Update reCaptcha code

[wood-chris]

The reCaptcha config option does currently work relatively well, but regardless of the type of v2 reCaptcha you specify (tickbox or invisible) it always falls back to tickbox, and v3 doesn't seem to be supported at all.

I don't think it'd be much work to upgrade the reCaptcha code to support both types of v2, and v3.

[wood-chris]

I've had a quick look at the code (https://github.com/ckan/ckan/blob/master/ckan/templates/user/snippets/recaptcha.html) - I can't find any reference to https://www.google.com/recaptcha/api/fallback? in any of the reCaptcha docs. I thought it might be an old v1 URL that is technically deprecated but still returns a v2 challenge? But https://codepen.io/pdxnam/pen/RGOqKJ suggests it is valid v2 to support browsers without js

@smotornyuk was the last person to update the code, maybe he can remember what he did & why he used the URL

[smotornyuk]

As far as I remember, I wasn't able to found details about this fallback URL in official docs, but there were some details about it in old google-threads. And I think that I've tested it with keys for v2-captcha and it looked valid.

As for the support of different captcha types, it's a really great idea. And, maybe, it won't take much effort to extract it from the user form and implement some common way to integrate recaptcha challenge and validation into any form through the app. I'm sure that there are use-cases when one wants to protect dataset creation form with captcha, for example

[wood-chris]

If I get a chance I'll try and update the code to at least support both types of v2, and maybe v3 - probably only starting for the registration form though

[crstn-aiw]

Hi there @wood-chris @smotornyuk ,

I am new to CKAN and I am investigating an issue on our CKAN recaptcha as it seems it is not validating correctly and found this thread as it may be related...

When I try the recaptcha button, I can see a response changing everytime and the contact form is submitted and email is received.

However, our user got spam emails and when checking on our google recaptcha admin console, we are getting this message: "We detected that your site is not verifying reCAPTCHA solutions. This is required for the proper use of reCAPTCHA on your site. Please see our developer site for more information".

I try to troubleshoot and check the code as per google support docu but when checking it, I can see there is client side and server side checks existing...
CKAN 2.9.11 captcha.py
CKAN contact 2.4.3 recaptcha.py

https://github.com/ckan/ckan/blob/master/ckan/lib/captcha.py
https://github.com/NaturalHistoryMuseum/ckanext-contact/blob/main/ckanext/contact/recaptcha.py

Based on this thread, it doesn't look like the recaptcha v3 is supported in the CKAN base? Would that cause conflict to the contact extension since it is using v3?

Any insight to this would be appreciated.

Our website implemented CKAN 2.9.11 and uses an extension for contact page (both look like having recaptcha implementations).

Thank you,
Tina