captcha_type=tcaptcha previously fell through to the built-in graphic
captcha. Adds pkg/tcaptcha implementing the Tencent Cloud
DescribeCaptchaResult call with TC3-HMAC-SHA256 request signing, a
TCaptcha.js popup widget component emitting {ticket, randstr}, site
config exposure of the app id, and admin credential fields.
Generated with Devin
pull/3589/head
Tomas Dvorak
2 weeks ago
parent
c58d3d1ad8
commit
c9b9414505
@ -0,0 +1,66 @@
|
|||||||
|
import { FormControl, Stack } from "@mui/material";
|
||||||
|
import { Trans, useTranslation } from "react-i18next";
|
||||||
|
import SettingForm from "../../../Pages/Setting/SettingForm.tsx";
|
||||||
|
import { DenseFilledTextField } from "../../../Common/StyledComponents.tsx";
|
||||||
|
import { NoMarginHelperText } from "../Settings.tsx";
|
||||||
|
|
||||||
|
export interface TCaptchaProps {
|
||||||
|
values: {
|
||||||
|
[key: string]: string;
|
||||||
|
};
|
||||||
|
setSettings: (settings: { [key: string]: string }) => void;
|
||||||
|
}
|
||||||
|
|
||||||
|
const TCaptcha = ({ values, setSettings }: TCaptchaProps) => {
|
||||||
|
const { t } = useTranslation("dashboard");
|
||||||
|
return (
|
||||||
|
<Stack spacing={3}>
|
||||||
|
<SettingForm title={t("settings.tcaptchaAppId")} lgWidth={5}>
|
||||||
|
<FormControl fullWidth>
|
||||||
|
<DenseFilledTextField
|
||||||
|
value={values.captcha_TCaptcha_CaptchaAppId}
|
||||||
|
onChange={(e) => setSettings({ captcha_TCaptcha_CaptchaAppId: e.target.value })}
|
||||||
|
required
|
||||||
|
/>
|
||||||
|
<NoMarginHelperText>
|
||||||
|
<Trans
|
||||||
|
i18nKey="settings.tcaptchaDes"
|
||||||
|
ns={"dashboard"}
|
||||||
|
components={[<a key={0} href="https://console.cloud.tencent.com/captcha/graphical" target="_blank" rel="noreferrer" />]}
|
||||||
|
/>
|
||||||
|
</NoMarginHelperText>
|
||||||
|
</FormControl>
|
||||||
|
</SettingForm>
|
||||||
|
<SettingForm title={t("settings.tcaptchaAppSecretKey")} lgWidth={5}>
|
||||||
|
<FormControl fullWidth>
|
||||||
|
<DenseFilledTextField
|
||||||
|
value={values.captcha_TCaptcha_AppSecretKey}
|
||||||
|
onChange={(e) => setSettings({ captcha_TCaptcha_AppSecretKey: e.target.value })}
|
||||||
|
required
|
||||||
|
/>
|
||||||
|
</FormControl>
|
||||||
|
</SettingForm>
|
||||||
|
<SettingForm title={t("settings.tcaptchaSecretId")} lgWidth={5}>
|
||||||
|
<FormControl fullWidth>
|
||||||
|
<DenseFilledTextField
|
||||||
|
value={values.captcha_TCaptcha_SecretId}
|
||||||
|
onChange={(e) => setSettings({ captcha_TCaptcha_SecretId: e.target.value })}
|
||||||
|
required
|
||||||
|
/>
|
||||||
|
<NoMarginHelperText>{t("settings.tcaptchaSecretDes")}</NoMarginHelperText>
|
||||||
|
</FormControl>
|
||||||
|
</SettingForm>
|
||||||
|
<SettingForm title={t("settings.tcaptchaSecretKey")} lgWidth={5}>
|
||||||
|
<FormControl fullWidth>
|
||||||
|
<DenseFilledTextField
|
||||||
|
value={values.captcha_TCaptcha_SecretKey}
|
||||||
|
onChange={(e) => setSettings({ captcha_TCaptcha_SecretKey: e.target.value })}
|
||||||
|
required
|
||||||
|
/>
|
||||||
|
</FormControl>
|
||||||
|
</SettingForm>
|
||||||
|
</Stack>
|
||||||
|
);
|
||||||
|
};
|
||||||
|
|
||||||
|
export default TCaptcha;
|
||||||
@ -0,0 +1,111 @@
|
|||||||
|
import { Box } from "@mui/material";
|
||||||
|
import { useEffect, useRef, useState } from "react";
|
||||||
|
import { useTranslation } from "react-i18next";
|
||||||
|
import { useAppSelector } from "../../../redux/hooks.ts";
|
||||||
|
import { SecondaryButton } from "../StyledComponents.tsx";
|
||||||
|
import { CaptchaParams } from "./Captcha.tsx";
|
||||||
|
|
||||||
|
const TCAPTCHA_SCRIPT = "https://turing.captcha.qcloud.com/TCaptcha.js";
|
||||||
|
const TCAPTCHA_SCRIPT_ID = "tcaptcha-script";
|
||||||
|
|
||||||
|
export interface TCaptchaProps {
|
||||||
|
onStateChange: (state: CaptchaParams) => void;
|
||||||
|
generation: number;
|
||||||
|
fullWidth?: boolean;
|
||||||
|
[x: string]: unknown;
|
||||||
|
}
|
||||||
|
|
||||||
|
declare global {
|
||||||
|
interface Window {
|
||||||
|
TencentCaptcha?: new (
|
||||||
|
appId: string,
|
||||||
|
callback: (res: { ret: number; ticket: string; randstr: string }) => void,
|
||||||
|
options?: Record<string, unknown>,
|
||||||
|
) => { show: () => void; destroy?: () => void };
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TCaptcha renders a verify button opening Tencent's captcha popup. On
|
||||||
|
// success the widget yields { ticket, randstr }, which the backend verifies
|
||||||
|
// via DescribeCaptchaResult.
|
||||||
|
const TCaptcha = ({ onStateChange, generation, fullWidth, ...rest }: TCaptchaProps) => {
|
||||||
|
const { t } = useTranslation("common");
|
||||||
|
const appId = useAppSelector((state) => state.siteConfig.basic.config.tcaptcha_app_id);
|
||||||
|
const [ready, setReady] = useState(false);
|
||||||
|
const [verified, setVerified] = useState(false);
|
||||||
|
const captchaRef = useRef<{ show: () => void; destroy?: () => void } | null>(null);
|
||||||
|
const onStateChangeRef = useRef(onStateChange);
|
||||||
|
|
||||||
|
useEffect(() => {
|
||||||
|
onStateChangeRef.current = onStateChange;
|
||||||
|
}, [onStateChange]);
|
||||||
|
|
||||||
|
useEffect(() => {
|
||||||
|
if (!appId) {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
let script = document.getElementById(TCAPTCHA_SCRIPT_ID) as HTMLScriptElement | null;
|
||||||
|
const onLoad = () => setReady(true);
|
||||||
|
if (!script) {
|
||||||
|
script = document.createElement("script");
|
||||||
|
script.id = TCAPTCHA_SCRIPT_ID;
|
||||||
|
script.src = TCAPTCHA_SCRIPT;
|
||||||
|
script.async = true;
|
||||||
|
script.onload = onLoad;
|
||||||
|
document.head.appendChild(script);
|
||||||
|
} else if (window.TencentCaptcha) {
|
||||||
|
setReady(true);
|
||||||
|
} else {
|
||||||
|
script.onload = onLoad;
|
||||||
|
}
|
||||||
|
}, [appId]);
|
||||||
|
|
||||||
|
// Regeneration invalidates a previous solve.
|
||||||
|
useEffect(() => {
|
||||||
|
if (generation > 0) {
|
||||||
|
setVerified(false);
|
||||||
|
captchaRef.current = null;
|
||||||
|
}
|
||||||
|
}, [generation]);
|
||||||
|
|
||||||
|
const openCaptcha = () => {
|
||||||
|
if (!window.TencentCaptcha || !appId) {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
captchaRef.current?.destroy?.();
|
||||||
|
const instance = new window.TencentCaptcha(
|
||||||
|
appId,
|
||||||
|
(res) => {
|
||||||
|
if (res.ret === 0) {
|
||||||
|
setVerified(true);
|
||||||
|
onStateChangeRef.current({ ticket: res.ticket, randstr: res.randstr });
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{ needFeedBack: false },
|
||||||
|
);
|
||||||
|
captchaRef.current = instance;
|
||||||
|
instance.show();
|
||||||
|
};
|
||||||
|
|
||||||
|
if (!appId) {
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
return (
|
||||||
|
<Box sx={{ textAlign: "center", ...(fullWidth && { width: "100%" }) }} {...rest}>
|
||||||
|
<SecondaryButton
|
||||||
|
variant="outlined"
|
||||||
|
fullWidth={fullWidth}
|
||||||
|
onClick={openCaptcha}
|
||||||
|
disabled={!ready}
|
||||||
|
color={verified ? "success" : "primary"}
|
||||||
|
>
|
||||||
|
{verified ? t("captcha.verified") : t("captcha.verify")}
|
||||||
|
</SecondaryButton>
|
||||||
|
</Box>
|
||||||
|
);
|
||||||
|
};
|
||||||
|
|
||||||
|
export default TCaptcha;
|
||||||
@ -0,0 +1,138 @@
|
|||||||
|
// Package tcaptcha verifies Tencent Cloud Captcha tickets via the
|
||||||
|
// DescribeCaptchaResult API (TencentCloud API v3, TC3-HMAC-SHA256 signing).
|
||||||
|
package tcaptcha
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"crypto/hmac"
|
||||||
|
"crypto/sha256"
|
||||||
|
"encoding/hex"
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"strconv"
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/cloudreve/Cloudreve/v4/pkg/request"
|
||||||
|
"github.com/cloudreve/Cloudreve/v4/pkg/setting"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
endpoint = "captcha.tencentcloudapi.com"
|
||||||
|
service = "captcha"
|
||||||
|
version = "2019-07-22"
|
||||||
|
action = "DescribeCaptchaResult"
|
||||||
|
signAlgorithm = "TC3-HMAC-SHA256"
|
||||||
|
signedHeaders = "content-type;host;x-tc-action"
|
||||||
|
captchaTypeNew = 9 // interactive captcha (popup widget)
|
||||||
|
)
|
||||||
|
|
||||||
|
type describeResultResponse struct {
|
||||||
|
Response struct {
|
||||||
|
CaptchaCode int `json:"CaptchaCode"`
|
||||||
|
CaptchaMsg string `json:"CaptchaMsg"`
|
||||||
|
Error *struct {
|
||||||
|
Code string `json:"Code"`
|
||||||
|
Message string `json:"Message"`
|
||||||
|
} `json:"Error"`
|
||||||
|
} `json:"Response"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// Verify checks a ticket produced by the Tencent captcha widget. CaptchaCode
|
||||||
|
// 1 means the ticket is valid.
|
||||||
|
func Verify(ctx context.Context, client request.Client, cfg *setting.TcCaptcha, ticket, randstr, userIP string) (bool, error) {
|
||||||
|
appID, err := strconv.ParseInt(strings.TrimSpace(cfg.AppID), 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
return false, fmt.Errorf("invalid CaptchaAppId: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
payload, err := json.Marshal(map[string]any{
|
||||||
|
"CaptchaType": captchaTypeNew,
|
||||||
|
"Ticket": ticket,
|
||||||
|
"Randstr": randstr,
|
||||||
|
"UserIp": userIP,
|
||||||
|
"CaptchaAppId": appID,
|
||||||
|
"AppSecretKey": cfg.AppSecretKey,
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
|
||||||
|
timestamp := time.Now().Unix()
|
||||||
|
auth := sign(cfg.SecretID, cfg.SecretKey, string(payload), timestamp)
|
||||||
|
|
||||||
|
res, err := client.Request(
|
||||||
|
"POST",
|
||||||
|
"https://"+endpoint,
|
||||||
|
strings.NewReader(string(payload)),
|
||||||
|
request.WithContext(ctx),
|
||||||
|
request.WithHeader(http.Header{
|
||||||
|
"Content-Type": []string{"application/json; charset=utf-8"},
|
||||||
|
"Host": []string{endpoint},
|
||||||
|
"X-TC-Action": []string{action},
|
||||||
|
"X-TC-Version": []string{version},
|
||||||
|
"X-TC-Timestamp": []string{strconv.FormatInt(timestamp, 10)},
|
||||||
|
"Authorization": []string{auth},
|
||||||
|
}),
|
||||||
|
).CheckHTTPResponse(http.StatusOK).GetResponse()
|
||||||
|
if err != nil {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
|
||||||
|
var parsed describeResultResponse
|
||||||
|
if err := json.Unmarshal([]byte(res), &parsed); err != nil {
|
||||||
|
return false, fmt.Errorf("failed to parse captcha result: %w", err)
|
||||||
|
}
|
||||||
|
if parsed.Response.Error != nil {
|
||||||
|
return false, fmt.Errorf("captcha api error %s: %s", parsed.Response.Error.Code, parsed.Response.Error.Message)
|
||||||
|
}
|
||||||
|
return parsed.Response.CaptchaCode == 1, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// sign builds the TC3-HMAC-SHA256 Authorization header value.
|
||||||
|
func sign(secretID, secretKey, payload string, timestamp int64) string {
|
||||||
|
date := time.Unix(timestamp, 0).UTC().Format("2006-01-02")
|
||||||
|
|
||||||
|
canonicalRequest := strings.Join([]string{
|
||||||
|
"POST",
|
||||||
|
"/",
|
||||||
|
"",
|
||||||
|
"content-type:application/json; charset=utf-8\n" +
|
||||||
|
"host:" + endpoint + "\n" +
|
||||||
|
"x-tc-action:" + strings.ToLower(action) + "\n",
|
||||||
|
signedHeaders,
|
||||||
|
sha256Hex(payload),
|
||||||
|
}, "\n")
|
||||||
|
|
||||||
|
credentialScope := date + "/" + service + "/tc3_request"
|
||||||
|
stringToSign := strings.Join([]string{
|
||||||
|
signAlgorithm,
|
||||||
|
strconv.FormatInt(timestamp, 10),
|
||||||
|
credentialScope,
|
||||||
|
sha256Hex(canonicalRequest),
|
||||||
|
}, "\n")
|
||||||
|
|
||||||
|
signingKey := hmacSHA256(
|
||||||
|
hmacSHA256(
|
||||||
|
hmacSHA256([]byte("TC3"+secretKey), date),
|
||||||
|
service,
|
||||||
|
),
|
||||||
|
"tc3_request",
|
||||||
|
)
|
||||||
|
signature := hex.EncodeToString(hmacSHA256(signingKey, stringToSign))
|
||||||
|
|
||||||
|
return fmt.Sprintf("%s Credential=%s/%s, SignedHeaders=%s, Signature=%s",
|
||||||
|
signAlgorithm, secretID, credentialScope, signedHeaders, signature)
|
||||||
|
}
|
||||||
|
|
||||||
|
func sha256Hex(s string) string {
|
||||||
|
sum := sha256.Sum256([]byte(s))
|
||||||
|
return hex.EncodeToString(sum[:])
|
||||||
|
}
|
||||||
|
|
||||||
|
func hmacSHA256(key []byte, data string) []byte {
|
||||||
|
h := hmac.New(sha256.New, key)
|
||||||
|
h.Write([]byte(data))
|
||||||
|
return h.Sum(nil)
|
||||||
|
}
|
||||||
@ -0,0 +1,29 @@
|
|||||||
|
package tcaptcha
|
||||||
|
|
||||||
|
import (
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/cloudreve/Cloudreve/v4/pkg/setting"
|
||||||
|
"github.com/stretchr/testify/require"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestSignProducesStableAuthorization(t *testing.T) {
|
||||||
|
auth := sign("AKIDTEST", "secret", `{"CaptchaType":9}`, 1700000000)
|
||||||
|
|
||||||
|
require.True(t, strings.HasPrefix(auth, "TC3-HMAC-SHA256 Credential=AKIDTEST/2023-11-14/captcha/tc3_request"))
|
||||||
|
require.Contains(t, auth, "SignedHeaders=content-type;host;x-tc-action")
|
||||||
|
require.Contains(t, auth, "Signature=")
|
||||||
|
|
||||||
|
// Signature is the last 64 hex chars and deterministic.
|
||||||
|
sig := auth[strings.LastIndex(auth, "Signature=")+len("Signature="):]
|
||||||
|
require.Len(t, sig, 64)
|
||||||
|
require.Equal(t, auth, sign("AKIDTEST", "secret", `{"CaptchaType":9}`, 1700000000))
|
||||||
|
require.NotEqual(t, auth, sign("AKIDTEST", "secret2", `{"CaptchaType":9}`, 1700000000))
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestVerifyRejectsBadAppID(t *testing.T) {
|
||||||
|
ok, err := Verify(t.Context(), nil, &setting.TcCaptcha{AppID: "not-a-number"}, "t", "r", "1.2.3.4")
|
||||||
|
require.Error(t, err)
|
||||||
|
require.False(t, ok)
|
||||||
|
}
|
||||||
Loading…
Reference in new issue