From aa450a2ebe27e64389a7aa17edf50a71cdba9d2b Mon Sep 17 00:00:00 2001
From: Lunar <lunar@debian.org>
Date: Thu, 7 Jan 2021 15:29:39 +0100
Subject: [PATCH] Source reCAPTCHA API only when needed

When using a subscription form as an iframe, our CSP catched up that the reCAPTCHA API was included despite MailPoet being configured to use its internal CAPTCHA. The following change will only output the relevant <script> tag when MailPoet uses reCAPTCHA.
---
 lib/Form/AssetsController.php | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/Form/AssetsController.php b/lib/Form/AssetsController.php
index cb4b9dd20a..a38cac8858 100644
--- a/lib/Form/AssetsController.php
+++ b/lib/Form/AssetsController.php
@@ -35,7 +35,12 @@ class AssetsController {
     $this->wp->wpPrintScripts('jquery');
     $this->wp->wpPrintScripts('mailpoet_vendor');
     $this->wp->wpPrintScripts('mailpoet_public');
-    echo '<script src="' . self::RECAPTCHA_API_URL . '" async defer></script>';
+    
+    $captcha = $this->settings->get('captcha');
+    if (!empty($captcha['type']) && $captcha['type'] === Captcha::TYPE_RECAPTCHA) {
+      echo '<script src="' . self::RECAPTCHA_API_URL . '" async defer></script>';
+    } 
+
     $scripts = ob_get_contents();
     ob_end_clean();
     if ($scripts === false) {