fix: add honeypot support for an input comment field - #852
Open
faisalahammad wants to merge 3 commits into
Open
Conversation
- Use the core is-dismissible close button and drop the hand-rolled one.
- Keep i18n one translatable string per message.
- Persist dismissal keyed to PR PLUGIN_VERSION so it returns on newer builds.
- Fold is_pre_release into PreReleaseNotice and allow build metadata.
- Deny without capability via wp_send_json_error(403) or wp_die('', 403).
- Rename the dismiss script to pre-release-notice.js and persist on X clicks.
Add an input case to the honeypot renderer so themes that output the comment field as a text input get a working honeypot. The visible input keeps its id and gets an obfuscated name, and a hidden duplicate with the comment name is appended as the bait, matching how the textarea case works. Fixes pluginkollektiv#738
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add honeypot support for themes that render the comment field as a text
<input>instead of a<textarea>. Previously the honeypot renderer only handled a textarea, so an input-based comment form got no honeypot at all. The plugin now injects a honeypot that matches the field type automatically, with no new setting.Fixes #738
Changes
src/Helpers/Honeypot.php
Add an
inputcase to theswitchininject().For a textarea form nothing changes. For an input form, the visible input keeps its id and class but gets an obfuscated name, and a hidden duplicate input that carries
name="comment"is appended right after it as the bait. That mirrors how the textarea case traps the honeypot, so the existing check side of the rule keeps working unchanged.Why: themes that output the comment field as
<input type="text">had no honeypot, so honeypot-dependent spam protection was silently missing on those sites.Testing
Test 1: Textarea form regression
<textarea name="comment" id="comment">in place.Result: unchanged behavior from before this fix.
Test 2: Input form
<input type="text" id="comment" name="comment" class="comment-field">.name="comment"is inserted after it.Result: input-based comment forms now have a working honeypot.
Test 3: Prefixed fields
<input id="comment-extra" name="comment-extra">before the real comment field.comment-extrais left untouched.Result: prefixed fields are not mistaken for the comment field.
Screenshot