From ae772a09b2ceb6c4298600696550ce1b2b78747d Mon Sep 17 00:00:00 2001
From: Frantisek Holop <fholop@ripe.net>
Date: Fri, 3 Apr 2020 22:18:43 +0200
Subject: [PATCH] Treat an empty SITE_KEY as error

Recently I had a configuration error where the SITE_KEY remained unset
and the empty defaults made the widget render without the captcha and
subsequently fail every submission. While the form showed a validation
error, it took days until someone reported it.  Lack of logging made
tracking down this issue needlessly long as well.  When this widget is
required, having an empty SITE_KEY and/or SITE_SECRET is simply an error
and should be handled as such.

While here, simplify the widget and add the SITE_KEY as the hidden input
field's value= instead of creating a free floating <script> tag with a
single variable...

Remove the empty defaults, they dont make sense.
This diff is against 0.16.1
---
 .../security/invisible_recaptcha/conf.py      |  9 +++----
 .../security/invisible_recaptcha/defaults.py  | 11 --------
 .../fobi.plugin.invisible_recaptcha.js        |  7 +----
 .../security/invisible_recaptcha/widgets.py   | 27 +++++++------------
 4 files changed, 14 insertions(+), 40 deletions(-)
 delete mode 100644 src/fobi/contrib/plugins/form_elements/security/invisible_recaptcha/defaults.py

diff --git a/src/fobi/contrib/plugins/form_elements/security/invisible_recaptcha/conf.py b/src/fobi/contrib/plugins/form_elements/security/invisible_recaptcha/conf.py
index 26289967..cee95e5b 100644
--- a/src/fobi/contrib/plugins/form_elements/security/invisible_recaptcha/conf.py
+++ b/src/fobi/contrib/plugins/form_elements/security/invisible_recaptcha/conf.py
@@ -1,7 +1,5 @@
 from django.conf import settings
 
-from . import defaults
-
 __title__ = 'fobi.contrib.plugins.form_elements.security.' \
             'invisible_recaptcha.conf'
 __author__ = 'Artur Barseghyan <artur.barseghyan@gmail.com>'
@@ -26,8 +24,9 @@ def get_setting(setting, override=None):
     """
     if override is not None:
         return override
-    key = 'FOBI_PLUGIN_INVISIBLE_RECAPTCHA_{0}'.format(setting)
+
+    key = "FOBI_PLUGIN_INVISIBLE_RECAPTCHA_{0}".format(setting)
     if hasattr(settings, key):
         return getattr(settings, key)
-    else:
-        return getattr(defaults, setting)
+
+    return ""
diff --git a/src/fobi/contrib/plugins/form_elements/security/invisible_recaptcha/defaults.py b/src/fobi/contrib/plugins/form_elements/security/invisible_recaptcha/defaults.py
deleted file mode 100644
index 3457c7fb..00000000
--- a/src/fobi/contrib/plugins/form_elements/security/invisible_recaptcha/defaults.py
+++ /dev/null
@@ -1,11 +0,0 @@
-__title__ = 'fobi.contrib.plugins.form_elements.security.honeypot.defaults'
-__author__ = 'Artur Barseghyan <artur.barseghyan@gmail.com>'
-__copyright__ = '2014-2019 Artur Barseghyan'
-__license__ = 'GPL 2.0/LGPL 2.1'
-__all__ = (
-    'SITE_KEY',
-    'SITE_SECRET',
-)
-
-SITE_KEY = ''
-SITE_SECRET = ''
diff --git a/src/fobi/contrib/plugins/form_elements/security/invisible_recaptcha/static/invisible_recaptcha/fobi.plugin.invisible_recaptcha.js b/src/fobi/contrib/plugins/form_elements/security/invisible_recaptcha/static/invisible_recaptcha/fobi.plugin.invisible_recaptcha.js
index 83774e86..9e8b4601 100644
--- a/src/fobi/contrib/plugins/form_elements/security/invisible_recaptcha/static/invisible_recaptcha/fobi.plugin.invisible_recaptcha.js
+++ b/src/fobi/contrib/plugins/form_elements/security/invisible_recaptcha/static/invisible_recaptcha/fobi.plugin.invisible_recaptcha.js
@@ -8,17 +8,12 @@
 ;
 
 function g_recaptcha_onSubmit(token) {
-    console.log("g_recaptcha_onSubmit")
-//    document.getElementById("fobi-form").submit();
-//    document.getElementsByClassName("form-horizontal").submit();
-//    $('form.form-horizontal').submit();
     $('form#fobi-form').submit();
 }
 
 $(document).ready(function() {
-    var siteKey = window.InvisibleRecaptchaSiteKey || "";
+    var siteKey = $("#id_captcha").val();
     if (siteKey) {
-//        var submitFormButton = $('form.form-horizontal button[type=submit]');
         var submitFormButton = $('form#fobi-form button[type=submit]');
         submitFormButton.addClass('g-recaptcha');
         submitFormButton.attr('data-sitekey', siteKey);
diff --git a/src/fobi/contrib/plugins/form_elements/security/invisible_recaptcha/widgets.py b/src/fobi/contrib/plugins/form_elements/security/invisible_recaptcha/widgets.py
index 98c2c387..5c9df34a 100644
--- a/src/fobi/contrib/plugins/form_elements/security/invisible_recaptcha/widgets.py
+++ b/src/fobi/contrib/plugins/form_elements/security/invisible_recaptcha/widgets.py
@@ -1,6 +1,4 @@
-# from django.utils.html import format_html
 from django.forms.widgets import HiddenInput
-from django.utils.safestring import mark_safe
 
 from fobi.base import FormElementPluginWidget
 
@@ -22,23 +20,16 @@ class InvisibleRecaptchaWidget(HiddenInput):
     """Invisible recaptcha widget."""
 
     def __init__(self, *args, **kwargs):
-        attrs = kwargs.get('attrs', {})
-        attrs.update({'data-customforms': 'disabled'})
-        kwargs.update({'attrs': attrs})
-        super(InvisibleRecaptchaWidget, self).__init__(*args, **kwargs)
+        attrs = kwargs.get("attrs", {})
+        attrs["data-customforms"] = "disabled"
 
-    def render(self, *args, **kwargs):
-        """Returns this Widget rendered as HTML, as a Unicode string."""
-        html = super(InvisibleRecaptchaWidget, self).render(*args, **kwargs)
-        g_recaptcha_sitekey = get_setting('SITE_KEY')
-        invisible_recaptcha_html = """
-            <script>
-                var InvisibleRecaptchaSiteKey = "{g_recaptcha_sitekey}";
-            </script>
-        """.format(
-            g_recaptcha_sitekey=g_recaptcha_sitekey
-        )
-        return html + mark_safe(invisible_recaptcha_html)
+        site_key = get_setting("SITE_KEY")
+        if not site_key:
+            raise ValueError("SITE_KEY not set")
+        attrs["value"] = site_key
+
+        kwargs["attrs"] = attrs
+        super(InvisibleRecaptchaWidget, self).__init__(*args, **kwargs)
 
 
 class BaseInvisibleRecaptchaWidget(FormElementPluginWidget):