From cf0cd1cd8838f402502d89ea2055caaaa8a866b5 Mon Sep 17 00:00:00 2001
From: Osmium Sorcerer <os@sof.beauty>
Date: Tue, 7 Apr 2026 03:16:18 +0000
Subject: Remove defunct CAPTCHA

The hCaptcha integration has been abandoned for a while. It added yet
another questionable third-party API (which also set a Cloudflare
cookie), and its effectiveness is unclear considering its client-side
nature.

A custom CAPTCHA implementation (such as PoW challenge) is an
interesting prospect, but it'll require proper server-side support.
---
 public/client.html | 23 ++++-------------------
 1 file changed, 4 insertions(+), 19 deletions(-)

(limited to 'public')

diff --git a/public/client.html b/public/client.html
index 490715f..60b7c0d 100644
--- a/public/client.html
+++ b/public/client.html
@@ -36,13 +36,12 @@
     <meta
       http-equiv="Content-Security-Policy"
       content="
-		script-src-elem 'self' 'unsafe-inline' https://hcaptcha.com https://*.hcaptcha.com;
+		script-src-elem 'self' 'unsafe-inline';
 		style-src-elem 'self' 'unsafe-inline' https://golden-layout.com;
-		script-src 'self' 'unsafe-inline' 'unsafe-eval' https://hcaptcha.com https://*.hcaptcha.com;
-		style-src 'self' 'unsafe-inline' https://golden-layout.com https://hcaptcha.com https://*.hcaptcha.com;
+		script-src 'self' 'unsafe-inline' 'unsafe-eval';
+		style-src 'self' 'unsafe-inline' https://golden-layout.com;
 		img-src 'self' data: file: *;
-		frame-src https://hcaptcha.com https://*.hcaptcha.com;
-		connect-src 'self' ws: file: * https://hcaptcha.com https://*.hcaptcha.com;
+		connect-src 'self' ws: file: *;
 		media-src 'self' file: *;"
     />
 
@@ -105,20 +104,6 @@
       <div id="client_loading">
         <h1 id="client_loadingtext">Loading</h1>
       </div>
-      <div id="client_secondfactor" style="display: none">
-        <center>
-          <p>You seem to be new 👋</p>
-          <form method="POST">
-            <div
-              class="h-captcha"
-              data-sitekey="6cbe7d73-706d-4e4b-9147-8b9aebb83b5d"
-              data-theme="dark"
-              data-callback="hcallback"
-            ></div>
-            <script src="https://js.hcaptcha.com/1/api.js" async defer></script>
-          </form>
-        </center>
-      </div>
       <div id="client_charselect">
         <p>Choose your character</p>
         <button onclick="pickChar(-1)">Or spectate</button>
-- 
cgit