shell bypass 403
<?php /** * Copyright (c) 2017 - present * LaravelGoogleRecaptcha - ReCaptchaBuilderV3.php * author: Roberto Belotti - roby.belotti@gmail.com * web : robertobelotti.com, github.com/biscolab * Initial version created on: 22/1/2019 * MIT license: https://github.com/biscolab/laravel-recaptcha/blob/master/LICENSE */ namespace Biscolab\ReCaptcha; use Illuminate\Support\Arr; /** * Class ReCaptchaBuilderV3 * @package Biscolab\ReCaptcha */ class ReCaptchaBuilderV3 extends ReCaptchaBuilder { /** * ReCaptchaBuilderV3 constructor. * * @param string $api_site_key * @param string $api_secret_key */ public function __construct(string $api_site_key, string $api_secret_key) { parent::__construct($api_site_key, $api_secret_key, 'v3'); } /** * Write script HTML tag in you HTML code * Insert before </head> tag * * @param array|null $configuration * * @return string */ public function htmlScriptTagJsApi(?array $configuration = []): string { if ($this->skip_by_ip) { return ''; } $html = "<script src=\"" . $this->api_js_url . "?render={$this->api_site_key}\"></script>"; $action = Arr::get($configuration, 'action', 'homepage'); $js_custom_validation = Arr::get($configuration, 'custom_validation', ''); // Check if set custom_validation. That function will override default fetch validation function if ($js_custom_validation) { $validate_function = ($js_custom_validation) ? "{$js_custom_validation}(token);" : ''; } else { $js_then_callback = Arr::get($configuration, 'callback_then', ''); $js_callback_catch = Arr::get($configuration, 'callback_catch', ''); $js_then_callback = ($js_then_callback) ? "{$js_then_callback}(response)" : ''; $js_callback_catch = ($js_callback_catch) ? "{$js_callback_catch}(err)" : ''; $validate_function = " fetch('/" . config( 'recaptcha.default_validation_route', 'biscolab-recaptcha/validate' ) . "?" . config( 'recaptcha.default_token_parameter_name', 'token' ) . "=' + token, { headers: { \"X-Requested-With\": \"XMLHttpRequest\", \"X-CSRF-TOKEN\": csrfToken.content } }) .then(function(response) { {$js_then_callback} }) .catch(function(err) { {$js_callback_catch} });"; } $html .= "<script> var csrfToken = document.head.querySelector('meta[name=\"csrf-token\"]'); grecaptcha.ready(function() { grecaptcha.execute('{$this->api_site_key}', {action: '{$action}'}).then(function(token) { {$validate_function} }); }); </script>"; return $html; } }