Submitting Cloudflare turnstile token

[joezappie]

I see that addons are not supported. I added plugin to make the Cloudflare Turnstile settings queryable using the graphql query RootQuery.gfSettingsTurnstile I have it rendering and generating a token on my site with this.

When I go to submit the form, I send back the following:

{
    "id": 18,
    "value": "0.Z6pH7qakYaKUce_EnGH0bHp3UPFGx_cQHserkwsNn-...."
}

Field 18 is my turnstile, but I get the error: "Invalid Turnstile captcha response". Could anyone provide some guidance on how I could support this?

[justlevine]

@joezappie Without having the source code for the Turnstile addon in front of me, my assumption is that you need to process the token, not just submit it as a field.

For example, the GF "core" captcha requires the use of specific $_POST fields:

wp-graphql-gravity-forms/src/Data/FieldValueInput/CaptchaValueInput.php

Line 32 in 5b4f7ca

if ( 'simple_captcha' === $captcha_type || 'math' === $captcha_type ) {

. Or it could be a specific function needs to be called.

[joezappie]

Thanks for the help. I'm still trying to wrap my head around this and writing the PHP to do that.

My front end should send the cloudflare token as a field value. such as { id: 18, value: 'token' }.

In my custom plugin, I need to intercept the form submission and add the value as a $_POST value with the correct key. Looking at the code for the turnstile addon that should be cf-turnstile-response .

My understanding is once that data is in $_POST then the cloudflare turnstile addon should handle the validation of the token.

Where I'm hung up is how would I go about registering my own field type like CaptchaValueInput.php that you linked?

I did try hooking into the gform pre validation, but that hasnt gone over well. $_POST seems to be serialized or something so I cant access my token value:

add_filter('gform_pre_validation', function ($form) {
    foreach ($form['fields'] as $field) {
        if ($field->type === 'turnstile') {
            // Set the expected POST key for the Turnstile plugin
            $_POST['cf-turnstile-response'] = sanitize_text_field($_POST[$field->id]);
        }
    }
    return $form;
});

[justlevine]

Try this one (pseudocode from my phone, so check for typos)

add_filter(
  'graphql_gf_field_value_input_prepared_value',
  static function ( $value, $args, $field ) {
    if ( $field instance of \GF_Field_Turnstile } {
      /**
       * Turnstile validates from the $_POST
       * @see https://github.com/codewurker/gravityformsturnstile/blob/c3aa326017cd7e0ea2a7efe353d02c4e159b15fa/includes/class-gf-field-turnstile.php#L214
       */
      $_POST[ 'cf-turnstile-response' ] = sanitize_text_field( $value );
    }
    return $value;
  },
  10, 
  3
);

[joezappie]

@justlevine Thank you!!! That was almost perfect for being written on a phone lol, heres my final changes incase some one else comes across this. I'll make a pull request with the turnstile addon to hopefully get this supported out of the box.

add_filter(
    'graphql_gf_field_value_input_prepared_value',
    static function ($value, $args, $field) {
        if ($field instanceof \GF_Field_Turnstile) {
            // Inject the turnstile token into the post data
            $_POST['cf-turnstile-response_' . $field->formId] = sanitize_text_field($value);
        }
        return $value;
    },
    10,
    3
);

add_action('graphql_register_types', function () {

    // Create a Turnstile field type
    register_graphql_object_type('GfTurnstileSettings', [
        'description' => 'Gravity Forms Turnstile Settings',
        'fields' => [
            'siteKey' => [
                'type' => 'String',
                'description' => 'Public Site key for Turnstile',
            ],
            'theme' => [
                'type' => 'String',
                'description' => 'Theme to use for Turnstile',
            ],
        ],
    ]);

    // Make it queryable from graphql
    register_graphql_field('GfSettings', 'turnstile', [
        'type' => 'GfTurnstileSettings',
        'description' => 'Gravity Forms CloudFlare Turnstile Settings',
        'resolve' => function () {
            $option = get_option('gravityformsaddon_gravityformsturnstile_settings');
            return [
                'siteKey' => $option['site_key'] ?? null,
                'theme' => $option['theme'] ?? null,
            ];
        },
    ]);
});