Added self-hosted GDPR compliant captcha module

.github/workflows/copyright.yml

@@ -53,7 +53,7 @@ jobs:
 
             # Only check files with specific extensions
             extension="${file##*.}"
-            if ! [[ "${extension,,}" =~ ^(css|js|php|phtml|template|xml)$ ]]; then
+            if ! [[ "${extension,,}" =~ ^(css|js|php|phtml)$ ]]; then
               continue
             fi
 

app/code/core/Maho/Captcha/Helper/Data.php

@@ -0,0 +1,129 @@
+<?php
+
+/**
+ * Maho
+ *
+ * @package    Maho_Captcha
+ * @copyright  Copyright (c) 2025 Maho (https://mahocommerce.com)
+ * @license    https://opensource.org/licenses/osl-3.0.php  Open Software License (OSL 3.0)
+ */
+
+use AltchaOrg\Altcha;
+
+class Maho_Captcha_Helper_Data extends Mage_Core_Helper_Abstract
+{
+    public const XML_PATH_ENABLED = 'admin/captcha/enabled';
+    public const XML_PATH_FRONTEND_SELECTORS = 'admin/captcha/selectors';
+
+    protected $_moduleName = 'Maho_Captcha';
+
+    /** @var array <string, bool> */
+    protected static array $_payloadVerificationCache = [];
+
+    public function isEnabled(): bool
+    {
+        return $this->isModuleEnabled() && $this->isModuleOutputEnabled() && Mage::getStoreConfigFlag(self::XML_PATH_ENABLED);
+    }
+
+    public function getTableName(): string
+    {
+        return Mage::getSingleton('core/resource')->getTableName('captcha/challenge');
+    }
+
+    public function getHmacKey(): string
+    {
+        return (string) Mage::getConfig()->getNode('global/crypt/key');
+    }
+
+    public function getFrontendSelectors(): string
+    {
+        $selectors = Mage::getStoreConfig(self::XML_PATH_FRONTEND_SELECTORS) ?? '';
+        $selectors = trim($selectors);
+        $selectors = str_replace(["\r\n", "\r"], "\n", $selectors);
+        $selectors = explode("\n", $selectors);
+
+        $selectorsToKeep = [];
+        foreach ($selectors as $selector) {
+            $selector = trim($selector);
+            if (strlen($selector) && !str_starts_with($selector, '//')) {
+                $selectorsToKeep[] = $selector;
+            }
+        }
+
+        return implode(',', $selectorsToKeep);
+    }
+
+    public function getChallengeUrl(): string
+    {
+        return Mage::getUrl('captcha/index/challenge');
+    }
+
+    public function getWidgetAttributes(): Varien_Object
+    {
+        return new Varien_Object([
+            'challengeurl' => $this->getChallengeUrl(),
+            'name' => 'maho_captcha',
+            'auto' => 'onload',
+            'hidelogo' => '',
+            'hidefooter' => '',
+            'refetchonexpire' => '',
+        ]);
+    }
+
+    public function createChallenge(?array $options = null): Altcha\Challenge
+    {
+        $options = new Altcha\ChallengeOptions([
+            'algorithm' => Altcha\Algorithm::SHA512,
+            'saltLength' => 32,
+            'expires' => (new DateTime())->modify('+1 minute'),
+            'hmacKey' => $this->getHmacKey(),
+            ...($options ?? []),
+        ]);
+        return Altcha\Altcha::createChallenge($options);
+    }
+
+    public function verify(string $payload): bool
+    {
+        if (empty($payload)) {
+            return false;
+        }
+
+        if (isset(self::$_payloadVerificationCache[$payload])) {
+            return self::$_payloadVerificationCache[$payload];
+        }
+
+        // Check that the challenge is not stored in the database, meaning it was already solved
+        $coreRead = Mage::getSingleton('core/resource')->getConnection('core_read');
+        $select = $coreRead->select()
+            ->from($this->getTableName(), ['challenge'])
+            ->where('challenge = ?', $payload);
+        if ($coreRead->fetchOne($select)) {
+            return false;
+        }
+
+        try {
+            $isValid = Altcha\Altcha::verifySolution($payload, $this->getHmacKey(), true);
+            $this->logChallenge($payload);
+        } catch (Exception $e) {
+            $isValid = false;
+            Mage::logException($e);
+        }
+
+        self::$_payloadVerificationCache[$payload] = $isValid;
+        return $isValid;
+    }
+
+    protected function logChallenge(string $payload): void
+    {
+        try {
+            Mage::getSingleton('core/resource')
+                ->getConnection('core_write')
+                ->insert($this->getTableName(), [
+                    'challenge' => $payload,
+                    'created_at' => Mage::getModel('core/date')->gmtDate('Y-m-d H:i:s'),
+                ]);
+        } catch (Exception $e) {
+            Mage::logException($e);
+        }
+    }
+}

app/code/core/Maho/Captcha/Model/Challenge.php

@@ -0,0 +1,17 @@
+<?php
+
+/**
+ * Maho
+ *
+ * @package    Maho_Captcha
+ * @copyright  Copyright (c) 2025 Maho (https://mahocommerce.com)
+ * @license    https://opensource.org/licenses/osl-3.0.php  Open Software License (OSL 3.0)
+ */
+
+class Maho_Captcha_Model_Challenge extends Mage_Core_Model_Abstract
+{
+    protected function _construct()
+    {
+        $this->_init('captcha/challenge');
+    }
+}

app/code/core/Maho/Captcha/Model/Observer.php

@@ -0,0 +1,113 @@
+<?php
+
+/**
+ * Maho
+ *
+ * @package    Maho_Captcha
+ * @copyright  Copyright (c) 2025 Maho (https://mahocommerce.com)
+ * @license    https://opensource.org/licenses/osl-3.0.php  Open Software License (OSL 3.0)
+ */
+
+class Maho_Captcha_Model_Observer
+{
+    public function verify(Varien_Event_Observer $observer): void
+    {
+        $helper = Mage::helper('captcha');
+        if (!$helper->isEnabled()) {
+            return;
+        }
+
+        /** @var Mage_Core_Controller_Front_Action $controller */
+        $controller = $observer->getControllerAction();
+        $data = $controller->getRequest()->getPost();
+
+        $token = $data['maho_captcha'] ?? '';
+        if ($helper->verify((string) $token)) {
+            return;
+        }
+
+        $this->failedVerification($controller);
+    }
+
+    public function verifyAjax(Varien_Event_Observer $observer): void
+    {
+        $helper = Mage::helper('captcha');
+        if (!$helper->isEnabled()) {
+            return;
+        }
+
+        /** @var Mage_Core_Controller_Front_Action $controller */
+        $controller = $observer->getControllerAction();
+        if ($controller->getFullActionName() == 'checkout_onepage_saveBilling' &&
+            Mage::getSingleton('customer/session')->isLoggedIn()) {
+            return;
+        }
+
+        $data = $controller->getRequest()->getPost();
+        $token = $data['maho_captcha'] ?? '';
+        if ($helper->verify((string) $token)) {
+            return;
+        }
+
+        $this->failedVerification($controller, true);
+    }
+
+    public function verifyAdmin(Varien_Event_Observer $observer): void
+    {
+        $helper = Mage::helper('captcha');
+        if (!$helper->isEnabled()) {
+            return;
+        }
+
+        $request = Mage::app()->getRequest();
+        if ($request->getActionName() == 'prelogin' || !$request->isPost()) {
+            return;
+        }
+
+        $data = $request->getPost();
+        $token = $data['maho_captcha'] ?? '';
+
+        if ($helper->verify((string) $token)) {
+            return;
+        }
+
+        Mage::throwException(Mage::helper('captcha')->__('Incorrect CAPTCHA.'));
+    }
+
+    protected function failedVerification(Mage_Core_Controller_Front_Action $controller, bool $isAjax = false): void
+    {
+        $controller->setFlag('', Mage_Core_Controller_Varien_Action::FLAG_NO_DISPATCH, true);
+        $errorMessage = Mage::helper('captcha')->__('Incorrect CAPTCHA.');
+
+        if ($isAjax) {
+            $result = ['error' => 1, 'message' => $errorMessage];
+            $controller->getResponse()->setBodyJson($result);
+            return;
+        }
+
+        Mage::getSingleton('core/session')->addError($errorMessage);
+        $request = $controller->getRequest();
+        $refererUrl = $request->getServer('HTTP_REFERER');
+        if ($url = $request->getParam(Mage_Core_Controller_Varien_Action::PARAM_NAME_REFERER_URL)) {
+            $refererUrl = $url;
+        } elseif ($url = $request->getParam(Mage_Core_Controller_Varien_Action::PARAM_NAME_BASE64_URL)) {
+            $refererUrl = Mage::helper('core')->urlDecodeAndEscape($url);
+        } elseif ($url = $request->getParam(Mage_Core_Controller_Varien_Action::PARAM_NAME_URL_ENCODED)) {
+            $refererUrl = Mage::helper('core')->urlDecodeAndEscape($url);
+        }
+        $controller->getResponse()->setRedirect($refererUrl);
+    }
+
+    public function cleanup()
+    {
+        $resource = Mage::getSingleton('core/resource');
+        $connection = $resource->getConnection('core_write');
+        $table = $resource->getTableName('captcha/challenge');
+
+        $cutOffDate = Mage::getModel('core/date')->gmtDate('Y-m-d H:i:s', strtotime('-1 day'));
+        $connection->delete(
+            $table,
+            ['created_at < ?' => $cutOffDate],
+        );
+    }
+}

app/code/core/Maho/Captcha/Model/Resource/Challenge.php

@@ -0,0 +1,17 @@
+<?php
+
+/**
+ * Maho
+ *
+ * @package    Maho_Captcha
+ * @copyright  Copyright (c) 2025 Maho (https://mahocommerce.com)
+ * @license    https://opensource.org/licenses/osl-3.0.php  Open Software License (OSL 3.0)
+ */
+
+class Maho_Captcha_Model_Resource_Challenge extends Mage_Core_Model_Resource_Db_Abstract
+{
+    protected function _construct()
+    {
+        $this->_init('captcha/challenge', 'challenge');
+    }
+}

app/code/core/Maho/Captcha/controllers/IndexController.php

@@ -0,0 +1,32 @@
+<?php
+
+/**
+ * Maho
+ *
+ * @package    Maho_Captcha
+ * @copyright  Copyright (c) 2025 Maho (https://mahocommerce.com)
+ * @license    https://opensource.org/licenses/osl-3.0.php  Open Software License (OSL 3.0)
+ */
+
+class Maho_Captcha_IndexController extends Mage_Core_Controller_Front_Action
+{
+    public function challengeAction()
+    {
+        $helper = Mage::helper('captcha');
+        try {
+            if (!$helper->isEnabled()) {
+                Mage::throwException($helper->__('Captcha is disabled'));
+            }
+            $this->getResponse()->setBodyJson($helper->createChallenge());
+        } catch (Mage_Core_Exception $e) {
+            $error = $e->getMessage();
+        } catch (Exception $e) {
+            $error = $helper->__('Internal Error');
+        }
+        if (isset($error)) {
+            $this->getResponse()
+                ->setHttpResponseCode(400)
+                ->setBodyJson(['error' => true, 'message' => $error]);
+        }
+    }
+}