From 2c3a744e2e2c9fd923fbb42b6b75bcc1c14d97a7 Mon Sep 17 00:00:00 2001
From: Timothy Allen <tim@treehouse.org.za>
Date: Sat, 26 Sep 2026 00:19:21 +0200
Subject: [PATCH] Turn the captcha off when RECAPTCHA_SITE_KEY is empty.

---
 .env.example    |  3 ++-
 captcha.lib.php | 19 ++++++++++++++++---
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/.env.example b/.env.example
index c0c54f4..26f060b 100644
--- a/.env.example
+++ b/.env.example
@@ -7,7 +7,8 @@ DB_USER=xxx
 DB_PASS=
 DB_NAME=xxx
 
-# Google reCAPTCHA v2 keys (https://www.google.com/recaptcha/admin)
+# Google reCAPTCHA v2 keys (https://www.google.com/recaptcha/admin).
+# Leave RECAPTCHA_SITE_KEY empty to turn the captcha off.
 RECAPTCHA_SITE_KEY=
 RECAPTCHA_SECRET=
 
diff --git a/captcha.lib.php b/captcha.lib.php
index 8d43894..4c5ec1a 100644
--- a/captcha.lib.php
+++ b/captcha.lib.php
@@ -1,25 +1,38 @@
 <?php
 /*
  * Google reCAPTCHA v2. The keys come from RECAPTCHA_SITE_KEY and
- * RECAPTCHA_SECRET in .env. When the secret is missing or Google cannot
- * be reached, every check fails (and the reason is logged), so a broken
- * configuration never turns the captcha off.
+ * RECAPTCHA_SECRET in .env.
+ *
+ * Without RECAPTCHA_SITE_KEY the captcha is off: the pages load nothing
+ * from Google and every check passes. With the site key but without the
+ * secret, or when Google cannot be reached, every check fails (and the
+ * reason is logged).
  */
 require_once(__DIR__ . '/config.lib.php');
 require_once(__DIR__ . '/html.lib.php');
 
 define('CAPTCHA_PASS_SECONDS', 30 * 60);
 
+function captcha_enabled() {
+  return (string)config('RECAPTCHA_SITE_KEY') !== '';
+}
+
 function captcha_script() {
+  if (!captcha_enabled())
+    return '';
   return '<script src="https://www.google.com/recaptcha/api.js" async defer></script>';
 }
 
 function captcha_widget() {
+  if (!captcha_enabled())
+    return '';
   return '<div class="g-recaptcha" data-sitekey="'.form_value(config('RECAPTCHA_SITE_KEY')).'"></div>';
 }
 
 // Ask Google whether the captcha in this POST was solved
 function captcha_verify_response() {
+  if (!captcha_enabled())
+    return TRUE;
   $response = $_POST['g-recaptcha-response'] ?? '';
   if (!is_string($response) || $response === '')
     return FALSE;