Merge branch 'master' of github.com:phpmyadmin/phpmyadmin

ChangeLog

@@ -94,6 +94,8 @@ phpMyAdmin - ChangeLog
 - issue #11367 Export after search, missing WHERE clause
 - issue #11380 Incomplete message after import
 - issue        Incorrect scalar type declaration (reported under PHP 7)
+- issue #11389 ReCaptcha produces deprecated messages under PHP 7
+- issue #11387 phpseclib < 2.0 produces deprecated messages on PHP 7
 
 4.4.13.1 (2015-08-08)
 - issue #11368 SQL error when importing phpMyAdmin dump file

libraries/phpseclib/Crypt/AES.php

@@ -5,23 +5,27 @@
  *
  * Uses mcrypt, if available/possible, and an internal implementation, otherwise.
  *
- * PHP versions 4 and 5
+ * PHP version 5
  *
- * If {@link Crypt_AES::setKeyLength() setKeyLength()} isn't called, it'll be calculated from
- * {@link Crypt_AES::setKey() setKey()}.  ie. if the key is 128-bits, the key length will be 128-bits.  If it's 136-bits
- * it'll be null-padded to 192-bits and 192 bits will be the key length until {@link Crypt_AES::setKey() setKey()}
+ * NOTE: Since AES.php is (for compatibility and phpseclib-historical reasons) virtually
+ * just a wrapper to Rijndael.php you may consider using Rijndael.php instead of
+ * to save one include_once().
+ *
+ * If {@link \phpseclib\Crypt\AES::setKeyLength() setKeyLength()} isn't called, it'll be calculated from
+ * {@link \phpseclib\Crypt\AES::setKey() setKey()}.  ie. if the key is 128-bits, the key length will be 128-bits.  If it's 136-bits
+ * it'll be null-padded to 192-bits and 192 bits will be the key length until {@link \phpseclib\Crypt\AES::setKey() setKey()}
  * is called, again, at which point, it'll be recalculated.
  *
- * Since Crypt_AES extends Crypt_Rijndael, some functions are available to be called that, in the context of AES, don't
- * make a whole lot of sense.  {@link Crypt_AES::setBlockLength() setBlockLength()}, for instance.  Calling that function,
+ * Since \phpseclib\Crypt\AES extends \phpseclib\Crypt\Rijndael, some functions are available to be called that, in the context of AES, don't
+ * make a whole lot of sense.  {@link \phpseclib\Crypt\AES::setBlockLength() setBlockLength()}, for instance.  Calling that function,
  * however possible, won't do anything (AES has a fixed block length whereas Rijndael has a variable one).
  *
  * Here's a short example of how to use this library:
  * <code>
  * <?php
- *    include 'Crypt/AES.php';
+ *    include 'vendor/autoload.php';
  *
- *    $aes = new Crypt_AES();
+ *    $aes = new \phpseclib\Crypt\AES();
  *
  *    $aes->setKey('abcdefghijklmnop');
  *
@@ -35,145 +39,33 @@
  * ?>
  * </code>
  *
- * LICENSE: Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- *
  * @category  Crypt
- * @package   Crypt_AES
+ * @package   AES
  * @author    Jim Wigginton <terrafrost@php.net>
- * @copyright MMVIII Jim Wigginton
+ * @copyright 2008 Jim Wigginton
  * @license   http://www.opensource.org/licenses/mit-license.html  MIT License
  * @link      http://phpseclib.sourceforge.net
  */
 
-/**
- * Include Crypt_Rijndael
- */
-if (!class_exists('Crypt_Rijndael')) {
-    include_once 'Rijndael.php';
-}
+namespace phpseclib\Crypt;
 
-/**#@+
- * @access public
- * @see Crypt_AES::encrypt()
- * @see Crypt_AES::decrypt()
- */
-/**
- * Encrypt / decrypt using the Counter mode.
- *
- * Set to -1 since that's what Crypt/Random.php uses to index the CTR mode.
- *
- * @link http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Counter_.28CTR.29
- */
-define('CRYPT_AES_MODE_CTR', CRYPT_MODE_CTR);
-/**
- * Encrypt / decrypt using the Electronic Code Book mode.
- *
- * @link http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Electronic_codebook_.28ECB.29
- */
-define('CRYPT_AES_MODE_ECB', CRYPT_MODE_ECB);
-/**
- * Encrypt / decrypt using the Code Book Chaining mode.
- *
- * @link http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Cipher-block_chaining_.28CBC.29
- */
-define('CRYPT_AES_MODE_CBC', CRYPT_MODE_CBC);
-/**
- * Encrypt / decrypt using the Cipher Feedback mode.
- *
- * @link http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Cipher_feedback_.28CFB.29
- */
-define('CRYPT_AES_MODE_CFB', CRYPT_MODE_CFB);
-/**
- * Encrypt / decrypt using the Cipher Feedback mode.
- *
- * @link http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Output_feedback_.28OFB.29
- */
-define('CRYPT_AES_MODE_OFB', CRYPT_MODE_OFB);
-/**#@-*/
-
-/**#@+
- * @access private
- * @see Crypt_AES::Crypt_AES()
- */
-/**
- * Toggles the internal implementation
- */
-define('CRYPT_AES_MODE_INTERNAL', CRYPT_MODE_INTERNAL);
-/**
- * Toggles the mcrypt implementation
- */
-define('CRYPT_AES_MODE_MCRYPT', CRYPT_MODE_MCRYPT);
-/**#@-*/
+use phpseclib\Crypt\Rijndael;
 
 /**
  * Pure-PHP implementation of AES.
  *
- * @package Crypt_AES
+ * @package AES
  * @author  Jim Wigginton <terrafrost@php.net>
  * @access  public
  */
-class Crypt_AES extends Crypt_Rijndael
+class AES extends Rijndael
 {
-    /**
-     * The namespace used by the cipher for its constants.
-     *
-     * @see Crypt_Base::const_namespace
-     * @var String
-     * @access private
-     */
-    var $const_namespace = 'AES';
-
-    /**
-     * Default Constructor.
-     *
-     * Determines whether or not the mcrypt extension should be used.
-     *
-     * $mode could be:
-     *
-     * - CRYPT_AES_MODE_ECB
-     *
-     * - CRYPT_AES_MODE_CBC
-     *
-     * - CRYPT_AES_MODE_CTR
-     *
-     * - CRYPT_AES_MODE_CFB
-     *
-     * - CRYPT_AES_MODE_OFB
-     *
-     * If not explicitly set, CRYPT_AES_MODE_CBC will be used.
-     *
-     * @see Crypt_Rijndael::Crypt_Rijndael()
-     * @see Crypt_Base::Crypt_Base()
-     * @param optional Integer $mode
-     * @access public
-     */
-    function Crypt_AES($mode = CRYPT_AES_MODE_CBC)
-    {
-        parent::Crypt_Rijndael($mode);
-    }
-
     /**
      * Dummy function
      *
-     * Since Crypt_AES extends Crypt_Rijndael, this function is, technically, available, but it doesn't do anything.
+     * Since \phpseclib\Crypt\AES extends \phpseclib\Crypt\Rijndael, this function is, technically, available, but it doesn't do anything.
      *
-     * @see Crypt_Rijndael::setBlockLength()
+     * @see \phpseclib\Crypt\Rijndael::setBlockLength()
      * @access public
      * @param Integer $length
      */
@@ -181,4 +73,56 @@ class Crypt_AES extends Crypt_Rijndael
     {
         return;
     }
+
+    /**
+     * Sets the key length
+     *
+     * Valid key lengths are 128, 192, and 256.  If the length is less than 128, it will be rounded up to
+     * 128.  If the length is greater than 128 and invalid, it will be rounded down to the closest valid amount.
+     *
+     * @see \phpseclib\Crypt\Rijndael:setKeyLength()
+     * @access public
+     * @param Integer $length
+     */
+    function setKeyLength($length)
+    {
+        switch ($length) {
+            case 160:
+                $length = 192;
+                break;
+            case 224:
+                $length = 256;
+        }
+        parent::setKeyLength($length);
+    }
+
+    /**
+     * Sets the key.
+     *
+     * Rijndael supports five different key lengths, AES only supports three.
+     *
+     * @see \phpseclib\Crypt\Rijndael:setKey()
+     * @see setKeyLength()
+     * @access public
+     * @param String $key
+     */
+    function setKey($key)
+    {
+        parent::setKey($key);
+
+        if (!$this->explicit_key_length) {
+            $length = strlen($key);
+            switch (true) {
+                case $length <= 16:
+                    $this->key_size = 16;
+                    break;
+                case $length <= 24:
+                    $this->key_size = 24;
+                    break;
+                default:
+                    $this->key_size = 32;
+            }
+            $this->_setEngine();
+        }
+    }
 }

libraries/phpseclib/Crypt/Random.php

@@ -3,54 +3,44 @@
 /**
  * Random Number Generator
  *
- * PHP versions 4 and 5
+ * PHP version 5
  *
  * Here's a short example of how to use this library:
  * <code>
  * <?php
- *    include 'Crypt/Random.php';
+ *    include 'vendor/autoload.php';
  *
- *    echo bin2hex(crypt_random_string(8));
+ *    echo bin2hex(\phpseclib\Crypt\Random::string(8));
  * ?>
  * </code>
  *
- * LICENSE: Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- *
  * @category  Crypt
- * @package   Crypt_Random
+ * @package   Random
  * @author    Jim Wigginton <terrafrost@php.net>
- * @copyright MMVII Jim Wigginton
+ * @copyright 2007 Jim Wigginton
  * @license   http://www.opensource.org/licenses/mit-license.html  MIT License
  * @link      http://phpseclib.sourceforge.net
  */
 
-// laravel is a PHP framework that utilizes phpseclib. laravel workbenches may, independently,
-// have phpseclib as a requirement as well. if you're developing such a program you may encounter
-// a "Cannot redeclare crypt_random_string()" error.
-if (!function_exists('crypt_random_string')) {
-    /**
-     * "Is Windows" test
-     *
-     * @access private
-     */
-    define('CRYPT_RANDOM_IS_WINDOWS', strtoupper(substr(PHP_OS, 0, 3)) === 'WIN');
+namespace phpseclib\Crypt;
 
+use phpseclib\Crypt\AES;
+use phpseclib\Crypt\Base;
+use phpseclib\Crypt\Blowfish;
+use phpseclib\Crypt\DES;
+use phpseclib\Crypt\RC4;
+use phpseclib\Crypt\TripleDES;
+use phpseclib\Crypt\Twofish;
+
+/**
+ * Pure-PHP Random Number Generator
+ *
+ * @package Random
+ * @author  Jim Wigginton <terrafrost@php.net>
+ * @access  public
+ */
+class Random
+{
     /**
      * Generate a random string.
      *
@@ -60,11 +50,10 @@ if (!function_exists('crypt_random_string')) {
      *
      * @param Integer $length
      * @return String
-     * @access public
      */
-    function crypt_random_string($length)
+    public static function string($length)
     {
-        if (CRYPT_RANDOM_IS_WINDOWS) {
+        if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
             // method 1. prior to PHP 5.3 this would call rand() on windows hence the function_exists('class_alias') call.
             // ie. class_alias is a function that was introduced in PHP 5.3
             if (function_exists('mcrypt_create_iv') && function_exists('class_alias')) {
@@ -120,7 +109,7 @@ if (!function_exists('crypt_random_string')) {
         // easy to guess at. linux uses mouse clicks, keyboard timings, etc, as entropy sources, but
         // PHP isn't low level to be able to use those as sources and on a web server there's not likely
         // going to be a ton of keyboard or mouse action. web servers do have one thing that we can use
-        // however. a ton of people visiting the website. obviously you don't want to base your seeding
+        // however, a ton of people visiting the website. obviously you don't want to base your seeding
         // soley on parameters a potential attacker sends but (1) not everything in $_SERVER is controlled
         // by the user and (2) this isn't just looking at the data sent by the current user - it's based
         // on the data sent by all users. one user requests the page and a hash of their info is saved.
@@ -168,9 +157,9 @@ if (!function_exists('crypt_random_string')) {
                 ini_set('session.use_cookies', $old_use_cookies);
                 session_cache_limiter($old_session_cache_limiter);
             } else {
-               if ($_OLD_SESSION !== false) {
-                   $_SESSION = $_OLD_SESSION;
-                   unset($_OLD_SESSION);
+                if ($_OLD_SESSION !== false) {
+                    $_SESSION = $_OLD_SESSION;
+                    unset($_OLD_SESSION);
                 } else {
                     unset($_SESSION);
                 }
@@ -191,21 +180,27 @@ if (!function_exists('crypt_random_string')) {
             //
             // http://en.wikipedia.org/wiki/Cryptographically_secure_pseudorandom_number_generator#Designs_based_on_cryptographic_primitives
             switch (true) {
-                case class_exists('Crypt_AES'):
-                    $crypto = new Crypt_AES(CRYPT_AES_MODE_CTR);
+                case class_exists('\phpseclib\Crypt\AES'):
+                    $crypto = new AES(Base::MODE_CTR);
                     break;
-                case class_exists('Crypt_TripleDES'):
-                    $crypto = new Crypt_TripleDES(CRYPT_DES_MODE_CTR);
+                case class_exists('\phpseclib\Crypt\Twofish'):
+                    $crypto = new Twofish(Base::MODE_CTR);
                     break;
-                case class_exists('Crypt_DES'):
-                    $crypto = new Crypt_DES(CRYPT_DES_MODE_CTR);
+                case class_exists('\phpseclib\Crypt\Blowfish'):
+                    $crypto = new Blowfish(Base::MODE_CTR);
                     break;
-                case class_exists('Crypt_RC4'):
-                    $crypto = new Crypt_RC4();
+                case class_exists('\phpseclib\Crypt\TripleDES'):
+                    $crypto = new TripleDES(Base::MODE_CTR);
+                    break;
+                case class_exists('\phpseclib\Crypt\DES'):
+                    $crypto = new DES(Base::MODE_CTR);
+                    break;
+                case class_exists('\phpseclib\Crypt\RC4'):
+                    $crypto = new RC4();
                     break;
                 default:
-                    $crypto = $seed;
-                    return crypt_random_string($length);
+                    user_error(__CLASS__ . ' requires at least one symmetric cipher be loaded');
+                    return false;
             }
 
             $crypto->setKey($key);
@@ -213,37 +208,21 @@ if (!function_exists('crypt_random_string')) {
             $crypto->enableContinuousBuffer();
         }
 
-        if (is_string($crypto)) {
-            // the following is based off of ANSI X9.31:
-            //
-            // http://csrc.nist.gov/groups/STM/cavp/documents/rng/931rngext.pdf
-            //
-            // OpenSSL uses that same standard for it's random numbers:
-            //
-            // http://www.opensource.apple.com/source/OpenSSL/OpenSSL-38/openssl/fips-1.0/rand/fips_rand.c
-            // (do a search for "ANS X9.31 A.2.4")
-            //
-            // ANSI X9.31 recommends ciphers be used and phpseclib does use them if they're available (see
-            // later on in the code) but if they're not we'll use sha1
-            $result = '';
-            while (strlen($result) < $length) { // each loop adds 20 bytes
-                // microtime() isn't packed as "densely" as it could be but then neither is that the idea.
-                // the idea is simply to ensure that each "block" has a unique element to it.
-                $i = pack('H*', sha1(microtime()));
-                $r = pack('H*', sha1($i ^ $v));
-                $v = pack('H*', sha1($r ^ $i));
-                $result.= $r;
-            }
-            return substr($result, 0, $length);
-        }
-
         //return $crypto->encrypt(str_repeat("\0", $length));
 
+        // the following is based off of ANSI X9.31:
+        //
+        // http://csrc.nist.gov/groups/STM/cavp/documents/rng/931rngext.pdf
+        //
+        // OpenSSL uses that same standard for it's random numbers:
+        //
+        // http://www.opensource.apple.com/source/OpenSSL/OpenSSL-38/openssl/fips-1.0/rand/fips_rand.c
+        // (do a search for "ANS X9.31 A.2.4")
         $result = '';
         while (strlen($result) < $length) {
-            $i = $crypto->encrypt(microtime());
-            $r = $crypto->encrypt($i ^ $v);
-            $v = $crypto->encrypt($r ^ $i);
+            $i = $crypto->encrypt(microtime()); // strlen(microtime()) == 21
+            $r = $crypto->encrypt($i ^ $v); // strlen($v) == 20
+            $v = $crypto->encrypt($r ^ $i); // strlen($r) == 20
             $result.= $r;
         }
         return substr($result, 0, $length);

libraries/phpseclib/LICENSE

@@ -0,0 +1,21 @@
+Copyright 2007-2013 TerraFrost and other contributors
+http://phpseclib.sourceforge.net/
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

libraries/plugins/auth/AuthenticationCookie.class.php

@@ -10,6 +10,8 @@ if (! defined('PHPMYADMIN')) {
     exit;
 }
 
+use phpseclib\Crypt;
+
 /* Get the authentication interface */
 require_once 'libraries/plugins/AuthenticationPlugin.class.php';
 
@@ -28,6 +30,20 @@ if (! empty($_REQUEST['target'])) {
  */
 require './libraries/plugins/auth/swekey/swekey.auth.lib.php';
 
+/**
+ * phpseclib
+ */
+if (! function_exists('openssl_encrypt')
+    || ! function_exists('openssl_decrypt')
+    || ! function_exists('openssl_random_pseudo_bytes')
+    || PHP_VERSION_ID < 50304
+) {
+    require PHPSECLIB_INC_DIR . '/Crypt/Base.php';
+    require PHPSECLIB_INC_DIR . '/Crypt/Rijndael.php';
+    require PHPSECLIB_INC_DIR . '/Crypt/AES.php';
+    require PHPSECLIB_INC_DIR . '/Crypt/Random.php';
+}
+
 /**
  * Handles the cookie authentication method
  *
@@ -358,19 +374,19 @@ class AuthenticationCookie extends AuthenticationPlugin
             ) {
                 if (! empty($_POST["g-recaptcha-response"])) {
 
-                    include_once 'libraries/plugins/auth/recaptcha/recaptchalib.php';
-                    $reCaptcha = new ReCaptcha(
+                    include_once 'libraries/plugins/auth/recaptcha/autoload.php';
+                    $reCaptcha = new \ReCaptcha\ReCaptcha(
                         $GLOBALS['cfg']['CaptchaLoginPrivateKey']
                     );
 
                     // verify captcha status.
-                    $resp = $reCaptcha->verifyResponse(
-                        $_SERVER["REMOTE_ADDR"],
-                        $_POST["g-recaptcha-response"]
+                    $resp = $reCaptcha->verify(
+                        $_POST["g-recaptcha-response"],
+                        $_SERVER["REMOTE_ADDR"]
                     );
 
                     // Check if the captcha entered is valid, if not stop the login.
-                    if ($resp == null || ! $resp->success) {
+                    if ($resp == null || ! $resp->isSuccess()) {
                         $conn_error = __('Entered captcha is wrong, try again!');
                         $_SESSION['last_valid_captcha'] = false;
                         return false;
@@ -712,7 +728,7 @@ class AuthenticationCookie extends AuthenticationPlugin
             if (self::useOpenSSL()) {
                 $_SESSION['encryption_key'] = openssl_random_pseudo_bytes(256);
             } else {
-                $_SESSION['encryption_key'] = crypt_random_string(256);
+                $_SESSION['encryption_key'] = Crypt\Random::string(256);
             }
         }
         return $_SESSION['encryption_key'];
@@ -753,7 +769,7 @@ class AuthenticationCookie extends AuthenticationPlugin
                 $this->_cookie_iv
             );
         } else {
-            $cipher = new Crypt_AES(CRYPT_AES_MODE_CBC);
+            $cipher = new Crypt\AES(Crypt\Base::MODE_CBC);
             $cipher->setIV($this->_cookie_iv);
             $cipher->setKey($secret);
             return base64_encode($cipher->encrypt($data));
@@ -787,7 +803,7 @@ class AuthenticationCookie extends AuthenticationPlugin
                 $this->_cookie_iv
             );
         } else {
-            $cipher = new Crypt_AES(CRYPT_AES_MODE_CBC);
+            $cipher = new Crypt\AES(Crypt\Base::MODE_CBC);
             $cipher->setIV($this->_cookie_iv);
             $cipher->setKey($secret);
             return $cipher->decrypt(base64_decode($encdata));
@@ -804,7 +820,7 @@ class AuthenticationCookie extends AuthenticationPlugin
         if (self::useOpenSSL()) {
             return openssl_cipher_iv_length('AES-128-CBC');
         }
-        $cipher = new Crypt_AES(CRYPT_AES_MODE_CBC);
+        $cipher = new Crypt\AES(Crypt\Base::MODE_CBC);
         return $cipher->block_size;
     }
 
@@ -823,7 +839,7 @@ class AuthenticationCookie extends AuthenticationPlugin
                 $this->getIVSize()
             );
         } else {
-            $this->_cookie_iv = crypt_random_string(
+            $this->_cookie_iv = Crypt\Random::string(
                 $this->getIVSize()
             );
         }
@@ -864,4 +880,4 @@ class AuthenticationCookie extends AuthenticationPlugin
 if (! AuthenticationCookie::useOpenSSL()) {
     include PHPSECLIB_INC_DIR . '/Crypt/AES.php';
     include PHPSECLIB_INC_DIR . '/Crypt/Random.php';
-}
+}

libraries/plugins/auth/recaptcha/ReCaptcha/ReCaptcha.php

@@ -0,0 +1,97 @@
+<?php
+/**
+ * This is a PHP library that handles calling reCAPTCHA.
+ *
+ * @copyright Copyright (c) 2015, Google Inc.
+ * @link      http://www.google.com/recaptcha
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+namespace ReCaptcha;
+
+/**
+ * reCAPTCHA client.
+ */
+class ReCaptcha
+{
+    /**
+     * Version of this client library.
+     * @const string
+     */
+    const VERSION = 'php_1.1.0';
+
+    /**
+     * Shared secret for the site.
+     * @var type string
+     */
+    private $secret;
+
+    /**
+     * Method used to communicate  with service. Defaults to POST request.
+     * @var RequestMethod
+     */
+    private $requestMethod;
+
+    /**
+     * Create a configured instance to use the reCAPTCHA service.
+     *
+     * @param string $secret shared secret between site and reCAPTCHA server.
+     * @param RequestMethod $requestMethod method used to send the request. Defaults to POST.
+     */
+    public function __construct($secret, RequestMethod $requestMethod = null)
+    {
+        if (empty($secret)) {
+            throw new \RuntimeException('No secret provided');
+        }
+
+        if (!is_string($secret)) {
+            throw new \RuntimeException('The provided secret must be a string');
+        }
+
+        $this->secret = $secret;
+
+        if (!is_null($requestMethod)) {
+            $this->requestMethod = $requestMethod;
+        } else {
+            $this->requestMethod = new RequestMethod\Post();
+        }
+    }
+
+    /**
+     * Calls the reCAPTCHA siteverify API to verify whether the user passes
+     * CAPTCHA test.
+     *
+     * @param string $response The value of 'g-recaptcha-response' in the submitted form.
+     * @param string $remoteIp The end user's IP address.
+     * @return Response Response from the service.
+     */
+    public function verify($response, $remoteIp = null)
+    {
+        // Discard empty solution submissions
+        if (empty($response)) {
+            $recaptchaResponse = new Response(false, array('missing-input-response'));
+            return $recaptchaResponse;
+        }
+
+        $params = new RequestParameters($this->secret, $response, $remoteIp, self::VERSION);
+        $rawResponse = $this->requestMethod->submit($params);
+        return Response::fromJson($rawResponse);
+    }
+}

libraries/plugins/auth/recaptcha/ReCaptcha/RequestMethod.php

@@ -0,0 +1,42 @@
+<?php
+/**
+ * This is a PHP library that handles calling reCAPTCHA.
+ *
+ * @copyright Copyright (c) 2015, Google Inc.
+ * @link      http://www.google.com/recaptcha
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+namespace ReCaptcha;
+
+/**
+ * Method used to send the request to the service.
+ */
+interface RequestMethod
+{
+
+    /**
+     * Submit the request with the specified parameters.
+     *
+     * @param RequestParameters $params Request parameters
+     * @return string Body of the reCAPTCHA response
+     */
+    public function submit(RequestParameters $params);
+}

libraries/plugins/auth/recaptcha/ReCaptcha/RequestMethod/Post.php

@@ -0,0 +1,70 @@
+<?php
+/**
+ * This is a PHP library that handles calling reCAPTCHA.
+ *
+ * @copyright Copyright (c) 2015, Google Inc.
+ * @link      http://www.google.com/recaptcha
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+namespace ReCaptcha\RequestMethod;
+
+use ReCaptcha\RequestMethod;
+use ReCaptcha\RequestParameters;
+
+/**
+ * Sends POST requests to the reCAPTCHA service.
+ */
+class Post implements RequestMethod
+{
+    /**
+     * URL to which requests are POSTed.
+     * @const string
+     */
+    const SITE_VERIFY_URL = 'https://www.google.com/recaptcha/api/siteverify';
+
+    /**
+     * Submit the POST request with the specified parameters.
+     *
+     * @param RequestParameters $params Request parameters
+     * @return string Body of the reCAPTCHA response
+     */
+    public function submit(RequestParameters $params)
+    {
+        /**
+         * PHP 5.6.0 changed the way you specify the peer name for SSL context options.
+         * Using "CN_name" will still work, but it will raise deprecated errors.
+         */
+        $peer_key = version_compare(PHP_VERSION, '5.6.0', '<') ? 'CN_name' : 'peer_name';
+        $options = array(
+            'http' => array(
+                'header' => "Content-type: application/x-www-form-urlencoded\r\n",
+                'method' => 'POST',
+                'content' => $params->toQueryString(),
+                // Force the peer to validate (not needed in 5.6.0+, but still works
+                'verify_peer' => true,
+                // Force the peer validation to use www.google.com
+                $peer_key => 'www.google.com',
+            ),
+        );
+        $context = stream_context_create($options);
+        return file_get_contents(self::SITE_VERIFY_URL, false, $context);
+    }
+}

libraries/plugins/auth/recaptcha/ReCaptcha/RequestMethod/Socket.php

@@ -0,0 +1,104 @@
+<?php
+/**
+ * This is a PHP library that handles calling reCAPTCHA.
+ *
+ * @copyright Copyright (c) 2015, Google Inc.
+ * @link      http://www.google.com/recaptcha
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+namespace ReCaptcha\RequestMethod;
+
+/**
+ * Convenience wrapper around native socket and file functions to allow for
+ * mocking.
+ */
+class Socket
+{
+    private $handle = null;
+
+    /**
+     * fsockopen
+     * 
+     * @see http://php.net/fsockopen
+     * @param string $hostname
+     * @param int $port
+     * @param int $errno
+     * @param string $errstr
+     * @param float $timeout
+     * @return resource
+     */
+    public function fsockopen($hostname, $port = -1, &$errno = 0, &$errstr = '', $timeout = null)
+    {
+        $this->handle = fsockopen($hostname, $port, $errno, $errstr, (is_null($timeout) ? ini_get("default_socket_timeout") : $timeout));
+
+        if ($this->handle != false && $errno === 0 && $errstr === '') {
+            return $this->handle;
+        } else {
+            return false;
+        }
+    }
+
+    /**
+     * fwrite
+     * 
+     * @see http://php.net/fwrite
+     * @param string $string
+     * @param int $length
+     * @return int | bool
+     */
+    public function fwrite($string, $length = null)
+    {
+        return fwrite($this->handle, $string, (is_null($length) ? strlen($string) : $length));
+    }
+
+    /**
+     * fgets
+     * 
+     * @see http://php.net/fgets
+     * @param int $length
+     */
+    public function fgets($length = null)
+    {
+        return fgets($this->handle, $length);
+    }
+
+    /**
+     * feof
+     * 
+     * @see http://php.net/feof
+     * @return bool
+     */
+    public function feof()
+    {
+        return feof($this->handle);
+    }
+
+    /**
+     * fclose
+     * 
+     * @see http://php.net/fclose
+     * @return bool
+     */
+    public function fclose()
+    {
+        return fclose($this->handle);
+    }
+}

libraries/plugins/auth/recaptcha/ReCaptcha/RequestMethod/SocketPost.php

@@ -0,0 +1,120 @@
+<?php
+/**
+ * This is a PHP library that handles calling reCAPTCHA.
+ *
+ * @copyright Copyright (c) 2015, Google Inc.
+ * @link      http://www.google.com/recaptcha
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+namespace ReCaptcha\RequestMethod;
+
+use ReCaptcha\RequestMethod;
+use ReCaptcha\RequestParameters;
+
+/**
+ * Sends a POST request to the reCAPTCHA service, but makes use of fsockopen() 
+ * instead of get_file_contents(). This is to account for people who may be on 
+ * servers where allow_furl_open is disabled.
+ */
+class SocketPost implements RequestMethod
+{
+    /**
+     * reCAPTCHA service host.
+     * @const string 
+     */
+    const RECAPTCHA_HOST = 'www.google.com';
+
+    /**
+     * @const string reCAPTCHA service path
+     */
+    const SITE_VERIFY_PATH = '/recaptcha/api/siteverify';
+
+    /**
+     * @const string Bad request error
+     */
+    const BAD_REQUEST = '{"success": false, "error-codes": ["invalid-request"]}';
+
+    /**
+     * @const string Bad response error
+     */
+    const BAD_RESPONSE = '{"success": false, "error-codes": ["invalid-response"]}';
+
+    /**
+     * Socket to the reCAPTCHA service
+     * @var Socket
+     */
+    private $socket;
+
+    /**
+     * Constructor
+     * 
+     * @param \ReCaptcha\RequestMethod\Socket $socket optional socket, injectable for testing
+     */
+    public function __construct(Socket $socket = null)
+    {
+        if (!is_null($socket)) {
+            $this->socket = $socket;
+        } else {
+            $this->socket = new Socket();
+        }
+    }
+
+    /**
+     * Submit the POST request with the specified parameters.
+     *
+     * @param RequestParameters $params Request parameters
+     * @return string Body of the reCAPTCHA response
+     */
+    public function submit(RequestParameters $params)
+    {
+        $errno = 0;
+        $errstr = '';
+
+        if ($this->socket->fsockopen('ssl://' . self::RECAPTCHA_HOST, 443, $errno, $errstr, 30) !== false) {
+            $content = $params->toQueryString();
+
+            $request = "POST " . self::SITE_VERIFY_PATH . " HTTP/1.1\r\n";
+            $request .= "Host: " . self::RECAPTCHA_HOST . "\r\n";
+            $request .= "Content-Type: application/x-www-form-urlencoded\r\n";
+            $request .= "Content-length: " . strlen($content) . "\r\n";
+            $request .= "Connection: close\r\n\r\n";
+            $request .= $content . "\r\n\r\n";
+
+            $this->socket->fwrite($request);
+            $response = '';
+
+            while (!$this->socket->feof()) {
+                $response .= $this->socket->fgets(4096);
+            }
+
+            $this->socket->fclose();
+
+            if (0 === strpos($response, 'HTTP/1.1 200 OK')) {
+                $parts = preg_split("#\n\s*\n#Uis", $response);
+                return $parts[1];
+            }
+
+            return self::BAD_RESPONSE;
+        }
+
+        return self::BAD_REQUEST;
+    }
+}

libraries/plugins/auth/recaptcha/ReCaptcha/RequestParameters.php

@@ -0,0 +1,103 @@
+<?php
+/**
+ * This is a PHP library that handles calling reCAPTCHA.
+ *
+ * @copyright Copyright (c) 2015, Google Inc.
+ * @link      http://www.google.com/recaptcha
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+namespace ReCaptcha;
+
+/**
+ * Stores and formats the parameters for the request to the reCAPTCHA service.
+ */
+class RequestParameters
+{
+    /**
+     * Site secret.
+     * @var string
+     */
+    private $secret;
+
+    /**
+     * Form response.
+     * @var string
+     */
+    private $response;
+
+    /**
+     * Remote user's IP address.
+     * @var string
+     */
+    private $remoteIp;
+
+    /**
+     * Client version.
+     * @var string
+     */
+    private $version;
+
+    /**
+     * Initialise parameters.
+     *
+     * @param string $secret Site secret.
+     * @param string $response Value from g-captcha-response form field.
+     * @param string $remoteIp User's IP address.
+     * @param string $version Version of this client library.
+     */
+    public function __construct($secret, $response, $remoteIp = null, $version = null)
+    {
+        $this->secret = $secret;
+        $this->response = $response;
+        $this->remoteIp = $remoteIp;
+        $this->version = $version;
+    }
+
+    /**
+     * Array representation.
+     *
+     * @return array Array formatted parameters.
+     */
+    public function toArray()
+    {
+        $params = array('secret' => $this->secret, 'response' => $this->response);
+
+        if (!is_null($this->remoteIp)) {
+            $params['remoteip'] = $this->remoteIp;
+        }
+
+        if (!is_null($this->version)) {
+            $params['version'] = $this->version;
+        }
+
+        return $params;
+    }
+
+    /**
+     * Query string representation for HTTP request.
+     *
+     * @return string Query string formatted parameters.
+     */
+    public function toQueryString()
+    {
+        return http_build_query($this->toArray());
+    }
+}

libraries/plugins/auth/recaptcha/ReCaptcha/Response.php

@@ -0,0 +1,102 @@
+<?php
+/**
+ * This is a PHP library that handles calling reCAPTCHA.
+ *
+ * @copyright Copyright (c) 2015, Google Inc.
+ * @link      http://www.google.com/recaptcha
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+namespace ReCaptcha;
+
+/**
+ * The response returned from the service.
+ */
+class Response
+{
+    /**
+     * Succes or failure.
+     * @var boolean
+     */
+    private $success = false;
+
+    /**
+     * Error code strings.
+     * @var array
+     */
+    private $errorCodes = array();
+
+    /**
+     * Build the response from the expected JSON returned by the service.
+     *
+     * @param string $json
+     * @return \ReCaptcha\Response
+     */
+    public static function fromJson($json)
+    {
+        $responseData = json_decode($json, true);
+
+        if (!$responseData) {
+            return new Response(false, array('invalid-json'));
+        }
+
+        if (isset($responseData['success']) && $responseData['success'] == true) {
+            return new Response(true);
+        }
+
+        if (isset($responseData['error-codes']) && is_array($responseData['error-codes'])) {
+            return new Response(false, $responseData['error-codes']);
+        }
+
+        return new Response(false);
+    }
+
+    /**
+     * Constructor.
+     *
+     * @param boolean $success
+     * @param array $errorCodes
+     */
+    public function __construct($success, array $errorCodes = array())
+    {
+        $this->success = $success;
+        $this->errorCodes = $errorCodes;
+    }
+
+    /**
+     * Is success?
+     *
+     * @return boolean
+     */
+    public function isSuccess()
+    {
+        return $this->success;
+    }
+
+    /**
+     * Get error codes.
+     *
+     * @return array
+     */
+    public function getErrorCodes()
+    {
+        return $this->errorCodes;
+    }
+}

libraries/plugins/auth/recaptcha/autoload.php

@@ -0,0 +1,38 @@
+<?php
+
+/* An autoloader for ReCaptcha\Foo classes. This should be require()d
+ * by the user before attempting to instantiate any of the ReCaptcha
+ * classes.
+ */
+
+spl_autoload_register(function ($class) {
+    if (substr($class, 0, 10) !== 'ReCaptcha\\') {
+      /* If the class does not lie under the "ReCaptcha" namespace,
+       * then we can exit immediately.
+       */
+      return;
+    }
+
+    /* All of the classes have names like "ReCaptcha\Foo", so we need
+     * to replace the backslashes with frontslashes if we want the
+     * name to map directly to a location in the filesystem.
+     */
+    $class = str_replace('\\', '/', $class);
+
+    /* First, check under the current directory. It is important that
+     * we look here first, so that we don't waste time searching for
+     * test classes in the common case.
+     */
+    $path = dirname(__FILE__).'/'.$class.'.php';
+    if (is_readable($path)) {
+        require_once $path;
+    }
+
+    /* If we didn't find what we're looking for already, maybe it's
+     * a test class?
+     */
+    $path = dirname(__FILE__).'/../tests/'.$class.'.php';
+    if (is_readable($path)) {
+        require_once $path;
+    }
+});

libraries/plugins/auth/recaptcha/recaptchalib.php

@@ -1,139 +0,0 @@
-<?php
-/**
- * This is a PHP library that handles calling reCAPTCHA.
- *    - Documentation and latest version
- *          https://developers.google.com/recaptcha/docs/php
- *    - Get a reCAPTCHA API Key
- *          https://www.google.com/recaptcha/admin/create
- *    - Discussion group
- *          http://groups.google.com/group/recaptcha
- *
- * @copyright Copyright (c) 2014, Google Inc.
- * @link      http://www.google.com/recaptcha
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-/**
- * A ReCaptchaResponse is returned from checkAnswer().
- */
-class ReCaptchaResponse
-{
-    public $success;
-    public $errorCodes;
-}
-
-class ReCaptcha
-{
-    private static $_signupUrl = "https://www.google.com/recaptcha/admin";
-    private static $_siteVerifyUrl =
-        "https://www.google.com/recaptcha/api/siteverify?";
-    private $_secret;
-    private static $_version = "php_1.0";
-
-    /**
-     * Constructor.
-     *
-     * @param string $secret shared secret between site and ReCAPTCHA server.
-     */
-    public function ReCaptcha($secret)
-    {
-        if ($secret == null || $secret == "") {
-            die("To use reCAPTCHA you must get an API key from <a href='"
-                . self::$_signupUrl . "'>" . self::$_signupUrl . "</a>");
-        }
-        $this->_secret=$secret;
-    }
-
-    /**
-     * Encodes the given data into a query string format.
-     *
-     * @param array $data array of string elements to be encoded.
-     *
-     * @return string - encoded request.
-     */
-    private function _encodeQS($data)
-    {
-        $req = "";
-        foreach ($data as $key => $value) {
-            $req .= $key . '=' . urlencode(stripslashes($value)) . '&';
-        }
-
-        // Cut the last '&'
-        $req=substr($req, 0, strlen($req)-1);
-        return $req;
-    }
-
-    /**
-     * Submits an HTTP GET to a reCAPTCHA server.
-     *
-     * @param string $path url path to recaptcha server.
-     * @param array  $data array of parameters to be sent.
-     *
-     * @return array response
-     */
-    private function _submitHTTPGet($path, $data)
-    {
-        $req = $this->_encodeQS($data);
-        $response = file_get_contents($path . $req);
-        return $response;
-    }
-
-    /**
-     * Calls the reCAPTCHA siteverify API to verify whether the user passes
-     * CAPTCHA test.
-     *
-     * @param string $remoteIp   IP address of end user.
-     * @param string $response   response string from recaptcha verification.
-     *
-     * @return ReCaptchaResponse
-     */
-    public function verifyResponse($remoteIp, $response)
-    {
-        // Discard empty solution submissions
-        if ($response == null || strlen($response) == 0) {
-            $recaptchaResponse = new ReCaptchaResponse();
-            $recaptchaResponse->success = false;
-            $recaptchaResponse->errorCodes = 'missing-input';
-            return $recaptchaResponse;
-        }
-
-        $getResponse = $this->_submitHttpGet(
-            self::$_siteVerifyUrl,
-            array (
-                'secret' => $this->_secret,
-                'remoteip' => $remoteIp,
-                'v' => self::$_version,
-                'response' => $response
-            )
-        );
-        $answers = json_decode($getResponse, true);
-        $recaptchaResponse = new ReCaptchaResponse();
-
-        if (trim($answers ['success']) == true) {
-            $recaptchaResponse->success = true;
-        } else {
-            $recaptchaResponse->success = false;
-            $recaptchaResponse->errorCodes = $answers ['error-codes'];
-        }
-
-        return $recaptchaResponse;
-    }
-}
-