Move the encryption out of kocaptcha into general captcha module

That way there won't be a need to reimplement it for other captcha services
This commit is contained in:
Ekaterina Vaartis 2018-12-22 22:39:08 +03:00
parent 336e37d98f
commit b386e560ba
3 changed files with 67 additions and 53 deletions

View file

@ -1,4 +1,8 @@
defmodule Pleroma.Captcha do defmodule Pleroma.Captcha do
alias Plug.Crypto.KeyGenerator
alias Plug.Crypto.MessageEncryptor
alias Calendar.DateTime
use GenServer use GenServer
@doc false @doc false
@ -32,13 +36,58 @@ defmodule Pleroma.Captcha do
if !enabled do if !enabled do
{:reply, %{type: :none}, state} {:reply, %{type: :none}, state}
else else
{:reply, method().new(), state} new_captcha = method().new()
secret_key_base = Pleroma.Config.get!([Pleroma.Web.Endpoint, :secret_key_base])
# This make salt a little different for two keys
token = new_captcha[:token]
secret = KeyGenerator.generate(secret_key_base, token <> "_encrypt")
sign_secret = KeyGenerator.generate(secret_key_base, token <> "_sign")
# Basicallty copy what Phoenix.Token does here, add the time to
# the actual data and make it a binary to then encrypt it
encrypted_captcha_answer =
%{
at: DateTime.now_utc(),
answer_data: new_captcha[:answer_data]
}
|> :erlang.term_to_binary()
|> MessageEncryptor.encrypt(secret, sign_secret)
IO.inspect(%{new_captcha | answer_data: encrypted_captcha_answer})
{
:reply,
# Repalce the answer with the encrypted answer
%{new_captcha | answer_data: encrypted_captcha_answer},
state
}
end end
end end
@doc false @doc false
def handle_call({:validate, token, captcha, answer_data}, _from, state) do def handle_call({:validate, token, captcha, answer_data}, _from, state) do
{:reply, method().validate(token, captcha, answer_data), state} secret_key_base = Pleroma.Config.get!([Pleroma.Web.Endpoint, :secret_key_base])
secret = KeyGenerator.generate(secret_key_base, token <> "_encrypt")
sign_secret = KeyGenerator.generate(secret_key_base, token <> "_sign")
# If the time found is less than (current_time - seconds_valid), then the time has already passed.
# Later we check that the time found is more than the presumed invalidatation time, that means
# that the data is still valid and the captcha can be checked
seconds_valid = Pleroma.Config.get!([Pleroma.Captcha, :seconds_valid])
valid_if_after = DateTime.subtract!(DateTime.now_utc(), seconds_valid)
result =
with {:ok, data} <- MessageEncryptor.decrypt(answer_data, secret, sign_secret),
%{at: at, answer_data: answer_md5} <- :erlang.binary_to_term(data) do
if DateTime.after?(at, valid_if_after),
do: method().validate(token, captcha, answer_md5),
else: {:error, "CAPTCHA expired"}
else
_ -> {:error, "Invalid answer data"}
end
{:reply, result, state}
end end
defp method, do: Pleroma.Config.get!([__MODULE__, :method]) defp method, do: Pleroma.Config.get!([__MODULE__, :method])

View file

@ -4,9 +4,14 @@ defmodule Pleroma.Captcha.Service do
Returns: Returns:
Service-specific data for using the newly created captcha Type/Name of the service, the token to identify the captcha,
the data of the answer and service-specific data to use the newly created captcha
""" """
@callback new() :: map @callback new() :: %{
type: atom(),
token: String.t(),
answer_data: any()
}
@doc """ @doc """
Validated the provided captcha solution. Validated the provided captcha solution.
@ -23,6 +28,6 @@ defmodule Pleroma.Captcha.Service do
@callback validate( @callback validate(
token :: String.t(), token :: String.t(),
captcha :: String.t(), captcha :: String.t(),
answer_data :: String.t() answer_data :: any()
) :: :ok | {:error, String.t()} ) :: :ok | {:error, String.t()}
end end

View file

@ -1,8 +1,4 @@
defmodule Pleroma.Captcha.Kocaptcha do defmodule Pleroma.Captcha.Kocaptcha do
alias Plug.Crypto.KeyGenerator
alias Plug.Crypto.MessageEncryptor
alias Calendar.DateTime
alias Pleroma.Captcha.Service alias Pleroma.Captcha.Service
@behaviour Service @behaviour Service
@ -17,57 +13,21 @@ defmodule Pleroma.Captcha.Kocaptcha do
{:ok, res} -> {:ok, res} ->
json_resp = Poison.decode!(res.body) json_resp = Poison.decode!(res.body)
token = json_resp["token"]
answer_md5 = json_resp["md5"]
secret_key_base = Pleroma.Config.get!([Pleroma.Web.Endpoint, :secret_key_base])
# This make salt a little different for two keys
secret = KeyGenerator.generate(secret_key_base, token <> "_encrypt")
sign_secret = KeyGenerator.generate(secret_key_base, token <> "_sign")
# Basicallty copy what Phoenix.Token does here, add the time to
# the actual data and make it a binary to then encrypt it
encrypted_captcha_answer =
%{
at: DateTime.now_utc(),
answer_md5: answer_md5
}
|> :erlang.term_to_binary()
|> MessageEncryptor.encrypt(secret, sign_secret)
%{ %{
type: :kocaptcha, type: :kocaptcha,
token: token, token: json_resp["token"],
url: endpoint <> json_resp["url"], url: endpoint <> json_resp["url"],
answer_data: encrypted_captcha_answer answer_data: json_resp["md5"]
} }
end end
end end
@impl Service @impl Service
def validate(token, captcha, answer_data) do def validate(_token, captcha, answer_data) do
secret_key_base = Pleroma.Config.get!([Pleroma.Web.Endpoint, :secret_key_base]) # Here the token is unsed, because the unencrypted captcha answer is just passed to method
secret = KeyGenerator.generate(secret_key_base, token <> "_encrypt") if not is_nil(captcha) and
sign_secret = KeyGenerator.generate(secret_key_base, token <> "_sign") :crypto.hash(:md5, captcha) |> Base.encode16() == String.upcase(answer_data),
do: :ok,
# If the time found is less than (current_time - seconds_valid), then the time has already passed. else: {:error, "Invalid CAPTCHA"}
# Later we check that the time found is more than the presumed invalidatation time, that means
# that the data is still valid and the captcha can be checked
seconds_valid = Pleroma.Config.get!([Pleroma.Captcha, :seconds_valid])
valid_if_after = DateTime.subtract!(DateTime.now_utc(), seconds_valid)
with {:ok, data} <- MessageEncryptor.decrypt(answer_data, secret, sign_secret),
%{at: at, answer_md5: answer_md5} <- :erlang.binary_to_term(data) do
if DateTime.after?(at, valid_if_after) do
if not is_nil(captcha) and
:crypto.hash(:md5, captcha) |> Base.encode16() == String.upcase(answer_md5),
do: :ok,
else: {:error, "Invalid CAPTCHA"}
else
{:error, "CAPTCHA expired"}
end
else
_ -> {:error, "Invalid answer data"}
end
end end
end end