Add ReCAPTCHA support to password reset form

[asmecher]

The password reset form can generate unwanted emails if abused. Add ReCAPTCHA support to the password reset form.

[NateWr]

Since ReCAPTCHA is not available in China, can/should we do some basic rate limiting? If we log the reset request, we should be able to not send another reset request until the last one expires?

[henriqueramos]

As mentioned on Slack channel, we could use the hCaptcha instead reCaptcha.

[mfelczak]

Just wanted to add a +1 for rate limiting the password reset form.

[LuisLepidus]

+1

[henriqueramos]

@asmecher This feature its on dev roadmap? If not, I will spend some time creating this as a package.

[asmecher]

@henriqueramos, it hasn't yet been prioritized against a specific release, but I'd be happy to get a pull request reviewed!

[Godoy0722]

Hello @asmecher! Hope you're doing well.

I just created two PRs that are related to this issue. If you want to take a look or assign someone to make the code reviews, I would appreciate that!

[asmecher]

Looks good, @Godoy0722; can you forward-port this to stable-3_5_0, stable-3_4_0, and main? (If porting through stable-3_4_0 is too time-consuming, I'd consider leaving it out of that branch; stable-3_5_0 and main are basically equivalent.)

[Godoy0722]

Hello Alec! I'll work on it and ping you in the other PRs as soon as possible. I'll also link the PRs that I create with this one.

[Godoy0722]

Hi there @asmecher! Just a heads-up that I make the forward port for this issue on all OJS versions ahead of the 3.3 one, in case you want to take a better look at them! If there's anything else you need me to do about this issue, please don't hesitate to contact me! Thank you so much, Alec!

[LuisLepidus]

Hi @asmecher! Would it be possible to add this fix to version 3.3.0-21?

[jonasraoni]

If we're implementing this, then I think it makes sense to also bring the #6539 to 3.3

[asmecher]

@Godoy0722, could you list out all the PRs here in a comment? That'll make sure I don't miss anything. Thanks!

[Godoy0722]

Hello @asmecher ! Of course, I'll summarize all my PRs for all OJS versions:

OJS 3.3

• OJS
• Lib PKP

OJS 3.4

• OJS
• Lib PKP

OJS 3.5

• OJS
• Lib PKP

OJS main branch

• OJS
• Lib PKP

Here are all my created PRs for this request. Also, on OJS 3.3, I made a backport for the request on the issue #6539. Please let me know if you need anything else! 😄

[asmecher]

@Godoy0722, with apologies for the delay, there's just one small comment on the 3.3.0 review that needs attention, then it's all ready!