[16.0][IMP] Add modularity for other reCAPTCHA v2-compatible APIs #1111

Honeyxilia · 2025-06-27T11:06:03Z

Context

In Odoo v12.0, the OCA module website_form_recaptcha allowed for the use of CAPTCHA APIs that were compatible with reCAPTCHA v2 by changing some variables.
However, with website_form_recaptcha being fused into website_form (and itself into website), there are no reCAPTCHA v2 compatibility tool for various APIs.

So, we bring forward this development, to allow for customisation of the used CAPTCHA API for the widget introduced by this module.

Additions

We add 4 new Char fields to the website model, to offer customization of the used API :
- recaptcha_v2_api_url : the link to the JS CAPTCHA library file (default is https://www.recaptcha.net/recaptcha/api.js )
- recaptcha_v2_verify_url : the link to the verification endpoint of the API (default is https://www.recaptcha.net/recaptcha/api/siteverify )
- recaptcha_v2_html_class : the CSS class to indicate in which element the widget is to be inserted (default is g-recaptcha)
- recaptcha_v2_resp_attr : the value of the form field for hCaptcha validation (default is g-recaptcha-response)
  -> These fields are inserted into the verification code of the website model, as well as in the reCAPTCHA template.
We added editable fields in the Settings section to allow them to be easily changed by frontend users.

Other points

As we were coding this addition, we noticed that, despite the stated goal for this module to "used by other modules to actually display it on website forms", the widget is actually not available in the Website Page Editor menu, in the Snippets Blocks - is it voluntary ? If not, would it be interesting to add the widget as a Snippet block in the Website Page Editor menu ?
While the module offers the widget, its initialization and a method to verify the CAPTCHA, there are no controllers in the module for the /website/form/ endpoint to actually verify it - would it be worth considering adding controllers in this module in order to offer reCAPTCHA verification for the /website/form/ endpoint ?

To be able to make use of the work of this module for other CAPTCHA APIs compatible with reCAPTCHA v2 (ie. hCaptcha), we added fields to allow modification of the API used by the CAPTCHA widget. To avoid disrupting current implementations of the module, we however still set default fields that correspond to the Google reCAPTCHA API.

By adding these fields (API urls, CSS class, response attribute) in Settings -> Website, alongside the previous fields, this allows front-end users to handily change the values related to the used API, to be able to input other implementations, such as hCaptcha.

- Since the base implementation of reCAPTCHA in the Odoo module is based on reCAPTCHA v3, and the v3 implementation of hCaptcha is kept behind an Enterprise subscription, we aimed to reimplement hCaptcha (reCAPT. v2) though other means. - While researching, we found the OCA module 'website_recapatcha_v2', which reimplements reCAPTCHA v2 on Odoo 16 - so, urban_mine now depends on website_captcha_v2 to reimplement hCaptcha. (Since the values for reCAPTCHA were hardcoded in the module, we added the ability to customized the CAPTCHA API used in website_recaptche_v2 : OCA/website#1111 ) - We then call the recaptcha_widget template to insert and initialize the hCaptcha check, by changing the values in Odoo's settings.