hCaptcha
diff --git a/‎.wordpress-org/blueprints/blueprint.json‎
Lines changed: 91 additions & 6 deletions b/‎.wordpress-org/blueprints/blueprint.json‎
Lines changed: 91 additions & 6 deletions
diff --git a/‎SECURITY.md‎
Lines changed: 3 additions & 17 deletions b/‎SECURITY.md‎
Lines changed: 3 additions & 17 deletions
diff --git a/‎assets/css/integrations.css‎
Lines changed: 64 additions & 18 deletions b/‎assets/css/integrations.css‎
Lines changed: 64 additions & 18 deletions
diff --git a/‎assets/images/antispam-fst.svg‎
Lines changed: 9 additions & 0 deletions b/‎assets/images/antispam-fst.svg‎
Lines changed: 9 additions & 0 deletions
diff --git a/‎assets/images/antispam-honeypot.svg‎
Lines changed: 1 addition & 1 deletion b/‎assets/images/antispam-honeypot.svg‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎assets/images/demo/honeypot.png‎
65.1 KB b/‎assets/images/demo/honeypot.png‎
65.1 KB
diff --git a/‎assets/js/hcaptcha-acfe.js‎
Lines changed: 55 additions & 42 deletions b/‎assets/js/hcaptcha-acfe.js‎
Lines changed: 55 additions & 42 deletions
diff --git a/‎assets/js/hcaptcha-avada.js‎
Lines changed: 0 additions & 1 deletion b/‎assets/js/hcaptcha-avada.js‎
Lines changed: 0 additions & 1 deletion
diff --git a/‎assets/js/hcaptcha-brizy.js‎
Lines changed: 2 additions & 2 deletions b/‎assets/js/hcaptcha-brizy.js‎
Lines changed: 2 additions & 2 deletions
@@ -11,9 +11,14 @@
     "networking": true
   },
   "steps": [
+    {
+      "step": "login",
+      "username": "admin",
+      "password": "password"
+    },
     {
       "step": "installPlugin",
-      "pluginZipFile": {
+      "pluginData": {
         "resource": "wordpress.org/plugins",
         "slug": "hcaptcha-for-forms-and-more"
       },
@@ -23,18 +28,98 @@
     },
     {
       "step": "installPlugin",
-      "pluginZipFile": {
+      "pluginData": {
         "resource": "wordpress.org/plugins",
-        "url": "contact-form-7"
+        "slug": "contact-form-7"
       },
       "options": {
         "activate": true
       }
     },
     {
-      "step": "login",
-      "username": "admin",
-      "password": "password"
+      "step": "setSiteOptions",
+      "options": {
+        "hcaptcha_settings": {
+          "wp_status": [
+            "comment",
+            "login",
+            "lost_pass",
+            "password_protected",
+            "register"
+          ],
+          "cf7_status": [
+            "form",
+            "embed",
+            "live",
+            "replace_rsc"
+          ],
+          "_network_wide": [],
+          "off_when_logged_in": [],
+          "recaptcha_compat_off": [],
+          "secret_key": "",
+          "theme": "light",
+          "size": "normal",
+          "language": "",
+          "whitelisted_ips": "100.200.0.2\n220.45.45.1\n",
+          "mode": "test:publisher",
+          "site_key": "",
+          "delay": "0",
+          "login_limit": "0",
+          "login_interval": "5",
+          "force": [
+            "on"
+          ],
+          "statistics": [
+            "on"
+          ],
+          "custom_themes": [],
+          "api_host": "js.hcaptcha.com",
+          "asset_host": "",
+          "endpoint": "",
+          "host": "",
+          "image_host": "",
+          "report_api": "",
+          "sentry": "",
+          "backend": "api.hcaptcha.com",
+          "license": "pro",
+          "menu_position": [],
+          "sample_hcaptcha": "",
+          "check_config": "",
+          "reset_notifications": "",
+          "custom_prop": "",
+          "custom_value": "",
+          "hide_login_errors": [],
+          "anonymous": [],
+          "protect_content": [],
+          "protected_urls": "\/protected-content",
+          "cleanup_on_uninstall": [],
+          "whats_new_last_shown_version": "4.18.0",
+          "blacklisted_ips": "",
+          "antispam": [
+            "on"
+          ],
+          "antispam_provider": "akismet",
+          "honeypot": [
+            "on"
+          ],
+          "set_min_submit_time": [
+            "on"
+          ],
+          "min_submit_time": "2",
+          "show_antispam_coverage": [
+            "on"
+          ]
+        }
+      }
+    },
+    {
+      "step": "runPHP",
+      "code": "<?php require_once '/wordpress/wp-load.php'; \\HCaptcha\\Admin\\Events\\Events::create_table(); $forms = get_posts( [ 'post_type' => 'wpcf7_contact_form', 'post_status' => 'publish', 'posts_per_page' => 1 ] ); $form = reset( $forms ); $shortcode = '[contact-form-7 id=\"' . (int) $form->ID . '\"]'; $page_id = wp_insert_post( [ 'post_type' => 'page', 'post_title' => 'Contact Form 7 Test Page', 'post_status' => 'publish', 'post_content' => $shortcode, 'post_name' => 'contact-form-7-test' ] ); update_option( 'page_on_front', $page_id ); update_option( 'show_on_front', 'page' );"
+    },
+    {
+      "step": "writeFile",
+      "path": "/wordpress/wp-content/mu-plugins/hcaptcha.php",
+      "data": "<?php add_filter( 'wpcf7_skip_mail', '__return_true' ); ?>"
     }
   ]
 }
@@ -4,25 +4,11 @@ We in hCaptcha take the security of our software products and services seriously
 
 If you believe you have found a security vulnerability in any hCaptcha-owned repository, please report it to us as described below.
 
-## Reporting Security Issues
+## How can I report security bugs?
 
-**Please do not report security vulnerabilities through public GitHub issues.**
-
-Please email to [secure@kagg.eu](mailto:secure@kagg.eu).
-
-You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message.
+You can report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team helps validate, triage and handle any security vulnerabilities. [Report a security vulnerability.](https://patchstack.com/database/wordpress/plugin/hcaptcha-for-forms-and-more/vdp)
 
-Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:
-
-* Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
-* Full paths of source file(s) related to the manifestation of the issue
-* The location of the affected source code (tag/branch/commit or direct URL)
-* Any special configuration required to reproduce the issue
-* Step-by-step instructions to reproduce the issue
-* Proof-of-concept or exploit code (if possible)
-* Impact of the issue, including how an attacker might exploit the issue
-
-This information will help us triage your report more quickly.
+**Please do not report security vulnerabilities through public GitHub issues.**
 
 ## Preferred Languages
 
 
@@ -1,3 +1,12 @@
+.form-table:first-of-type tr {
+	background: none;
+	padding: 10px 0;
+}
+
+.form-table:first-of-type tr th {
+	display: none;
+}
+
 #hcaptcha-options p {
 	margin: 0.5em 0;
 }
@@ -156,37 +165,74 @@
 
 #hcaptcha-options label + .helper {
 	position: absolute;
+	display: none;
+	flex-direction: row-reverse;
 	right: 0;
-	width: 100%;
+	margin-top: 6px;
+	width: calc(100% - 40px);
+	height: 1.25rem;
+	box-sizing: border-box;
 }
 
-#hcaptcha-options label[data-antispam] + .helper::before {
-	content: '';
-	background: url('../images/antispam-green.svg');
-	background-size: cover;
-	width: 18px;
-	height: 20px;
-	top: 0.35em;
-	border-radius: unset;
-	transform: translate(0, 0);
+#hcaptcha-options label + .helper:hover {
+	cursor: initial;
 }
 
-#hcaptcha-options label:is([data-antispam-native],[data-antispam-native]) + .helper::before {
-	background: url('../images/antispam-yellow.svg');
-	background-size: cover;
+#hcaptcha-options label + .helper i {
+	cursor: help;
 }
 
-#hcaptcha-options label:is([data-antispam-honeypot],[data-antispam-honeypot]) + .helper::before {
-	background: url('../images/antispam-honeypot.svg');
+#hcaptcha-options label + .helper:before {
+	display: none;
+}
+
+/* Display antispam icons inserted by JS as <i> elements. */
+#hcaptcha-options label + .helper i[class^="antispam"] {
+	display: inline-block;
+	width: 18px;
+	height: 20px;
 	background-size: cover;
+	background-repeat: no-repeat;
+	background-position: center center;
+	vertical-align: middle;
 }
 
-#hcaptcha-options fieldset:disabled label[data-antispam] + .helper::before {
+#hcaptcha-options fieldset:disabled label + .helper i[class^="antispam"] {
 	opacity: 0.7;
 }
 
-#hcaptcha-options label[data-antispam] + .helper .helper-content {
-	transform: translate(0px, 38px);
+#hcaptcha-options label + .helper i.antispam-hcaptcha {
+	background-image: url('../images/antispam-green.svg');
+}
+
+#hcaptcha-options label + .helper i.antispam-native {
+	background-image: url('../images/antispam-yellow.svg');
+}
+
+#hcaptcha-options label + .helper i.antispam-honeypot {
+	background-image: url('../images/antispam-honeypot.svg');
+}
+
+#hcaptcha-options label + .helper i.antispam-fst {
+	background-image: url('../images/antispam-fst.svg');
+	width: 24px;
+	transform: translateY(1px);
+}
+
+#hcaptcha-options fieldset .helper .helper-content {
+	transform: translate(0px, 37px);
+	width: calc(100% + 40px);
+	/* Transition */
+	display: block;
+	visibility: hidden;
+	opacity: 0;
+}
+
+#hcaptcha-options fieldset .helper:hover .helper-content {
+	/* Transition */
+	visibility: visible;
+	opacity: 1;
+	transition: opacity .2s ease .3s, visibility 0s linear .3s;
 }
 
 .hcaptcha-disabled-section {
 
@@ -1,46 +1,59 @@
-const acfe = function() {
-	function hCaptchaACFECallback( response, callback ) {
-		[
-			...document.querySelectorAll(
-				'.acfe-field-recaptcha input[type="hidden"]'
-			),
-		].map( ( el ) => {
-			el.value = response;
-			return el;
-		} );
-
-		if ( callback !== undefined ) {
-			callback( response );
-		}
-	}
-
-	function hCaptchaACFEOnLoad() {
-		window.hCaptchaOnLoad = hCaptchaACFEOnLoadSaved;
-		window.hCaptchaOnLoad();
-	}
-
-	const params = window.hCaptcha.getParams();
-	const savedCallback = params.callback;
-	const savedErrorCallback = params[ 'error-callback' ];
-	const savedExpiredCallback = params[ 'expired-callback' ];
-
-	params.callback = ( response ) => {
-		hCaptchaACFECallback( response, savedCallback );
+/* global jQuery */
+
+const hCaptchaACFE = window.hCaptchaACFE || ( function( window, $ ) {
+	const app = {
+		savedOnLoad: null,
+
+		init() {
+			// Install custom callbacks to sync token into ACFE hidden field.
+			app.installCallbacks();
+
+			// Bind ajaxComplete event to re-bind hCaptcha after AJAX requests.
+			$( document ).on( 'ajaxComplete', app.ajaxCompleteHandler );
+		},
+
+		installCallbacks() {
+			const params = window.hCaptcha.getParams();
+			const savedCallback = params.callback;
+			const savedErrorCallback = params[ 'error-callback' ];
+			const savedExpiredCallback = params[ 'expired-callback' ];
+
+			params.callback = ( response ) => app.updateHidden( response, savedCallback );
+			params[ 'error-callback' ] = () => app.updateHidden( '', savedErrorCallback );
+			params[ 'expired-callback' ] = () => app.updateHidden( '', savedExpiredCallback );
+
+			window.hCaptcha.setParams( params );
+
+			app.savedOnLoad = window.hCaptchaOnLoad;
+			window.hCaptchaOnLoad = app.onLoadWrapper;
+		},
+
+		updateHidden( response, callback ) {
+			[ ...document.querySelectorAll( '.acfe-field-recaptcha input[id^="acf-field_"]' ) ].forEach( ( el ) => {
+				el.value = response;
+			} );
+
+			if ( callback ) {
+				callback( response );
+			}
+		},
+
+		onLoadWrapper() {
+			window.hCaptchaOnLoad = app.savedOnLoad;
+			window.hCaptchaOnLoad();
+		},
+
+		ajaxCompleteHandler() {
+			// ACFE may perform AJAX validation; simply re-bind safely after requests.
+			if ( typeof window.hCaptchaBindEvents === 'function' ) {
+				window.hCaptchaBindEvents();
+			}
+		},
 	};
-	params[ 'error-callback' ] = () => {
-		hCaptchaACFECallback( '', savedErrorCallback );
-	};
-	params[ 'expired-callback' ] = () => {
-		hCaptchaACFECallback( '', savedExpiredCallback );
-	};
-
-	window.hCaptcha.setParams( params );
-
-	const hCaptchaACFEOnLoadSaved = window.hCaptchaOnLoad;
 
-	window.hCaptchaOnLoad = hCaptchaACFEOnLoad;
-};
+	return app;
+}( window, jQuery ) );
 
-window.hCaptchaACFE = acfe;
+window.hCaptchaACFE = hCaptchaACFE;
 
-acfe();
+hCaptchaACFE.init();
@@ -3,7 +3,6 @@
 const hCaptchaAvada = window.hCaptchaAvada || ( function( window, $ ) {
 	const app = {
 		init() {
-			$( app.ready );
 			$( document ).on( 'ajaxSuccess', app.ajaxSuccessHandler );
 		},
 
 
@@ -20,12 +20,12 @@ import { helper } from './hcaptcha-helper.js';
 		// The hcaptcha-widget-id is already in the data object.
 		data.push( {
 			name: 'h-captcha-response',
-			value: hCaptchaData.response,
+			value: hCaptchaData[ 'h-captcha-response' ],
 			required: false,
 		} );
 		data.push( {
 			name: nonceName,
-			value: hCaptchaData.nonce,
+			value: hCaptchaData[ nonceName ],
 			required: false,
 		} );