-
Bug
-
Resolution: Fixed
-
Neutral
-
1.4.5, 2.0
-
None
-
None
In form.ftl, the input field "dedicated" to fool the robot is hidden.
<input type="hidden" name="field" value="" />
A couple of problems I see here:
1. The "hidden" type can be detected easily by a bot.
2. Once the form is submitted the first time by a bot, it is then redirected to the form page again. All the form fields are filled in EXCEPT the hidden field (it then has an empty value!). So if the bot resubmit the form a second time (without entering any value in any field) the form is then processed. You can test this by editing the form hidden field using your dev tool, submit, then resubmit.
Solution for those problems:
1. Moving to a CSS based solution seems sensible (see Cedric's post): the bot having more trouble to find out when a field is hidden via a separate CSS file.
<input type="hidden" name="field" id="field" value="" />
#field { display: none; }
Note: No idea if making wrapping div hidden (like Cedric did) is a better technique or not.
2. The issue here is that our field here looses its value. And you can't use
${model.value!}
like other "regular" fields do as this field is not a component itself.
So I opted for "manual" creation of the field component, that is:
2.1 Remove from form.ftl: [code]<input type="hidden" name="field" value="" />[/code]
2.2 In edit mode of your form page, create a text field with "Field Label"=field, and "Field Name"=field
2.3 Since the field gets also assigned an id of value "field" (same as "Field Name" value), we can then hide it in style.css
.form-item-hidden,
.form-wrapper input[type=hidden],
.form-wrapper #field,
.form-wrapper label[for=field] {
display: none;
}
The label[for=field] attribute selector is compatible for IE7 and above, see http://www.quirksmode.org/css/selectors/
Improvement: In my case I add this field manually but this could be done automatically via configuration (generator) I think.
http://documentation.magnolia-cms.com/templates/stk/template-definitions.html#Autogeneratedcomponents
http://wiki.magnolia-cms.com/display/WIKI/Extending+the+stkArticle+template#ExtendingthestkArticletemplate-Addanautogeneratedcomponent
- depends upon
-
MGNLSTK-1201 Css style for form honey pot
- Closed
-
MGNLSTK-1209 Css style for form honey pot
- Closed
- is causing
-
MGNLFORM-275 Skip validation of empty non-mandatory field
- Closed
- is related to
-
MGNLFORM-191 Honeypot feature not installed on update (1.4 branch only)
- Closed
-
MGNLFORM-188 Honeypot feature needs label for screenreaders
- Closed
- relates to
-
MGNLFORM-210 Pluggable Spam detection mechanism for all form technologies (form, PUR, forum, commenting)
- Closed
- to be documented by
-
DOCU-447 New Form Honeypot component
- Closed