nucleos/antispam-bundle

This bundle provides some basic features to reduce spam in symfony forms.

3.0.0 2023-04-29 06:34 UTC

Requires

• php: ^8.1
• ext-pcre: *
• symfony/config: ^5.4 || ^6.2
• symfony/dependency-injection: ^5.4 || ^6.2
• symfony/event-dispatcher: ^5.4 || ^6.2
• symfony/expression-language: ^5.4 || ^6.2
• symfony/form: ^5.4 || ^6.2
• symfony/framework-bundle: ^5.4.19 || ^6.2.5
• symfony/http-foundation: ^5.4 || ^6.2
• symfony/http-kernel: ^5.4 || ^6.2
• symfony/options-resolver: ^5.4 || ^6.2
• symfony/translation-contracts: ^1.1 || ^2.0 || ^3.0
• twig/twig: ^2.4 || ^3.0

Requires (Dev)

• ergebnis/composer-normalize: ^2.0.1
• symfony/browser-kit: ^5.4 || ^6.2
• symfony/console: ^5.4 || ^6.2
• symfony/translation: ^5.4 || ^6.2
• symfony/twig-bundle: ^5.4 || ^6.2
• symfony/yaml: ^5.4 || ^6.2

MIT

• Christian Gripp

• symfony
• twig
• form
• bundle
• spam
• antispam
• protection

README

This bundle provides some basic features to reduce spam in Symfony. It is the successor of core23/antispam-bundle, but not related to isometriks/spam-bundle.

Features

• Honeypot protection for forms: An additional "hidden" (i.e. made invisible with CSS) field will be added to your form. Whoever fills out this field, is considered to be a spam bot.

• Time protection for forms: The time between displaying the form and submitting the form is measured. Anybody who submits the form quicker than a certain number of seconds, is considered to be a spam bot. The timestamp is stored in the session.

• Email address obfuscation filter for Twig: To prevent spam harvest bots from detecting your email address, they are obfuscated by e.g. replacing @ with [AT]. The filter will find email addresses automatically, so you can apply it to your entire text.

Installation

Open a command console, enter your project directory and execute the following command to download the latest stable version of this bundle:

composer require nucleos/antispam-bundle

Enable the Bundle

In older versions of Symfony, you need to enable it manually:

// config/bundles.php

return [
    // ...
    Nucleos\AntiSpamBundle\NucleosAntiSpamBundle::class => ['all' => true],
];

Usage

Form based protection

In a controller:

$this->createForm(CustomFormType:class, null, [
    // Time protection
    'antispam_time'     => true,
    'antispam_time_min' => 10, // seconds
    'antispam_time_max' => 60,

    // Honeypot protection
    'antispam_honeypot'       => true,
    'antispam_honeypot_class' => 'hide-me',
    'antispam_honeypot_field' => 'email-repeat',
])

In a form class:

class MyType extends AbstractType
{
    // ...

    public function configureOptions(OptionsResolver $resolver): void
    {
        $resolver->setDefaults([
            // ...
            'antispam_time'     => true,
            'antispam_time_min' => 10,
            // same as above
        ]);
    }
}

Twig email address obfuscation

The Twig filter antispam replaces @ by e.g. [AT].

{# Replace plain text #}
{{ text|antispam }}

{# Replace rich text mails #}
{{ htmlText|antispam(true) }}

If you want a JavaScript decoding for the encoded email addresses, you should use the AntiSpam.js library:

document.addEventListener('DOMContentLoaded', () => {
  new AntiSpam('.custom_class');
});

It is recommended to use webpack / webpack-encore to include the JavaScript library in your page. This file is located in the assets folder.

Configure the Bundle

Create a configuration file called nucleos_antispam.yaml:

# config/packages/nucleos_antispam.yaml

nucleos_antispam:
    # Twig mail filter
    twig:
        mail:
            css_class: 'custom_class'
            at_text:   [ '[AT]', '(AT)', '[ÄT]' ]
            dot_text:  [ '[DOT]', '(DOT)', '[.]' ]

    # Time protection
    time:
        min: 5
        max: 3600
        global: true # This will add antispam to all forms

    # Honeypot protection
    honeypot:
        field: 'email_address'
        class: 'hidden'
        global: false
        provider: 'nucleos_antispam.provider.session'

License

This bundle is under the MIT license.