From 0c39f8307892357e70f34905b8704db5a8996c7f Mon Sep 17 00:00:00 2001
From: Xiaochen Cui <jcnlcxc.new@gmail.com>
Date: Fri, 29 Aug 2025 06:23:26 +0800
Subject: [PATCH] captcha: imporve condition checks for cloudflare turnstile
 (#1469)

* captcha: imporve condition checks for cloudflare turnstile

* captcha: fix undefined "resetTurnstile" func

* captcha: set appearance

* captcha: add the missing prefix
---
 .../src/services/PuterHomepageService.js      |  6 ++-
 src/gui/src/UI/UIWindowSignup.js              | 45 +++++++++----------
 2 files changed, 24 insertions(+), 27 deletions(-)

diff --git a/src/backend/src/services/PuterHomepageService.js b/src/backend/src/services/PuterHomepageService.js
index 858ad49ac..ddb5cbbc0 100644
--- a/src/backend/src/services/PuterHomepageService.js
+++ b/src/backend/src/services/PuterHomepageService.js
@@ -125,6 +125,9 @@ class PuterHomepageService extends BaseService {
             login: req.captchaRequired,
             signup: req.captchaRequired,
         };
+
+        // cloudflare turnstile site key
+        const turnstileSiteKey = config.services?.['cloudflare-turnstile']?.enabled ? config.services?.['cloudflare-turnstile']?.site_key : null;
         
         return res.send(this.generate_puter_page_html({
             env: config.env,
@@ -166,8 +169,7 @@ class PuterHomepageService extends BaseService {
                 co_isolation_enabled: req.co_isolation_enabled,
                 // Add captcha requirements to GUI parameters
                 captchaRequired: captchaRequired,
-                // Add Turnstile site key to GUI parameters
-                turnstileSiteKey: config.services?.['cloudflare-turnstile']?.site_key,
+                turnstileSiteKey: turnstileSiteKey,
             },
         }));
     }
diff --git a/src/gui/src/UI/UIWindowSignup.js b/src/gui/src/UI/UIWindowSignup.js
index 6734307b6..a3acca4c6 100644
--- a/src/gui/src/UI/UIWindowSignup.js
+++ b/src/gui/src/UI/UIWindowSignup.js
@@ -22,16 +22,6 @@ import UIWindowLogin from './UIWindowLogin.js'
 import UIWindowEmailConfirmationRequired from './UIWindowEmailConfirmationRequired.js'
 import check_password_strength from '../helpers/check_password_strength.js'
 
-// Helper function to reset Turnstile state
-const resetTurnstile = (el_window) => {
-    if (window.turnstile) {
-        window.turnstile.reset('.cf-turnstile');
-        $(el_window).find('.cf-turnstile').removeAttr('data-token');
-        $(el_window).find('.cf-turnstile').removeClass('captcha-completed');
-        $(el_window).find('.signup-btn').prop('disabled', true);
-    }
-};
-
 function UIWindowSignup(options){
     options = options ?? {};
     options.reload_on_success = options.reload_on_success ?? true;
@@ -89,12 +79,12 @@ function UIWindowSignup(options){
                     // bot trap - if this value is submitted server will ignore the request
                     h += `<input type="text" name="p102xyzname" class="p102xyzname" value="">`;
 
-                    // Turnstile widget
+                    // Turnstile widget (only when enabled)
                     if(window.gui_params?.turnstileSiteKey){
                         h += `<div style="margin-bottom: 20px; display: flex; justify-content: center;">`;
-                            // Get Turnstile site key from configuration, with fallback
-                            const turnstileSiteKey = window.gui_params?.turnstileSiteKey || '3x00000000000000000000FF';
-                            h += `<div class="cf-turnstile" data-sitekey="${turnstileSiteKey}"></div>`;
+                            // appearance: always/execute/interaction-only
+                            // docs: https://developers.cloudflare.com/turnstile/get-started/client-side-rendering/widget-configurations/?utm_source=chatgpt.com#appearance-modes
+                            h += `<div class="cf-turnstile" data-sitekey="${window.gui_params.turnstileSiteKey}" data-appearance="interaction-only"></div>`;
                         h += `</div>`;
                     }
 
@@ -137,11 +127,9 @@ function UIWindowSignup(options){
                 
                 // Initialize Turnstile widget with callback to capture token
                 const initTurnstile = () => {
-                    if (window.turnstile) {
-                        // Get Turnstile site key from configuration, with fallback
-                        const turnstileSiteKey = window.gui_params?.turnstileSiteKey;
+                    if (window.turnstile && window.gui_params?.turnstileSiteKey) {
                         window.turnstile.render('.cf-turnstile', {
-                            sitekey: turnstileSiteKey,
+                            sitekey: window.gui_params.turnstileSiteKey,
                             callback: function(token) {
                                 // Store the token for the signup request
                                 $(el_window).find('.cf-turnstile').attr('data-token', token);
@@ -268,12 +256,15 @@ function UIWindowSignup(options){
                 return;
             }
             
-            // Check if CAPTCHA was completed
-            const turnstileToken = $(el_window).find('.cf-turnstile').attr('data-token');
-            if (!turnstileToken) {
-                $(el_window).find('.signup-error-msg').html(i18n('captcha_required') || 'Please complete the CAPTCHA verification');
-                $(el_window).find('.signup-error-msg').fadeIn();
-                return;
+            // Check if Cloudflare Turnstile CAPTCHA was completed
+            let turnstileToken = null;
+            if (window.turnstile && window.gui_params?.turnstileSiteKey) {
+                turnstileToken = $(el_window).find('.cf-turnstile').attr('data-token');
+                if (!turnstileToken) {
+                    $(el_window).find('.signup-error-msg').html(i18n('captcha_required') || 'Please complete the CAPTCHA verification');
+                    $(el_window).find('.signup-error-msg').fadeIn();
+                    return;
+                }
             }
             
             //xyzname
@@ -327,7 +318,11 @@ function UIWindowSignup(options){
                     $(el_window).find('.signup-btn').prop('disabled', false);
 
                     // Reset Turnstile widget for retry
-                    resetTurnstile(el_window);
+                    if (window.turnstile) {
+                        window.turnstile.reset('.cf-turnstile');
+                        $(el_window).find('.cf-turnstile').removeAttr('data-token');
+                        $(el_window).find('.cf-turnstile').removeClass('captcha-completed');
+                    }
 
                     // Process error response
                     const errorText = err.responseText || '';