derhansen / powermail_crshield
Challenge/response spambot protection for TYPO3 ext:powermail
Installs: 1
Dependents: 0
Suggesters: 0
Security: 0
Stars: 0
Watchers: 0
Forks: 0
Open Issues: 0
Type:typo3-cms-extension
Requires
- in2code/powermail: ^12.5
- typo3/cms-core: ^12.4
Replaces
- typo3-ter/powermail-crshield: 1.0.0
README
Challenge/response spam shield for TYPO3 ext:powermail
What is it?
This TYPO3 extension provides a Challenge/response spam shield for TYPO3 ext:powermail to prevent automated form submissions.
How does it work?
Challenge/response spam shield adds a hidden input field to every form generated by the TYPO3 powermail extension. The input field has a precalculated value with a challenge. The included JavaScript will use the challenge to calculate an expected response which will be checked on every form submission. If the expected response is not submitted, validation for the hidden input field is considered as failed and no email will be sent.
To make automatic form submissions harder for spambots with active JavaScript, a configurable delay for the JavaScript response calculation can be defined in the extension settings (default value: 3 seconds).
From a technical point of view, the extension overwrites the powermail partial Misc/HoneyPod.html
and the
template Form/Confirmation.html
. There, the CrFieldViewHelper
viewHelper is used in the overwritten files to
add a hidden input field to the form and includes the required JavaScript file.
Can the protection be bypassed?
Yes, the challenge/response spam shield can be bypassed, if the algorithm used by the extension is implemented to a spambot. This is however unlikely, since the spambot either has to use JavaScript (which I believe most spambots do not) or has to extract the challenge from the parsed HTML and must calculate and submit the response correctly.
Requirements
The extension uses JavaScript to calculate the expected response, so if JavaScript is disabled on client side, form submission will not be possible.
A modern webbrowser is required to run the JavaScript. Internet Explorer < 11 is not supported.
Installation
- Install the extension on your TYPO3 website using composer or the TYPO3 extension manager.
- Add the TypoScript setting "Powermail challenge/response spambot shield" to your TypoScript template.
Configuration
By default, the extension ships TypoScript that adds template/partial overrides (to inject the CR field +
JavaScript) and registers a new spamcheck with the key 9880
.
If you do not override the powermail partial Misc/HoneyPod.html
or the template Form/Confirmation.html
,
the extension will work without any further configuration.
If you however have overwritten one of the mentioned files, you must manually add the CR field ViewHelper and
JavaScript include to your overrides (see shipped Misc/HoneyPod.html
and Form/Confirmation.html
for reference).
Extension settings
The extension has the following extension settings, which can be adjusted if required. The default values should however be fine for most websites.
crJavaScriptDelay
Defines the delay in seconds for the JavaScript response calculation. The default value is 3
seconds.
minimumPageExpirationTime
If the calculated page cache lifetime if very low (e.g. 60 seconds), it may not be possible to fill out a
form before the expiration time for the CR response is reached. This setting defines the minimum amount of
second, the calculated page cache lifetime must have. Default value is 900
seconds.
additionalPageExpirationTime
Defines the amount of seconds, which is added to the calculated page cache lifetime, if the calculated page cache
lifetime is below the defined value in minimumPageExpirationTime
.
obfuscationMethod
Defines the obfuscation method used for the challenge/response calculation. Possible values are:
1
- ROT13 (default value)2
- Reverse String
Logging
To log failed requests, it is possible to use a dedicated logfile like shown below:
$GLOBALS['TYPO3_CONF_VARS']['LOG']['Derhansen']['PowermailCrshield']['writerConfiguration'] = [
\TYPO3\CMS\Core\Log\LogLevel::DEBUG => [
\TYPO3\CMS\Core\Log\Writer\FileWriter::class => [
'logFile' => \TYPO3\CMS\Core\Core\Environment::getVarPath() . '/log/powermail-crshield.log',
]
]
];
Usage in own extensions
The extension provides the service ChallengeResponseService
which can be used to retrieve and validate
the challenge and the expected response. 3rd party extensions can use this service and the included JavaScript
snippet to implement the challenge/response protection in their own forms (e.g. Extbase forms).
Versions
Version | TYPO3 | PHP | Support/Development |
---|---|---|---|
1.x | 12.4 | 8.1 - 8.4 | Features, Bugfixes, Security Updates |
Extensions using the challenge/response algorithm
The following extensions use the challenge/response algorithm:
Thanks for sponsoring
- Thanks to DMS Deutsche Möbelspedition GmbH & Co. KG for supporting my open source work on this extension