Add reCAPTCHA support to registration.

Because I *hate* spam bots.

Gemfile

@@ -44,6 +44,9 @@ gem 'omniauth-openid'
 gem 'omniauth-google-oauth2'
 gem 'omniauth-github'
 
+# Bot-filtering
+gem 'recaptcha', require: 'recaptcha/rails'
+
 # as authorization framework
 gem 'cancancan'
 

Gemfile.lock

@@ -420,6 +420,8 @@ GEM
       loggability (~> 0.12)
       rdoc (~> 5.0)
       yajl-ruby (~> 1.3)
+    recaptcha (4.6.2)
+      json
     redcarpet (3.2.3)
     referer-parser (0.2.1)
     request_store (1.1.0)
@@ -636,6 +638,7 @@ DEPENDENCIES
   rails-i18n (~> 4.0.0)
   rails_12factor
   rdoc-generator-fivefish
+  recaptcha
   redcarpet
   responders (~> 2.0)
   rolify

app/assets/stylesheets/osem.css.scss

@@ -1,3 +1,5 @@
+@import "bootstrap/mixins";
+
 html {
   position: relative;
   min-height: 100%;
@@ -104,3 +106,12 @@ p.comment-body {
 .qr-image{
   margin-left: 120px;
 }
+
+.g-recaptcha {
+    @include clearfix;
+    padding-bottom: 12px;
+    
+    div {
+        float: right;
+    }
+}

app/controllers/registrations_controller.rb

@@ -1,5 +1,5 @@
 class RegistrationsController < Devise::RegistrationsController
-  before_action :configure_permitted_parameters, if: :devise_controller?
+  prepend_before_action :check_captcha, only: [:create]
 
   def edit
     @openids = Openid.where(user_id: current_user.id).order(:provider)
@@ -21,14 +21,35 @@ class RegistrationsController < Devise::RegistrationsController
     edit_user_registration_path(resource)
   end
 
-  def configure_permitted_parameters
+  private
-    devise_parameter_sanitizer.permit(:account_update) do |u|
+
-      u
+  def sign_up_params
-          .permit(:email, :password, :password_confirmation, :current_password, :username, :email_public)
+    params.require(:user).permit(
-    end
+      :email,
-    devise_parameter_sanitizer.permit(:sign_up) do |u|
+      :password,
-      u
+      :password_confirmation,
-          .permit(:email, :password, :password_confirmation, :name, :username)
+      :name,
+      :username
+    )
+  end
+
+  def account_update_params
+    params.require(:user).permit(
+      :email,
+      :password,
+      :password_confirmation,
+      :current_password,
+      :username,
+      :email_public
+    )
+  end
+
+  def check_captcha
+    unless verify_recaptcha
+      self.resource = resource_class.new sign_up_params
+      resource.validate # Look for any other validation errors besides Recaptcha
+      respond_with_navigational(resource) { render :new }
     end
   end
+
 end

app/views/devise/registrations/new.html.haml

@@ -12,6 +12,7 @@
             = f.input :name, input_html: { required: true }, hint: 'This is your real name'
             = f.input :password, input_html: { required: true }
             = f.input :password_confirmation, input_html: { required: true }
+            = recaptcha_tags
             %p.text-right
               = f.action :submit, as: :button, label: 'Sign Up', button_html: { class: 'btn btn-success' }
 

dotenv.example

@@ -63,3 +63,7 @@ OSEM_SMTP_OPENSSL_VERIFY_MODE=""
 
 # Enable the usage of the devise ichain plugin
 OSEM_ICHAIN_ENABLED=false
+
+# ReCAPTCHA keys
+RECAPTCHA_SITE_KEY=""
+RECAPTCHA_SECRET_KEY=""