V4.17.0 (#421)

* Do not run migrations on the fresh installation.

* Prevent updating the option on each admin request.

* Honeypot - first implementation.

* Honeypot - move the script to hcaptcha.js.

* Update yarn.

* Honeypot - update tests.

* Update packages.

* Honeypot - ignore hcap_hp_sig field.

* Honeypot - add setting.

* Update readme.txt.

* Add hCaptcha to Layouts 3 and 4 on Blocksy WC Product page.

* Update changelog from readme.txt

* Fix test.

* Bump up the version to 4.17.0-RC1.

* Cover app.js 100%.

* Cover app.js 100%.

* Cover hcaptcha.js.

* Cover hcaptcha.js.

* Cover hcaptcha.js.

* Cover files in src/js 100%.

* Cover Integrations.php.

* Cover Integrations.php.

* Cover Integrations.php.

* Cover Integrations.php 100%.

* Code style and 100% coverage for the Settings dir.

* Cover CommentBase.php.

* Cover CommentBase.php.

* Cover CommentBase.php.

* Code style.

* Cover Main.php.

* Cover Discuz.

* Cover Notifications.

* Cover Notifications.

* Add a notification message on the placeholder when hCaptcha failed to load.

* Update changelog from readme.txt

* Verify honeypot nonce for logged-in users only.

* Code style.

* Add a minimal form submit time check.

* Add FST token error messages.

* Fix a fatal error on saving the Integration settings with active plugins having all switches off.

* Update changelog from readme.txt

* Bump up the version to 4.17.0-RC2.

* Code style.

* Fix tests.

* Code style.

* Add form submit time settings.

* Fix signature mismatch error.

* Fix an issue with several Divi optin email forms on the page.

* Update changelog from readme.txt

* Bump up the version to 4.17.0-RC3.

* Remove hCaptcha fields from Divi processing.

* Do not perform antispam actions during Check Config on the General page.

* Fix conflict with reCaptcha in Divi Contact form.

* Revert not related changes.

* Update FST token upon sending a form.

* Update FST token upon sending a form.

* Fix tests.

* Update changelog from readme.txt

* Add hCaptcha error messages to Divi email optin form.

* Fix activation of blocksy plugins with any theme.

* Fix activation of blocksy plugins with any theme.

* Update changelog from readme.txt

* Fix activation of blocksy plugins with any theme.

* Update changelog from readme.txt

* Use JSON_UNESCAPED_UNICODE in the FST signature.

* Fix client problem on a shared hosting - get rid of SHORTINIT.

* Bump up the version to 4.17.0-RC4.

* Fix floating bug with disappearing hcap_hp_ input.

* Move honeypot input only once and together with its label.

* Fix jest.

* Bump up the version to 4.17.0-RC5.

* Refresh hCaptcha upon failed submission in Jetpack.

* Update changelog from readme.txt

* Refine Form Submit Time token info sent and stored.

* Add honeypot and token processing to WC Checkout.

* Remove debug log.

* Set honeypot and token off by default.

* Set honeypot and token off by default - fix tests.

* Add honeypot and token processing to WPForms.

* Add honeypot and token processing to MailChimp.

* Add honeypot and token processing to MailChimp.

* Add honeypot and token processing to Avada.

* Add honeypot and token processing to Spectra.

* Fix Ninja Forms uncaught type error in JS.

* Update changelog from readme.txt

* Bump up the version to 4.17.0-RC6.

* Fix Ninja Forms when form duplicates are on the same page.

* Update changelog from readme.txt

* Code style in spectra.js.

* Add honeypot and token processing to NF (prepare).

* Code style in HCaptcha.php.

* Add honeypot and token processing to NF.

* Fix a fatal error in the Protect Content feature.

* Fix Chrome Autofill issue with honeypot.

* Add hCaptcha error messages to the JetPack form.

* Update changelog from readme.txt

* Fix honeypot and token processing with Protect Content.

* Allow the honeypot and token on updated integrations only.

* Fix honeypot and token processing with Protect Content.

* Update changelog from readme.txt

* Bump up the version to 4.17.0.

* Show the honeypot icon on the Integrations page.

---------

Co-authored-by: hCaptcha GHA <gha@hcaptcha.com>

Author: kagg-design

assets/css/general.css

@@ -327,17 +327,33 @@ h3.closed .hcaptcha-section-header-toggle:after {
 	display: grid;
 	grid-template-columns: repeat(2, 1fr);
 	grid-template-areas:
+		"set-min-submit-time min-submit-time"
+		"honeypot min-submit-time"
 		"antispam antispam-provider";
 	gap: 0 20px;
 	padding: 15px 20px;
 }
 
+.hcaptcha-section-antispam + table tbody tr.hcaptcha-general-set-min-submit-time {
+	grid-area: set-min-submit-time;
+}
+
+.hcaptcha-section-antispam + table tbody tr.hcaptcha-general-min-submit-time {
+	grid-area: min-submit-time;
+}
+
+.hcaptcha-section-antispam + table tbody tr.hcaptcha-general-honeypot {
+	grid-area: honeypot;
+}
+
 .hcaptcha-section-antispam + table tbody tr.hcaptcha-general-antispam {
 	grid-area: antispam;
+	padding-top: 15px;
 }
 
 .hcaptcha-section-antispam + table tbody tr.hcaptcha-general-antispam-provider {
 	grid-area: antispam-provider;
+	padding-top: 15px;
 }
 
 .hcaptcha-section-antispam + table tbody tr.hcaptcha-general-antispam-provider div {
@@ -354,6 +370,7 @@ h3.closed .hcaptcha-section-header-toggle:after {
 	width: max-content;
 }
 
+.hcaptcha-section-antispam + table tbody tr.hcaptcha-general-min-submit-time td,
 .hcaptcha-section-antispam + table tbody tr.hcaptcha-general-antispam-provider td {
 	width: auto;
 }
@@ -363,6 +380,14 @@ h3.closed .hcaptcha-section-header-toggle:after {
 	width: 100%;
 }
 
+.hcaptcha-section-antispam + table tbody tr.hcaptcha-general-honeypot th {
+	padding: 0;
+}
+
+.hcaptcha-section-antispam + table tbody tr td input {
+	width: 100%;
+}
+
 /* Section Other */
 .hcaptcha-section-other + table tbody {
 	display: grid;

assets/css/integrations.css

@@ -154,6 +154,12 @@
 	width: 100%;
 }
 
+#hcaptcha-options label + .helper {
+	position: absolute;
+	right: 0;
+	width: 100%;
+}
+
 #hcaptcha-options label[data-antispam] + .helper::before {
 	content: '';
 	background: url('../images/antispam-green.svg');
@@ -165,11 +171,16 @@
 	transform: translate(0, 0);
 }
 
-#hcaptcha-options label[data-antispam="native"] + .helper::before {
+#hcaptcha-options label:is([data-antispam-native],[data-antispam-native]) + .helper::before {
 	background: url('../images/antispam-yellow.svg');
 	background-size: cover;
 }
 
+#hcaptcha-options label:is([data-antispam-honeypot],[data-antispam-honeypot]) + .helper::before {
+	background: url('../images/antispam-honeypot.svg');
+	background-size: cover;
+}
+
 #hcaptcha-options fieldset:disabled label[data-antispam] + .helper::before {
 	opacity: 0.7;
 }

assets/images/antispam-honeypot.svg

@@ -2,7 +2,6 @@
 
 /**
  * @param HCaptchaJetpackObject.hCaptcha
- * @param window.hCaptchaJetpack
  */
 
 const jetpack = window.hCaptchaJetpack || ( function( document, window, wp ) {

assets/js/admin-jetpack.js

@@ -0,0 +1,27 @@
+/* global jQuery */
+
+const hCaptchaAvada = window.hCaptchaAvada || ( function( window, $ ) {
+	const app = {
+		init() {
+			$( app.ready );
+			$( document ).on( 'ajaxSuccess', app.ajaxSuccessHandler );
+		},
+
+		// jQuery ajaxSuccess handler.
+		ajaxSuccessHandler( event, xhr, settings ) {
+			const params = new URLSearchParams( settings.data );
+
+			if ( params.get( 'action' ) !== 'fusion_form_submit_ajax' ) {
+				return;
+			}
+
+			window.hCaptchaBindEvents();
+		},
+	};
+
+	return app;
+}( window, jQuery ) );
+
+window.hCaptchaAvada = hCaptchaAvada;
+
+hCaptchaAvada.init();

assets/js/hcaptcha-avada.js

@@ -14,7 +14,7 @@ const customerReviews = window.hCaptchaCustomerReviews || ( function( document,
 				'hcaptcha.formSelector',
 				'hcaptcha',
 				( formSelector ) => {
-					return formSelector + ', div#tab-reviews, div#tab-cr_qna, div.cr-qna-list-inl-answ';
+					return formSelector + ', div#tab-reviews, div#tab-cr_qna, div.cr-qna-list-inl-answ, div.cr-qna-new-q-form';
 				},
 			);
 
@@ -33,7 +33,8 @@ const customerReviews = window.hCaptchaCustomerReviews || ( function( document,
 			$( document ).on(
 				'click',
 				'#tab-title-reviews a, #tab-title-cr_qna a, ' +
-				'button.cr-review-form-continue.cr-review-form-error',
+				'button.cr-review-form-continue.cr-review-form-error, ' +
+				'button.cr-qna-ask-button',
 				function() {
 					hCaptchaBindEvents();
 				},

assets/js/hcaptcha-customer-reviews.js

@@ -5,11 +5,26 @@ import { helper } from './hcaptcha-helper.js';
 ( function( $ ) {
 	// noinspection JSCheckFunctionSignatures
 	$.ajaxPrefilter( function( options ) {
+		// eslint-disable-next-line @wordpress/no-global-active-element
+		let $form = $( document.activeElement ).closest( 'form' );
+
+		$form = $form.length ? $form : $( '.et_pb_newsletter_form form' );
+
 		helper.addHCaptchaData(
 			options,
 			'et_pb_submit_subscribe_form',
 			'hcaptcha_divi_email_optin_nonce',
-			$( '.et_pb_newsletter_form form' )
+			$form
 		);
 	} );
+
+	$( document ).on( 'ajaxSuccess', function( event, xhr, settings ) {
+		const params = new URLSearchParams( settings.data );
+
+		if ( params.get( 'action' ) !== 'et_pb_submit_subscribe_form' ) {
+			return;
+		}
+
+		window.hCaptchaBindEvents();
+	} );
 }( jQuery ) );

assets/js/hcaptcha-divi-email-optin.js

@@ -0,0 +1,72 @@
+/* global HCaptchaFSTObject */
+
+/**
+ * @param HCaptchaFSTObject.ajaxUrl
+ * @param HCaptchaFSTObject.issueTokenAction
+ */
+
+/**
+ * The 'Form Submit Token' script.
+ *
+ * @param {Document} document The document instance.
+ */
+const fst = window.hCaptchaFST || ( function( document ) {
+	/**
+	 * Public functions and properties.
+	 *
+	 * @type {Object}
+	 */
+	const app = {
+		init() {
+			let hCaptchaLoaded;
+
+			document.addEventListener( 'hCaptchaAfterBindEvents', function() {
+				if ( ! hCaptchaLoaded ) {
+					return;
+				}
+
+				app.getToken();
+			} );
+
+			document.addEventListener( 'hCaptchaLoaded', function() {
+				app.getToken();
+
+				hCaptchaLoaded = true;
+			} );
+		},
+
+		getToken() {
+			( async function() {
+				const bodyClassName = document.body.className;
+				let postId = bodyClassName.match( /post-id-(\d+)/ )?.[ 1 ] ?? '';
+				postId = bodyClassName.match( /page-id-(\d+)/ )?.[ 1 ] ?? postId;
+				const formBody = new URLSearchParams();
+
+				formBody.set( 'action', HCaptchaFSTObject.issueTokenAction );
+				formBody.set( 'postId', postId );
+
+				const res = await fetch( HCaptchaFSTObject.ajaxUrl, {
+					method: 'POST',
+					credentials: 'same-origin',
+					cache: 'no-store',
+					headers: {
+						'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8',
+					},
+					body: formBody.toString(),
+				} );
+				const body = await res.json();
+				const token = body?.data?.token ?? '';
+
+				document.querySelectorAll( '[name="hcap_fst_token"]' ).forEach( ( element ) => {
+					element.value = token;
+				} );
+			}() );
+		},
+	};
+
+	return app;
+}( document ) );
+
+window.hCaptchaFST = fst;
+
+fst.init();

assets/js/hcaptcha-fst.js

@@ -1,3 +1,5 @@
+/* global jQuery */
+
 export class helper {
 	static addHCaptchaData( options, action, nonceName, $node ) {
 		const data = options.data ?? '';
@@ -6,22 +8,103 @@ export class helper {
 			return;
 		}
 
-		const hCaptchaData = helper.getHCaptchaData( $node, nonceName );
-
-		options.data +=
-			'&h-captcha-response=' + hCaptchaData.response +
-			'&hcaptcha-widget-id=' + hCaptchaData.id +
-			'&' + nonceName + '=' + hCaptchaData.nonce;
+		options.data += helper.getHCaptchaData( $node, nonceName );
 	}
 
+	/**
+	 * Get hCaptcha data from a node.
+	 *
+	 * @param {jQuery} $node     Node.
+	 * @param {string} nonceName Nonce name.
+	 * @return {string} Data.
+	 */
 	static getHCaptchaData( $node, nonceName ) {
-		let response = $node.find( '[name="h-captcha-response"]' ).val();
-		response = response ? response : '';
-		let id = $node.find( '[name="hcaptcha-widget-id"]' ).val();
-		id = id ? id : '';
-		let nonce = $node.find( '[name="' + nonceName + '"]' ).val();
-		nonce = nonce ? nonce : '';
-
-		return { response, id, nonce };
+		const hpName = $node.find( '[name^="hcap_hp_"]' ).first().attr( 'name' ) ?? '';
+		const names = [ 'h-captcha-response', 'hcaptcha-widget-id', nonceName, hpName, 'hcap_hp_sig', 'hcap_fst_token' ];
+
+		let data = '';
+
+		for ( const name of names ) {
+			if ( ! name ) {
+				continue;
+			}
+
+			const val = $node.find( `[name="${ name }"]` ).first().val() ?? '';
+
+			data += `&${ name }=${ val }`;
+		}
+
+		return data;
+	}
+
+	/**
+	 * Installs a composable wrapper around window.fetch and dispatches custom events.
+	 * - Does not alter request/response behavior.
+	 * - Returns the original Promise from fetch.
+	 * - Safe to call multiple times (idempotent).
+	 */
+	static installFetchEvents() {
+		if ( typeof window === 'undefined' || typeof window.fetch !== 'function' ) {
+			return;
+		}
+
+		// Prevent double wrapping.
+		if ( window.__hcapFetchWrapped ) {
+			return;
+		}
+
+		( function( prevFetch ) {
+			window.fetch = function( ...args ) {
+				// Fire "before" event prior to the actual call.
+				try {
+					window.dispatchEvent(
+						new CustomEvent( 'hCaptchaFetch:before', { detail: { args } } )
+					);
+				} catch ( e ) {
+					// Never break the chain because of event listener errors.
+				}
+
+				const p = prevFetch( ...args );
+
+				// Side-subscribe without altering the returned Promise.
+				p.then( ( response ) => {
+					try {
+						window.dispatchEvent(
+							new CustomEvent( 'hCaptchaFetch:success', {
+								detail: { args, response: response.clone() },
+							} )
+						);
+					} catch ( e ) {
+					}
+				} ).catch( ( error ) => {
+					try {
+						window.dispatchEvent(
+							new CustomEvent( 'hCaptchaFetch:error', { detail: { args, error } } )
+						);
+					} catch ( e ) {
+					}
+				} ).finally( () => {
+					try {
+						window.dispatchEvent(
+							new CustomEvent( 'hCaptchaFetch:complete', { detail: { args } } )
+						);
+					} catch ( e ) {
+					}
+				} );
+
+				return p;
+			};
+		}( window.fetch ) );
+
+		// Mark as wrapped (non-enumerable if possible).
+		try {
+			Object.defineProperty( window, '__hcapFetchWrapped', {
+				value: true,
+				configurable: true,
+			} );
+		} catch ( e ) {
+			// Fallback if defineProperty is restricted.
+			window.__hcapFetchWrapped = true;
+		}
 	}
 }