[forgetso]

IP matching: off by default, now a setting

1.23.0 sent the visitor's IP (REMOTE_ADDR) to /siteverify, which turns on IP matching. On sites behind Cloudflare, REMOTE_ADDR is Cloudflare's address, so real visitors could be rejected.

• New setting: "Visitor IP matching" on the General tab. It's off by default, with these options:
  • On, behind Cloudflare (CF-Connecting-IP)
  • On, behind another proxy (first X-Forwarded-For address)
  • On, direct connection (REMOTE_ADDR)
• If the chosen header is missing or isn't a valid IP, nothing is sent.
• Filter change: prosopo/procaptcha/visitor_ip now receives ($ip_from_setting, $remote_addr), where the first value is empty when the setting is off. It can still override the result.
• Tests: new Pest unit tests cover each source, the default, the filter, and invalid values.
• Translations: the new strings are translated into de, es, fr, it and pt.

User Registration: AJAX login always failed the captcha check

With "AJAX login" on, ur-login.js posts only its own fields. wp_signon() then runs our wp_authenticate_user check, which never saw procaptcha-response, so every AJAX login was rejected.

• Fix: a jQuery prefilter adds the token from the login form to action=user_registration_ajax_login_submit requests.
• Also: user_registration_after_login_failed resets the widget.

Spectra: wrong token when a page has several forms

Spectra reads hidden fields with getElementById('hidden'), which returns the first match on the whole page:

• a second Spectra form sent the first form's token;

• a form whose own Spectra hidden field comes first sent no token.

• Fix: our input no longer has that id. A hidden <span id="prosopo_procaptcha"> lets Spectra's per-form field loop send each form's own value.

Testing

• tools/check-code-quality.sh passes, including the 7 new unit tests.
• Spectra: I ran the real forms.min.js (2.20.5) in headless Chrome with two forms. With the old markup, form 2 sent tok-1; with the new markup, each form sent its own token.
• User Registration: I ran the real ur-login.js (5.3.1) and clicked the AJAX login button. The request now includes procaptcha-response, and a failed login resets the widget.
• CI: the first two e2e runs on this PR failed a different Beaver Builder "wrong token" test each time, alongside 30+ Failed to fetch errors from the browser to the Procaptcha provider. Reset the captcha after AJAX submissions, public JS events, log failed verifications (1.24.0) #67 had none of those errors. Beaver Builder wasn't changed here, so it looks environmental, but I'm checking it on this run.

🤖 Generated with Claude Code