From 857c3b298043bec7e9f8730d6f722667df4fa527 Mon Sep 17 00:00:00 2001
From: Awesome-E <54484616+Awesome-E@users.noreply.github.com>
Date: Sun, 17 Dec 2023 20:08:27 -0800
Subject: [PATCH 01/14] Pass recaptcha token in form on client side

---
 site/src/component/ReviewForm/ReviewForm.tsx | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/site/src/component/ReviewForm/ReviewForm.tsx b/site/src/component/ReviewForm/ReviewForm.tsx
index 045e532a..cee2c7d0 100644
--- a/site/src/component/ReviewForm/ReviewForm.tsx
+++ b/site/src/component/ReviewForm/ReviewForm.tsx
@@ -57,7 +57,7 @@ const ReviewForm: FC<ReviewFormProps> = (props) => {
   const [textbook, setTextbook] = useState<boolean>(false);
   const [attendance, setAttendance] = useState<boolean>(false);
   const [selectedTags, setSelectedTags] = useState<string[]>([]);
-  const [verified, setVerified] = useState(false);
+  const [captchaToken, setCaptchaToken] = useState("");
   const [submitted, setSubmitted] = useState(false);
   const [overCharLimit, setOverCharLimit] = useState(false);
   const [cookies, setCookie] = useCookies(["user"]);
@@ -110,7 +110,7 @@ const ReviewForm: FC<ReviewFormProps> = (props) => {
       return;
     }
 
-    if (!verified) {
+    if (!captchaToken) {
       alert("Please complete the CAPTCHA");
       return;
     }
@@ -136,6 +136,7 @@ const ReviewForm: FC<ReviewFormProps> = (props) => {
       textbook: textbook,
       attendance: attendance,
       tags: selectedTags,
+      captchaToken: captchaToken,
       verified: false,
     };
     if (content.length > 500) {
@@ -424,16 +425,7 @@ const ReviewForm: FC<ReviewFormProps> = (props) => {
               <ReCAPTCHA
                 className="d-inline"
                 sitekey="6Le6rfIUAAAAAOdqD2N-QUEW9nEtfeNyzkXucLm4"
-                onChange={(token) => {
-                  // if verified
-                  if (token) {
-                    setVerified(true);
-                  }
-                  // captcha expired
-                  else {
-                    setVerified(false);
-                  }
-                }}
+                onChange={(token) => setCaptchaToken(token || "")}
               />
               <div>
                 <Button className="py-2 px-4 float-right" type="submit" variant="secondary">

From e904c876ef7af8f4a743b7d9588809ba5982939c Mon Sep 17 00:00:00 2001
From: Awesome-E <54484616+Awesome-E@users.noreply.github.com>
Date: Sun, 17 Dec 2023 20:11:39 -0800
Subject: [PATCH 02/14] implement server side recaptcha check

---
 api/src/controllers/reviews.ts               | 22 ++++++++++++++++++++
 site/src/component/ReviewForm/ReviewForm.tsx |  2 +-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/api/src/controllers/reviews.ts b/api/src/controllers/reviews.ts
index 57bd05be..1ed67fda 100644
--- a/api/src/controllers/reviews.ts
+++ b/api/src/controllers/reviews.ts
@@ -6,6 +6,7 @@ import express from "express";
 import { ObjectID } from "mongodb";
 import { VoteData } from "../types/types";
 import { COLLECTION_NAMES, getCollection, addDocument, getDocuments, updateDocument, deleteDocument, deleteDocuments } from "../helpers/mongo";
+import axios from "axios";
 
 const router = express.Router();
 
@@ -119,6 +120,23 @@ router.get("/", async function (req, res, next) {
   }
 });
 
+/** @todo ReviewData type */
+async function verifyCaptcha (review: any) {
+  const reqBody = {
+    secret: process.env.GRECAPTCHA_SECRET,
+    response: review.captchaToken
+  };
+  const queryStr = new URLSearchParams(Object.entries(reqBody)).toString();
+  const response = await axios.post("https://www.google.com/recaptcha/api/siteverify?" + queryStr)
+    .then(x => x.data)
+    .catch(e => {
+      console.error("Error validating captcha response", e);
+      return { success: false };
+    });
+
+  return response.success;
+}
+
 /**
  * Add a review
  */
@@ -141,6 +159,10 @@ router.post("/", async function (req, res, next) {
       req.body.verified = true;
     }
 
+    // Verify the captcha
+    const captchaVerified = await verifyCaptcha(req.body);
+    if (!captchaVerified) return res.status(400).json({ error: "ReCAPTCHA token is invalid" });
+
     //check if review already exists for same professor, course, and user
     let query: ReviewFilter = {
       courseID: req.body.courseID,
diff --git a/site/src/component/ReviewForm/ReviewForm.tsx b/site/src/component/ReviewForm/ReviewForm.tsx
index cee2c7d0..dec797b4 100644
--- a/site/src/component/ReviewForm/ReviewForm.tsx
+++ b/site/src/component/ReviewForm/ReviewForm.tsx
@@ -86,7 +86,7 @@ const ReviewForm: FC<ReviewFormProps> = (props) => {
   const postReview = async (review: ReviewData) => {
     const res = await axios.post<ReviewData>("/api/reviews", review).catch((err) => err.response);
     if (res.status === 400) {
-      alert("You have already submitted a review for this course/professor");
+      alert(res.data.error || "You have already submitted a review for this course/professor");
     } else if (res.data.hasOwnProperty("error")) {
       alert("You must be logged in to add a review!");
     } else {

From f822ef9f9da17b3f200d8c2f332e8a04eb226ac3 Mon Sep 17 00:00:00 2001
From: Awesome-E <54484616+Awesome-E@users.noreply.github.com>
Date: Sun, 17 Dec 2023 20:17:12 -0800
Subject: [PATCH 03/14] set review verified on server side

also remove it from the client side reviews request

type is optional because we still use it when displaying reviews
---
 api/src/controllers/reviews.ts               | 7 +++----
 site/src/component/ReviewForm/ReviewForm.tsx | 1 -
 site/src/types/types.ts                      | 2 +-
 3 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/api/src/controllers/reviews.ts b/api/src/controllers/reviews.ts
index 1ed67fda..50f1432e 100644
--- a/api/src/controllers/reviews.ts
+++ b/api/src/controllers/reviews.ts
@@ -154,10 +154,9 @@ router.post("/", async function (req, res, next) {
         verified: true,
       })
       .count();
-    // set the review as verified
-    if (verifiedCount >= 3) {
-      req.body.verified = true;
-    }
+    
+    // Set on server so the client can't automatically verify their own review.
+    req.body.verified = verifiedCount >= 3; // auto-verify if use has posted 3+ reviews
 
     // Verify the captcha
     const captchaVerified = await verifyCaptcha(req.body);
diff --git a/site/src/component/ReviewForm/ReviewForm.tsx b/site/src/component/ReviewForm/ReviewForm.tsx
index dec797b4..15e070d5 100644
--- a/site/src/component/ReviewForm/ReviewForm.tsx
+++ b/site/src/component/ReviewForm/ReviewForm.tsx
@@ -137,7 +137,6 @@ const ReviewForm: FC<ReviewFormProps> = (props) => {
       attendance: attendance,
       tags: selectedTags,
       captchaToken: captchaToken,
-      verified: false,
     };
     if (content.length > 500) {
       setOverCharLimit(true);
diff --git a/site/src/types/types.ts b/site/src/types/types.ts
index c951790a..d5159032 100644
--- a/site/src/types/types.ts
+++ b/site/src/types/types.ts
@@ -80,7 +80,7 @@ export interface ReviewData {
     textbook: boolean;
     attendance: boolean;
     tags: string[];
-    verified: boolean;
+    verified?: boolean;
 }
 
 export interface ReportData {

From 9c090cfc28b0479380e676d2ebc01e09b2477e5d Mon Sep 17 00:00:00 2001
From: Awesome-E <54484616+Awesome-E@users.noreply.github.com>
Date: Sun, 17 Dec 2023 20:27:49 -0800
Subject: [PATCH 04/14] Refactor - make helper for captcha validation

---
 api/src/controllers/reviews.ts | 18 +-----------------
 api/src/helpers/recaptcha.ts   | 19 +++++++++++++++++++
 api/src/types/types.ts         | 24 ++++++++++++++++++++++++
 site/src/types/types.ts        |  1 +
 4 files changed, 45 insertions(+), 17 deletions(-)
 create mode 100644 api/src/helpers/recaptcha.ts

diff --git a/api/src/controllers/reviews.ts b/api/src/controllers/reviews.ts
index 50f1432e..9dfcfd09 100644
--- a/api/src/controllers/reviews.ts
+++ b/api/src/controllers/reviews.ts
@@ -7,6 +7,7 @@ import { ObjectID } from "mongodb";
 import { VoteData } from "../types/types";
 import { COLLECTION_NAMES, getCollection, addDocument, getDocuments, updateDocument, deleteDocument, deleteDocuments } from "../helpers/mongo";
 import axios from "axios";
+import { verifyCaptcha } from "../helpers/recaptcha";
 
 const router = express.Router();
 
@@ -120,23 +121,6 @@ router.get("/", async function (req, res, next) {
   }
 });
 
-/** @todo ReviewData type */
-async function verifyCaptcha (review: any) {
-  const reqBody = {
-    secret: process.env.GRECAPTCHA_SECRET,
-    response: review.captchaToken
-  };
-  const queryStr = new URLSearchParams(Object.entries(reqBody)).toString();
-  const response = await axios.post("https://www.google.com/recaptcha/api/siteverify?" + queryStr)
-    .then(x => x.data)
-    .catch(e => {
-      console.error("Error validating captcha response", e);
-      return { success: false };
-    });
-
-  return response.success;
-}
-
 /**
  * Add a review
  */
diff --git a/api/src/helpers/recaptcha.ts b/api/src/helpers/recaptcha.ts
new file mode 100644
index 00000000..ead28db7
--- /dev/null
+++ b/api/src/helpers/recaptcha.ts
@@ -0,0 +1,19 @@
+import axios from 'axios';
+import { ReviewData } from '../types/types';
+
+export async function verifyCaptcha(review: ReviewData) {
+  const reqBody = {
+    secret: process.env.GRECAPTCHA_SECRET || '',
+    response: review.captchaToken || '',
+  };
+  const queryStr = new URLSearchParams(Object.entries(reqBody)).toString();
+  const response = await axios
+    .post('https://www.google.com/recaptcha/api/siteverify?' + queryStr)
+    .then((x) => x.data)
+    .catch((e) => {
+      console.error('Error validating captcha response', e);
+      return { success: false };
+    });
+
+  return response.success;
+}
diff --git a/api/src/types/types.ts b/api/src/types/types.ts
index 6809c7cf..20210e88 100644
--- a/api/src/types/types.ts
+++ b/api/src/types/types.ts
@@ -50,6 +50,30 @@ export interface VoteData {
     score: number;
 }
 
+/** @todo should have some shared types between server and client */
+export interface ReviewData {
+    _id?: string;
+    professorID: string;
+    courseID: string;
+    userID: string;
+    userDisplay: string;
+    reviewContent: string;
+    rating: number;
+    difficulty: number;
+    timestamp: string;
+    gradeReceived: string;
+    forCredit: boolean;
+    quarter: string;
+    score: number;
+    takeAgain: boolean;
+    textbook: boolean;
+    attendance: boolean;
+    tags: string[];
+    verified?: boolean;
+    captchaToken: string;
+}
+
+
 declare module "express-session" {
     export interface SessionData {
         /**
diff --git a/site/src/types/types.ts b/site/src/types/types.ts
index d5159032..f6068c5b 100644
--- a/site/src/types/types.ts
+++ b/site/src/types/types.ts
@@ -81,6 +81,7 @@ export interface ReviewData {
     attendance: boolean;
     tags: string[];
     verified?: boolean;
+    captchaToken?: string;
 }
 
 export interface ReportData {

From b98370730906cecbec8edbdc5718b5024ac0c496 Mon Sep 17 00:00:00 2001
From: Awesome-E <54484616+Awesome-E@users.noreply.github.com>
Date: Sun, 17 Dec 2023 20:46:45 -0800
Subject: [PATCH 05/14] Add recaptcha secret as env var in the readme

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index a10720f6..f8321cbd 100644
--- a/README.md
+++ b/README.md
@@ -82,6 +82,7 @@ MONGO_URL=<secret>
 SESSION_SECRET=<secret>
 GOOGLE_CLIENT=<client>
 GOOGLE_SECRET=<secret>
+GRECAPTCHA_SECRET=<secret>
 ADMIN_EMAILS=["<your email>"]
 ```
 

From 71cbb1bd4c596207d9c167fc0490446b6f246980 Mon Sep 17 00:00:00 2001
From: Awesome-E <54484616+Awesome-E@users.noreply.github.com>
Date: Sun, 17 Dec 2023 21:32:19 -0800
Subject: [PATCH 06/14] Add env var to `stacks/backend.ts`

---
 stacks/backend.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/stacks/backend.ts b/stacks/backend.ts
index 8aa90fb2..2e2330a8 100644
--- a/stacks/backend.ts
+++ b/stacks/backend.ts
@@ -39,6 +39,7 @@ export function BackendStack({app, stack}: StackContext) {
                         PUBLIC_API_GRAPHQL_URL: process.env.PUBLIC_API_GRAPHQL_URL,
                         GOOGLE_CLIENT: process.env.GOOGLE_CLIENT,
                         GOOGLE_SECRET: process.env.GOOGLE_SECRET,
+                        GRECAPTCHA_SECRET: process.env.GRECAPTCHA_SECRET,
                         PRODUCTION_DOMAIN: process.env.PRODUCTION_DOMAIN,
                         ADMIN_EMAILS: process.env.ADMIN_EMAILS,
                         NODE_ENV: process.env.NODE_ENV

From fc2931cec7280ab0d8e3cb1abe36ad458b20e86c Mon Sep 17 00:00:00 2001
From: Awesome-E <54484616+Awesome-E@users.noreply.github.com>
Date: Mon, 18 Dec 2023 11:49:10 -0800
Subject: [PATCH 07/14] add env vars to GH workflows

---
 .github/workflows/build-and-deploy.yml |  1 +
 .github/workflows/clean-up-pr.yml      |  1 +
 api/src/types/environment.d.ts         | 39 +++++++++++++-------------
 3 files changed, 22 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml
index 7d515512..f2b75f8c 100644
--- a/.github/workflows/build-and-deploy.yml
+++ b/.github/workflows/build-and-deploy.yml
@@ -40,6 +40,7 @@ jobs:
           SESSION_SECRET: ${{secrets.SESSION_SECRET}}
           GOOGLE_CLIENT: ${{secrets.GOOGLE_CLIENT}}
           GOOGLE_SECRET: ${{secrets.GOOGLE_SECRET}}
+          GRECAPTCHA_SECRET: $${{secrets.GRECAPTCHA_SECRET}}
           ADMIN_EMAILS: ${{secrets.ADMIN_EMAILS}}
           PRODUCTION_DOMAIN: ${{secrets.PRODUCTION_DOMAIN}}
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
diff --git a/.github/workflows/clean-up-pr.yml b/.github/workflows/clean-up-pr.yml
index e28c3280..f64822a3 100644
--- a/.github/workflows/clean-up-pr.yml
+++ b/.github/workflows/clean-up-pr.yml
@@ -39,6 +39,7 @@ jobs:
           SESSION_SECRET: ${{secrets.SESSION_SECRET}}
           GOOGLE_CLIENT: ${{secrets.GOOGLE_CLIENT}}
           GOOGLE_SECRET: ${{secrets.GOOGLE_SECRET}}
+          GRECAPTCHA_SECRET: $${{secrets.GRECAPTCHA_SECRET}}
           ADMIN_EMAILS: ${{secrets.ADMIN_EMAILS}}
           PRODUCTION_DOMAIN: ${{secrets.PRODUCTION_DOMAIN}}
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
diff --git a/api/src/types/environment.d.ts b/api/src/types/environment.d.ts
index 5f7311b0..852920c7 100644
--- a/api/src/types/environment.d.ts
+++ b/api/src/types/environment.d.ts
@@ -1,24 +1,25 @@
 declare global {
-    namespace NodeJS {
-        /**
-         * Define schema for environment variables
-         */
-        interface ProcessEnv {
-            MONGO_URL: string;
-            NODE_ENV: 'development' | 'production' | 'staging';
-            PORT?: string;
-            PUBLIC_API_URL: string;
-            PUBLIC_API_GRAPHQL_URL: string;
-            MONGO_URL: string;
-            SESSION_SECRET: string;
-            GOOGLE_CLIENT: string;
-            GOOGLE_SECRET: string;
-            PRODUCTION_DOMAIN: string;
-            GITHUB_ADMIN_USERNAMES: string;
-            ADMIN_EMAILS: string;
-        }
+  namespace NodeJS {
+    /**
+     * Define schema for environment variables
+     */
+    interface ProcessEnv {
+      MONGO_URL: string;
+      NODE_ENV: 'development' | 'production' | 'staging';
+      PORT?: string;
+      PUBLIC_API_URL: string;
+      PUBLIC_API_GRAPHQL_URL: string;
+      MONGO_URL: string;
+      SESSION_SECRET: string;
+      GOOGLE_CLIENT: string;
+      GOOGLE_SECRET: string;
+      GRECAPTCHA_SECRET: string;
+      PRODUCTION_DOMAIN: string;
+      GITHUB_ADMIN_USERNAMES: string;
+      ADMIN_EMAILS: string;
     }
+  }
 }
 
 // need to export something to be considered a 'module'
-export {}
\ No newline at end of file
+export {};

From 8f96e403ef2092fb54d93620e3c96b29b6f1a797 Mon Sep 17 00:00:00 2001
From: Awesome-E <54484616+Awesome-E@users.noreply.github.com>
Date: Mon, 18 Dec 2023 14:36:39 -0800
Subject: [PATCH 08/14] return response for now

---
 api/src/controllers/reviews.ts | 4 ++--
 api/src/helpers/recaptcha.ts   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/api/src/controllers/reviews.ts b/api/src/controllers/reviews.ts
index 9dfcfd09..131c66e1 100644
--- a/api/src/controllers/reviews.ts
+++ b/api/src/controllers/reviews.ts
@@ -143,8 +143,8 @@ router.post("/", async function (req, res, next) {
     req.body.verified = verifiedCount >= 3; // auto-verify if use has posted 3+ reviews
 
     // Verify the captcha
-    const captchaVerified = await verifyCaptcha(req.body);
-    if (!captchaVerified) return res.status(400).json({ error: "ReCAPTCHA token is invalid" });
+    const verifyResponse = await verifyCaptcha(req.body);
+    if (!verifyResponse?.success) return res.status(400).json({ error: "ReCAPTCHA token is invalid", data: verifyResponse });
 
     //check if review already exists for same professor, course, and user
     let query: ReviewFilter = {
diff --git a/api/src/helpers/recaptcha.ts b/api/src/helpers/recaptcha.ts
index ead28db7..9ce00496 100644
--- a/api/src/helpers/recaptcha.ts
+++ b/api/src/helpers/recaptcha.ts
@@ -15,5 +15,5 @@ export async function verifyCaptcha(review: ReviewData) {
       return { success: false };
     });
 
-  return response.success;
+  return response;
 }

From 098dab60045bf5e8f24da99e2c0683fa03a0b630 Mon Sep 17 00:00:00 2001
From: Awesome-E <54484616+Awesome-E@users.noreply.github.com>
Date: Mon, 18 Dec 2023 14:41:53 -0800
Subject: [PATCH 09/14] fix typo

---
 .github/workflows/build-and-deploy.yml | 2 +-
 .github/workflows/clean-up-pr.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml
index f2b75f8c..c9d4ab12 100644
--- a/.github/workflows/build-and-deploy.yml
+++ b/.github/workflows/build-and-deploy.yml
@@ -40,7 +40,7 @@ jobs:
           SESSION_SECRET: ${{secrets.SESSION_SECRET}}
           GOOGLE_CLIENT: ${{secrets.GOOGLE_CLIENT}}
           GOOGLE_SECRET: ${{secrets.GOOGLE_SECRET}}
-          GRECAPTCHA_SECRET: $${{secrets.GRECAPTCHA_SECRET}}
+          GRECAPTCHA_SECRET: ${{secrets.GRECAPTCHA_SECRET}}
           ADMIN_EMAILS: ${{secrets.ADMIN_EMAILS}}
           PRODUCTION_DOMAIN: ${{secrets.PRODUCTION_DOMAIN}}
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
diff --git a/.github/workflows/clean-up-pr.yml b/.github/workflows/clean-up-pr.yml
index f64822a3..5658d377 100644
--- a/.github/workflows/clean-up-pr.yml
+++ b/.github/workflows/clean-up-pr.yml
@@ -39,7 +39,7 @@ jobs:
           SESSION_SECRET: ${{secrets.SESSION_SECRET}}
           GOOGLE_CLIENT: ${{secrets.GOOGLE_CLIENT}}
           GOOGLE_SECRET: ${{secrets.GOOGLE_SECRET}}
-          GRECAPTCHA_SECRET: $${{secrets.GRECAPTCHA_SECRET}}
+          GRECAPTCHA_SECRET: ${{secrets.GRECAPTCHA_SECRET}}
           ADMIN_EMAILS: ${{secrets.ADMIN_EMAILS}}
           PRODUCTION_DOMAIN: ${{secrets.PRODUCTION_DOMAIN}}
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}

From ef0c45a582d3f4811aba4e8485c4cd255d607372 Mon Sep 17 00:00:00 2001
From: Awesome-E <54484616+Awesome-E@users.noreply.github.com>
Date: Mon, 18 Dec 2023 15:08:09 -0800
Subject: [PATCH 10/14] Simplify query string

Co-authored-by: Jacob Sommer <js0mmer@users.noreply.github.com>
---
 api/src/helpers/recaptcha.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/api/src/helpers/recaptcha.ts b/api/src/helpers/recaptcha.ts
index 9ce00496..0d5f5be8 100644
--- a/api/src/helpers/recaptcha.ts
+++ b/api/src/helpers/recaptcha.ts
@@ -6,9 +6,9 @@ export async function verifyCaptcha(review: ReviewData) {
     secret: process.env.GRECAPTCHA_SECRET || '',
     response: review.captchaToken || '',
   };
-  const queryStr = new URLSearchParams(Object.entries(reqBody)).toString();
+  const query = new URLSearchParams(reqBody);
   const response = await axios
-    .post('https://www.google.com/recaptcha/api/siteverify?' + queryStr)
+    .post('https://www.google.com/recaptcha/api/siteverify?' + query)
     .then((x) => x.data)
     .catch((e) => {
       console.error('Error validating captcha response', e);

From f3ec66178f3543b9ff1bb26467564e6c300d3044 Mon Sep 17 00:00:00 2001
From: Awesome-E <54484616+Awesome-E@users.noreply.github.com>
Date: Mon, 18 Dec 2023 15:08:45 -0800
Subject: [PATCH 11/14] delete recaptcha token

---
 api/src/controllers/reviews.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/api/src/controllers/reviews.ts b/api/src/controllers/reviews.ts
index 131c66e1..e1a618f2 100644
--- a/api/src/controllers/reviews.ts
+++ b/api/src/controllers/reviews.ts
@@ -145,6 +145,7 @@ router.post("/", async function (req, res, next) {
     // Verify the captcha
     const verifyResponse = await verifyCaptcha(req.body);
     if (!verifyResponse?.success) return res.status(400).json({ error: "ReCAPTCHA token is invalid", data: verifyResponse });
+    delete req.body.captchaToken; // so it doesn't get stored in DB
 
     //check if review already exists for same professor, course, and user
     let query: ReviewFilter = {

From 0f4764bca34291de852ca33a9d31f049a8563d39 Mon Sep 17 00:00:00 2001
From: Awesome-E <54484616+Awesome-E@users.noreply.github.com>
Date: Mon, 18 Dec 2023 15:09:27 -0800
Subject: [PATCH 12/14] prefer `??` over `||`

---
 api/src/helpers/recaptcha.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/api/src/helpers/recaptcha.ts b/api/src/helpers/recaptcha.ts
index 0d5f5be8..3fc01e83 100644
--- a/api/src/helpers/recaptcha.ts
+++ b/api/src/helpers/recaptcha.ts
@@ -3,8 +3,8 @@ import { ReviewData } from '../types/types';
 
 export async function verifyCaptcha(review: ReviewData) {
   const reqBody = {
-    secret: process.env.GRECAPTCHA_SECRET || '',
-    response: review.captchaToken || '',
+    secret: process.env.GRECAPTCHA_SECRET ?? '',
+    response: review.captchaToken ?? '',
   };
   const query = new URLSearchParams(reqBody);
   const response = await axios

From fd4abbb73ed27f8d2d4e5413cf8067c998c65f28 Mon Sep 17 00:00:00 2001
From: Awesome-E <54484616+Awesome-E@users.noreply.github.com>
Date: Mon, 18 Dec 2023 16:50:11 -0800
Subject: [PATCH 13/14] Update site/src/component/ReviewForm/ReviewForm.tsx

Co-authored-by: Jacob Sommer <js0mmer@users.noreply.github.com>
---
 site/src/component/ReviewForm/ReviewForm.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/site/src/component/ReviewForm/ReviewForm.tsx b/site/src/component/ReviewForm/ReviewForm.tsx
index 15e070d5..16eaa229 100644
--- a/site/src/component/ReviewForm/ReviewForm.tsx
+++ b/site/src/component/ReviewForm/ReviewForm.tsx
@@ -86,7 +86,7 @@ const ReviewForm: FC<ReviewFormProps> = (props) => {
   const postReview = async (review: ReviewData) => {
     const res = await axios.post<ReviewData>("/api/reviews", review).catch((err) => err.response);
     if (res.status === 400) {
-      alert(res.data.error || "You have already submitted a review for this course/professor");
+      alert(res.data.error ?? "You have already submitted a review for this course/professor");
     } else if (res.data.hasOwnProperty("error")) {
       alert("You must be logged in to add a review!");
     } else {

From b35dcf92970c63a51c821e9c0383328f6f817b9e Mon Sep 17 00:00:00 2001
From: Awesome-E <54484616+Awesome-E@users.noreply.github.com>
Date: Mon, 18 Dec 2023 16:50:21 -0800
Subject: [PATCH 14/14] Update site/src/component/ReviewForm/ReviewForm.tsx

Co-authored-by: Jacob Sommer <js0mmer@users.noreply.github.com>
---
 site/src/component/ReviewForm/ReviewForm.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/site/src/component/ReviewForm/ReviewForm.tsx b/site/src/component/ReviewForm/ReviewForm.tsx
index 16eaa229..c5025eb7 100644
--- a/site/src/component/ReviewForm/ReviewForm.tsx
+++ b/site/src/component/ReviewForm/ReviewForm.tsx
@@ -424,7 +424,7 @@ const ReviewForm: FC<ReviewFormProps> = (props) => {
               <ReCAPTCHA
                 className="d-inline"
                 sitekey="6Le6rfIUAAAAAOdqD2N-QUEW9nEtfeNyzkXucLm4"
-                onChange={(token) => setCaptchaToken(token || "")}
+                onChange={(token) => setCaptchaToken(token ?? "")}
               />
               <div>
                 <Button className="py-2 px-4 float-right" type="submit" variant="secondary">