Explicitly check terms and conditions checkbox. closes PrivateCaptcha/issues#150

pkg/common/constants.go

@@ -41,6 +41,7 @@ const (
 	ParamHardwareID       = "hwid"
 	ParamVersion          = "version"
 	ParamPortalSolution   = "pc_portal_solution"
+	ParamTerms            = "terms"
 )
 
 var (

pkg/portal/register.go

@@ -70,6 +70,13 @@ func (s *Server) postRegister(w http.ResponseWriter, r *http.Request) {
 		CaptchaRenderContext: s.CreateCaptchaRenderContext(db.PortalRegisterSitekey),
 	}
 
+	if _, termsAndConditions := r.Form[common.ParamTerms]; !termsAndConditions {
+		// it's error because they are marked 'required' on the frontend, so something went terribly wrong
+		slog.ErrorContext(ctx, "Terms and conditions were not accepted")
+		s.RedirectError(http.StatusBadRequest, w, r)
+		return
+	}
+
 	captchaSolution := r.FormValue(common.ParamPortalSolution)
 	if len(captchaSolution) == 0 {
 		slog.WarnContext(ctx, "Captcha solution field is empty")

pkg/portal/render.go

@@ -55,6 +55,7 @@ type RenderConstants struct {
 	AllowLocalhost       string
 	AllowReplay          string
 	IgnoreError          string
+	Terms                string
 }
 
 func NewRenderConstants() *RenderConstants {
@@ -101,6 +102,7 @@ func NewRenderConstants() *RenderConstants {
 		AllowLocalhost:       common.ParamAllowLocalhost,
 		AllowReplay:          common.ParamAllowReplay,
 		IgnoreError:          common.ParamIgnoreError,
+		Terms:                common.ParamTerms,
 	}
 }
 

web/layouts/register/form.html

@@ -27,11 +27,11 @@
 
     <div class="relative flex items-center mt-4">
         <div class="flex items-center h-5">
-            <input type="checkbox" name="terms" id="terms" class="pc-form-checkbox" required />
+            <input type="checkbox" name="{{ .Const.Terms }}" id="termsInput" class="pc-form-checkbox" required />
         </div>
 
         <div class="ml-3 text-base">
-            <label for="terms" class="pc-form-checkbox-label"> I agree with <a href="https://privatecaptcha.com/legal/terms-and-conditions" target="_blank" title="" class="pc-form-link">Terms & Conditions</a> and <a href="https://privatecaptcha.com/legal/dpa" target="_blank" title="" class="pc-form-link">DPA</a> </label>
+            <label for="termsInput" class="pc-form-checkbox-label"> I agree with <a href="https://privatecaptcha.com/legal/terms-and-conditions" target="_blank" title="" class="pc-form-link">Terms & Conditions</a> and <a href="https://privatecaptcha.com/legal/dpa" target="_blank" title="" class="pc-form-link">DPA</a> </label>
         </div>
     </div>