Turn the captcha off when RECAPTCHA_SITE_KEY is empty.

.env.example

@@ -7,7 +7,8 @@ DB_USER=xxx
 DB_PASS=
 DB_NAME=xxx
 
-# Google reCAPTCHA v2 keys (https://www.google.com/recaptcha/admin)
+# Google reCAPTCHA v2 keys (https://www.google.com/recaptcha/admin).
+# Leave RECAPTCHA_SITE_KEY empty to turn the captcha off.
 RECAPTCHA_SITE_KEY=
 RECAPTCHA_SECRET=
 

captcha.lib.php

@@ -1,25 +1,38 @@
 <?php
 /*
  * Google reCAPTCHA v2. The keys come from RECAPTCHA_SITE_KEY and
- * RECAPTCHA_SECRET in .env. When the secret is missing or Google cannot
+ * RECAPTCHA_SECRET in .env.
- * be reached, every check fails (and the reason is logged), so a broken
+ *
- * configuration never turns the captcha off.
+ * Without RECAPTCHA_SITE_KEY the captcha is off: the pages load nothing
+ * from Google and every check passes. With the site key but without the
+ * secret, or when Google cannot be reached, every check fails (and the
+ * reason is logged).
  */
 require_once(__DIR__ . '/config.lib.php');
 require_once(__DIR__ . '/html.lib.php');
 
 define('CAPTCHA_PASS_SECONDS', 30 * 60);
 
+function captcha_enabled() {
+  return (string)config('RECAPTCHA_SITE_KEY') !== '';
+}
+
 function captcha_script() {
+  if (!captcha_enabled())
+    return '';
   return '<script src="https://www.google.com/recaptcha/api.js" async defer></script>';
 }
 
 function captcha_widget() {
+  if (!captcha_enabled())
+    return '';
   return '<div class="g-recaptcha" data-sitekey="'.form_value(config('RECAPTCHA_SITE_KEY')).'"></div>';
 }
 
 // Ask Google whether the captcha in this POST was solved
 function captcha_verify_response() {
+  if (!captcha_enabled())
+    return TRUE;
   $response = $_POST['g-recaptcha-response'] ?? '';
   if (!is_string($response) || $response === '')
     return FALSE;