2

I want to check the Captcha Google reCaptcha in a handler before validate the user and password.

require_once('recaptchalib.php');
$privatekey = "your_private_key";
$resp = recaptcha_check_answer ($privatekey,
                            $_SERVER["REMOTE_ADDR"],
                            $_POST["recaptcha_challenge_field"],
                            $_POST["recaptcha_response_field"]);
if (!$resp->is_valid) {
     // What happens when the CAPTCHA was entered incorrectly
     die ("The reCAPTCHA wasn't entered correctly. Go back and try it again." .
     "(reCAPTCHA said: " . $resp->error . ")");
} else {
     // Your code here to handle a successful verification
}

I'm using FOSUserBundle and I want to check if captcha is correct before the validation with a handler or extending some controller.

My question is, what handler can I use to do this? Something as beforeLogin?

2
  • 1
    Just want to let you know that there is a bundle for this. I am using GregwarCaptchaBundleavailable here that you can literally install in 2 minutes.
    – Mick
    Jan 22, 2013 at 8:34
  • Thanks @Patt! I installed yet and it's true, it's very easy to install, but at this moment I prefer reCaptcha from Google. Do you know if exists something as beforeLoginHandler or event or listener?
    – Santi
    Jan 22, 2013 at 9:24

2 Answers 2

4

I see this is an old question, but here is what I did, in case it helps someone.

You want to create a custom AuthenticationListener:

<?php

namespace Acme\UserBundle\EventListener;

use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\Security\Core\Exception\BadCredentialsException;
use Symfony\Component\Security\Http\Firewall\UsernamePasswordFormAuthenticationListener;

class FormAuthenticationListener extends UsernamePasswordFormAuthenticationListener
{
    protected function attemptAuthentication(Request $request)
    {
        // check for a valid captcha here
        // I am using the GregwarCaptchaBundle
        // only shown when throttling in my case
        $captcha = $request->request->get('login[captcha]', null, true);
        if (null !== $captcha) {
            $check = $request->getSession()->get('gcb_captcha');
            if ($captcha !== $check['phrase']) {
                throw new BadCredentialsException('Captcha is invalid');
            }
        }

        return parent::attemptAuthentication($request);
    }
}

You would need to register your authentication listener in your Bundle config or the app config.

Example in YAML:

parameters:
    security.authentication.listener.form.class: Acme\UserBundle\EventListener\FormAuthenticationListener

Since you override the UsernamePasswordFormAuthenticationListener, do not forget to end the method with return parent::attemptAuthentication($request) after your custom logic

1

You can overwrite FOSUserBundle login controller and insert captcha logic inside loginAction

Here you can find how to overwrite the controllers: https://github.com/FriendsOfSymfony/FOSUserBundle/blob/master/Resources/doc/overriding_controllers.md

1
  • Thanks @Ferhad. The problem is that loginAction from FOSUserBundle executes after login validation. I need before login validation.
    – Santi
    Jan 22, 2013 at 13:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.