Uploaded image for project: 'Magnolia Form Module'
  1. Magnolia Form Module
  2. MGNLFORM-178

Form's Honeypot anti-spam - needed improvements

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Neutral
    • Resolution: Fixed
    • Affects Version/s: 1.4.5, 2.0
    • Fix Version/s: 1.4.8, 2.0.1
    • Component/s: None
    • Labels:
      None
    • Patch included:
      Yes

      Description

      In form.ftl, the input field "dedicated" to fool the robot is hidden.

      <input type="hidden" name="field" value="" />

      A couple of problems I see here:
      1. The "hidden" type can be detected easily by a bot.
      2. Once the form is submitted the first time by a bot, it is then redirected to the form page again. All the form fields are filled in EXCEPT the hidden field (it then has an empty value!). So if the bot resubmit the form a second time (without entering any value in any field) the form is then processed. You can test this by editing the form hidden field using your dev tool, submit, then resubmit.

      Solution for those problems:
      1. Moving to a CSS based solution seems sensible (see Cedric's post): the bot having more trouble to find out when a field is hidden via a separate CSS file.

      <input type="hidden" name="field" id="field" value="" />
      #field {
        display: none;
      }

      Note: No idea if making wrapping div hidden (like Cedric did) is a better technique or not.

      2. The issue here is that our field here looses its value. And you can't use

      ${model.value!}

      like other "regular" fields do as this field is not a component itself.

      So I opted for "manual" creation of the field component, that is:
      2.1 Remove from form.ftl: [code]<input type="hidden" name="field" value="" />[/code]
      2.2 In edit mode of your form page, create a text field with "Field Label"=field, and "Field Name"=field
      2.3 Since the field gets also assigned an id of value "field" (same as "Field Name" value), we can then hide it in style.css

      .form-item-hidden,
      .form-wrapper input[type=hidden],
      .form-wrapper #field,
      .form-wrapper label[for=field] {
         display: none;
      }
      

      The label[for=field] attribute selector is compatible for IE7 and above, see http://www.quirksmode.org/css/selectors/

      Improvement: In my case I add this field manually but this could be done automatically via configuration (generator) I think.
      http://documentation.magnolia-cms.com/templates/stk/template-definitions.html#Autogeneratedcomponents
      http://wiki.magnolia-cms.com/display/WIKI/Extending+the+stkArticle+template#ExtendingthestkArticletemplate-Addanautogeneratedcomponent

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              rkovarik Roman Kovařík
              Reporter:
              adrien_be Adrien Berthou
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Date of First Response:

                  Checklists

                  Bug DoR
                  DoD