CSP Not Showing Google Recaptcha about mozsecworld HOT 7 CLOSED

How can I change this chunk into externalized-jinja-happy template https://github.com/haoqili/MozSecWorld/blob/master/apps/msw/captcha.py#L33-44
:(

from mozsecworld.

^ trying to copy https://github.com/jbalogh/zamboni/blob/master/apps/amo/templates/amo/recaptcha_js.html, get "global name 'settings' is not defined" error

from mozsecworld.

^ latest push has https://github.com/haoqili/MozSecWorld/blob/7b4cff394aae590a637c7ad95a79c87dc5e33a29/apps/msw/recaptcha_test.py that gets new challenge strings from recaptcha every time

with the challenge string, append it to the end of "https://www.google.com/recaptcha/api/image?c=" to get a new recaptcha image

from mozsecworld.

Great resource found! https://github.com/mozilla/django-recaptcha

from mozsecworld.

Django-recaptcha uses the same recaptcha backend, with the "displayhtml()" function that contains the in-body javascript. The only difference is that they have a custom display. Let me try that.

from mozsecworld.

New Firebug bug

        call to setInterval blocked by CSP            recaptcha.js (line 23)

Because setInterval() is blocked by CSP.

Set it by: https://github.com/mozilla/django-csp/blob/master/README.rst

from mozsecworld.

2 break throughs, 1 question.
BT1: change into amo register's custom RecaptchaOptions to avoid in-body script.
BT2: have to allow setInterval like 'CSP_OPTIONS = ("eval-script",)'.
Q1 #45 How come amo register does not have "setInterval blocked by CSP" problem even without CSP_OPTIONS?

blog post about the in-body javascript

from mozsecworld.