Treat an empty SITE_KEY as error

Recently I had a configuration error where the SITE_KEY remained unset
and the empty defaults made the widget render without the captcha and
subsequently fail every submission. While the form showed a validation
error, it took days until someone reported it.  Lack of logging made
tracking down this issue needlessly long as well.  When this widget is
required, having an empty SITE_KEY and/or SITE_SECRET is simply an error
and should be handled as such.

While here, simplify the widget and add the SITE_KEY as the hidden input
field's value= instead of creating a free floating <script> tag with a
single variable...

Remove the empty defaults, they dont make sense.
This diff is against 0.16.1
This commit is contained in:
Frantisek Holop 2020-04-03 22:18:43 +02:00
parent b0cb1901aa
commit ae772a09b2
4 changed files with 14 additions and 40 deletions

View file

@ -1,7 +1,5 @@
from django.conf import settings
from . import defaults
__title__ = 'fobi.contrib.plugins.form_elements.security.' \
'invisible_recaptcha.conf'
__author__ = 'Artur Barseghyan <artur.barseghyan@gmail.com>'
@ -26,8 +24,9 @@ def get_setting(setting, override=None):
"""
if override is not None:
return override
key = 'FOBI_PLUGIN_INVISIBLE_RECAPTCHA_{0}'.format(setting)
key = "FOBI_PLUGIN_INVISIBLE_RECAPTCHA_{0}".format(setting)
if hasattr(settings, key):
return getattr(settings, key)
else:
return getattr(defaults, setting)
return ""

View file

@ -1,11 +0,0 @@
__title__ = 'fobi.contrib.plugins.form_elements.security.honeypot.defaults'
__author__ = 'Artur Barseghyan <artur.barseghyan@gmail.com>'
__copyright__ = '2014-2019 Artur Barseghyan'
__license__ = 'GPL 2.0/LGPL 2.1'
__all__ = (
'SITE_KEY',
'SITE_SECRET',
)
SITE_KEY = ''
SITE_SECRET = ''

View file

@ -8,17 +8,12 @@
;
function g_recaptcha_onSubmit(token) {
console.log("g_recaptcha_onSubmit")
// document.getElementById("fobi-form").submit();
// document.getElementsByClassName("form-horizontal").submit();
// $('form.form-horizontal').submit();
$('form#fobi-form').submit();
}
$(document).ready(function() {
var siteKey = window.InvisibleRecaptchaSiteKey || "";
var siteKey = $("#id_captcha").val();
if (siteKey) {
// var submitFormButton = $('form.form-horizontal button[type=submit]');
var submitFormButton = $('form#fobi-form button[type=submit]');
submitFormButton.addClass('g-recaptcha');
submitFormButton.attr('data-sitekey', siteKey);

View file

@ -1,6 +1,4 @@
# from django.utils.html import format_html
from django.forms.widgets import HiddenInput
from django.utils.safestring import mark_safe
from fobi.base import FormElementPluginWidget
@ -22,23 +20,16 @@ class InvisibleRecaptchaWidget(HiddenInput):
"""Invisible recaptcha widget."""
def __init__(self, *args, **kwargs):
attrs = kwargs.get('attrs', {})
attrs.update({'data-customforms': 'disabled'})
kwargs.update({'attrs': attrs})
super(InvisibleRecaptchaWidget, self).__init__(*args, **kwargs)
attrs = kwargs.get("attrs", {})
attrs["data-customforms"] = "disabled"
def render(self, *args, **kwargs):
"""Returns this Widget rendered as HTML, as a Unicode string."""
html = super(InvisibleRecaptchaWidget, self).render(*args, **kwargs)
g_recaptcha_sitekey = get_setting('SITE_KEY')
invisible_recaptcha_html = """
<script>
var InvisibleRecaptchaSiteKey = "{g_recaptcha_sitekey}";
</script>
""".format(
g_recaptcha_sitekey=g_recaptcha_sitekey
)
return html + mark_safe(invisible_recaptcha_html)
site_key = get_setting("SITE_KEY")
if not site_key:
raise ValueError("SITE_KEY not set")
attrs["value"] = site_key
kwargs["attrs"] = attrs
super(InvisibleRecaptchaWidget, self).__init__(*args, **kwargs)
class BaseInvisibleRecaptchaWidget(FormElementPluginWidget):