This is a useful module that is stopping bad traffic very nicely for the most part, I've only had one spambot that did not fill in the hidden field, must of been parsing the css. I will be moving some sites to D6 in the near future, so I rolled a D6 version in preparation.
Attached is a prospective gotcha tarball for drupal 6.x
The menu and form insert works and the hidden field is there, I stuffed some data from a live site (on D5) in and it displays in the log table.
Unfortunately I cannot test it 'in anger' as I don't have a D6 contact form being abused to test it on, the code is the same as for D5 with a few bellsnwhistles and no more dependency on the spam module.
Hope this helps someone.
| Comment | File | Size | Author |
|---|---|---|---|
| gotcha-6.x-beta.tar_.gz | 6.88 KB | hutch |
Comments
Comment #1
nancydruThanks for the code. Well, I have to jump through Windows hoops to view this patch, so it will be a bit.
I am debating on whether to continue this module with the introduction of Mollom and the delays in Spam. Comments are welcome.
Comment #2
hutch commentedPersonally I'm happy with what gotcha does and have applied the principles on non-drupal contact forms and it has stopped the garbage there as well as a couple of drupal sites.
Mollom is certainly very impressive as I would expect from Dries and is the right tool for for high profile, high activity multi user sites but for the sites I'm dealing with it would be overkill.
I would suggest that gotcha just needs a bit of a cleanup, a couple of added admin settings (the ability to change weight and fieldname) and that would do nicely.
Comment #3
the1gofer commentedAny word on an 6.x implementation?
Comment #4
nancydruFirst I have to upgrade it for Spam V3.
Comment #5
tiendoan commented+1 for upgrade please.
My site is non-English and Mollom doesn't quite work (or is it just me?).
Thank you,
Regards
Comment #6
nancydruI will get to this when I can.
Comment #7
TheresaB-1 commentedHow does effect screen readers? For instance a visually impaired or blind person visits the site using a screen reader. The screen reader still "see" the display:none field as screen readers ignore CSS rules and the person using the screen reader will then fill out the field and thus their submission will erroneously be labeled spam.
I ask because the sites I work on must follow section 508 for accessibility and thus be able to work with screen readers.
Comment #8
mdlueck commented+1 Mollom is cost based. I would rather something free for our NPO clients.
For now I guess I will install Captcha once again...
Comment #9
TheresaB-1 commentedAny response to the accessibility issue?
Comment #10
nancydru@TheresaB: is there some way to mark a field to not be read that would not also be used by a spambot to skip it?
@mdlueck: Sorry. If anyone is willing to fund this, then its priority will go up.
Comment #11
TheresaB-1 commentedNancy, no not by using CSS. As you probably know you can either define a display:none;, which is used for such things as skip navigation to facilitate screen readers not having to constantly repeat a site's navigation before getting to the content of a page, and visibility: hidden;.
There is no way to hide a field, that I know of, so that a screen reader will not "read" it. What you see when you turn off all css on your site is what the screen reader will see and the order it will see it in.
I want to note I so appreciate your efforts in this, in providing a way to help curb the spam bots from making a mess of one's site and for those that do not have to comply with accessibility standards this is a very good way to differentiate between whether a human or bot filled out the form.
Thank you Nancy for all your work with this module.
Comment #12
nancydruDoesn't it have a description that says to skip the field? I can't remember.
Comment #13
TheresaB-1 commentedIf your speaking of a "skip nav" no, just a display:none; is all. Screen readers completely ignore CCS styles.
The only other way to skip anything is the alt tag for images if you do not define an alt tag the screen reader will read the name ofthe image, which not only does not convey any useful information to the person using the screen reader but will be very irritating if the site makes use of graphics for visuals and/or layout. The alt tag is then used to provide a short description which will be read instead of the image name and conveys meaning to the person using the screen reader. If the graphic is only being used for decorative or lay out a empty alt tag will cause the reader to "skip" reading the image all together, such as alt="".
There is no command, that I am aware of that will instruct a screen reader to "skip" an element in the code. I wish there was as it would make my life easier. ;)
Comment #14
mgiffordadding accessibility tag
Comment #15
nancydruSee the note on the project page. I have one site left using this, but as soon as I can, it will be switched to Mollom. If someone wants to take thsi module over, open a "task" issue.
Comment #16
hutch commentedA development version of gotcha for D6 is now in CVS.
Comment #17
hutch commented6.x-1.x-dev is now available under View All Releases
Comment #18
keinstein commentedI don't see Mollom as an replacement for Gotcha. We run a site, where people submit confidential information via web form. To limit the potential risk of disclosure we can't forward the form to any other party than recessary.
An improvement for this module would be a local honeypot page. That can be a hidden Page (preferably the first Link on the page), which contains a link and a formular, which will blacklist the poster immediatly on access. Search engines can be prevented to index the page and to follow the link by setting the robots meta tag to noindex,nofollow.
Comment #19
dbeall commentedI see this is moving to D6.. so this is old news, but the project page asks for comments about using Mollom.
My tiny comment is; Have you looked at text in the e-mail that is received when using Mollom? well, that is why I won't use it. My web site subscribers/users would see that and delete their membership.
Comment #20
hankpalan.com commentedI"m not a big fan of Captcha and forcing my users to fill out a form, but the spam module is hard to configure.
I never had a problem with the Captcha and re-Captcha modules, so I'm not sure why I would use Mollom ever.
This idea is pure genius, until spammers get around it. But until then I will use it with full force.
Is there anyway to integrate this into the comments? I'm only having spam issues with comments.
+1 for continuing this module. Don't give up!
Comment #21
hutch commentedGotcha works on the form_id, it is currently set to work on
contact_mail_page
contact_mail_user
try adding
immediately below
in function gotcha_form_alter() which is circa line 118 in gotcha.module
I just did a quick test, the hidden field appeared in the comment form so it should work ;-)
Comment #22
hankpalan.com commentedIt would seem this would work but for one small problem:
If you have ajax comments installed you get this error:
An error occurred.
And then it hangs.
Looking at line 338:
It is apparent that its trying to submit to the mail page but since this is comment it won't work?
Comment #23
hankpalan.com commentedI opened up a separate issue for the inclusion of comment form for gotcha. #638626: Gotcha for Comments
Comment #24
Ela commentedIs Gotcha for D6 able to catch spam links on contact forms?
From the description page, this is what I understood the module does by hooking into the Spam module.
However, I see that Gotcha for D6 does not require Spam module.
Spamicide module ( http://drupal.org/project/spamicide ) adds a hidden field as well, but I'm looking for an additional solution that would not send messages if they contain spam links and thought that this is what Gotcha does. (?)
Ella
Comment #25
hutch commentedWhat Gotcha for D6 does is add a hidden field to the contact form, if it is filled in the form content is not sent to the email address configured to receive mail for that contact form. It does not attempt to search for spam links or analyse the content in any way.
Comment #26
Ela commentedThank you for your quick answer. I've spent hours trying to find a module that would prevent links from being added to emails.... this was the only one I found, and I guess it only works forD5. Please let me know if I've missed something..
Comment #27
hutch commentedThe problem is getting software to spot a 'good' link from a 'bad' one. My own experiences with Spamassassin (in my role as email server admin) have been that there is a variable rate of False Positives depending on all sorts of factors which have made spam filtering rather unreliable. The simple trick that Gotcha uses works well, very little spam gets through on the dozen or so sites that I use it on and all the 'real' contacts get through.
Of course it is possible for someone to write a smarter spambot that would parse the css so that the bot would 'know' that the hidden field should be left empty but it hasn't happened yet and as the bot operators do not know that their attempts to abuse the contact form are futile I don't think it will either.
Try it, if it works for you you are done, if not try another method.
Comment #28
Ela commentedI'm using Spamicide module ( http://drupal.org/project/spamicide ) which adds a hidden field as well... It has worked for blocking automated submissions. However, I'm not sure if the recent submission on my site was automated.
I use author contact module which adds contact forms on nodes. It would be safe to say that any submission that has a link in it would most likely be a spam, as the forms are used only to contact author about their node.
Having an option to for example block any email submission that contains any links, would work for me.
Hidden field works great for spambot but for non-automated submissions this type of protection (not sending an email if it contains links) would be great.
I'm still searching Drupal, but did not find anything yet that would help. :(
Comment #29
hutch commentedSpamicide looks like a good module, more flexible than Gotcha.
I suspect that the one you have got was manual, probably a pretty rare event, unless it starts happening regularly it shouldn't be a cause for concern. I do see the occasional SEO services peddlar that is manually done, anyone stupid enough to think they can outwit google is stupid enough to send spam by hand ;-)
Comment #30
Ela commented:) Thanks.. I'm giving up for the day, as I searched, and searched, and searched.. What you said made me feel better,... maybe it will not happen often.
Comment #31
mgiffordComment #32
klanahan commentedThis version of Gotcha is not supported anymore. The issue is closed for this reason. Please upgrade to a supported version and feel free to reopen the issue on the new version if applicable.