From 117c6a5668ac3d3a9b935ba60e52cc1990766063 Mon Sep 17 00:00:00 2001
From: dxl <dxl@plotbridge.com>
Date: Thu, 27 Oct 2022 10:02:39 +0800
Subject: [PATCH 1/3] add support for hcaptcha.com

---
 clientapi/routing/auth_fallback.go | 14 ++++++++------
 clientapi/routing/register.go      |  9 ++++++---
 dendrite-sample.monolith.yaml      |  8 +++++++-
 setup/config/config_clientapi.go   | 18 ++++++++++++++++++
 4 files changed, 39 insertions(+), 10 deletions(-)

diff --git a/clientapi/routing/auth_fallback.go b/clientapi/routing/auth_fallback.go
index abfe830fb4..96674b156f 100644
--- a/clientapi/routing/auth_fallback.go
+++ b/clientapi/routing/auth_fallback.go
@@ -31,8 +31,7 @@ const recaptchaTemplate = `
 <title>Authentication</title>
 <meta name='viewport' content='width=device-width, initial-scale=1,
     user-scalable=no, minimum-scale=1.0, maximum-scale=1.0'>
-<script src="https://www.google.com/recaptcha/api.js"
-    async defer></script>
+<script src="{{.apiJsUrl}}" async defer></script>
 <script src="//code.jquery.com/jquery-1.11.2.min.js"></script>
 <script>
 function captchaDone() {
@@ -51,8 +50,8 @@ function captchaDone() {
         Please verify that you're not a robot.
         </p>
 		<input type="hidden" name="session" value="{{.session}}" />
-        <div class="g-recaptcha"
-            data-sitekey="{{.siteKey}}"
+        <div class="{{.sitekeyClass}}"
+            data-sitekey="{{.sitekey}}"
             data-callback="captchaDone">
         </div>
         <noscript>
@@ -116,7 +115,10 @@ func AuthFallback(
 		data := map[string]string{
 			"myUrl":   req.URL.String(),
 			"session": sessionID,
-			"siteKey": cfg.RecaptchaPublicKey,
+            "apiJsUrl": cfg.RecaptchaApiJsUrl,
+			"sitekey": cfg.RecaptchaPublicKey,
+            "sitekeyClass": cfg.RecaptchaSitekeyClass,
+            "formField": cfg.RecaptchaFormField,
 		}
 		serveTemplate(w, recaptchaTemplate, data)
 	}
@@ -155,7 +157,7 @@ func AuthFallback(
 				return &res
 			}
 
-			response := req.Form.Get("g-recaptcha-response")
+			response := req.Form.Get(cfg.RecaptchaFormField)
 			if err := validateRecaptcha(cfg, response, clientIP); err != nil {
 				util.GetLogger(req.Context()).Error(err)
 				return err
diff --git a/clientapi/routing/register.go b/clientapi/routing/register.go
index 0bda1e488d..d5ca53df7c 100644
--- a/clientapi/routing/register.go
+++ b/clientapi/routing/register.go
@@ -20,6 +20,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+    "net"
 	"net/http"
 	"net/url"
 	"regexp"
@@ -336,6 +337,7 @@ func validateRecaptcha(
 	response string,
 	clientip string,
 ) *util.JSONResponse {
+    ip,_ ,_ := net.SplitHostPort(clientip)
 	if !cfg.RecaptchaEnabled {
 		return &util.JSONResponse{
 			Code: http.StatusConflict,
@@ -355,7 +357,7 @@ func validateRecaptcha(
 		url.Values{
 			"secret":   {cfg.RecaptchaPrivateKey},
 			"response": {response},
-			"remoteip": {clientip},
+			"remoteip": {ip},
 		},
 	)
 
@@ -382,7 +384,7 @@ func validateRecaptcha(
 	if err != nil {
 		return &util.JSONResponse{
 			Code: http.StatusInternalServerError,
-			JSON: jsonerror.BadJSON("Error in unmarshaling captcha server's response: " + err.Error()),
+			JSON: jsonerror.BadJSON("Error in unmarshaling captcha server's response: " + err.Error()+"\n"+ string(body) + "\n"+clientip),
 		}
 	}
 
@@ -748,7 +750,8 @@ func handleRegistrationFlow(
 	switch r.Auth.Type {
 	case authtypes.LoginTypeRecaptcha:
 		// Check given captcha response
-		resErr := validateRecaptcha(cfg, r.Auth.Response, req.RemoteAddr)
+        clientIp, _, _ := net.SplitHostPort(req.RemoteAddr)
+		resErr := validateRecaptcha(cfg, r.Auth.Response, clientIp)
 		if resErr != nil {
 			return *resErr
 		}
diff --git a/dendrite-sample.monolith.yaml b/dendrite-sample.monolith.yaml
index eadb74a2a5..826208e7e3 100644
--- a/dendrite-sample.monolith.yaml
+++ b/dendrite-sample.monolith.yaml
@@ -179,7 +179,13 @@ client_api:
   recaptcha_public_key: ""
   recaptcha_private_key: ""
   recaptcha_bypass_secret: ""
-  recaptcha_siteverify_api: ""
+  
+  # To use hcaptcha.com instead of ReCAPTCHA, set the following parameters, otherwise just keep them empty.
+  # recaptcha_siteverify_api: "https://hcaptcha.com/siteverify"
+  # recaptcha_api_js_url: "https://js.hcaptcha.com/1/api.js"
+  # recaptcha_form_field: "h-captcha-response"
+  # recaptcha_sitekey_class: "h-captcha"
+
 
   # TURN server information that this homeserver should send to clients.
   turn:
diff --git a/setup/config/config_clientapi.go b/setup/config/config_clientapi.go
index 56f4b3f92d..5d09ca2d90 100644
--- a/setup/config/config_clientapi.go
+++ b/setup/config/config_clientapi.go
@@ -32,6 +32,12 @@ type ClientAPI struct {
 	// Boolean stating whether catpcha registration is enabled
 	// and required
 	RecaptchaEnabled bool `yaml:"enable_registration_captcha"`
+    // Recaptcha api.js Url, for compatible with hcaptcha.com, etc.
+    RecaptchaApiJsUrl string `yaml:"recaptcha_api_js_url"`
+    // Recaptcha div class for sitekey, for compatible with hcaptcha.com, etc.
+    RecaptchaSitekeyClass string `yaml:"recaptcha_sitekey_class"`
+    // Recaptcha form field, for compatible with hcaptcha.com, etc.
+    RecaptchaFormField string `yaml:"recaptcha_form_field"`
 	// This Home Server's ReCAPTCHA public key.
 	RecaptchaPublicKey string `yaml:"recaptcha_public_key"`
 	// This Home Server's ReCAPTCHA private key.
@@ -75,6 +81,18 @@ func (c *ClientAPI) Verify(configErrs *ConfigErrors, isMonolith bool) {
 		checkNotEmpty(configErrs, "client_api.recaptcha_public_key", c.RecaptchaPublicKey)
 		checkNotEmpty(configErrs, "client_api.recaptcha_private_key", c.RecaptchaPrivateKey)
 		checkNotEmpty(configErrs, "client_api.recaptcha_siteverify_api", c.RecaptchaSiteVerifyAPI)
+        if c.RecaptchaSiteVerifyAPI == "" {
+            c.RecaptchaSiteVerifyAPI = "https://www.google.com/recaptcha/api/siteverify"
+        }
+        if c.RecaptchaApiJsUrl == "" {
+            c.RecaptchaApiJsUrl = "https://www.google.com/recaptcha/api.js"
+        }
+        if c.RecaptchaFormField == "" {
+            c.RecaptchaFormField = "g-recaptcha"
+        }
+        if c.RecaptchaSitekeyClass == "" {
+            c.RecaptchaSitekeyClass = "g-recaptcha-response"
+        }
 	}
 	// Ensure there is any spam counter measure when enabling registration
 	if !c.RegistrationDisabled && !c.OpenRegistrationWithoutVerificationEnabled {

From 90a9db2fea61fd5f759a8e91c53297ea76dede6c Mon Sep 17 00:00:00 2001
From: dxl <dxl@plotbridge.com>
Date: Thu, 27 Oct 2022 10:31:40 +0800
Subject: [PATCH 2/3] remove redundant code

---
 clientapi/routing/register.go | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/clientapi/routing/register.go b/clientapi/routing/register.go
index 70d4737ad4..8e58d4975a 100644
--- a/clientapi/routing/register.go
+++ b/clientapi/routing/register.go
@@ -384,7 +384,7 @@ func validateRecaptcha(
 	if err != nil {
 		return &util.JSONResponse{
 			Code: http.StatusInternalServerError,
-			JSON: jsonerror.BadJSON("Error in unmarshaling captcha server's response: " + err.Error()+"\n"+ string(body) + "\n"+clientip),
+			JSON: jsonerror.BadJSON("Error in unmarshaling captcha server's response: " + err.Error()),
 		}
 	}
 
@@ -750,8 +750,7 @@ func handleRegistrationFlow(
 	switch r.Auth.Type {
 	case authtypes.LoginTypeRecaptcha:
 		// Check given captcha response
-        clientIp, _, _ := net.SplitHostPort(req.RemoteAddr)
-		resErr := validateRecaptcha(cfg, r.Auth.Response, clientIp)
+		resErr := validateRecaptcha(cfg, r.Auth.Response, req.RemoteAddr)
 		if resErr != nil {
 			return *resErr
 		}

From 9e21fc557eaf7be310f95d971935eb3b0a70526b Mon Sep 17 00:00:00 2001
From: dxl <dxl@plotbridge.com>
Date: Fri, 28 Oct 2022 09:48:28 +0800
Subject: [PATCH 3/3] format fix and copy additional parameters into polylith
 sample

---
 clientapi/routing/auth_fallback.go | 12 +++++-----
 clientapi/routing/register.go      |  4 ++--
 dendrite-sample.polylith.yaml      |  8 ++++++-
 setup/config/config_clientapi.go   | 36 +++++++++++++++---------------
 4 files changed, 33 insertions(+), 27 deletions(-)

diff --git a/clientapi/routing/auth_fallback.go b/clientapi/routing/auth_fallback.go
index 96674b156f..ad870993eb 100644
--- a/clientapi/routing/auth_fallback.go
+++ b/clientapi/routing/auth_fallback.go
@@ -113,12 +113,12 @@ func AuthFallback(
 
 	serveRecaptcha := func() {
 		data := map[string]string{
-			"myUrl":   req.URL.String(),
-			"session": sessionID,
-            "apiJsUrl": cfg.RecaptchaApiJsUrl,
-			"sitekey": cfg.RecaptchaPublicKey,
-            "sitekeyClass": cfg.RecaptchaSitekeyClass,
-            "formField": cfg.RecaptchaFormField,
+			"myUrl":        req.URL.String(),
+			"session":      sessionID,
+			"apiJsUrl":     cfg.RecaptchaApiJsUrl,
+			"sitekey":      cfg.RecaptchaPublicKey,
+			"sitekeyClass": cfg.RecaptchaSitekeyClass,
+			"formField":    cfg.RecaptchaFormField,
 		}
 		serveTemplate(w, recaptchaTemplate, data)
 	}
diff --git a/clientapi/routing/register.go b/clientapi/routing/register.go
index 8e58d4975a..b9ebb0518a 100644
--- a/clientapi/routing/register.go
+++ b/clientapi/routing/register.go
@@ -20,7 +20,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-    "net"
+	"net"
 	"net/http"
 	"net/url"
 	"regexp"
@@ -337,7 +337,7 @@ func validateRecaptcha(
 	response string,
 	clientip string,
 ) *util.JSONResponse {
-    ip,_ ,_ := net.SplitHostPort(clientip)
+	ip, _, _ := net.SplitHostPort(clientip)
 	if !cfg.RecaptchaEnabled {
 		return &util.JSONResponse{
 			Code: http.StatusConflict,
diff --git a/dendrite-sample.polylith.yaml b/dendrite-sample.polylith.yaml
index bbbe16fdc2..ecc3f4051a 100644
--- a/dendrite-sample.polylith.yaml
+++ b/dendrite-sample.polylith.yaml
@@ -175,7 +175,13 @@ client_api:
   recaptcha_public_key: ""
   recaptcha_private_key: ""
   recaptcha_bypass_secret: ""
-  recaptcha_siteverify_api: ""
+
+  # To use hcaptcha.com instead of ReCAPTCHA, set the following parameters, otherwise just keep them empty.
+  # recaptcha_siteverify_api: "https://hcaptcha.com/siteverify"
+  # recaptcha_api_js_url: "https://js.hcaptcha.com/1/api.js"
+  # recaptcha_form_field: "h-captcha-response"
+  # recaptcha_sitekey_class: "h-captcha"
+
 
   # TURN server information that this homeserver should send to clients.
   turn:
diff --git a/setup/config/config_clientapi.go b/setup/config/config_clientapi.go
index 5d09ca2d90..0a871da187 100644
--- a/setup/config/config_clientapi.go
+++ b/setup/config/config_clientapi.go
@@ -32,12 +32,12 @@ type ClientAPI struct {
 	// Boolean stating whether catpcha registration is enabled
 	// and required
 	RecaptchaEnabled bool `yaml:"enable_registration_captcha"`
-    // Recaptcha api.js Url, for compatible with hcaptcha.com, etc.
-    RecaptchaApiJsUrl string `yaml:"recaptcha_api_js_url"`
-    // Recaptcha div class for sitekey, for compatible with hcaptcha.com, etc.
-    RecaptchaSitekeyClass string `yaml:"recaptcha_sitekey_class"`
-    // Recaptcha form field, for compatible with hcaptcha.com, etc.
-    RecaptchaFormField string `yaml:"recaptcha_form_field"`
+	// Recaptcha api.js Url, for compatible with hcaptcha.com, etc.
+	RecaptchaApiJsUrl string `yaml:"recaptcha_api_js_url"`
+	// Recaptcha div class for sitekey, for compatible with hcaptcha.com, etc.
+	RecaptchaSitekeyClass string `yaml:"recaptcha_sitekey_class"`
+	// Recaptcha form field, for compatible with hcaptcha.com, etc.
+	RecaptchaFormField string `yaml:"recaptcha_form_field"`
 	// This Home Server's ReCAPTCHA public key.
 	RecaptchaPublicKey string `yaml:"recaptcha_public_key"`
 	// This Home Server's ReCAPTCHA private key.
@@ -81,18 +81,18 @@ func (c *ClientAPI) Verify(configErrs *ConfigErrors, isMonolith bool) {
 		checkNotEmpty(configErrs, "client_api.recaptcha_public_key", c.RecaptchaPublicKey)
 		checkNotEmpty(configErrs, "client_api.recaptcha_private_key", c.RecaptchaPrivateKey)
 		checkNotEmpty(configErrs, "client_api.recaptcha_siteverify_api", c.RecaptchaSiteVerifyAPI)
-        if c.RecaptchaSiteVerifyAPI == "" {
-            c.RecaptchaSiteVerifyAPI = "https://www.google.com/recaptcha/api/siteverify"
-        }
-        if c.RecaptchaApiJsUrl == "" {
-            c.RecaptchaApiJsUrl = "https://www.google.com/recaptcha/api.js"
-        }
-        if c.RecaptchaFormField == "" {
-            c.RecaptchaFormField = "g-recaptcha"
-        }
-        if c.RecaptchaSitekeyClass == "" {
-            c.RecaptchaSitekeyClass = "g-recaptcha-response"
-        }
+		if c.RecaptchaSiteVerifyAPI == "" {
+			c.RecaptchaSiteVerifyAPI = "https://www.google.com/recaptcha/api/siteverify"
+		}
+		if c.RecaptchaApiJsUrl == "" {
+			c.RecaptchaApiJsUrl = "https://www.google.com/recaptcha/api.js"
+		}
+		if c.RecaptchaFormField == "" {
+			c.RecaptchaFormField = "g-recaptcha"
+		}
+		if c.RecaptchaSitekeyClass == "" {
+			c.RecaptchaSitekeyClass = "g-recaptcha-response"
+		}
 	}
 	// Ensure there is any spam counter measure when enabling registration
 	if !c.RegistrationDisabled && !c.OpenRegistrationWithoutVerificationEnabled {