git.squeep.com Git - akkoma/blob - lib/pleroma/captcha/captcha.ex

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Captcha do
   6   alias Calendar.DateTime
   7   alias Plug.Crypto.KeyGenerator
   8   alias Plug.Crypto.MessageEncryptor
   9
  10   use GenServer
  11
  12   @doc false
  13   def start_link(_) do
  14     GenServer.start_link(__MODULE__, [], name: __MODULE__)
  15   end
  16
  17   @doc false
  18   def init(_) do
  19     {:ok, nil}
  20   end
  21
  22   @doc """
  23   Ask the configured captcha service for a new captcha
  24   """
  25   def new do
  26     GenServer.call(__MODULE__, :new)
  27   end
  28
  29   @doc """
  30   Ask the configured captcha service to validate the captcha
  31   """
  32   def validate(token, captcha, answer_data) do
  33     GenServer.call(__MODULE__, {:validate, token, captcha, answer_data})
  34   end
  35
  36   @doc false
  37   def handle_call(:new, _from, state) do
  38     if not enabled?() do
  39       {:reply, %{type: :none}, state}
  40     else
  41       new_captcha = method().new()
  42
  43       # This make salt a little different for two keys
  44       {secret, sign_secret} = secret_pair(new_captcha[:token])
  45
  46       # Basically copy what Phoenix.Token does here, add the time to
  47       # the actual data and make it a binary to then encrypt it
  48       encrypted_captcha_answer =
  49         %{
  50           at: DateTime.now_utc(),
  51           answer_data: new_captcha[:answer_data]
  52         }
  53         |> :erlang.term_to_binary()
  54         |> MessageEncryptor.encrypt(secret, sign_secret)
  55
  56       {
  57         :reply,
  58         # Replace the answer with the encrypted answer
  59         %{new_captcha | answer_data: encrypted_captcha_answer},
  60         state
  61       }
  62     end
  63   end
  64
  65   @doc false
  66   def handle_call({:validate, token, captcha, answer_data}, _from, state) do
  67     {:reply, do_validate(token, captcha, answer_data), state}
  68   end
  69
  70   def enabled?, do: Pleroma.Config.get([__MODULE__, :enabled], false)
  71
  72   defp seconds_valid, do: Pleroma.Config.get!([__MODULE__, :seconds_valid])
  73
  74   defp secret_pair(token) do
  75     secret_key_base = Pleroma.Config.get!([Pleroma.Web.Endpoint, :secret_key_base])
  76     secret = KeyGenerator.generate(secret_key_base, token <> "_encrypt")
  77     sign_secret = KeyGenerator.generate(secret_key_base, token <> "_sign")
  78
  79     {secret, sign_secret}
  80   end
  81
  82   defp do_validate(token, captcha, answer_data) do
  83     with {:ok, %{at: at, answer_data: answer_md5}} <- validate_answer_data(token, answer_data),
  84          :ok <- validate_expiration(at),
  85          :ok <- validate_usage(token),
  86          :ok <- method().validate(token, captcha, answer_md5),
  87          {:ok, _} <- mark_captcha_as_used(token) do
  88       :ok
  89     end
  90   end
  91
  92   defp validate_answer_data(token, answer_data) do
  93     {secret, sign_secret} = secret_pair(token)
  94
  95     with false <- is_nil(answer_data),
  96          {:ok, data} <- MessageEncryptor.decrypt(answer_data, secret, sign_secret),
  97          %{at: at, answer_data: answer_md5} <- :erlang.binary_to_term(data) do
  98       {:ok, %{at: at, answer_data: answer_md5}}
  99     else
 100       _ -> {:error, :invalid_answer_data}
 101     end
 102   end
 103
 104   defp validate_expiration(created_at) do
 105     # If the time found is less than (current_time-seconds_valid) then the time has already passed
 106     # Later we check that the time found is more than the presumed invalidatation time, that means
 107     # that the data is still valid and the captcha can be checked
 108
 109     valid_if_after = DateTime.subtract!(DateTime.now_utc(), seconds_valid())
 110
 111     if DateTime.before?(created_at, valid_if_after) do
 112       {:error, :expired}
 113     else
 114       :ok
 115     end
 116   end
 117
 118   defp validate_usage(token) do
 119     if is_nil(Cachex.get!(:used_captcha_cache, token)) do
 120       :ok
 121     else
 122       {:error, :already_used}
 123     end
 124   end
 125
 126   defp mark_captcha_as_used(token) do
 127     ttl = seconds_valid() |> :timer.seconds()
 128     Cachex.put(:used_captcha_cache, token, true, ttl: ttl)
 129   end
 130
 131   defp method, do: Pleroma.Config.get!([__MODULE__, :method])
 132 end