diff --git a/cmd/init.go b/cmd/init.go
index 0cb4e14..99b7929 100644
--- a/cmd/init.go
+++ b/cmd/init.go
@@ -24,6 +24,7 @@ import (
"github.com/knadh/koanf/providers/posflag"
"github.com/knadh/listmonk/internal/bounce"
"github.com/knadh/listmonk/internal/bounce/mailbox"
+ "github.com/knadh/listmonk/internal/captcha"
"github.com/knadh/listmonk/internal/i18n"
"github.com/knadh/listmonk/internal/manager"
"github.com/knadh/listmonk/internal/media"
@@ -69,6 +70,11 @@ type constants struct {
Exportable map[string]bool `koanf:"-"`
DomainBlocklist map[string]bool `koanf:"-"`
} `koanf:"privacy"`
+ Security struct {
+ EnableCaptcha bool `koanf:"enable_captcha"`
+ CaptchaKey string `koanf:"captcha_key"`
+ CaptchaSecret string `koanf:"captcha_secret"`
+ } `koanf:"security"`
AdminUsername []byte `koanf:"admin_username"`
AdminPassword []byte `koanf:"admin_password"`
@@ -351,6 +357,9 @@ func initConstants() *constants {
if err := ko.Unmarshal("privacy", &c.Privacy); err != nil {
lo.Fatalf("error loading app.privacy config: %v", err)
}
+ if err := ko.Unmarshal("security", &c.Security); err != nil {
+ lo.Fatalf("error loading app.security config: %v", err)
+ }
if err := ko.UnmarshalWithConf("appearance", &c.Appearance, koanf.UnmarshalConf{FlatPaths: true}); err != nil {
lo.Fatalf("error loading app.appearance config: %v", err)
}
@@ -735,6 +744,12 @@ func initHTTPServer(app *App) *echo.Echo {
return srv
}
+func initCaptcha() *captcha.Captcha {
+ return captcha.New(captcha.Opt{
+ CaptchaSecret: ko.String("security.captcha_secret"),
+ })
+}
+
func awaitReload(sigChan chan os.Signal, closerWait chan bool, closer func()) chan bool {
// The blocking signal handler that main() waits on.
out := make(chan bool)
diff --git a/cmd/main.go b/cmd/main.go
index 801a195..e6b2930 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -17,6 +17,7 @@ import (
"github.com/knadh/koanf/providers/env"
"github.com/knadh/listmonk/internal/bounce"
"github.com/knadh/listmonk/internal/buflog"
+ "github.com/knadh/listmonk/internal/captcha"
"github.com/knadh/listmonk/internal/core"
"github.com/knadh/listmonk/internal/i18n"
"github.com/knadh/listmonk/internal/manager"
@@ -47,6 +48,7 @@ type App struct {
i18n *i18n.I18n
bounce *bounce.Manager
paginator *paginator.Paginator
+ captcha *captcha.Captcha
notifTpls *notifTpls
log *log.Logger
bufLog *buflog.BufLog
@@ -168,6 +170,7 @@ func main() {
messengers: make(map[string]messenger.Messenger),
log: lo,
bufLog: bufLog,
+ captcha: initCaptcha(),
paginator: paginator.New(paginator.Opt{
DefaultPerPage: 20,
diff --git a/cmd/public.go b/cmd/public.go
index 3931a7b..9c15917 100644
--- a/cmd/public.go
+++ b/cmd/public.go
@@ -79,7 +79,8 @@ type msgTpl struct {
type subFormTpl struct {
publicTpl
- Lists []models.List
+ Lists []models.List
+ CaptchaKey string
}
var (
@@ -418,6 +419,10 @@ func handleSubscriptionFormPage(c echo.Context) error {
out.Title = app.i18n.T("public.sub")
out.Lists = lists
+ if app.constants.Security.EnableCaptcha {
+ out.CaptchaKey = app.constants.Security.CaptchaKey
+ }
+
return c.Render(http.StatusOK, "subscription-form", out)
}
@@ -433,6 +438,19 @@ func handleSubscriptionForm(c echo.Context) error {
return echo.NewHTTPError(http.StatusBadGateway, app.i18n.T("public.invalidFeature"))
}
+ // Process CAPTCHA.
+ if app.constants.Security.EnableCaptcha {
+ err, ok := app.captcha.Verify(c.FormValue("h-captcha-response"))
+ if err != nil {
+ app.log.Printf("Captcha request failed: %v", err)
+ }
+
+ if !ok {
+ return c.Render(http.StatusBadRequest, tplMessage,
+ makeMsgTpl(app.i18n.T("public.errorTitle"), "", app.i18n.T("public.invalidCaptcha")))
+ }
+ }
+
hasOptin, err := processSubForm(c)
if err != nil {
e, ok := err.(*echo.HTTPError)
diff --git a/cmd/settings.go b/cmd/settings.go
index 5f86a29..06435f3 100644
--- a/cmd/settings.go
+++ b/cmd/settings.go
@@ -44,6 +44,7 @@ func handleGetSettings(c echo.Context) error {
}
s.UploadS3AwsSecretAccessKey = ""
s.SendgridKey = ""
+ s.SecurityCaptchaSecret = ""
return c.JSON(http.StatusOK, okResp{s})
}
@@ -158,6 +159,9 @@ func handleUpdateSettings(c echo.Context) error {
if set.SendgridKey == "" {
set.SendgridKey = cur.SendgridKey
}
+ if set.SecurityCaptchaSecret == "" {
+ set.SecurityCaptchaSecret = cur.SecurityCaptchaSecret
+ }
// Domain blocklist.
doms := make([]string, 0)
diff --git a/cmd/upgrade.go b/cmd/upgrade.go
index a65bd0b..48f2bd3 100644
--- a/cmd/upgrade.go
+++ b/cmd/upgrade.go
@@ -34,6 +34,7 @@ var migList = []migFunc{
{"v2.1.0", migrations.V2_1_0},
{"v2.2.0", migrations.V2_2_0},
{"v2.3.0", migrations.V2_3_0},
+ {"v2.4.0", migrations.V2_4_0},
}
// upgrade upgrades the database to the current version by running SQL migration files
diff --git a/frontend/src/views/Settings.vue b/frontend/src/views/Settings.vue
index b395a5f..8dad6d9 100644
--- a/frontend/src/views/Settings.vue
+++ b/frontend/src/views/Settings.vue
@@ -34,6 +34,10 @@
+
+
+
+
@@ -66,6 +70,7 @@ import { mapState } from 'vuex';
import GeneralSettings from './settings/general.vue';
import PerformanceSettings from './settings/performance.vue';
import PrivacySettings from './settings/privacy.vue';
+import SecuritySettings from './settings/security.vue';
import MediaSettings from './settings/media.vue';
import SmtpSettings from './settings/smtp.vue';
import BounceSettings from './settings/bounces.vue';
@@ -79,6 +84,7 @@ export default Vue.extend({
GeneralSettings,
PerformanceSettings,
PrivacySettings,
+ SecuritySettings,
MediaSettings,
SmtpSettings,
BounceSettings,
@@ -136,6 +142,10 @@ export default Vue.extend({
form['bounce.sendgrid_key'] = '';
}
+ if (form['security.captcha_secret'] === dummyPassword) {
+ form['security.captcha_secret'] = '';
+ }
+
for (let i = 0; i < form.messengers.length; i += 1) {
// If it's the dummy UI password placeholder, ignore it.
if (form.messengers[i].password === dummyPassword) {
@@ -203,6 +213,7 @@ export default Vue.extend({
d['upload.s3.aws_secret_access_key'] = dummyPassword;
}
d['bounce.sendgrid_key'] = dummyPassword;
+ d['security.captcha_secret'] = dummyPassword;
// Domain blocklist array to multi-line string.
d['privacy.domain_blocklist'] = d['privacy.domain_blocklist'].join('\n');
diff --git a/frontend/src/views/settings/security.vue b/frontend/src/views/settings/security.vue
new file mode 100644
index 0000000..0faf837
--- /dev/null
+++ b/frontend/src/views/settings/security.vue
@@ -0,0 +1,42 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
{{ L.T "globals.terms.lists" }}
{{ range $i, $l := .Data.Lists }}
@@ -28,6 +28,13 @@
{{ end }}
+
+ {{ if .Data.CaptchaKey }}
+
+ {{ end }}