pepepper/fluxer
1
0 Fork 0
mirror of https://github.com/fluxerapp/fluxer synced 2026-10-19 05:55:34 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix(captcha): drop the body-email contact policy exemption (#2343)

Browse Source
This commit is contained in:
Hampus authored and GitHub committed 2026-09-02 17:23:02 +02:00
1 parent 0f7ad484ce
commit e86e24a2db
1 file changed
+3 -14
Download Patch File Download Diff File Expand all files Collapse all files
fluxer_api/src/api/middleware/CaptchaMiddleware.ts
+3 -14
View File
@@ -1,5 +1,6 @@
// SPDX-License-Identifier: AGPL-3.0-or-later // SPDX-License-Identifier: AGPL-3.0-or-later
import {Headers} from '@fluxer/constants/src/Headers';
import {UserFlags} from '@fluxer/constants/src/UserConstants'; import {UserFlags} from '@fluxer/constants/src/UserConstants';
import {CaptchaRequiredError, InvalidCaptchaError} from '@fluxer/errors/src/CaptchaErrors'; import {CaptchaRequiredError, InvalidCaptchaError} from '@fluxer/errors/src/CaptchaErrors';
import {extractClientIp} from '@fluxer/ip_utils/src/ClientIp'; import {extractClientIp} from '@fluxer/ip_utils/src/ClientIp';
@@ -55,13 +56,12 @@ export async function verifyCaptchaToken(ctx: Context<HonoEnv>): Promise<void> {
const user = ctx.get('user') as User | undefined; const user = ctx.get('user') as User | undefined;
if (accountPolicyContactHasCapability(user?.email, 'captcha_exempt')) return; if (accountPolicyContactHasCapability(user?.email, 'captcha_exempt')) return;
if (userHasCaptchaExemptFlag(user)) return; if (userHasCaptchaExemptFlag(user)) return;
if (await requestContactHasCaptchaExemption(ctx.req.raw)) return;
if (await requestUserHasCaptchaExemptFlag(ctx)) return; if (await requestUserHasCaptchaExemptFlag(ctx)) return;
const token = ctx.req.header('x-captcha-token'); const token = ctx.req.header(Headers.X_CAPTCHA_TOKEN);
if (!token) { if (!token) {
throw new CaptchaRequiredError(); throw new CaptchaRequiredError();
} }
const provider = resolveCaptchaProvider(captchaConfig, ctx.req.header('x-captcha-type')); const provider = resolveCaptchaProvider(captchaConfig, ctx.req.header(Headers.X_CAPTCHA_TYPE));
const isValid = await provider.verify({ const isValid = await provider.verify({
token, token,
remoteIp: remoteIp:
@@ -75,17 +75,6 @@ export async function verifyCaptchaToken(ctx: Context<HonoEnv>): Promise<void> {
} }
} }
async function requestContactHasCaptchaExemption(request: Request): Promise<boolean> {
try {
const body = (await request.clone().json()) as unknown;
if (!body || typeof body !== 'object' || Array.isArray(body)) return false;
const email = (body as Record<string, unknown>).email;
return typeof email === 'string' && accountPolicyContactHasCapability(email, 'captcha_exempt');
} catch {
return false;
}
}
function userHasCaptchaExemptFlag(user: User | null | undefined): boolean { function userHasCaptchaExemptFlag(user: User | null | undefined): boolean {
return user != null && (user.flags & UserFlags.APP_STORE_REVIEWER) !== 0n; return user != null && (user.flags & UserFlags.APP_STORE_REVIEWER) !== 0n;
} }