captcha keys (#82)

Author: ankitamk14

website/middleware.py

@@ -0,0 +1,46 @@
+from django.conf import settings
+from django.shortcuts import render
+
+class FilterCaptchaGateMiddleware(object):
+    """
+    Protects expensive /filter/ GET pages.
+
+    Rules:
+    - page 1 with default sorting is allowed anonymously
+    - page > 1 requires prior verification
+    - any sorting (o=...) requires prior verification
+    - invalid page values are challenged early
+    """
+    def __init__(self, get_response=None):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        path = request.path
+
+        # Only apply to filter endpoints
+        if path.startswith('/filter/'):
+
+            # return if already verified 
+            if request.session.get('filter_verified', False):
+                return self.get_response(request) 
+            
+            page = request.GET.get('page', '1')
+            ordering = request.GET.get('o', None)
+
+            # Validate page early
+            if page is None or page == '':
+                page = 1
+            page_num = int(page)
+            
+            # Challenge if:
+            # - deeper page, OR
+            # - any sorting is used
+            needs_verification = (page_num > 1) or bool(ordering)
+            if needs_verification:
+                    context = {
+                        'next_url': request.get_full_path(),
+                        'site_key': settings.RECAPTCHA_SITE_KEY_v3
+                    }
+                    return render(request, 'website/templates/filter_verify.html',context)
+        
+        return self.get_response(request)

website/views.py

@@ -1102,7 +1102,7 @@ def verify_filter_access(request):
         return HttpResponseForbidden("Missing captcha token")
 
     try:
-        data = {'secret': settings.RECAPTCHA_SECRET_KEY, 'response': token}
+        data = {'secret': settings.RECAPTCHA_SECRET_KEY_v3, 'response': token}
         resp = requests.post('https://www.google.com/recaptcha/api/siteverify',
                              data, timeout=5)
         result = resp.json()