Hi all, is there a possibility to add a honeypot fiedl to a form without having installed the form builder?
I found the package dl/honeypotformfield from @daniellienert which needs the form builder as I understand.
I also found a forums post (Captcha in the Neos.Form-Builder) whre @bwaidelich describes a possibility. But due to lack of knowledge I don’t understand if this soultion works without the form builder package and if, how it should be worked out.
A simple solution without a finisher would suit my needs, e.g. just an invisible honeypot field which is validated to null.
I thought that because in the package description the form builder is suggested and in the github code e.g. in the file NodeTypes.Finishers.SpamDetection.yaml the supertype Neos.Form.Builder:AbstractFinisher is used (in other files also supertypes of the from builder package are used).
I thought maybe it would be easily possible to achieve the aims by somehow validating the honeypotfield to null and therefore submitting the form is not possible when it is not null.
This is not necessary as I could find out. It functions like I thought a lightweight solution could work.
I wrote a custom validator which adds an error if the field is not empty. Then I added a Neos.Form:SingleLineText field to the form with the custom validator and an additional honeypot property. An extension to the fluid field template adds a class to the field group if the honeypot property is set (e.g. for making it invisible).
That’s all. For a human nothing changes but a bot will not be able to send the form because the honeypot field is filled. That’s fine for me and without too much overload.
Thanks a lot for getting back and thoroughly explaining your solution.
You’re right, that should work just fine. The only “drawback” of that solution might be that you can’t easily log blocked requests but that might not be a requirement of yours – and even if it was it should be possible to implement that via a custom form element implementation.