Merge pull request #4409 from pixelfed/staging

Update login form, allow admins to enable captcha after X failed atte…

CHANGELOG.md

@@ -53,6 +53,7 @@
 - Update PublicTimelineService, improve warmCache query ([9f901d65](https://github.com/pixelfed/pixelfed/commit/9f901d65))
 - Update AP Inbox, fix delete handling ([2800c888](https://github.com/pixelfed/pixelfed/commit/2800c888))
 - Update login/register views and captcha config, enable login or register captchas or both ([c071c719](https://github.com/pixelfed/pixelfed/commit/c071c719))
+- Update login form, allow admins to enable captcha after X failed attempts. Admins can set the number of attempts before captcha is shown, default is 2 attempts before captcha is required ([221ddce0](https://github.com/pixelfed/pixelfed/commit/221ddce0))
 -  ([](https://github.com/pixelfed/pixelfed/commit/))
 
 ## [v0.11.6 (2023-05-03)](https://github.com/pixelfed/pixelfed/compare/v0.11.5...v0.11.6)

app/Http/Controllers/Auth/LoginController.php

@@ -7,6 +7,8 @@ use App\Http\Controllers\Controller;
 use App\User;
 use Illuminate\Foundation\Auth\AuthenticatesUsers;
 use App\Services\BouncerService;
+use Illuminate\Http\Request;
+use Illuminate\Validation\ValidationException;
 
 class LoginController extends Controller
 {
@@ -70,8 +72,16 @@ class LoginController extends Controller
             'password'        => 'required|string|min:6',
         ];
 
-        if(config('captcha.enabled') || config('captcha.active.login')) {
+        if(
-            $rules['h-captcha-response'] = 'required|captcha';
+        	config('captcha.enabled') ||
+        	config('captcha.active.login') ||
+        	(
+				config('captcha.triggers.login.enabled') &&
+				request()->session()->has('login_attempts') &&
+				request()->session()->get('login_attempts') >= config('captcha.triggers.login.attempts')
+			)
+        ) {
+            $rules['h-captcha-response'] = 'required|filled|captcha|min:5';
         }
         
         $this->validate($request, $rules);
@@ -102,4 +112,28 @@ class LoginController extends Controller
         $log->user_agent = $request->userAgent();
         $log->save();
     }
+
+    /**
+     * Get the failed login response instance.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return \Symfony\Component\HttpFoundation\Response
+     *
+     * @throws \Illuminate\Validation\ValidationException
+     */
+    protected function sendFailedLoginResponse(Request $request)
+    {
+    	if(config('captcha.triggers.login.enabled')) {
+			if ($request->session()->has('login_attempts')) {
+				$ct = $request->session()->get('login_attempts');
+				$request->session()->put('login_attempts', $ct + 1);
+			} else {
+				$request->session()->put('login_attempts', 1);
+			}
+    	}
+
+        throw ValidationException::withMessages([
+            $this->username() => [trans('auth.failed')],
+        ]);
+    }
 }

config/captcha.php

@@ -16,5 +16,12 @@ return [
     'active' => [
     	'login' => env('CAPTCHA_ENABLED_ON_LOGIN', false),
     	'register' => env('CAPTCHA_ENABLED_ON_REGISTER', false)
+    ],
+
+    'triggers' => [
+    	'login' => [
+    		'enabled' => env('CAPTCHA_TRIGGERS_LOGIN_ENABLED', false),
+    		'attempts' => env('CAPTCHA_TRIGGERS_LOGIN_ATTEMPTS', 2)
+    	]
     ]
 ];

resources/views/auth/login.blade.php

@@ -50,10 +50,18 @@
                             </div>
                         </div>
 
-                        @if(config('captcha.enabled') || config('captcha.active.login'))
+                        @if(
-                        <div class="d-flex justify-content-center mb-3">
+                        	config('captcha.enabled') ||
-                            {!! Captcha::display() !!}
+                        	config('captcha.active.login') ||
-                        </div>
+                        	(
+                        		config('captcha.triggers.login.enabled') &&
+                        		request()->session()->has('login_attempts') &&
+                        		request()->session()->get('login_attempts') >= config('captcha.triggers.login.attempts')
+                        	)
+                        )
+	                        <div class="d-flex justify-content-center mb-3">
+	                            {!! Captcha::display() !!}
+	                        </div>
                         @endif
 
                         <div class="form-group row mb-0">