fluxerapp/fluxer
1
0
Fork 0
mirror of https://github.com/fluxerapp/fluxer.git synced 2026-09-02 21:04:06 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(captcha): drop the body-email contact policy exemption (#2343)

Browse Source
This commit is contained in:
Hampus
2026-09-02 17:23:02 +02:00
committed by GitHub
parent 0f7ad484ce
commit e86e24a2db
1 changed files with 3 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fluxer_api/src/api/middleware/CaptchaMiddleware.ts
+3 -14
View File
@@ -1,5 +1,6 @@
// SPDX-License-Identifier: AGPL-3.0-or-later
import {Headers} from '@fluxer/constants/src/Headers';
import {UserFlags} from '@fluxer/constants/src/UserConstants';
import {CaptchaRequiredError, InvalidCaptchaError} from '@fluxer/errors/src/CaptchaErrors';
import {extractClientIp} from '@fluxer/ip_utils/src/ClientIp';
@@ -55,13 +56,12 @@ export async function verifyCaptchaToken(ctx: Context<HonoEnv>): Promise<void> {
const user = ctx.get('user') as User | undefined;
if (accountPolicyContactHasCapability(user?.email, 'captcha_exempt')) return;
if (userHasCaptchaExemptFlag(user)) return;
if (await requestContactHasCaptchaExemption(ctx.req.raw)) return;
if (await requestUserHasCaptchaExemptFlag(ctx)) return;
const token = ctx.req.header('x-captcha-token');
const token = ctx.req.header(Headers.X_CAPTCHA_TOKEN);
if (!token) {
throw new CaptchaRequiredError();
}
const provider = resolveCaptchaProvider(captchaConfig, ctx.req.header('x-captcha-type'));
const provider = resolveCaptchaProvider(captchaConfig, ctx.req.header(Headers.X_CAPTCHA_TYPE));
const isValid = await provider.verify({
token,
remoteIp:
@@ -75,17 +75,6 @@ export async function verifyCaptchaToken(ctx: Context<HonoEnv>): Promise<void> {
}
}
async function requestContactHasCaptchaExemption(request: Request): Promise<boolean> {
try {
const body = (await request.clone().json()) as unknown;
if (!body || typeof body !== 'object' || Array.isArray(body)) return false;
const email = (body as Record<string, unknown>).email;
return typeof email === 'string' && accountPolicyContactHasCapability(email, 'captcha_exempt');
} catch {
return false;
}
}
function userHasCaptchaExemptFlag(user: User | null | undefined): boolean {
return user != null && (user.flags & UserFlags.APP_STORE_REVIEWER) !== 0n;
}