Strange behavior when used with hcaptcha

Resolved erpiu
(@erpiu)

1 month, 3 weeks ago

Hi,

When I integrated your plugin into one of my websites, I noticed some strange behavior: even though I hadn’t checked the plugin option to disable the “Unauthorized content” message, I couldn’t get the plugin to display the expected message, and a blank space always appeared instead.
I tried to figure out what was going on, and after numerous debugging attempts, I noticed that when I used the get_option function to read the value of the WP option “cacsp_option_disable_content_not_allowed_message,” the returned value was always 1, no matter what I did with the corresponding plugin option. Strange, isn’t it?
To make a long story short, I finally noticed that disabling another plugin I was using solved the problem. The culprit is “hcaptcha for WP.”

Reading the documentation and source code for the “hcaptcha for WP” plugin is very interesting. The documentation states that “hcaptcha for WP” is “integrated” with or “supports” the CACSP plugin, and the source code shows how this integration is implemented: the hcaptcha plugin filters the value returned by the get_option function when it reads three of the options defined by CACSP. This filtering aims, on the one hand, to automatically add the domain hcaptcha.com to the list of domains always allowed by CACSP and, on the other hand, to prevent CACSP from displaying the “Unauthorized content” message! But why does hcaptcha do this, and why isn’t the user informed of it???
Were you aware of this? I assume you are in contact with the authors of the hcaptcha plugin or that you can contact them.
Instead of this hidden and automatic integration by hcaptcha, would it be possible for you to offer an explicit solution, for example by adding hcaptcha to your list of plugins for which you offer to add allowed domains? You do this for reCaptcha. Why wouldn’t you do it for hcaptcha? And , of course, let the user decide whether to enable or disable the display of the “Unauthorized content” message!
In your opinion, what is the best approach to resolve this issue?

Thanks in advance,

Viewing 15 replies - 1 through 15 (of 16 total)

1 2 →

Plugin Author Johan Jonk Stenström
(@jonkastonka)

1 month, 3 weeks ago

Hi!

I tested get_cacsp_options( ‘cacsp_option_disable_content_not_allowed_message’ ); and I get 0 when “Disable content not allowed message.” is unchecked and see the error message, if I check it I get 1 and the error message is not shown. All as expected.

I am not in contact with the authors of the hcaptcha plugin, and this is the first time I hear about this integration. Maybe the authors @hcaptcha and @kaggdesign can bring clarity to this matter?

kaggdesign
(@kaggdesign)

1 month, 3 weeks ago

Thank you, @erpiu, for your report.

I have added compatibility with the CACSP plugin because of this issue. The CCSP plugin blocked the hCaptcha API script, which must be loaded from the external site (js.hcaptcha.com). This broke the functionality of hCaptcha.

I will look more closely at the current issue and reconsider showing the Unauthorized Content message.

However, a proper solution would be adding hCaptcha to the list of allowed domains.

hcaptcha
(@hcaptcha)

1 month, 3 weeks ago

(Deleted duplicate, looks like @kaggdesign already replied.)

@jonkastonka As @erpiu suggests, adding native support for hCaptcha in CACSP is the best long-term solution here.

Thread Starter erpiu
(@erpiu)

1 month, 3 weeks ago

Hi Johan,

Whenever you made the test from any “cacsp_settings” page of your plugin and according to the source code of hcaptcha, no filtering is performed (in such a way admin actions are not disrupted) and you get results as expected. But filtering happens from any other page, for instance when your plugin tries to enqueue the script that will display the message “Not allowed content”.

Please have a look at the file /wp-content/plugins/hcaptcha-for-forms-and-more/src/php/CACSP/Compatibility.php

Do you agree with my understanding ?

Thread Starter erpiu
(@erpiu)

1 month, 3 weeks ago

@kaggdesign : If adding native support of hcaptcha in CACSP simply means not blocking domains of the form https://*.hcaptcha.com, I assume @jonkastonka can do it quickly. But, at the same time, it will be necessary to remove the existing code in hcaptcha related to the support of CACSP.

@kaggdesign, @jonkastonka : Can we expect a coordinated effort from both of you? Users like me thank you in advance.
kaggdesign
(@kaggdesign)

1 month, 3 weeks ago
I found why I forced the option “Disable content not allowed message.” See how Contact From 7 with hCaptcha looks when I do not block this option.

Here, hCaptcha is loading, but has become non-functional due to the CACSP error message.

@erpiu, you can reach the same result by commenting out 1 line in the \HCaptcha\CACSP\Compatibility::init_hooks.
```
		$cacsp_options = [
			'cacsp_option_always_scripts',
			'cacsp_option_always_frames',
//			'cacsp_option_disable_content_not_allowed_message',
		];
```
Plugin Author Johan Jonk Stenström
(@jonkastonka)

1 month, 3 weeks ago

To use hCaptcha, all you need to do is add https://*.hcaptcha.com in the right places. If @kaggdesign would like to, tell me where these should be added (in Settings > Cookies and Content Security Policy > Domains), and I’ll add it as a Quickstart item.

kaggdesign
(@kaggdesign)

1 month, 3 weeks ago

@jonkastonka, I can propose some code to add to your plugin. Do you have a public GitHub repository?

Plugin Author Johan Jonk Stenström
(@jonkastonka)

1 month, 3 weeks ago

@kaggdesign, no, only the SVN repo.
kaggdesign
(@kaggdesign)

1 month, 3 weeks ago
@jonkastonka, I have created a fork repository on GitHub and a PR with hCaptcha support: https://github.com/kagg-design/cookies-and-content-security-policy/pull/1/changes

You can implement changes in your plugin.

When released, I can remove the integration class from the hCaptcha plugin, which will resolve the current issue reported by @erpiu.
- This reply was modified 1 month, 3 weeks ago by kaggdesign.
Plugin Author Johan Jonk Stenström
(@jonkastonka)

1 month, 3 weeks ago

@kaggdesign, perfect! I will release next week.

Thread Starter erpiu
(@erpiu)

1 month, 3 weeks ago

@jonkastonka, @kaggdesign : Thank you very much!

Plugin Author Johan Jonk Stenström
(@jonkastonka)

1 month, 2 weeks ago

@erpiu, @kaggdesign: This is released now.

Thread Starter erpiu
(@erpiu)

1 month, 2 weeks ago

@jonkastonka : Thanks.

@kaggdesign : Now it’s your turn! Thank you for removing the CACSP integration class from the hcaptcha plugin.

kaggdesign
(@kaggdesign)

1 month, 2 weeks ago

Thank you guys, I will take care of it and come back.

Viewing 15 replies - 1 through 15 (of 16 total)

1 2 →

You must be logged in to reply to this topic.