diff --git a/config/config.ini.example b/config/config.ini.example
index a296c1c..89a1049 100644
--- a/config/config.ini.example
+++ b/config/config.ini.example
@@ -43,6 +43,13 @@ google.publisher = ""
; Google analytics
google.analytics.id = ""
+; Google reCaptcha
+; https://www.google.com/recaptcha/admin
+
+google.reCaptcha = false
+google.reCaptcha.public = ""
+google.reCaptcha.private = ""
+
; Pagination, RSS, and JSON
posts.perpage = "5"
tag.perpage = "10"
diff --git a/system/admin/views/login.html.php b/system/admin/views/login.html.php
index cc97d9f..916e9b7 100644
--- a/system/admin/views/login.html.php
+++ b/system/admin/views/login.html.php
@@ -9,6 +9,11 @@
Password *
+
+
+
">
+
+
\ No newline at end of file
diff --git a/system/htmly.php b/system/htmly.php
index 22d9a95..83cf5ba 100644
--- a/system/htmly.php
+++ b/system/htmly.php
@@ -57,11 +57,12 @@ get('/index', function () {
// Get submitted login data
post('/login', function () {
- $proper = is_csrf_proper(from($_REQUEST, 'csrf_token'));
+ $proper = (is_csrf_proper(from($_REQUEST, 'csrf_token')));
+ $captcha = isCaptcha(from($_REQUEST, 'g-recaptcha-response'));
$user = from($_REQUEST, 'user');
$pass = from($_REQUEST, 'password');
- if ($proper && !empty($user) && !empty($pass)) {
+ if ($proper && $captcha && !empty($user) && !empty($pass)) {
session($user, $pass, null);
$log = session($user, $pass, null);
@@ -88,6 +89,9 @@ post('/login', function () {
if (!$proper) {
$message['error'] .= 'CSRF Token not correct.';
}
+ if(!$captcha) {
+ $message['error'] .= 'reCaptcha not correct.';
+ }
config('views.root', 'system/admin/views');
diff --git a/system/includes/functions.php b/system/includes/functions.php
index 7b2933c..33b952b 100644
--- a/system/includes/functions.php
+++ b/system/includes/functions.php
@@ -1758,3 +1758,24 @@ function remove_html_comments($content)
{
return trim(preg_replace('/(\s|)(\s|)/', '', $content));
}
+
+function isCaptcha($reCaptchaResponse){
+ if(! config("google.reCaptcha")){
+ return true;
+ }
+ $url = "https://www.google.com/recaptcha/api/siteverify";
+ $options = array(
+ "secret" => config("google.reCaptcha.private"),
+ "response" => $reCaptchaResponse,
+ "remoteip" => $_SERVER['REMOTE_ADDR'],
+ );
+ $fileContent = @file_get_contents($url . "?" . http_build_query($options));
+ if($fileContent === false) {
+ return false;
+ }
+ $json = json_decode($fileContent, true);
+ if($json == false){
+ return false;
+ }
+ return ($json['success']);
+}