peertube-plugin-recaptcha issueshttps://framagit.org/rigelk/peertube-plugin-recaptcha/-/issues2022-10-22T18:19:55Zhttps://framagit.org/rigelk/peertube-plugin-recaptcha/-/issues/2Recaptcha Doesn't Display in PeerTube 4.3.02022-10-22T18:19:55ZOwN-3m-AllRecaptcha Doesn't Display in PeerTube 4.3.0Recaptcha plugin appears to no longer work on PeerTube 4.3.0. It never shows a captcha for the end user to solve during the registration process.Recaptcha plugin appears to no longer work on PeerTube 4.3.0. It never shows a captcha for the end user to solve during the registration process.https://framagit.org/rigelk/peertube-plugin-recaptcha/-/issues/1Parameter not escaped2020-01-17T17:10:45ZJohn LivingstonParameter not escapedIn the following code:
`const verificationUrl =
"https://www.google.com/recaptcha/api/siteverify?secret=" +
secretKey +
"&response=" +
params.body["g-recaptcha-response"] +
"&remoteip=" +
params.ip
`
You have to ...In the following code:
`const verificationUrl =
"https://www.google.com/recaptcha/api/siteverify?secret=" +
secretKey +
"&response=" +
params.body["g-recaptcha-response"] +
"&remoteip=" +
params.ip
`
You have to escape the `response` parameter (at least). I don't see any exploit for now, but as it is an external value, you should escape it. If the code change, and developers don't pay attention, a bad value could send your secretKey to an attacker.