Inline comment form blocked by ObscureURL recipe

Hello, salvis, glad to see you!

BOTCHA is proving to be very effective, and I really like your recent changes -- thank you!

Pleased to hear.

I'm attaching one full log entry.

That's a good idea, it will help a lot to fix. Though I don't have much time to fix this issue (since I am working on #1849182: [META] Add Selenium tests for JavaScript recipes full test coverage), your bugreports are welcome (as usual). So are patches.
#1867180: ObscureUrl Recipe breaks in IE7 on node add form looks like related to this issue, since it also reports ObscureUrl recipe as broken.

Removing the ObscureUrl recipe has fixed the issue, but the comment form is such a common form that BOTCHA should probably handle it correctly without additional configuration.

You are absolutely, completely, totally right!:) The feature of per recipe turning on/off was added to let the module work stable while fixing recipe - an user has just to turn broken recipe off and that's it.

I'm also seeing the obscure_url recipe not working in comment forms. I had to disable it even in the case of using an authenticated user with Skip CAPTCHA permission, and giving the form tons of time before submitting.

Before I started a new bug report, I wonder if this is the same issue. I've tried from both FF17 and IE9 on a Win7 box. BOTCHA is 7.x-2.0.

Attached is a log (removed all identifying info).

I had the same problem here. A friend just reported that he was unable to comment as an anonymous user, getting the same "You must be a human, not a spam bot..." message; I tried myself to comment as an anonymous user, and got the same. Having googled and read this issue, I replaced the Default book with a new one without ObscureUrl, and now anonymous comments do get through.

Disabling ObscureUrl does not help. I uninstall botcha in favor of BlockAnonymousLinks module. It works great.

Disabling ObscureUrl does not help. I uninstall botcha in favor of BlockAnonymousLinks module. It works great.

Maybe that other module works great; however, AFAIU, it does not block registration attempts from spambots. (Maybe you do not get a lot of those, but my mailbox was flooded every day when I had nothing like BOTCHA to protect me.)

Maybe that other module works great; however, AFAIU, it does not block registration attempts from spambots. (Maybe you do not get a lot of those, but my mailbox was flooded every day when I had nothing like BOTCHA to protect me.)

The obscure_url recipe not working was not a big deal. I had to find an alternative due to BOTCHA not playing well with other AJAX elements (reCAPTCHA and Syntax Highlighter for myself), although I really did like its recipe idea. You may want to try the Spambot module for user registrations as it queries the Stopforumspam database. I use that now in combination with Honeypot for form protection.

Tagged "ObscureURL"

It looks like the issue might be fixed by handling the comment form id special case in ObscureURL.

I'm closing this issue. If problem remains in 7.x-3, please reopen.

Another subscriber here. Same problem, same solution (remove ObscureURL test from default recipe).

I dont understand how this issue was tagged, and closed at the same time... It seems desirable that any potential fix in the 3.x version should be backported to the 2.x version, to make it at least work out of the box, no?

UPDATE: just realized, it actually wasn't closed, even though the previous comment said it was ;)

There was a commit that should address the issue, hence it should have been set to "fixed". It just fell off before my last comment submission.

7.x-2.x is not a branch that receives much attention, but the fix was backported and comitted.

There was a commit that should address the issue, hence it should have been set to "fixed". It just fell off before my last comment submission.

7.x-2.x is not a branch that receives much attention, but the fix was backported and comitted to -dev.

This is not fixed yet. I've found a case where the form still fails:

1) Content type with comment form inline.
2) Submit the form, in such a way that it triggers a validation error. You can do this by adding a comment as an anonymous visitor and specifying an invalid email address. Or if you don't require the email address field enabled on your comment form, you can also trigger the invalid form, by specifying a Name field of an existing user on the site, eg "admin".
3) The validation error causes the page to reload at /comment/reply/X?dbbd_name=[sometoken]_form
4) Change the invalid data, and resubmit the form.
5) Boom. you get the error message: "You must be a human, not a spam bot, to submit forms on this website.".

Looking in the logs, it is still the ObscureURL that triggers this error message.

The only workaround is still to disable the ObscureURL check.

It is not specific to a comment form. Duplicate of #1926150: Resubmitting a failed form always fails with ObscureUrl enabled.

Moved my post to the appropriate topic mentioned above.