-
Notifications
You must be signed in to change notification settings - Fork 1.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Spamaway check in signup is skipped #7775
Comments
Thanks for opening your first issue! This space is protected by our Code of Conduct - and we're here to help. |
@jywarren @emilyashley @cesswairimu please review and label if approved. Also if it's valid and available then I would like to give this a shot. |
The relevant code is in |
Hi, I really appreciate this! I think this is relatively low priority because client-side validation is already a step beyond the critical server-side validation system, and replicating server-side systems on client side is a lot of extra code to maintain. Another issue is that there are two anti-bot measures which swap between, the Google ReCaptcha and this emoji-based one, and the logic to switch between is already complex on the server side: I like how you're thinking on this, but I'm hesitant to change the login sequence more than we absolutely have to, it being such a critical system which we can't afford to see fail. If you're looking for a project to work on, however, we could definitely use a lot of help with our Editor project! (as documented here too: https://publiclab.org/w/gsoc-ideas) -- https://github.com/publiclab/PublicLab.Editor/ |
@jywarren Editor was the first PL project I started contributing to. But since there was a generic problem with the dependencies my tests failed and I couldn't proceed much further. Now that it is fixed, you'll definitely find me helping out there too. I've already opened a couple of issues. Thanks! |
Oh wow @Shreyaa-s @shreyaa-sharmaa you had caught this a while back. Must have missed it. I believe @jywarren fixed this on #8467. Closing this. Thanks all |
The last check i.e
spamaway
check is skipped and signup form is validated and accepted even without it though it does show an error during signup. The signup button is enabled even if you don't attempt the last part or attempt it wrong.Here's a representation of the same, the user is logged in despite the error displayed:
I went through the relevant code and the
spamaway
check consists of two parts:1)Firstly it reviews that it is not left empty.
2)Secondly, it checks for the authenticity of human responses.
Ideally, we should check for the first check ie. check that it is not left empty in client-side validation and the second check should be performed after clicking the submit button.
The text was updated successfully, but these errors were encountered: