Index: mollom.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/mollom/mollom.module,v
retrieving revision 1.2.2.173
diff -u -p -r1.2.2.173 mollom.module
--- mollom.module	6 Oct 2010 23:55:31 -0000	1.2.2.173
+++ mollom.module	15 Oct 2010 13:01:41 -0000
@@ -666,7 +666,12 @@ function mollom_form_alter(&$form, &$for
       $form['#validate'][] = 'mollom_validate_analysis';
       $form['#validate'][] = 'mollom_validate_captcha';
 
-      // Add a submit handler to remove form state storage.
+      // Add a submit handler to clean up internal Mollom values from
+      // $form_state['values'].
+      array_unshift($form['#submit'], 'mollom_form_pre_submit');
+      // Add a submit handler to store Mollom data. This handler requires the
+      // primary submit handler for entities to have run already, so an optional
+      // post_id mapping can be retrieved from $form_state['values'].
       $form['#submit'][] = 'mollom_form_submit';
 
       // Add link to privacy policy on forms protected via textual analysis,
@@ -1111,6 +1116,12 @@ function mollom_form_get_values($form_va
   // User IP.
   $data['author_ip'] = ip_address();
 
+  // Honeypot.
+  // Capture and send the actually submitted value, so Mollom can evaluate it.
+  if (isset($form_values['mollom']['homepage']) && $form_values['mollom']['homepage'] !== '') {
+    $data['honeypot'] = $form_values['mollom']['homepage'];
+  }
+
   return $data;
 }
 
@@ -1379,6 +1390,17 @@ function mollom_process_mollom($element,
     '#description' => t("Type the characters you see in the picture above; if you can't read them, submit the form and a new image will be generated. Not case sensitive."),
   );
 
+  // Add a spambot trap. Purposively use 'homepage' as field name.
+  // @todo Ideally, we'd additionally add some kind of randomization to make it
+  //   harder to identify this trap.
+  $element['homepage'] = array(
+    '#type' => 'textfield',
+    '#attributes' => array(
+      'title' => t('Leave blank, used to catch spammers'),
+      'style' => 'display: none;',
+    ),
+  );
+
   // Make Mollom form and session information available to #pre_render callback.
   // This must be assigned by reference. It is the essential "communication
   // layer" between form API and the rendering system. Any modifications to
@@ -1567,8 +1589,13 @@ function mollom_validate_captcha(&$form,
     'session_id' => $form_state['mollom']['response']['session_id'],
     'captcha_result' => $form_state['values']['mollom']['captcha'],
     'author_ip' => $all_data['author_ip'],
-    'author_id' => isset($all_data['author_id']) ? $all_data['author_id'] : NULL,
   );
+  if (isset($all_data['author_id'])) {
+    $data['author_id'] = $all_data['author_id'];
+  }
+  if (isset($all_data['honeypot'])) {
+    $data['honeypot'] = $all_data['honeypot'];
+  }
   $result = mollom('mollom.checkCaptcha', $data);
   // Use all available data properties for log messages below.
   $data += $all_data;
@@ -1676,6 +1703,26 @@ function mollom_pre_render_mollom($eleme
 }
 
 /**
+ * Form submit handler to clean up internal Mollom values from $form_state['values'].
+ *
+ * Various forms happen to blatantly take over $form_state['values'] and save
+ * that into the database. This form submit handler is prepended to the stack of
+ * $form['#submit'] handlers of protected forms to remove all of Mollom's
+ * additional values to prevent them from being mistakenly stored elsewhere.
+ *
+ * @see http://drupal.org/node/939510
+ */
+function mollom_form_pre_submit($form, &$form_state) {
+  // Some modules are implementing multi-step forms without separate form
+  // submit handlers. In case we reach here and the form will be rebuilt, we
+  // need to defer our submit handling until final submission.
+  if (!empty($form_state['rebuild'])) {
+    return;
+  }
+  unset($form_state['values']['mollom']);
+}
+
+/**
  * Form submit handler to flush Mollom session and form information from cache.
  */
 function mollom_form_submit($form, &$form_state) {
@@ -1685,6 +1732,7 @@ function mollom_form_submit($form, &$for
   if (!empty($form_state['rebuild'])) {
     return;
   }
+  dsm($form_state['values']);
   // If an 'entity' and a 'post_id' mapping was provided via
   // hook_mollom_form_info(), try to automatically store Mollom session data.
   if (!empty($form_state['mollom']['entity']) && isset($form_state['mollom']['mapping']['post_id'])) {
Index: tests/mollom.test
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/mollom/tests/mollom.test,v
retrieving revision 1.1.2.64
diff -u -p -r1.1.2.64 mollom.test
--- tests/mollom.test	6 Oct 2010 23:55:31 -0000	1.1.2.64
+++ tests/mollom.test	15 Oct 2010 12:42:28 -0000
@@ -2363,7 +2363,7 @@ class MollomDataTestCase extends MollomW
 
     // Verify that submitted data equals post data.
     $data = $this->getServerRecord('mollom.checkCaptcha');
-    $this->assertSame('author_id', $data['author_id'], NULL);
+    $this->assertFalse(isset($data['author_id']), t('author_id: Undefined.'));
 
     // Log in admin user and edit comment containing spam.
     $this->resetServerRecords();