Dropping hard-coded style="display:none" in favor of custom class#56
Draft
ThomasLandauer wants to merge 1 commit into
Draft
Dropping hard-coded style="display:none" in favor of custom class#56ThomasLandauer wants to merge 1 commit into
style="display:none" in favor of custom class#56ThomasLandauer wants to merge 1 commit into
Conversation
…ble `class`
Right now, the `HoneypotType` has `style="display:none"` hard-coded. Don't you think that this is really easy to detect for spambots?
So my idea would be to use a CSS `class` for that, with a name chosen by the user. So I'd add something like this to the recipe:
```yaml
attributes:
class: 'noShow' # change this to some other name to make it harder to detect for spambots
```
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #56 +/- ##
===========================================
Coverage 100.00% 100.00%
Complexity 203 203
===========================================
Files 26 26
Lines 590 590
===========================================
Hits 590 590 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Member
|
I don't mind having a config option for it, but in my experience the current mechanism works fine. Hidden fields, either through `type="hidden" or CSS, are used all the time for valid reasons like remembering context for contact forms, return URLs, CSRF fields et al. So specifically a spambot has to be really smart to realize that this specific element should be left empty, while the CSRF tokens and redirect URLs should not. I'll merge the PR if done right as there is added value, but limited. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Right now, the
HoneypotTypehasstyle="display:none"hard-coded. Don't you think that this is really easy to detect for spambots?So my idea would be to use a CSS
classfor that, with a name chosen by the user. So I'd add something like this to the recipe:What do you think?