Summary
The ConfirmEdit (CAPTCHA extension) hCaptcha captcha type verifies captchas using a call to an API named siteverify. This code should verify that the sitekey provided to the client matches the sitekey returned by the siteverify API
Background
- hCaptcha in ConfirmEdit (CAPTCHA extension) allows varying the type of sitekey used for a given request
- This includes varying the sitekey for an AbuseFilter consequence
- Currently we do not enforce that the given response token sent by the client during the POST request is associated with any given sitekey
- This means that a client could modify the JavaScript config variables to use a sitekey that has potentially less restrictions and may be easier to solve
- To address these issues, we should ensure that the sitekey API response sitekey property is compared against the sitekey that should have been used for the request
- If the sitekeys do not match, then we should consider that hCaptcha captcha check to have failed
Acceptance criteria
- In HCaptcha::passCaptcha, the method should return false if the sitekey returned by the siteverify API does not match the the sitekey passed to the client
