Merge pull request #89 from alexandreIFB/main

Update hCaptcha integration to use the new submit signature without r…

Author: wesleybl

news/88.bugfix

@@ -0,0 +1 @@
+Update hCaptcha integration to use the new submit signature without remoteip, aligning with plone.formwidget.hcaptcha privacy (GDPR/LGPD) change. @alexandreIFB

setup.py

@@ -73,7 +73,7 @@
     ],
     extras_require={
         "hcaptcha": [
-            "plone.formwidget.hcaptcha>=1.0.1",
+            "plone.formwidget.hcaptcha>=1.0.3",
         ],
         "recaptcha": [
             "plone.formwidget.recaptcha",

src/collective/volto/formsupport/captcha/hcaptcha.py

@@ -46,10 +46,7 @@ def verify(self, data):
                 )
             )
         token = data["token"]
-        remote_addr = self.request.get("HTTP_X_FORWARDED_FOR", "").split(",")[0]
-        if not remote_addr:
-            remote_addr = self.request.get("REMOTE_ADDR")
-        res = submit(token, self.settings.private_key, remote_addr)
+        res = submit(token, self.settings.private_key)
         if not res.is_valid:
             raise BadRequest(
                 translate(

src/collective/volto/formsupport/tests/test_captcha.py

@@ -276,7 +276,7 @@ def test_hcaptcha(
                 },
             )
             transaction.commit()
-            mock_submit.assert_called_once_with("12345", "private", "127.0.0.1")
+            mock_submit.assert_called_once_with("12345", "private")
             self.assertEqual(response.status_code, 400)
             self.assertEqual(
                 response.json()["message"],
@@ -301,7 +301,7 @@ def test_hcaptcha(
                 },
             )
             transaction.commit()
-            mock_submit.assert_called_once_with("12345", "private", "127.0.0.1")
+            mock_submit.assert_called_once_with("12345", "private")
             self.assertEqual(response.status_code, 200)
 
     def test_get_vocabulary(self):