Fix reCAPTCHA

[n7studios]

Summary

Fixes several issues with spam protection (Google reCAPTCHA v3 and Cloudflare Turnstile) on the Form Builder block, Restrict Content tag form and Member Content login form:

• reCAPTCHA score check could be bypassed. ConvertKit_Recaptcha::verify() returned true when the token's action didn't match the form's action, skipping the minimum score check. A token generated for any other action passed verification. A mismatched or missing action now fails with the same Google reCAPTCHA failed error as a low score. A missing score is also treated as a failure. Each form's submit button and server-side check already use the same action, so genuine submissions aren't affected.
• PHP errors on unexpected siteverify responses. If Google or Cloudflare returned an unsuccessful response without error-codes, implode() threw a TypeError. Both providers now handle a missing error-codes. reCAPTCHA also handles a response body that isn't valid JSON. Turnstile also handles a response with no success key.
• reCAPTCHA submitted the wrong form when a Page had multiple forms. convertKitRecaptchaFormSubmit() always submitted the first reCAPTCHA protected form on the Page. For example, with two Form Builder blocks, or a Form Builder block and a Restrict Content tag form, clicking the second form's button submitted the first form. The clicked submit button is now stored, and its form is submitted.

Testing

New Integration tests in SpamProtectionTest, mocking Google's and Cloudflare's siteverify responses:

• testRecaptchaValidToken
• testRecaptchaLowScore
• testRecaptchaActionMismatch
• testRecaptchaNoAction
• testRecaptchaFailureWithErrorCodes
• testRecaptchaFailureWithNoErrorCodes
• testRecaptchaInvalidResponse
• testCloudflareTurnstileValidToken
• testCloudflareTurnstileFailureWithNoErrorCodes
• testCloudflareTurnstileNoSuccess

All of these except testRecaptchaValidToken, testRecaptchaLowScore, testRecaptchaFailureWithErrorCodes and testCloudflareTurnstileValidToken fail on main.

New E2E test, PageBlockFormBuilderCest::testFormBuilderWithRecaptchaEnabledSubmitsClickedForm:

• Adds two Form Builder blocks to a Page and clicks the second form's submit button.
• Then calls the reCAPTCHA callback.
• Confirms the second form is submitted. On main, the first form is submitted.

The existing reCAPTCHA E2E tests in PageBlockFormBuilderCest, RestrictContentTagCest and RestrictContentMemberContentLoginCest use real keys from CI secrets, so they need to pass in CI to confirm genuine submissions aren't affected.

Checklist

• I have written a test and included it in this PR
• I have run all tests and they pass
• The code passes when running the PHP CodeSniffer
• Code meets WordPress Coding Standards for PHP, HTML, CSS and JS
• Security and Sanitization requirements have been followed
• I have assigned a reviewer or two to review this PR (if you're not sure who to assign, we can do this step for you)

[github-actions]

WordPress Playground

🚀 Your PR has been built and is ready for testing in WordPress Playground!

Click here to test your changes in WordPress Playground