[18.0][ADD] website_altcha by etobella · Pull Request #1175 · OCA/website

etobella · 2026-04-15T06:36:00Z

This module allows to use a Captcha System completly handled by Odoo.

It relies on Altcha, an OpenSource captcha alternative.

Currently, Odoo provides 2 options:

Google Recaptcha relies on tracking of the user. It implies cookies
Cloudfare Turnstile relies on signals of the browser so it is less
RGDP problematic. However, it relies on a third party infrastructure.
The decision is made from a probabilistic perspective (likely a human)

With this new module, everything relies on our own system with no
cookies, no tracking and no network calls.

The way to solve it is to add a deterministic puzzle to solve. Bots need
to spend more CPU, making it costly at scale.

luisDIXMIT

I am testing on runboat, system params are setted but I don't understand why it gives me "Verification failed. Try again later." error. I am doing it from "contact us" page on website.

etobella · 2026-04-15T08:30:16Z

The problem is that it requires https to work. If you change to https it should work (tested in runboat). In local there is not such a limitation when using localhost (only on localhost)

luisDIXMIT · 2026-04-15T08:33:27Z

The problem is that it requires https to work. If you change to https it should work (tested in runboat). In local there is not such a limitation when using localhost (only on localhost)

It works, thanks!

luisDIXMIT

Code review and tested on runboat, LGTM!

etobella · 2026-04-24T13:56:47Z

I made a major change, allowing to configure this for each website (much simpler to handle)

hbrunn

funny, I just came here to propose this for version 16, but as yours has seniority, I'll backport this instead when done.

Do you think the module could have an init hook that enables it for all websites? Seems a bit nonsensical for users to have to do this manually, as they'll install the module because they want to have it, right?

hbrunn · 2026-05-29T06:18:40Z

+            ("SCRYPT", "SCRYPT (memory hard)"),
+        ]
+        if argon2:
+            result.append(("ARGON2ID", "ARGON2ID (memory hard, recommended)"))


those two aren't included in the JS file, so I don't see how those choices can work (and expectedly selecting scrypt doesn't work on runbot). I think it's fine to remove them for version 1

hbrunn · 2026-05-29T06:22:19Z

@@ -0,0 +1,2 @@
+id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_altcha_key,access_altcha_key,website_altcha.model_altcha_key,base.group_user,1,0,0,0


Suggested change

access_altcha_key,access_altcha_key,website_altcha.model_altcha_key,base.group_user,1,0,0,0

access_altcha_key,access_altcha_key,website_altcha.model_altcha_key,base.group_system,1,0,0,0

as all access to this is sudo'd, no need for users to have access, right?

hbrunn · 2026-05-29T06:23:21Z

@@ -0,0 +1,15 @@
+This module allows to use a Captcha System completly handled by Odoo.
+
+It relies on Altcha, an OpenSource captcha alternative.


Suggested change

It relies on Altcha, an OpenSource captcha alternative.

It relies on Altcha (https://altcha.org), an OpenSource captcha alternative.

hbrunn · 2026-05-29T06:23:44Z

+Currently, Odoo provides 2 options:
+
+- Google Recaptcha relies on tracking of the user. It implies cookies
+- Cloudfare Turnstile relies on signals of the browser so it is less RGDP problematic.
+  However, it relies on a third party infrastructure. 
+  The decision is made from a probabilistic perspective (likely a human)
+
+With this new module, everything relies on our own system with no cookies, no tracking and no network calls.


this can go to CONTEXT.md I think

hbrunn · 2026-05-29T06:25:29Z

+  - Memory Hard: `SCRYPT`
+  - Memory Hard (it required argon2-cffi): `ARGON2ID`


hbrunn · 2026-05-29T06:26:57Z

+# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl).
+
+{
+    "name": "Website Friendly Captcha",


Suggested change

"name": "Website Friendly Captcha",

"name": "Privacy Friendly Captcha",

the point is that this is privacy friendly and self hosted, not friendly as in nice i think

hbrunn · 2026-05-29T06:27:51Z

+
+{
+    "name": "Website Friendly Captcha",
+    "summary": """Use Friendly Captcha for verifying users""",


Suggested change

"summary": """Use Friendly Captcha for verifying users""",

"summary": """Use self hosted privacy friendly captcha for verifying website users are not bots""",

hbrunn · 2026-05-29T06:29:44Z

@@ -0,0 +1,16 @@
+On each website, some extra parameters will appear with all the altcha information


this should start with: Go to Configuration/Website, check "Enable Altcha" under "Privacy"

ah, and they style their name ALTCHA, so I suggest to s/Altcha/ALTCHA in all user visible texts

etobella · 2026-05-29T08:20:47Z

@hbrunn All comments attended.

hbrunn

thanks, what do you think about activating this on installation though?

and I just tried to test password reset and signup on runbot, here the widget shows an error even though it works fine for the contact form. any idea what's going on there?

hbrunn · 2026-05-29T09:47:44Z

+     * @param {String} action
+     * @returns {Promise|Object}
+     */
+    async getToken(action) {


can you point me to where this function is used?

I think it comes from the first implementation. I will remove it.

hbrunn · 2026-05-29T10:04:24Z

+            this.$el
+                .find("div.oe_login_buttons")
+                .prepend(
+                    '<altcha-widget class="pb-2 o_altcha_widget" challengeurl="/altcha"></altcha-widget>'


@etobella this seems to be the problem, why not render here website_altcha.AltchaWidget?

btw in my version I named the controller /website_altcha/challenge to scope stuff with the module name

hbrunn · 2026-05-29T10:04:56Z

+        return this._super(...arguments);
+    },
+    start: function () {
+        if (this._altcha._publicKey && !this.$el.find(".altcha-widget").length) {


Suggested change

if (this._altcha._publicKey && !this.$el.find(".altcha-widget").length) {

if (this._altcha._publicKey && !this.$el.find(".o_altcha-widget").length) {

etobella · 2026-05-29T11:49:53Z

I am not confident about the pre_init change.

It might happend that your customer is already using a recaptcha system, so forcing it mitght be a problem.

hbrunn

fair enough, then we leave it like that. do you need this to be three commits or can it be just one?

OCA-git-bot · 2026-05-29T12:29:44Z

This PR has the approved label and has been created more than 5 days ago. It should therefore be ready to merge by a maintainer (or a PSC member if the concerned addon has no declared maintainer). 🤖

etobella · 2026-05-29T13:37:44Z

2 because there is 2 different authors 😉

hbrunn · 2026-05-29T13:38:13Z

thanks

/ocabot merge nobump

OCA-git-bot · 2026-05-29T13:38:22Z

Hey, thanks for contributing! Proceeding to merge this for you.
Prepared branch 18.0-ocabot-merge-pr-1175-by-hbrunn-bump-nobump, awaiting test results.

OCA-git-bot · 2026-05-29T13:46:07Z

@hbrunn The merge process could not be finalized, because command twine upload --disable-progress-bar --non-interactive --repository-url https://upload.pypi.org/legacy/ -u __token__ odoo_addon_website_altcha-18.0.1.0.0.3-py3-none-any.whl failed with output:

Uploading distributions to https://upload.pypi.org/legacy/
Uploading odoo_addon_website_altcha-18.0.1.0.0.3-py3-none-any.whl
�[33mWARNING �[0m Error during upload. Retry with the --verbose option for more details. 
�[31mERROR   �[0m HTTPError: 429 Too Many Requests from https://upload.pypi.org/legacy/  
         Too Many Requests

etobella · 2026-05-29T13:47:21Z

I will try tomorrow... the problem with pypi...

tarteo

Great, tested it locally! Only nitpicking so code LGTM!

tarteo · 2026-05-29T14:54:57Z

+publicWidget.registry.SignupAltcha = publicWidget.Widget.extend({
+    ...AltchaFunctionality,
+    selector: ".oe_signup_form",
+    tokenName: "signup",


tokenName is never used.

tarteo · 2026-05-29T14:55:31Z

+
+- Google Recaptcha relies on tracking of the user. It implies cookies
+- Cloudfare Turnstile relies on signals of the browser so it is less
+  RGDP problematic. However, it relies on a third party infrastructure.


Do you mean GDPR?

tarteo · 2026-05-29T14:56:38Z

+
+class AltchaKey(models.Model):
+    _name = "altcha.key"
+    _description = "Altcha Key"  # TODO


What is TODO here? I think it can be removed.

hbrunn

as you have to touch this anyways again for the typo, I added a few UI things I came across when backporting this to v16

hbrunn · 2026-05-29T14:49:25Z

+                        <field
+                            name="altcha_algorithm"
+                            required="altcha_enabled"
+                            placeholder="00000000-0000-0000-0000-000000000000"


Suggested change

placeholder="00000000-0000-0000-0000-000000000000"

hbrunn · 2026-05-29T14:57:35Z

+                    <div class="mt16" invisible="not altcha_enabled">
+                        <label
+                            class="col-md-3 o_light_label"
+                            string="Tracking ID"


Suggested change

string="Tracking ID"

string="HMAC secret"

hbrunn · 2026-05-29T14:57:53Z

+                    <div class="mt16" invisible="not altcha_enabled">
+                        <label
+                            class="col-md-3 o_light_label"
+                            string="Private Key"


Suggested change

string="Private Key"

string="HMAC key secret"

OCA-git-bot added mod:website_altcha Module website_altcha series:18.0 labels Apr 15, 2026

[ADD] website_altcha: Add module

047f313

etobella force-pushed the 18.0-add-website_altcha branch from 71aadf4 to 842051e Compare April 15, 2026 07:28

luisDIXMIT reviewed Apr 15, 2026

View reviewed changes

etobella force-pushed the 18.0-add-website_altcha branch from 842051e to d4f3616 Compare April 15, 2026 08:25

luisDIXMIT approved these changes Apr 15, 2026

View reviewed changes

etobella force-pushed the 18.0-add-website_altcha branch from d4f3616 to 916c261 Compare April 15, 2026 10:49

etobella force-pushed the 18.0-add-website_altcha branch from 916c261 to 41da999 Compare April 24, 2026 13:55

etobella force-pushed the 18.0-add-website_altcha branch 3 times, most recently from ad3850b to 7e766f4 Compare April 29, 2026 15:57

hbrunn requested changes May 29, 2026

View reviewed changes

etobella force-pushed the 18.0-add-website_altcha branch 2 times, most recently from cc2abba to 449f19d Compare May 29, 2026 07:36

hbrunn requested changes May 29, 2026

View reviewed changes

hbrunn reviewed May 29, 2026

View reviewed changes

etobella force-pushed the 18.0-add-website_altcha branch from 449f19d to a10d885 Compare May 29, 2026 11:49

hbrunn approved these changes May 29, 2026

View reviewed changes

OCA-git-bot added approved ready to merge labels May 29, 2026

[IMP] website_altcha: From v1 to v2, add tests & improve speed

2118c0f

etobella force-pushed the 18.0-add-website_altcha branch from a10d885 to 2118c0f Compare May 29, 2026 13:37

OCA-git-bot added the bot is merging ⏳ label May 29, 2026

OCA-git-bot removed the bot is merging ⏳ label May 29, 2026

hbrunn mentioned this pull request May 29, 2026

[16.0][MIG] website_altcha #1190

Open

tarteo approved these changes May 29, 2026

View reviewed changes

hbrunn requested changes May 29, 2026

View reviewed changes

OCA-git-bot removed approved ready to merge labels May 29, 2026

		@@ -0,0 +1,2 @@
		id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
		access_altcha_key,access_altcha_key,website_altcha.model_altcha_key,base.group_user,1,0,0,0

		@@ -0,0 +1,15 @@
		This module allows to use a Captcha System completly handled by Odoo.

		It relies on Altcha, an OpenSource captcha alternative.

	It relies on Altcha, an OpenSource captcha alternative.
	It relies on Altcha (https://altcha.org), an OpenSource captcha alternative.

		- Memory Hard: `SCRYPT`
		- Memory Hard (it required argon2-cffi): `ARGON2ID`

	"name": "Website Friendly Captcha",
	"name": "Privacy Friendly Captcha",

	"summary": """Use Friendly Captcha for verifying users""",
	"summary": """Use self hosted privacy friendly captcha for verifying website users are not bots""",

		@@ -0,0 +1,16 @@
		On each website, some extra parameters will appear with all the altcha information

	if (this._altcha._publicKey && !this.$el.find(".altcha-widget").length) {
	if (this._altcha._publicKey && !this.$el.find(".o_altcha-widget").length) {

Uh oh!

Conversation

etobella commented Apr 15, 2026

Uh oh!

luisDIXMIT left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

etobella commented Apr 15, 2026

Uh oh!

luisDIXMIT commented Apr 15, 2026

Uh oh!

luisDIXMIT left a comment

Choose a reason for hiding this comment

Uh oh!

etobella commented Apr 24, 2026

Uh oh!

hbrunn left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

etobella commented May 29, 2026

Uh oh!

hbrunn left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

etobella commented May 29, 2026

Uh oh!

hbrunn left a comment

Choose a reason for hiding this comment

Uh oh!

OCA-git-bot commented May 29, 2026

Uh oh!

etobella commented May 29, 2026

Uh oh!

hbrunn commented May 29, 2026

Uh oh!

OCA-git-bot commented May 29, 2026

Uh oh!

OCA-git-bot commented May 29, 2026

Uh oh!

etobella commented May 29, 2026

Uh oh!

tarteo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

luisDIXMIT left a comment •

edited

Loading

hbrunn left a comment •

edited

Loading