<?php
$creds = json_decode(file_get_contents('/etc/menlo/conf/test_page_secrets', false), true);
$url = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
$data = ['secret' => $creds['cloudflare_noninteractive']['secret_key'],
         'response' => $_POST['cf-turnstile-response']];

// use key 'http' even if you send the request to https://...
$options = [
  'http' => [
    'header' => "Content-type: application/x-www-form-urlencoded\r\n",
    'method' => 'POST',
    'content' => http_build_query($data),
  ],
];

echo '<h2>Input</h2>';
var_dump($_POST);

$context = stream_context_create($options);
$result = file_get_contents($url, false, $context);
echo '<h2>Result</h2>';
if ($result === false) {
  echo '<p>Siteverify call failed</p>';
} else {
  // { "success": true, "challenge_ts": "2025-02-14T12:18:20Z", "hostname": "ds-dev-2004.devatron.net" }
  // { "success": false, "error-codes": [ "timeout-or-duplicate" ] }
  echo '<p>' . $result . '</p>';
}
?>
