Support Thread for Google reCAPTCHA plugin

anything done in pieces winds up well in pieces

Load the entire template of your choice clone it and then change it to whatever you wanted to look like

zc 1.5.8a, php 8.1.24, recaptcha 3.6a
While its working fine, when the contact us page is loaded it throws this error:

17-Oct-2023 00:37:46 America/Chicago] Request URI: /contact_us?action=send, IP address: 82.147.85.78, Language id 1
#0 /includes/classes/observers/class.google_recaptcha.php(40): zen_debug_error_handler()
#1 /includes/classes/traits/NotifierManager.php(87): google_recaptcha->update()
#2 /includes/modules/pages/contact_us/header_php.php(31): base->notify()
#3 /index.php(35): require('/home/pcs/publi...')
--> PHP Warning: Undefined array key "g-recaptcha-response" in /includes/classes/observers/class.google_recaptcha.php on line 40.

Oddly the create account page does NOT do this.

Any suggestions would be greatly appreciated!

I checked and found no problem here. But in my shop, code for reCAPTCHA in contact page is placed before the ```html

Although I use Zen Cart 1.5.8a and PHP 8.1.24 like you I just realized I was using reCAPTCHA v3.7 from Torvista (on GitHub) and files are completly different. Please ignore my precedent post.

This has gone away without any other changes, so it must have been related to my screwed up DB having nulls where they shouldn't be everywhere. Sorry!

I installed Google reCAPTCHA Version: 3.6a on zencart 1.5.0 https://gmstationery.com.au/. The contract or create account page displays the reCAPTCHA field but form can be submitted without clicking it.

Template is called bootstrap. I placed the reCAPTCHA under the CUAS field

vandiermen:

I installed Google reCAPTCHA Version: 3.6a on zencart 1.5.0 https://gmstationery.com.au/. The contract or create account page displays the reCAPTCHA field but form can be submitted without clicking it.

Template is called bootstrap. I placed the reCAPTCHA under the CUAS field
Did you edit the /includes/functions/extra_functions/functions_google_recaptcha.php to indicate that the checking should occur on those pages?

The default values are 'false', set the pages you're interested in to 'true' (and don't forget the quotes):

//set to true for the pages on which you wish to enable reCaptcha (don't forget to add the code snippet to the template!)
define('GOOGLE_RECAPCHTA_ASK_QUESTION', 'false');
define('GOOGLE_RECAPCHTA_CONTACT_US', 'false');
define('GOOGLE_RECAPCHTA_CREATE_ACCOUNT', 'false');
define('GOOGLE_RECAPCHTA_REVIEWS', 'false');
define('GOOGLE_RECAPCHTA_BISN', 'false'); //Back In Stock Notification Plugin: https://github.com/torvista/Zen_Cart-Back_in_Stock_Notifications

v1.5.7b PHP7.3 OPC installed (among others)

README update suggestion

A customer encountered issues trying to create an account in that the Google reCAPTCHA wasn't showing on the page hence just the warning "prove you are not a robot".

I re-checked my istallation of the latest version of this plugin. I eventually solved the issue by adding the required code to an OPC template includes/templates/template_default/tpl_create_account_register.php

This is not mentioned in the README for the plugin, so I continued to tear my hair out trying and retrying to follow the README verbatim -so for others it may present the same issue - hence the suggestion to maybe update the README to include the above.

cheers, Mike

This is not mentioned in the README for the plugin, so I continued to tear my hair out trying and retrying to follow the README verbatim -so for others it may present the same issue - hence the suggestion to maybe update the README to include the above.

Feel free to go ahead and add your hard-earned knowledge (via the GitHub repository) to the readme, the code is open source for a reason.

Scott had already asked this but no-one replied.
I think it is crutial to add a reCaptcha to checkout_process page, as we are subject to many CC try attempts by bots.
Does anyone know how to do this properly?

barkiesc:

This plugin is really great. Previously bots were creating a ton of garbage accounts and this has completely stopped that.

Unfortunately I now have a bot testing out credit card numbers on my Zen Cart sites which is resulting in high credit card fees for all the authorization attempts. The bot is creating a Zen Cart account, I assume the human is doing that step to get through the reCAPTCHA, and then the bot is using that one account to complete the checkout process and try to charge a credit card. And doing this many many times.

Would it be possible to add a reCAPTCHA to some part of the checkout process so we can be sure it is a human checking out and not a bot? This functionality would likely be useful for other users as well who may be experiencing this type of problem, it seems to be becoming more common. For example adding a reCAPTCHA on the checkout_shipping or checkout_payment pages.

I tried to add a reCAPTCHA to checkout_shipping by editing these pages,

includes/classes/observers/auto.non_captcha_observer.php
includes/classes/observers/class.google_recaptcha.php
includes/modules/pages/checkout_shipping/header_php.php
includes/templates/MY_DEFAULT_TEMPLATE/templates/tpl_checkout_shipping_default.php

The reCAPTCHA is displayed on the shipping page but the user isn't being required to select it so I obviously am doing something wrong. All of the pages above seemed straightforward to edit except for checkout_shipping/header_php.php -- I'm unsure about the change I made there. I am running the current version of Zen Cart. Any help would be greatly appreciated.

-Scott

That's not a possibility, since the 'checkout_process' page is transitional ... i.e. no customer input accepted.

The order's payment is confirmed on checkout_confirmation and sent to the payment-provider, resulting in a redirect to checkout_process which results in a redirect to checkout_success on successful completion or somewhere else if an issue (like CC denial) occurs.

I am sorry, I have meant adding a captcha to the checkout_confirmation page. The last page before going to the payment provider.

lat9:

That's not a possibility, since the 'checkout_process' page is transitional ... i.e. no customer input accepted.

The order's payment is confirmed on checkout_confirmation and sent to the payment-provider, resulting in a redirect to checkout_process which results in a redirect to checkout_success on successful completion or somewhere else if an issue (like CC denial) occurs.

If a bot's got past the create account captcha already, I'd assume it'll get past any others.
Doesn't seem much point using another one, just more annoyance for real customers.

They seem to pass the create account part manually.
They have tried 14000 CC's in one night and due to this activity the bank has suspended the payment system.
In order to open the system back they require extra security mesures, one of which is captcha control, either on the first fail or in all attempts.
(in checkout_process there is a CC SLAM PREVENTION, it beats me how they get passed that)

torvista:

If a bot's got past the create account captcha already, I'd assume it'll get past any others.
Doesn't seem much point using another one, just more annoyance for real customers.

for every problem there is a solution.

which credit card module are you using?

in my auth.net module, look at these lines of code:

https://github.com/proseLA/authorizenet_cim/blob/2b45d8d26c38333e9d48a3e5f94633a737574ae4/includes/modules/payment/authorizenet_cim.php#L43-L46
https://github.com/proseLA/authorizenet_cim/blob/2b45d8d26c38333e9d48a3e5f94633a737574ae4/includes/modules/payment/authorizenet_cim.php#L1003-L1024

this slows them down and then logs them off...

it is possible that you have a method for testing credit cards that is NOT part of the checkout process, which is why the slam protection might not work.

best

I currently have this plugin installed in a v.1.5.8 and have used keys from Google for their v2 of ReCaptcha. I would like to move to v3 of ReCaptcha and I see that this plugin mentions it can be used for both v2 and v3.

To do this, do I simply get Google keys for v3 and place them in to make this change? Are there other changes that need to be made??

Thanks for your help!

[ZC 1.5.8]
My google reCaptcha works but
Somewhere along the path of upgrading I have ended up with both

includes/clases/observers/auto.non_captcha_observer.php

and

includes/auto_loaders/config.google_recaptcha.php
includes/clases/observers/class.google_recaptcha.php

Aren't these contradictory load types?
I mean either one or the other.
Should the other one be removed?

They are contradictory load types. I'm *guessing *that the auto-loaded observer is more recent; if so, the auto_loader and its observer-class should be removed. If my guess isn't correct, remove (or simply rename) the auto-loaded one.

Sorry my fault! :blush:
non_captcha_observer is totally something else, i.e. not a a part of google_recaptcha.
It comes with a standard ZC distribution.

zamzom:

[ZC 1.5.8]
My google reCaptcha works but
Somewhere along the path of upgrading I have ended up with both

includes/clases/observers/auto.non_captcha_observer.php

> and
> ```
includes/auto_loaders/config.google_recaptcha.php
includes/clases/observers/class.google_recaptcha.php

Aren't these contradictory load types?
I mean either one or the other.
Should the other one be removed?

zc158a
PHP v8.2
ZCA Bootstrap v3.6.5
Google reCaptcha (v3.6)
I've got several errors/warnings like this:

[18-Jun-2024 02:39:30 UTC] Request URI: /index.php?main_page=contact_us&action=send, IP address: 117.192.113.1, Language id 2
#0 /includes/classes/observers/class.google_recaptcha.php(40): zen_debug_error_handler()
#1 /includes/classes/traits/NotifierManager.php(87): google_recaptcha->update()
#2 /includes/modules/pages/contact_us/header_php.php(31): base->notify()
#3 /index.php(35): require('...')
--> PHP Warning: Undefined array key "g-recaptcha-response" in /includes/classes/observers/class.google_recaptcha.php on line 40.

Mainly at contact_us.
Any suggestions on how to solve this?

TIA,

jpda