Turn off IP matching by default (setting), fix User Registration AJAX login and Spectra with several forms

assets/src/integrations/plugins/user-registration/userRegistrationAjaxLogin.ts

@@ -0,0 +1,50 @@
+const LOGIN_ACTION = "action=user_registration_ajax_login_submit";
+const LOGIN_BUTTON_SELECTOR = "#user_registration_ajax_login_submit";
+const TOKEN_FIELD_NAME = "procaptcha-response";
+
+const getLoginForms = (): HTMLFormElement[] =>
+	Array.from(document.querySelectorAll(LOGIN_BUTTON_SELECTOR))
+		.map((button) => button.closest("form"))
+		.filter((form): form is HTMLFormElement => null !== form);
+
+const getFormToken = (form: HTMLFormElement): string => {
+	const input = form.querySelector(`input[name="${TOKEN_FIELD_NAME}"]`);
+
+	return input instanceof HTMLInputElement ? input.value : "";
+};
+
+const getLoginToken = (): string => {
+	const forms = getLoginForms();
+	// The clicked submit button is focused, so prefer its form when there are several.
+	const focusedForm = forms.find((form) =>
+		form.contains(document.activeElement),
+	);
+	const form = focusedForm || forms.find((form) => "" !== getFormToken(form));
+
+	return undefined !== form ? getFormToken(form) : "";
+};
+
+/**
+ * With the "AJAX login" option on, User Registration posts only its own fields,
+ * so the token must be added for the WordPress authentication check to see it.
+ */
+const addTokenToUserRegistrationAjaxLogin = ($: JQueryStatic): void => {
+	$.ajaxPrefilter((options) => {
+		if (
+			"string" !== typeof options.url ||
+			false === options.url.includes(LOGIN_ACTION) ||
+			"string" !== typeof options.data
+		) {
+			return;
+		}
+
+		const fields = new URLSearchParams(options.data);
+
+		if (false === fields.has(TOKEN_FIELD_NAME)) {
+			fields.set(TOKEN_FIELD_NAME, getLoginToken());
+			options.data = fields.toString();
+		}
+	});
+};
+
+export { addTokenToUserRegistrationAjaxLogin };

assets/src/integrations/procaptcha/ajaxFormsReset.ts

@@ -141,6 +141,17 @@ const bindJQueryEvents = ($: JQueryStatic): void => {
 		"user_registration_frontend_after_ajax_complete",
 		(_event, _response, _type, $form) => requestReset($form),
 	);
+	// AJAX login: passes the submit button. On success the page redirects.
+	$document.on("user_registration_after_login_failed", (_event, $button) =>
+		requestReset(
+			null !== $button &&
+				"object" === typeof $button &&
+				"closest" in $button &&
+				"function" === typeof $button.closest
+				? $button.closest("form")
+				: null,
+		),
+	);
 
 	$(document.body).on("checkout_error", () =>
 		requestReset(document.querySelector("form.checkout")),

assets/src/integrations/procaptcha/procaptcha-integration.ts

@@ -4,6 +4,7 @@ import type Logger from "../../utils/logger/logger.js";
 import FormIntegrationComponent from "#integrations/procaptcha/formIntegrationComponent.js";
 import WidgetIntegrationComponent from "#integrations/procaptcha/widgetIntegrationComponent.js";
 import { resetWidgetsAfterAjaxSubmissions } from "#integrations/procaptcha/ajaxFormsReset.js";
+import { addTokenToUserRegistrationAjaxLogin } from "#integrations/plugins/user-registration/userRegistrationAjaxLogin.js";
 
 const integrationConnector = createIntegrationConnector();
 
@@ -40,3 +41,7 @@ integrationConnector.connectIntegration(formIntegration);
 integrationConnector.connectIntegration(widgetIntegration);
 
 resetWidgetsAfterAjaxSubmissions();
+
+if ("function" === typeof window.jQuery) {
+	addTokenToUserRegistrationAjaxLogin(window.jQuery);
+}

assets/src/integrations/procaptcha/widgetIntegrationComponent.ts

@@ -161,10 +161,6 @@ class WidgetIntegrationComponent implements WebComponent {
 				clearToken,
 				globalAttributes["expired-callback"],
 			),
-			"error-callback": this.chainCallback(
-				clearToken,
-				globalAttributes["error-callback"],
-			),
 			"reset-callback": this.chainCallback(
 				clearToken,
 				globalAttributes["reset-callback"],
@@ -219,7 +215,8 @@ class WidgetIntegrationComponent implements WebComponent {
 	}
 
 	/**
-	 * Called when the token expires, the widget errors or is reset:
+	 * Called when the token expires or the widget is reset (not on errors: those include failed
+	 * background requests, which don't invalidate a token the visitor already has):
 	 * the Procaptcha's JS removes its own input, but the custom one must be cleared manually,
 	 * otherwise JS-based forms keep submitting a token that the server will reject.
 	 */

php-tools/code-quality/tests/Unit/Visitor_Ip_Test.php

@@ -0,0 +1,76 @@
+<?php
+
+namespace Unit;
+
+use Io\Prosopo\Procaptcha\Settings\Procaptcha_Settings;
+use Io\Prosopo\Procaptcha\Widget\Procaptcha_Widget;
+use Mockery;
+use Tests\TestCase;
+
+class Visitor_Ip_Test extends TestCase {
+	const SERVER = array(
+		'REMOTE_ADDR'           => '172.68.1.1',
+		'HTTP_CF_CONNECTING_IP' => '203.0.113.7',
+		'HTTP_X_FORWARDED_FOR'  => '198.51.100.9, 10.0.0.1',
+	);
+
+	protected function tearDown(): void {
+		$GLOBALS['test_filters'] = array();
+		Mockery::close();
+	}
+
+	public function testNothingIsSentByDefault() {
+		$this->assertSame( '', $this->get_visitor_ip( '' ) );
+	}
+
+	public function testCloudflareHeader() {
+		$this->assertSame( '203.0.113.7', $this->get_visitor_ip( Procaptcha_Settings::VISITOR_IP_CLOUDFLARE ) );
+	}
+
+	public function testCloudflareWithoutHeaderSendsNothing() {
+		$this->assertSame( '', $this->get_visitor_ip( Procaptcha_Settings::VISITOR_IP_CLOUDFLARE, array( 'REMOTE_ADDR' => '172.68.1.1' ) ) );
+	}
+
+	public function testFirstForwardedForAddress() {
+		$this->assertSame( '198.51.100.9', $this->get_visitor_ip( Procaptcha_Settings::VISITOR_IP_X_FORWARDED_FOR ) );
+	}
+
+	public function testRemoteAddr() {
+		$this->assertSame( '172.68.1.1', $this->get_visitor_ip( Procaptcha_Settings::VISITOR_IP_REMOTE_ADDR ) );
+	}
+
+	public function testFilterCanEnableWhenOff() {
+		$GLOBALS['test_filters']['prosopo/procaptcha/visitor_ip'] = fn( $ip, $remote_addr ) => $remote_addr;
+
+		$this->assertSame( '172.68.1.1', $this->get_visitor_ip( '' ) );
+	}
+
+	public function testInvalidIpIsNotSent() {
+		$this->assertSame( '', $this->get_visitor_ip( Procaptcha_Settings::VISITOR_IP_CLOUDFLARE, array( 'HTTP_CF_CONNECTING_IP' => 'not-an-ip' ) ) );
+	}
+
+	protected function get_visitor_ip( string $source, array $server = self::SERVER ): string {
+		$_SERVER = $server;
+
+		$settings = Mockery::mock( Procaptcha_Settings::class );
+		$settings->shouldReceive( 'get_visitor_ip_source' )->andReturn( $source );
+
+		$widget_class = get_class(
+			new class() extends Procaptcha_Widget {
+				// Skip the parent's constructor: only the settings are needed.
+				public function __construct() {}
+
+				public function visitor_ip(): string {
+					return $this->get_visitor_ip();
+				}
+			}
+		);
+		$widget       = new $widget_class();
+
+		$settings_property = new \ReflectionProperty( Procaptcha_Widget::class, 'procaptcha_settings' );
+		$settings_property->setAccessible( true );
+		$settings_property->setValue( $widget, $settings );
+
+		return $widget->visitor_ip();
+	}
+}

php-tools/code-quality/tests/bootstrap.php

@@ -7,6 +7,23 @@ function esc_html( string $var ): string {
 	return htmlentities( $var, ENT_QUOTES );
 }
 
+function wp_unslash( $value ) {
+	return $value;
+}
+
+function sanitize_text_field( $value ) {
+	return $value;
+}
+
+// Runs a callback set in $GLOBALS['test_filters'][ $hook_name ], if any.
+function apply_filters( string $hook_name, $value, ...$args ) {
+	$callback = $GLOBALS['test_filters'][ $hook_name ] ?? null;
+
+	return null !== $callback ?
+		$callback( $value, ...$args ) :
+		$value;
+}
+
 require_once __DIR__ . '/../vendor/autoload.php';
 require_once __DIR__ . '/TestCase.php';
 require_once __DIR__ . '/../../../prosopo-procaptcha/prefixed-vendors/vendor/scoper-autoload.php';

prosopo-procaptcha/lang/prosopo-procaptcha-de_DE.po

@@ -2,19 +2,20 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Prosopo ProCaptcha 1.0.0\n"
 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/prosopo-procaptcha\n"
-"POT-Creation-Date: 2026-10-27T13:57:59+00:00\n"
-"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
-"Language: \n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
+"POT-Creation-Date: 2026-10-27T13:57:59+00:00\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Language: \n"
 "X-Generator: WP-CLI 2.11.0\n"
 "X-Domain: prosopo-procaptcha\n"
 
 #. Plugin Name of the plugin
-#: prosopo-procaptcha.php src/Widget/Procaptcha_Widget.php:77
+#: prosopo-procaptcha.php
+#: src/Widget/Procaptcha_Widget.php:77
 msgid "Prosopo Procaptcha"
 msgstr "Prosopo Procaptcha"
 
@@ -111,49 +112,49 @@ msgstr "Hinweis: Inaktive Plugins werden nicht berücksichtigt, auch wenn sie ko
 msgid "Your favourite plugin is not listed? %1$s Start a thread %2$s in our support forum and we will consider adding the new integration."
 msgstr "Ihr Lieblings-Plugin fehlt? %1$s Starten Sie ein Thema %2$s in unserem Support-Forum, und wir prüfen eine neue Integration."
 
-#: src/Settings/General/Tab/General_Settings_Tab.php:30
+#: src/Settings/General/Tab/General_Settings_Tab.php:31
 msgid "General"
 msgstr "Allgemein"
 
-#: src/Settings/General/Tab/General_Settings_Tab.php:99
+#: src/Settings/General/Tab/General_Settings_Tab.php:114
 msgid "Your Secret Key:"
 msgstr "Ihr geheimer Schlüssel:"
 
-#: src/Settings/General/Tab/General_Settings_Tab.php:100
+#: src/Settings/General/Tab/General_Settings_Tab.php:115
 msgid "Your Site Key:"
 msgstr "Ihr Website-Schlüssel:"
 
-#: src/Settings/General/Tab/General_Settings_Tab.php:101
+#: src/Settings/General/Tab/General_Settings_Tab.php:116
 msgid "Theme:"
 msgstr "Design:"
 
-#: src/Settings/General/Tab/General_Settings_Tab.php:102
+#: src/Settings/General/Tab/General_Settings_Tab.php:118
 msgid "Language:"
 msgstr "Sprache:"
 
-#: src/Settings/General/Tab/General_Settings_Tab.php:108
+#: src/Settings/General/Tab/General_Settings_Tab.php:124
 msgid "Require from authorized users:"
 msgstr "Von autorisierten Benutzern verlangen:"
 
-#: src/Settings/General/Tab/General_Settings_Tab.php:122
+#: src/Settings/General/Tab/General_Settings_Tab.php:140
 #: src/Widget/Procaptcha_Widget.php:55
 msgid "Dark"
 msgstr "Dunkel"
 
-#: src/Settings/General/Tab/General_Settings_Tab.php:123
+#: src/Settings/General/Tab/General_Settings_Tab.php:141
 #: src/Widget/Procaptcha_Widget.php:56
 msgid "Light"
 msgstr "Hell"
 
-#: src/Settings/General/Tab/General_Settings_Tab.php:126
+#: src/Settings/General/Tab/General_Settings_Tab.php:151
 msgid "Same as the site"
 msgstr "Wie die Website"
 
-#: src/Settings/General/Tab/General_Settings_Tab.php:127
+#: src/Settings/General/Tab/General_Settings_Tab.php:152
 msgid "Visitor's browser language"
 msgstr "Browsersprache des Besuchers"
 
-#: src/Settings/General/Tab/General_Settings_Tab.php:137
+#: src/Settings/General/Tab/General_Settings_Tab.php:162
 msgid "Behavior"
 msgstr "Verhalten"
 
@@ -494,3 +495,23 @@ msgstr "Auftragsverarbeitungsvertrag"
 #: src/Settings/Statistics/statistics_settings.blade.php:34
 msgid "Please setup your keys to see the statistics."
 msgstr "Bitte richten Sie Ihre Schlüssel ein, um die Statistiken zu sehen."
+
+#: src/Settings/General/Tab/General_Settings_Tab.php:117
+msgid "Visitor IP matching:"
+msgstr "Abgleich der Besucher-IP:"
+
+#: src/Settings/General/Tab/General_Settings_Tab.php:145
+msgid "Off (recommended)"
+msgstr "Aus (empfohlen)"
+
+#: src/Settings/General/Tab/General_Settings_Tab.php:146
+msgid "On - site is behind Cloudflare"
+msgstr "An – Website läuft hinter Cloudflare"
+
+#: src/Settings/General/Tab/General_Settings_Tab.php:147
+msgid "On - visitors connect directly (REMOTE_ADDR)"
+msgstr "An – Besucher verbinden sich direkt (REMOTE_ADDR)"
+
+#: src/Settings/General/Tab/General_Settings_Tab.php:148
+msgid "On - site is behind another proxy (X-Forwarded-For)"
+msgstr "An – Website läuft hinter einem anderen Proxy (X-Forwarded-For)"