Merge pull request #2245 from coreos-inc/recaptcha

Add support for recaptcha during the create account flow

endpoints/api/user.py

@@ -2,6 +2,7 @@
 
 import logging
 import json
+import recaptcha2
 
 from flask import request, abort
 from flask_login import logout_user
@@ -183,6 +184,10 @@ class User(ApiResource):
           'type': 'string',
           'description': 'The optional invite code',
         },
+        'recaptcha_response': {
+          'type': 'string',
+          'description': 'The (may be disabled) recaptcha response code for verification',
+        },
       }
     },
     'UpdateUser': {
@@ -382,6 +387,19 @@ class User(ApiResource):
       abort(404)
 
     user_data = request.get_json()
+
+    # If recaptcha is enabled, then verify the user is a human.
+    if features.RECAPTCHA:
+      recaptcha_response = user_data.get('recaptcha_response', '')
+      result = recaptcha2.verify(app.config['RECAPTCHA_SECRET_KEY'],
+                                 recaptcha_response,
+                                 request.remote_addr)
+
+      if not result['success']:
+        return {
+          'message': 'Are you a bot? If not, please revalidate the captcha.'
+        }, 400
+
     invite_code = user_data.get('invite_code', '')
     existing_user = model.user.get_nonrobot_user(user_data['username'])
     if existing_user:

endpoints/common.py

@@ -220,6 +220,7 @@ def render_page_template(name, route_data=None, **kwargs):
                                        enterprise_logo=app.config.get('ENTERPRISE_LOGO_URL', ''),
                                        mixpanel_key=app.config.get('MIXPANEL_KEY', ''),
                                        munchkin_key=app.config.get('MARKETO_MUNCHKIN_ID', ''),
+                                       recaptcha_key=app.config.get('RECAPTCHA_SITE_KEY', ''),
                                        google_tagmanager_key=app.config.get('GOOGLE_TAGMANAGER_KEY', ''),
                                        google_anaytics_key=app.config.get('GOOGLE_ANALYTICS_KEY', ''),
                                        sentry_public_dsn=app.config.get('SENTRY_PUBLIC_DSN', ''),