llvy.ltd/casdoor
1
0
Fork 0
mirror of https://github.com/casdoor/casdoor.git synced 2025-05-23 02:35:49 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: fix secret information issue in the CAPTCHA provider code (#2531)

Browse Source
This commit is contained in:
HGZ-20 2023-12-11 18:01:56 +08:00 committed by GitHub
parent b068202e74
commit dc06eb9948
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 49 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
controllers/account.go
View File

@ -479,7 +479,7 @@ func (c *ApiController) GetCaptcha() {
Type: captchaProvider.Type, Type: captchaProvider.Type,
SubType: captchaProvider.SubType, SubType: captchaProvider.SubType,
ClientId: captchaProvider.ClientId, ClientId: captchaProvider.ClientId,
ClientSecret: captchaProvider.ClientSecret, ClientSecret: "***",
ClientId2: captchaProvider.ClientId2, ClientId2: captchaProvider.ClientId2,
ClientSecret2: captchaProvider.ClientSecret2, ClientSecret2: captchaProvider.ClientSecret2,
}) })

10
controllers/auth.go
View File

@ -387,6 +387,16 @@ func (c *ApiController) Login() {
c.ResponseError(err.Error()) c.ResponseError(err.Error())
return return
} else if enableCaptcha { } else if enableCaptcha {
captchaProvider, err := object.GetCaptchaProviderByApplication(util.GetId(application.Owner, application.Name), "false", c.GetAcceptLanguage())
if err != nil {
c.ResponseError(err.Error())
return
}
if captchaProvider.Type != "Default" {
authForm.ClientSecret = captchaProvider.ClientSecret
}
var isHuman bool var isHuman bool
isHuman, err = captcha.VerifyCaptchaByCaptchaType(authForm.CaptchaType, authForm.CaptchaToken, authForm.ClientSecret) isHuman, err = captcha.VerifyCaptchaByCaptchaType(authForm.CaptchaType, authForm.CaptchaToken, authForm.ClientSecret)
if err != nil { if err != nil {

43
controllers/verification.go
View File

@ -53,17 +53,34 @@ func (c *ApiController) SendVerificationCode() {
return return
} }
if vform.CaptchaType != "none" { provider, err := object.GetCaptchaProviderByApplication(vform.ApplicationId, "false", c.GetAcceptLanguage())
if captchaProvider := captcha.GetCaptchaProvider(vform.CaptchaType); captchaProvider == nil { if err != nil {
c.ResponseError(c.T("general:don't support captchaProvider: ") + vform.CaptchaType) c.ResponseError(err.Error())
return return
} else if isHuman, err := captchaProvider.VerifyCaptcha(vform.CaptchaToken, vform.ClientSecret); err != nil { }
c.ResponseError(err.Error())
return if provider != nil {
} else if !isHuman { if vform.CaptchaType != provider.Type {
c.ResponseError(c.T("verification:Turing test failed.")) c.ResponseError(c.T("verification:Turing test failed."))
return return
} }
if provider.Type != "Default" {
vform.ClientSecret = provider.ClientSecret
}
if vform.CaptchaType != "none" {
if captchaProvider := captcha.GetCaptchaProvider(vform.CaptchaType); captchaProvider == nil {
c.ResponseError(c.T("general:don't support captchaProvider: ") + vform.CaptchaType)
return
} else if isHuman, err := captchaProvider.VerifyCaptcha(vform.CaptchaToken, vform.ClientSecret); err != nil {
c.ResponseError(err.Error())
return
} else if !isHuman {
c.ResponseError(c.T("verification:Turing test failed."))
return
}
}
} }
application, err := object.GetApplication(vform.ApplicationId) application, err := object.GetApplication(vform.ApplicationId)
@ -225,6 +242,16 @@ func (c *ApiController) VerifyCaptcha() {
return return
} }
captchaProvider, err := object.GetCaptchaProviderByOwnerName(vform.ApplicationId, c.GetAcceptLanguage())
if err != nil {
c.ResponseError(err.Error())
return
}
if captchaProvider.Type != "Default" {
vform.ClientSecret = captchaProvider.ClientSecret
}
provider := captcha.GetCaptchaProvider(vform.CaptchaType) provider := captcha.GetCaptchaProvider(vform.CaptchaType)
if provider == nil { if provider == nil {
c.ResponseError(c.T("verification:Invalid captcha provider.")) c.ResponseError(c.T("verification:Invalid captcha provider."))

3
web/src/backend/UserBackend.js
View File

@ -153,11 +153,12 @@ export function sendCode(captchaType, captchaToken, clientSecret, method, countr
}); });
} }
export function verifyCaptcha(captchaType, captchaToken, clientSecret) { export function verifyCaptcha(owner, name, captchaType, captchaToken, clientSecret) {
const formData = new FormData(); const formData = new FormData();
formData.append("captchaType", captchaType); formData.append("captchaType", captchaType);
formData.append("captchaToken", captchaToken); formData.append("captchaToken", captchaToken);
formData.append("clientSecret", clientSecret); formData.append("clientSecret", clientSecret);
formData.append("applicationId", `${owner}/${name}`);
return fetch(`${Setting.ServerUrl}/api/verify-captcha`, { return fetch(`${Setting.ServerUrl}/api/verify-captcha`, {
method: "POST", method: "POST",
credentials: "include", credentials: "include",

2
web/src/common/CaptchaPreview.js
View File

@ -50,7 +50,7 @@ export const CaptchaPreview = (props) => {
}; };
const onOk = (captchaType, captchaToken, clientSecret) => { const onOk = (captchaType, captchaToken, clientSecret) => {
UserBackend.verifyCaptcha(captchaType, captchaToken, clientSecret).then(() => { UserBackend.verifyCaptcha(owner, name, captchaType, captchaToken, clientSecret).then(() => {
setVisible(false); setVisible(false);
}); });
}; };