diff --git a/controller/class.LoginController.php b/controller/class.LoginController.php
index d3705815..1de72564 100644
--- a/controller/class.LoginController.php
+++ b/controller/class.LoginController.php
@@ -59,7 +59,8 @@ public function go() {
die();
}
if (isset($_POST['submit']) && $_POST['submit']=='Login'
- && isset($_POST['username']) && isset($_POST['pwd']) ) {
+ && isset($_POST['username']) && isset($_POST['pwd'])
+ && isset($_POST['g-recaptcha-response']) ) {
if ($_POST['username']=='' || $_POST['pwd']=='') {
if ($_POST['username']=='') {
$this->addErrorMessage("Username must not be empty");
@@ -73,6 +74,7 @@ public function go() {
$username = $_POST['username'];
$this->addToView('username', $username);
$user=User::findByUsername($username);
+ $recaptcha_response = $_POST['g-recaptcha-response'];
if (!$user) {
header('Location:'.SOURCE_ROOT_PATH."?url=mainlogin&msg=username");
@@ -83,6 +85,9 @@ public function go() {
} elseif ($user->is_activated != 1){
header('Location:'.SOURCE_ROOT_PATH."?url=mainlogin&msg=activate");
die();
+ } elseif (!Utils::verifyReCaptcha($recaptcha_response)) {
+ header('Location:'.SOURCE_ROOT_PATH."?url=mainlogin&msg=recaptcha");
+ die();
} else {
// start the session
$session->completeLogin($user);
diff --git a/model/common/class.Utils.php b/model/common/class.Utils.php
index a9a5167c..ac453a53 100644
--- a/model/common/class.Utils.php
+++ b/model/common/class.Utils.php
@@ -61,7 +61,7 @@ public function validateEmail($email = '') {
public static function hash($password){
$hash = password_hash($password);
- if (FALSE === $hash)){
+ if (FALSE === $hash){
throw new Exception('Password could not be hashed');
return false;
}
@@ -77,4 +77,29 @@ public static function sanitizeInput($input) {
$input = htmlspecialchars($input);
return $input;
}
+
+ public static function verifyReCaptcha($input) {
+ $url = 'https://www.google.com/recaptcha/api/siteverify';
+ $payload = array(
+ 'response' => $input,
+ 'secret' => G_SECRET_KEY
+ );
+
+ $response = Utils::sendPostRequest($url, $payload);
+ $json_response = json_decode($response, true);
+ return $json_response['success'];
+ }
+
+ public static function sendPostRequest($url, $payload) {
+ $ch = curl_init($url);
+
+ curl_setopt($ch, CURLOPT_POST, 1);
+ curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
+ curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+
+ $response = curl_exec($ch);
+ curl_close($ch);
+
+ return $response;
+ }
}
diff --git a/sample.config.inc.php b/sample.config.inc.php
index 09c967ef..7c66912f 100755
--- a/sample.config.inc.php
+++ b/sample.config.inc.php
@@ -77,6 +77,10 @@
//the installation language
define('LANG','EN');
+//Google recaptcha site_key and secret_key obtained from https://www.google.com/recaptcha/admin
+define('G_SITE_KEY', '#GOOGLE_RECAPTCHA_SITE_KEY');
+define('G_SECRET_KEY', '#GOOGLE_RECAPTCHA_SECRET_KEY');
+
/* Unit Testing Variables*/
define('TEST_USERNAME_ADMIN','#THE_USERNAME_FOR_TESTS');
define('TEST_PASSWORD_ADMIN','#THE_PASSWORD_FOR_tESTS');
diff --git a/view/user_login.tpl b/view/user_login.tpl
index 50dfbe42..4f5a4eea 100755
--- a/view/user_login.tpl
+++ b/view/user_login.tpl
@@ -6,10 +6,12 @@
+
+