magento-hackathon / honeyspam Goto Github PK

Hello,

when I install the honeyspam addon, the customer form stops working.
The report file show the following:

a:5:{i:0;s:89:"Invalid method Hackathon_HoneySpam_Block_Honeypot::quoteEscape(Array
(
    [0] => url
)
)";i:1;s:4363:"#0 /var/www/usr/html/test/app/design/frontend/base/default/template/hackathon/honeyspam/honeypot.phtml(30): Varien_Object->__call('quoteEscape', Array)
#1 /var/www/web8/html/test/app/design/frontend/base/default/template/hackathon/honeyspam/honeypot.phtml(30): Hackathon_HoneySpam_Block_Honeypot->quoteEscape('url')

what does that mean?

thank you in advance.

Hi,

I install extension on my site. It does not worked for me. After submitting the registration form i got the error of "100 router match iterations". I debug the issue and issue is generated for following link of extension code.

Following code generate issue and file is observer.php

$e = new Mage_Core_Controller_Varien_Exception();
$e->prepareForward('index','error','honeyspam');

If have any idea why this issue generated. kindly guide. Thanks in advanced.

I consider changing the hidden filed from “url” to something completely random ie “cxcytg”
This is regarding error message “the form could not be sent because of SPAM detection”, which seems to be caused by password managers and chrome autofill - tools which fill the form for you and the hidden field as well.

Do you think it might help? Has anybody tried it? In case I’d like to make such change is it enough to edit honey spam settings in Magento backend or do I have to edit the code as well?

I would insert a warning bellow the Hidden field name input text box. If someone wants to change the default value url to keep in mind that the new value should not be used in any form on the page. For example, if you set the value to name then the contact form that already has a name value into the form will be considered SPAM.

Here is the warning:

<honeypotName>
    <label>Hidden Field Name</label>
    <comment><![CDATA[<strong style="color:red">Warning!</strong> Please make sure that the new value is not already used in a form on the page (e.g. name, email).]]></comment>
    <frontend_type>text</frontend_type>
    <sort_order>20</sort_order>
    <validate>validate-xml-identifier</validate>
    <show_in_default>1</show_in_default>
    <show_in_website>1</show_in_website>
    <show_in_store>1</show_in_store>
    <depends>
        <enableHoneypotName>1</enableHoneypotName>
    </depends>
</honeypotName>

Here is my system.xml file content with this warning and small changes:

<?xml version="1.0"?>
<!--
/**
 * Magento
 *
 * NOTICE OF LICENSE
 *
 * This source file is subject to the Open Software License (OSL 3.0)
 * that is bundled with this package in the file LICENSE.txt.
 * It is also available through the world-wide-web at this URL:
 * http://opensource.org/licenses/osl-3.0.php
 * If you did not receive a copy of the license and are unable to
 * obtain it through the world-wide-web, please send an email
 * to [email protected] so we can send you a copy immediately.
 *
 * @category  Hackathon
 * @package   Hackathon_HoneySpam
 * @author    Andreas Emer <[email protected]>
 * @author    Fabian Blechschmidt <[email protected]>
 * @author    Sascha Wohlgemuth <[email protected]>
 * @author    Bastian Ike <[email protected]>
 * @author    Peter Ukener <[email protected]>
 * @copyright 2012 Magento Hackathon
 * @license   http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
 * @link      http://www.magento-hackathon.de/
 */
-->
<config>
    <tabs>
        <hackathon translate="label"
                   module="hackathon_honeyspam">
            <label>Hackathon</label>
            <sort_order>100</sort_order>
        </hackathon>
    </tabs>

    <sections>
        <hackathon translate="label"
                   module="hackathon_honeyspam">
            <label>HoneySpam</label>
            <tab>hackathon</tab>
            <frontend_type>text</frontend_type>
            <sort_order>100</sort_order>
            <show_in_default>1</show_in_default>
            <show_in_website>1</show_in_website>
            <show_in_store>1</show_in_store>
            <groups>
                <honeyspam translate="label"
                           module="hackathon_honeyspam">
                    <label>Hackathon HoneySpam</label>
                    <sort_order>10</sort_order>
                    <show_in_default>1</show_in_default>
                    <show_in_website>1</show_in_website>
                    <show_in_store>1</show_in_store>
                    <expanded>1</expanded>
                    <fields>
                        <enableHoneypotName>
                            <label>Enable Honeypot Hidden Field</label>
                            <frontend_type>select</frontend_type>
                            <source_model>adminhtml/system_config_source_yesno</source_model>
                            <sort_order>10</sort_order>
                            <show_in_default>1</show_in_default>
                            <show_in_website>1</show_in_website>
                            <show_in_store>1</show_in_store>
                        </enableHoneypotName>

                        <honeypotName>
                            <label>Hidden Field Name</label>
                            <comment><![CDATA[<strong style="color:red">Warning!</strong> Please make sure that the new value is not already used in a form on the page (e.g. name, email).]]></comment>
                            <frontend_type>text</frontend_type>
                            <sort_order>20</sort_order>
                            <validate>validate-xml-identifier</validate>
                            <show_in_default>1</show_in_default>
                            <show_in_website>1</show_in_website>
                            <show_in_store>1</show_in_store>
                            <depends>
                                <enableHoneypotName>1</enableHoneypotName>
                            </depends>
                        </honeypotName>

                        <enableHoneypotAccountCreateTime>
                            <label>Enable Register Time Check</label>
                            <frontend_type>select</frontend_type>
                            <source_model>adminhtml/system_config_source_yesno</source_model>
                            <sort_order>30</sort_order>
                            <show_in_default>1</show_in_default>
                            <show_in_website>1</show_in_website>
                            <show_in_store>1</show_in_store>
                        </enableHoneypotAccountCreateTime>

                        <honeypotAccountCreateTime>
                            <label>Minimum Time for Registration</label>
                            <comment>Time in seconds.</comment>
                            <frontend_type>text</frontend_type>
                            <validate>validate-digits</validate>
                            <sort_order>40</sort_order>
                            <show_in_default>1</show_in_default>
                            <show_in_website>1</show_in_website>
                            <show_in_store>1</show_in_store>
                            <depends>
                                <enableHoneypotAccountCreateTime>1</enableHoneypotAccountCreateTime>
                            </depends>
                        </honeypotAccountCreateTime>

                        <enableSpamIndexing>
                            <label>Enable Spam Indexing for Input Fields</label>
                            <frontend_type>select</frontend_type>
                            <sort_order>50</sort_order>
                            <show_in_default>1</show_in_default>
                            <show_in_website>1</show_in_website>
                            <show_in_store>1</show_in_store>
                            <source_model>adminhtml/system_config_source_yesno</source_model>
                        </enableSpamIndexing>

                        <spamIndexLevel>
                            <label>Set Maximum Spam Index Trust Level</label>
                            <comment>An index of 2.5 should be enough to block average spam logins. The lower the level, the more spam gets through.</comment>
                            <frontend_type>text</frontend_type>
                            <validate>validate-number</validate>
                            <sort_order>60</sort_order>
                            <show_in_default>1</show_in_default>
                            <show_in_website>1</show_in_website>
                            <show_in_store>1</show_in_store>
                            <depends>
                                <enableSpamIndexing>1</enableSpamIndexing>
                            </depends>
                        </spamIndexLevel>

                        <enableLogging>
                            <label>Enable Honeypot Logging</label>
                            <frontend_type>select</frontend_type>
                            <source_model>adminhtml/system_config_source_yesno</source_model>
                            <sort_order>70</sort_order>
                            <show_in_default>1</show_in_default>
                            <show_in_website>1</show_in_website>
                            <show_in_store>1</show_in_store>
                        </enableLogging>

                        <logfile>
                            <label>Log Filename</label>
                            <comment>Allowed file extensions: log, txt, html, csv.</comment>
                            <frontend_type>text</frontend_type>
                            <validate>required-entry</validate>
                            <sort_order>80</sort_order>
                            <show_in_default>1</show_in_default>
                            <show_in_website>1</show_in_website>
                            <show_in_store>1</show_in_store>
                        </logfile>
                    </fields>
                </honeyspam>
            </groups>
        </hackathon>
    </sections>
</config>

In line 55 of Model/Checker.php, there is this code which I think left out an =.

if ($lastname = $firstname) {

Hi

Thanks for the great work, however after installation doesn't load the hidden input at front end. We have create a custom newsletter phtml form and we load it into static block with the following code
{{block type="newsletter/subscribe" name="newsletter" template="newsletter/subscribe_footer.phtml"}} Also, we put your code into form without any result.

Do you have any idea what we should change to works properly?

Thanks

The last tagged release is from 2015, I think the recent bugfixes are worthy of a new version

Hello guys, i don't know if it's the good place to ask my question (if it's not tell me). I got a problem im new on magento and didn't understand how to setup the code, i copy all the files in my magento application, but i don't understand when you say "Copy the file app/design/frontend/{base_or_rwd}/default/template/contacts/form.phtml to your own theme and insert the code"
//getChildHtml('form_fields_before') ?>
"within the

Are there any experiences in the wild with the module?

I like the approach to not show a CAPTCHA picture very much.

But am I right that if one specific page get's targeted by a spammer, it could easily be circumvented? Are there any measures against that?

I have followed all steps, module is installed, .js is in the code, but <input id="url" isn't appearing within

Currently, the honeypot is hidden via $('url').hide();. The issue is that the honeypot has an ID, which has to be unique by definition. Currently, if there are two honepots on one page (e.g. one newsletter registration form in the footer and the normal customer/account/create form), the second honeypot field is not hidden, because it is not catched by the expression $('url'). I would suggest deleting the ID of the honeypot form field and add a class mhhs-url (Magento Hackathon Honey Spam URL) :D Then we should update the JS (after #18 has been merged) to $$('.mhhs-url').each(Element.hide); and we should be good.

What do you think? I am happy to provide a PR if you like the idea.

hi guys yesterday i installed this extension and i love the idea, problem is that for me still a lot of spam accounts get created, any idea what i can do? everything looks setup correctly insee die mhhs url in the hrml.

In order to generate a SPAM event in frontend fill up honeyspam input text box with a value and an email address. Check the URL of the page after redirection. The extension redirects to /newsletter/subscriber/new instead of /honeyspam/error. I got the same results testing with Magento 1.9.2.4, 1.3,9.10, 1.9.4.5 and OpenMage 20.0.4.

This issue is coming from prepareForward method used in Observer.php file. Here is one example:

    /**
     * validate honeypot field
     * @throws Mage_Core_Controller_Varien_Exception
     */
    protected function _checkHoneypot()
    {
        /* @var Hackathon_HoneySpam_Helper_Data $helper */
        $helper = Mage::helper('hackathon_honeyspam');
        if (strlen(Mage::app()->getRequest()->getParam($helper->getHoneypotName()))) {
            $helper->log('Honeypot Input filled. Aborted.', Zend_Log::WARN);

	    $e = new Mage_Core_Controller_Varien_Exception();
            $e->prepareForward('index', 'error', 'honeyspam');
            throw $e;
        }
    }

I did a change in the code as follows in order to get honeyspam URL:

    /**
     * validate honeypot field
     * @throws Mage_Core_Controller_Varien_Exception
     */
    protected function _checkHoneypot()
    {
        /* @var Hackathon_HoneySpam_Helper_Data $helper */
        $helper = Mage::helper('hackathon_honeyspam');
        if (strlen(Mage::app()->getRequest()->getParam($helper->getHoneypotName()))) {
            $helper->log('Honeypot Input filled. Aborted.', Zend_Log::WARN);

	    /*$e = new Mage_Core_Controller_Varien_Exception();
            $e->prepareForward('index', 'error', 'honeyspam');
            throw $e;*/

            $newURL = rtrim(Mage::getBaseUrl(), '/') . strtolower('/honeyspam/error');
             Mage::app()->getFrontController()->getResponse()->setRedirect($newURL);
            Mage::app()->getResponse()->sendResponse();
            exit;
        }
    }

Any thougths?

The documentation doesn't give any details on which versions of Magento this works with. I couldn't find this information in any release notes either.

Hi all, this looks like a great plugin. I am trying to get it to load on a product page which uses tabs for a contact form. (Reference the Q&A tab near the middle of http://optechusa.com/straps/utility-strap-sling.html)

On my local environment I was able to get the JavaScript include to load by adding the following before the closing tag:

<!--app/design/frontend/base/default/layout/honeyspam.xml-->
<catalog_product_view>
    <update handle="honeypot"/>
    <reference name="contactForm">
        <block type="core/text_list" name="contacts.form.fields.before" as="form_fields_before" translate="label">
            <block type="hackathon_honeyspam/honeypot" name="honeyspam.honeypot"
                   template="hackathon/honeyspam/honeypot.phtml"/>
        </block>
    </reference>
</catalog_product_view>

However the honeypot input isn't showing up. I've tried to do a bit of research on block type and the name, but still can't figure it out. Could anyone point me in a direction that might help in implementing this? Thank you!

Hello,

Thanks for your time, I have installed this and after flushing cache in admin panel going to system configuration I am presented with error:
Fatal error: Class 'Hackathon_HoneySpam_Helper_Data' not found in /var/www/httpdocs/app/Mage.php on line 547

Also, the site has a timed popup email sign up form, the homepage has a signup in footer...
will this also place protection on the pop up sign up?
Magento ver. 1.9.2.2
using magento default newsletter signup

Have a Magento CE1.9.2.4 e-commerce website.
Have installed the program and made edits for newsletter signup, however false signups continue.
Any suggestions?
Thank you.

Could do with the ability to switch off inline css for those that want display:none in an external css file.

Using this command in Terminal I am able to add as many email addresses as I want into the database:

curl 'https://www.mydomain.com/newsletter/subscriber/new' --data '[email protected]'

The same thing is happening for creating new customer account using more data fields.

If I have the bad inspiration to set the options in Backend to confirm a subscription or an account Magento becomes a spammer. With Fail2Ban we catch daily around 60 new IP addresses based on a Regex filter. This is how the webserver log looks for such of requests:

"GET /customer/account/create/ HTTP/1.1" 200 82432 "-" "-"
"POST /newsletter/subscriber/new/ HTTP/1.1" 302 3874 "-" "-"

I gave it a try to this extension but I did not get any positive results. I am still able to use curl command without any issue. As I understand you are using a hidden input field in the forms but what happens if the controller is used directly based on the URL? Or maybe I am doing something wrong?

I noticed a mistake in the description of the backend config value "Set max. spam index trust level":

"An index of 2.5 should be enough to block average spam logins The lower the level, the higher the level, the more spam gets through"

What is true?

I am a big fan of this extension, however I have a slight issue. Whereby, when the HoneySpam field is filled it will redirect you to the page such as customer/account/createpost/ on the register page.

What I would like is for it to rather than redirect me there is it possible to keep them on the same page and just show the error as a normal magento error message?

Legit signups are detected as spam b/c getAccountCreateTime (when not yet logged in) returns an empty result. (Magento 1.9.3 CE). I did deactivate the timestamp for the time being - but still: did anyone also encounter the problem and poss. have a solution? Thanks a lot!

I have installed the extension successfully on a Magento 1.9 site. Pages of this site have, on average, 2 forms for newsletter subscription (left column + footer).

But the hidden field is added only to one of them.

At the following URL you can see 3 newsletter subscription forms (left column + body + footer), still the hidden field is added only to the first form created:
http://www.sanditlibri.it/newsletter

Is this a known problem? Any way to work around it?

Best,

Alessandro

Is it possible to add input field to other forms too? I have couple of contact and request contact -forms in the Magento eshop and spam is problem on those. HoneySpam Readme says only that input field is added in the Customer Register and in the Product Review Form. How to add it to my custom forms?

I was getting a 404 when trying to get into the admin section of the module until I added the 'hackathon_honeyspam/honeypot' to the list of allowed blocks (system-> permissions-> blocks). Once that was in place, i cleared the cache and the sessions and i was able to get into the admin page. Might be nice to toss that info into the setup instructions.

Thanks for the great module!

I have made the hidden field appear in all forms except the newsletter.

The newsletter is shown on the page through footer.phtml with this command: getChildHtml('footer.newsletter') ?>

I copied the file subscribe.phtml in my theme and added the code getChildHtml('form_fields_before')?> inside the form, but the hidden field does not appear: https://desarrollopapelstore.factoriadigitalpremium.es

This same action I have done for the contact page and it works correctly: https://desarrollopapelstore.factoriadigitalpremium.es/contacts/

My version is 1.9.3.10 with all security patches installed. Is there a bug related to this?

Hi guys, I'd want to add HoneySpan on checkout page. Could you help me? Thank you.

Any plans to make a version for Magento 2?

A small inoffensive change in etc/config.xml:

    <modules>
        <Hackathon_HoneySpam>
            <version>1.4.0</version>
        </Hackathon_HoneySpam>
    </modules>

I am pretty annoyed by all the system.log entries I get due to this extension. I would like to either remove or at least comment the Mage::log calls, so that the system.log is not filled with unimportant data. I am fine with implementing it and sending a pull request, but please give me your opinion first. Options:

1. Please keep the logging as it is.
2. Please completely remove the Mage::log calls.
3. Please keep the Mage::log calls, but add a line comment to it.

I vote for option 2.

/cc @Schrank

using a custom template on x-sol.dk using a pop-out contact form. Kontaktformular. How can i put honeyspam in that form? I have added getChildHtml('form_fields_before') ?>
but it does not add the extra form field..

I can't get the hidden input field inside the contact form. I have made sure that the block name is contactForm and I'm including echo $this->getChildHtml('form_fields_before'); right after the opening form tag.

Could it possibly have something to do with the fact that I'm using store codes, which means that the form action URL becomes: website.com/en/contacts/index/post/. Just a thought, since I can't get it to work.

Hi,

any thoughts on supporting the newsletter field too?

I have installed the module and cleaned cache as instructed. I get the option in config and can see that the js file is being loaded, however - there is no hidden 'url' field.

May I ask you what this option is doing "Enable spam indexing for input fields"?

Hi,
I installed honeyspam and i have input field "url" in contact form and signup, but I don't resolve spam.
But I think: input field hidden via js it's ok, but should be a required field. Right?

This is related to Newsletter subscription. How to simulate this issue:

1. In your browser inspect the code and find the input box with class named mhhs-input. Uncheck display: none and the input box will be visible in frontend.

2. Fill up both input boxes and click the button.

Now the URL is https://mydomain.tld/newsletter/subscriber/new/ and you will see the error message "The form could not be sent because of SPAM detection!".

In this page fill up the input box with an email address and press the button. The page is not loading and appears broken with an ERR_TOO_MANY_REQUESTS message.

Please note if I reload the page I will get the same error. If I open a new tab and access directly https://mydomain.tld/newsletter/subscriber/new/ I get the home page without any message which is a normal behavior. In webserver log there is not error related to this issue. Not even in PHP log.

Using this in the Newsletter subscription will cause the error:

[DOM] Found 2 elements with non-unique id #url error

Therefore, wouldn't it be appropriate to remove the id declaration?

It is not being used anywhere, and would help prevent his error!

Hello,

we use this extension with success for years now.
But would be good to have it in the form for Newsletter-Subcription (e.g. in thee footer).
Yesterday we had a bot putting in hundreds of addresses in the form, again.

After copying files over to Test server, the admin section has a 404 error. What are the possibilities of mistakes that i should check. The Added field is not working either.

I implemented all the things mentioned in this link https://github.com/magento-hackathon/HoneySpam
but still I never see any hidden field in the form.I am using magento version 1.9 is there any compatibility to the particular version.Please advice

Hi,

Installed the extention but it does not appear to work. It does not load the hidden inputs nor does it load the javasript file. I'm on magento 1.6.2.0
Cache and compiler are off.

I just copied the files in the root nothing special. The xml is active and in the magento settings it is enabled.

What am I missing?

Hello. We installed this extension but on website we still have bots. Please see screenshot attached.
Can you please help us to configure it so we don't have bots anymore?

Thanks in advanced,

Regards,
Dusan

We are integrating your extension and so far everything works fine.
Thank you for that extension.

But I wonder why you always throw an exception when the honeypot check fails.
Ok we are fighting bots, but what happens if the bot "creator" is waiting for an response status code?

Hi,
We're using mage_persistent for our customer account creation. Is there an easy way to configure this to work for that?

XXX/XXX/template/PERSISTENT/customer/form/register.phtml

Thank you for your efforts on this module. As others have said, HoneyPot modules are few for Magento, and yours seems to work very well so far.
I have one issue that I'm hoping you can help with. Looking through honeyspam.log, I see a LOT of legitimate entries that are being flagged as Spam because they have "3 or more consecutive consonants". This is actually a fairly common occurrence in names (especially when "Y" is considered a consonant). Is there some code I can change to increase that rule to 4 consonants and/or add "Y" as a vowel?
Thanks again for your help. I understand this is a non-supported module, so I'd like to do as much of the work myself as possible (even though I am definitely not a software engineer).

Hello, do you plan to develop a solution for magento 2?
Or do you know a good alternative?

Hii Team,

In Contacts Us Form this Extension not Working.Is it Possiblt to working in Contact Form and Newsletter.??

Hello,
I use HoneySpam on website https://dentaldirect.co.uk/. When some customers try to open an account the error occurs. Error message “the form could not be sent because of SPAM detection”. It happens rarely and without any logic. Any suggestions what is the possible reason?

Here are the steps to reproduce this issue:

1. Go to backend and change "Enable Hidden Honeypot Field" from Yes to No.

2. Visit the URL /customer/account/create/ and look into the source code. The input text box related to honeypot is still there.

At first glance it seems that regardless of the chosen value in backend, this field will appear in the source code.