My drupal 5 website is translated into Dutch by the localisation module.
I installed the Gotcha module today and did send an e-mail by the contact page, using about 10 identical links to a website in the real subject-block.
To my surprise the e-mail was send without any complaint.

I found the problem:
In function gotcha_form_alter you use: '#title' => t('Subject').

In function gotcha_contact_submit you use: $subject = check_plain($form_values['Subject']);
I altered it into:
$subjct = t('Subject');
$subject = check_plain($form_values[$subjct]);
Maybe there is a shorter PHP-way, but it works now.

I have a request:
in function gotcha_form_alter I tried to add a new case: 'contact-mail-user'. But it looks that this form can't be altered. Do you have a solution?

Thanks for a nice module. I hope it works as great as you promise.

Comments

promes’s picture

Update:
Maybe other $form_values-fields should be translated back into English before using the content of the form-field.

PROMES

promes’s picture

I almost forgot another problem:
the creation of the 'Gotcha: Go Away!' page doesn't set the page as published. So some users may not be aware of it and instead of the no-spam please page the spammer gets a not found error.

PROMES

nancydru’s picture

#2 is fixed in the next module build cycle.

Please do not post multiple problems in one issue. They need to be separate.

nancydru’s picture

in function gotcha_form_alter I tried to add a new case: 'contact-mail-user'. But it looks that this form can't be altered. Do you have a solution?

I stuck case 'contact-mail-user': right after the current case statement and it caught my email; I also see that it generated the hidden field. It does not, however, pick up the correct form fields. That would require additional work, which I may get to later - please open this as a feature request.

nancydru’s picture

Status: Active » Postponed (maintainer needs more info)

...translated into Dutch... send an e-mail by the contact page, using about 10 identical links... in the real subject... To my surprise the e-mail was send without any complaint.

Hmm, the code you reference is the title of the subject field, not the subject field itself. The field handling code is almost verbatim from the Contact module. I suspect it passed because the check_plain removes the stuff that would make the Spam filter recognize it as a URL (I think). I have to think about this for a while. I planned on people doing URLs in the body, but not the subject (and I suspect the Contact developers had the same mind-set). Possibly I'd have to make a separate filter call just to scan the subject before doing a check_plain. I think the same oversight probably also exists for the sender's name and email address as well. Hmm...

nancydru’s picture

...translated into Dutch... send an e-mail by the contact page, using about 10 identical links... in the real subject... To my surprise the e-mail was send without any complaint.

Hmm, the code you reference is the title of the subject field, not the subject field itself. The field handling code is almost verbatim from the Contact module. I suspect it passed because the check_plain removes the stuff that would make the Spam filter recognize it as a URL (I think). I have to think about this for a while. I planned on people doing URLs in the body, but not the subject (and I suspect the Contact developers had the same mind-set). Possibly I'd have to make a separate filter call just to scan the subject before doing a check_plain. I think the same oversight probably also exists for the sender's name and email address as well. Hmm...

promes’s picture

Hello Nancy,

Maybe the problem is caused because you add a second field with a Subject title to the form?

PROMES

nancydru’s picture

You cannot have two form fields with the same name (which is not the same as a title). The "#title" for a field is merely a text label that is placed before the input area. So yes, I have two fields with the same label, but there is really only one "Subject" field. The first one is actually called "Private Message" and it should be hidden from view. You should not have been able to enter anything in that field. Had you done so, the message would have immediately been called spam. I have caught several spam bots this way.

I do a little bit of extra processing up front, but otherwise the code is the same as the contact module. What you've told me is that I probably need to do a bit more on the (real) subject field or at least move the check_plain until after it goes through the spam filter. I'm still mulling this over.

Other than that, I think all your other requests are taken care of.

promes’s picture

Status: Postponed (maintainer needs more info) » Closed (fixed)

Nancy,

I owe you an apology. I did test also with your version 1.2 2007/10/22 and concluded my previous tests were not correct. The module works correct. The problem with the $subject is non-existing.
I will close this bug report.

Thanks for a perfect module, it cought already a lot of spam from my wifes website.