Add / Edit - Githubissues

sethjohnson1 / conflist5

Conflist cakePHP5

1 stars 0 forks source link

Add / Edit #6

Closed sethjohnson1 closed 1 month ago

sethjohnson1 commented 4 months ago

[x] CuratorCookie
[ ] Recaptcha - do you still want to use the v2? We could also look into invisible recaptcha 3 (lets Google slurp the data) or a HoneyPot (hidden field that if completed entry gets trashed. Spambots fill them out)
[x] Test basic add/edit functions, should mostly be working

nilesjohnson commented 4 months ago

Honeypot option seems fine for starters; we can add captcha if there are problems.

If I'm remembering correctly, the curator cookie does two things:

bypass the captcha
automatically show edit/delete links on the view page for each conference

So, the first one wouldn't be needed unless/until we implement a captcha, but the second one is still useful.

nilesjohnson commented 2 months ago

I did some simple add/edit tests and they were fine. I also removed the cookie/recaptcha part. So, we just need that honeypot thing.

We'll also need to get email working; that's probably best as a separate issue.

sethjohnson1 commented 2 months ago

Opened #13
What do you think of this one? They just used a checkbox, perhaps to make it more difficult for autocomplete to accidentally fill it (causing false flag) https://stackoverflow.com/questions/36227376/better-honeypot-implementation-form-anti-spam

nilesjohnson commented 2 months ago

ha ha, I looked at that same SO post yesterday. There is some discussion in the comments (two years after the OP + update) suggesting that a text input is more effective than a checkbox, and ways to avoid autocomplete with intentionally invalid settings. But, how about we start with a checkbox and worry more if it actually becomes a problem?

I'm not sure how to actually set this up; some kind of extra form element plus a check in the controller I guess. If you have ideas, go for it, or I'll figure it out later when I have a chance.

sethjohnson1 commented 2 months ago

Seems to be working, I guess time will tell if it tricks the Spammers. We could also save the entries and just flag as Spam - if you're worried about somehow blackholing valid entries,

nilesjohnson commented 2 months ago

Looks good to me! Instead of saving all the data, I added a very simple log message. I'll check every month or so for a while to see how often it's really happening. This will still trigger when debug mode is turned off, right?

nilesjohnson commented 1 month ago

seems good; closing!