Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Spamaway check in signup is skipped #7775

Closed
shreyaa-s-zz opened this issue Apr 1, 2020 · 6 comments
Closed

Spamaway check in signup is skipped #7775

shreyaa-s-zz opened this issue Apr 1, 2020 · 6 comments
Labels

Comments

@shreyaa-s-zz
Copy link
Collaborator

The last check i.e spamaway check is skipped and signup form is validated and accepted even without it though it does show an error during signup. The signup button is enabled even if you don't attempt the last part or attempt it wrong.
Here's a representation of the same, the user is logged in despite the error displayed:

signup

I went through the relevant code and the spamaway check consists of two parts:
1)Firstly it reviews that it is not left empty.
2)Secondly, it checks for the authenticity of human responses.

Ideally, we should check for the first check ie. check that it is not left empty in client-side validation and the second check should be performed after clicking the submit button.

@welcome
Copy link

welcome bot commented Apr 1, 2020

Thanks for opening your first issue! This space is protected by our Code of Conduct - and we're here to help.
Please follow the issue template to help us help you 👍🎉😄
If you have screenshots or a gif to share demonstrating the issue, that's really helpful! 📸
Do join our Gitter channel for some brainstorming discussions.

@shreyaa-s-zz
Copy link
Collaborator Author

@jywarren @emilyashley @cesswairimu please review and label if approved. Also if it's valid and available then I would like to give this a shot.

@shreyaa-s-zz
Copy link
Collaborator Author

The relevant code is in app/models/spamaway.rb I believe.

@jywarren
Copy link
Member

jywarren commented Apr 7, 2020

Hi, I really appreciate this!

I think this is relatively low priority because client-side validation is already a step beyond the critical server-side validation system, and replicating server-side systems on client side is a lot of extra code to maintain. Another issue is that there are two anti-bot measures which swap between, the Google ReCaptcha and this emoji-based one, and the logic to switch between is already complex on the server side:

image

I like how you're thinking on this, but I'm hesitant to change the login sequence more than we absolutely have to, it being such a critical system which we can't afford to see fail. If you're looking for a project to work on, however, we could definitely use a lot of help with our Editor project! (as documented here too: https://publiclab.org/w/gsoc-ideas) -- https://github.com/publiclab/PublicLab.Editor/

@shreyaa-s-zz
Copy link
Collaborator Author

@jywarren Editor was the first PL project I started contributing to. But since there was a generic problem with the dependencies my tests failed and I couldn't proceed much further. Now that it is fixed, you'll definitely find me helping out there too. I've already opened a couple of issues. Thanks!

@stale stale bot added the stale label Oct 7, 2020
@cesswairimu
Copy link
Collaborator

Oh wow @Shreyaa-s @shreyaa-sharmaa you had caught this a while back. Must have missed it. I believe @jywarren fixed this on #8467. Closing this. Thanks all

@publiclab publiclab deleted a comment from stale bot Oct 8, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants