*jT~7;1Z8yC!TiQ~Ii_iVL zY{IHyAXmIx-l0#o1P93E3ETUTy0@M$Ce@7%A&lEqLJWxU5{H zX7w1@)-@x$H2t4|=%0NO+K#42WW#Clv-?9AD}9O$cgF|(fl~8l>aYyZAgA)V`R>T8sY-)|w?ru_gd_-c%|(@-U2 z^|O+7=v_Cg&p_v3O}APfON9IF+n<*+eeG^fx4PXIQR&r;QpBb)S#6*VM3a32-=87o zblH$5ZmEQHqKp$mefct%$WrdQ!1QoEgdj~lZL=&JDpz1-r~eS~@@1HaZctW6 z)5pyy*qPTo)+64=JscNZ=5hGl@U5FWFMl&yg)dDu0MucU?ZfsHtihQfp3%XjnlB7p z9wydm8(O{Kp<=;7eCTT;3$2z=?~*@{=2%5@+VRDNISms^{U@pW%yM0uE-)5BO9r)> z_2-b(vWt;d0Pk&1&Plfky@FYatYa;4be0EWbE#&|I`*^motq#-UaSnC!#f&_cAvfv z_GPL+fq!GPtSSsIU+y+)ik-AQ*R!$_E$a~Xdr8tfEcvMN~+u~jRW|-HXYRBfS z9oI-tr`y(I%Tj5c+7xJ?_u$Y*?G#693)VD5)+YJfN6nV0=&k+xW9y;KDx&k8f`9NDax#_!wHVfT zC03~6C?^SXy*o&VH-4U~z^CtQVeWWhElL}S&_5JA25zwgjZmGXSzE7oc4TY zKcD0%PhtP{mcSEi*0yauY4d`=L#%enL-(ev%Q&&yHCtPr>>YF(iWH{Z!h6Ll+S<)l zx+`5XTpMKVzV|v(Q=5xpufH#b8^i{JMn~K5w6c#hl7GSV6}ev-N~B+wDHA|Ow?cdp zfY~*Y$2H^4Q5=72rNJu_btt}E!mi@#soE*Ny23&ta)B1=1b~LL_An<;r5-*$`?D~W zfOW%HSQ7J=Kqh3z&p(LgfhZ#tkBqU_fAD!B?v1X_RtmJ>opFUOALPn=|NaGA}2TidX)M=+S|I zIkc;czUvK>=m5e^-t}NOLFjsuG(KNxr9B^G+lmRfdX1aIPQUX!fB;mqX3;}*U~vpf z2U_{o>40Ft5x2&#{k)CLx3Z`wIA!9xU6(tKP^Ir;?l2G$T<|;S7Lg95b;T|k9MpDZ zqb8kn2EeZ@{{098pOkvfS#RsT2xn|h`)bV6ypBYvT5}x^)t~Y3L6nf>^y~ zX(6Le(c>2XC@Gj+$-R}bJvpuOQha5?OgJ5vw594yF*S*n;Ir-VmS(`!rnZmTsgJ}c zxHS-}vhUQtWq0k+oUE+qi_*qA)H(1ff7QNG@6o?!=qaZ<5_+M0qICcI=q4*=`VZG7 z8{3i$!2%8 z&)xg)H`oC6tNp`2FPyX9N-1zSPARQb0d<^GLD#9!!8%~g6o%yTWqi<-nz}P-oNTfO zc0)GRV887KN4yQ4%zk^Ce34Ta`88zQj;Jk62X^_(oag{DoXaTvCnn5Di`*GqCYC7M z@n*Wn9)x7`n9Op1Q0e*}IdXQ#gUR6M@8KvH+_fiP&h#CEW`=e \ No newline at end of file diff --git a/sendform.php b/sendform.php index 806b72a..cb1dd01 100644 --- a/sendform.php +++ b/sendform.php @@ -15,6 +15,10 @@ // $referals is a list of web site domains seperated by commas. Only requests originating from // these domains will be processed. $referals = "domain.com"; + + // Google reCaptcha v2 secret. Obtain your key from https://www.google.com/recaptcha/admin/create + // Enter your secret key below and be sure to integrate reCaptcha into your site with your site key. + $reCaptchaSecret = ""; // $excludeFields is a list of field names seperated by commas. Field names listed here will not // be included in the resulting email of this script. @@ -76,9 +80,30 @@ $theDomain = getdomain($_SERVER['HTTP_REFERER']); checkreferal(); - if(isset($_SESSION['image_random_value']) && strcasecmp(md5(strtoupper($_REQUEST['verification'])), $_SESSION['image_random_value']) != 0) { - die("Verification box did not match image"); - } + + // Google reCaptcha v2 + if(isset($reCaptchaSecret)){ + if(isset($_POST['g-recaptcha-response'])) $captcha=$_POST['g-recaptcha-response']; + else errormsg("Verification failed. Please try again."); + + // post request to server + $url = 'https://www.google.com/recaptcha/api/siteverify?secret=' . urlencode($reCaptchaSecret) . '&response=' . urlencode($captcha); + $ch = curl_init(); + + curl_setopt($ch, CURLOPT_AUTOREFERER, TRUE); + curl_setopt($ch, CURLOPT_HEADER, 0); + curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); + curl_setopt($ch, CURLOPT_URL, $url); + curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE); + + $response = curl_exec($ch); + curl_close($ch); + + $responseKeys = json_decode($response,true); + // should return JSON with success as true + if(!$responseKeys["success"]) errormsg("Verification failed. Please try again."); + } + checkrequired(); if(!validemail($defaultFrom) && !isset($_POST['email'])) bademail($defaultFrom); fillrecipients();