CaptchaChallenge
Corex\Captcha\CaptchaChallenge · class · Add-ons layer
The provider’s check for a CoreX form that the forms plugin does not draw: account registration, the newsletter signup, and a site’s own call request or job application form (spec 115, US-AUT-02 and US-VIS-11). One way to print the check and one way to judge it, so these forms behave like every other protected CoreX form. Printing it ({@see fields()}) also declares that the page needs the provider’s script, which {@see CaptchaAssetController} loads at the end of the page. A page that prints no check loads nothing. Judging it ({@see refusal()}) uses the same site-wide settings as the forms plugin: a reCAPTCHA v3 token must come from this site, for the form’s action, with the configured score. Request-scoped: bound as a container singleton, it lives for one request.
Public API
Section titled “Public API”__construct(Captcha $captcha, ChallengeSettings $settings, ClientAddress $client)
Section titled “__construct(Captcha $captcha, ChallengeSettings $settings, ClientAddress $client)”isRequired(): bool
Section titled “isRequired(): bool”Whether forms need the check: a provider is chosen and its keys entered.
fields(string $action): string
Section titled “fields(string $action): string”The token field and, for a provider that shows one, the place for its widget; ” when no check is needed. Printing it declares that this page needs the provider’s script.
formAttribute(): string
Section titled “formAttribute(): string”The attribute for the form element: it tells the provider’s scripts this form is theirs.
declared(): bool
Section titled “declared(): bool”Whether a form on this page printed the check.
refusal(string $token, string $action): ?string
Section titled “refusal(string $token, string $action): ?string”Null when the token passes; otherwise what to tell the visitor. With no provider, or the honeypot, every token passes, as before.