CUNY Academic Commons

I believe we are talking about contact forms created on blogs through plugins. That is my impression of what IT has been emailing us about. Here is one example: http://swipanalytic.org/contact/

After spending some time on this I think there's two directions we could go:

First, Contact Form 7 is designed to work with a plugin that we have installed called Really Simple CAPTCHA, which allows people to use CAPTCHA shortcodes when they're making contact forms.

-There's a filter for the HTML for the Contact Form 7 forms, with which I've been able to use the handle shortcode function from Really Simple CAPTCHA to generate a CAPTCHA and response field, but I haven't been able to actually hook those fields up to validation yet so that they prevent the contact from being sent if the CAPTCHA isn't filled out. CAPTCHA's added via the shortcodes in the way they're designed work. I think with some more time I figure out how to make that work, and we could just add something to muplugins that hooks into that filter for all Contact Form 7 forms - we'd have to make sure it tested to see if there was already a CAPTCHA in place too
-Second, we could hook somewhere into the save form process to add in a message recommending that people add in a CAPTCHA, and maybe providing some code that people can cut and paste to add one to the form. We could also include that code somewhere else on the form creation page - I bet there's a filter we could use.

Which of those do you think would be better to move on?

Got this working, although it is a little hack-y: https://github.com/cuny-academic-commons/cac/commit/306bf9d9a973b05453ac6f5bdac9b96fe4fd0803

I use a hook that Contact Form 7 provides right after it builds the form object on the page to manually add CAPTCHA shortcodes to the form (which is just represented by a string at that stage). I use strpos and substr_replace to put the CAPTCHA in right before the submit button. First I test to see if the form already has the captchac shortcode that CF7 uses for the CAPTCHA test. It uses a captchar shortcode for the response. I couldn't think of the best way to manage testing for the presence of both and what to do if only one of them was found, so I just figured if they don't have the quiz to add a whole new captcha. Like I mentioned, it's a little hacky, but I think it basically works. One thing that's nice is that adding the captcha manually to the form the way I do also has it show up on the edit form screen in the backend, so people can go in and customize it.

Let me know what you think about it.

Hi Daniel - Thanks for working on this. The basic idea of doing string manipulation like this on form elements seems like a fine strategy to me. But there are a couple points I'm not entirely clear on:

1. This probably should not be in wp-content/themes/bp-nelo. If we're trying to force CAPTCHA for all uses of contact-form-7, we'll need something that runs somewhere other than in the main site's theme. (In the past, I've used wp-content/mu-plugins/assets/ files for plugin-specific fixes. These files need to be loaded from wp-content/mu-plugins/cac-functions.php.)
2. I see that contact-form-7 natively supports ReallySimpleCaptcha - but this is only if that plugin is activated. It looks as though your suggested fix will result in an error message being thrown: https://github.com/cuny-academic-commons/cac/blob/master/wp-content/plugins/contact-form-7/modules/captcha.php#L18 This is pretty unappealing. Can you look into either (a) force-activating the plugin when contact-form-7 is active, or (b) abstracting the necessary captcha-generation logic out of the other plugin so that the other plugin is not required?

Yes I realized right after I pushed that bp-nelo was probably not the right place, but wasn't sure where that'd be. Thanks for pointing me in the right direction!

Oh yeah, that is unappealing! I'll look into force-activating the CAPTCHA plugin for Commons sites today.

Boone, would CAPTCHA be activated only on sites inserting forms on their pages (or activating a plugin to do so)? Would it be simpler to just add CAPTCHA to our mu-plugins (or whatever that sitewide-activated plugins folder is called now)?

Would it be simpler to just add CAPTCHA to our mu-plugins (or whatever that sitewide-activated plugins folder is called now)?

The goal is to require CAPTCHA on contact forms, so it's only necessary to have the functionality turned on when using a contact form. I'm not clear on whether you're suggesting something different.

Ugh really sorry - turns out I did need that included file even for activate_plugin, so I added it back in.

Thanks, Daniel, and sorry for the delay in my response.

The change is looking pretty good. I modded it a bit to avoid activating the plugin (and requiring the wp-admin file) if really-simple-captcha is already activated. https://github.com/cuny-academic-commons/cac/commit/d9d07a0c0e894429f1fcd179bd44bc68e0c3b9c4

I'm having issues with CATCHA images loading properly on my local. I haven't looked into it - it's possible there is an issue with file permissions or something - but I wonder if you can verify whether you're having the same problem? If not, I'll assume it's some quirk in my local, and make sure to test after deploying to the Commons.

One last request: I don't think we should be requiring captchas from logged-in users. It's easy to bail `if ( is_user_logged_in() )` from `cac_add_captcha_to_form()`, but it's possible that this'll cause issues on form submit. Could I ask you to verify this one way or another? Thanks!

Hey Boone - Thanks for this! I think the Codex entry for activate_plugin said that it doesn't activate a plugin if it's already active, but I think the extra check is totally fine, and definitely moving the include inside the if block. The CAPTCHA images generated fine on my machine - one thing is that the plugin requires that the GD PHP module be active to make the images, so it might be that GD isn't on your local.

Yes thanks for pointing that out about logged in users - I'll add it and test it locally ASAP. Thanks again!

Sorry it took me so long to add less than one line of code - here's the most recent version. Tested and working on my machine - https://github.com/cuny-academic-commons/cac/blob/force-captcha/wp-content/mu-plugins/assets/force-captcha.php

Let me know if this works!

Sure thing! Thanks Boone!

Merged - https://github.com/cuny-academic-commons/cac/compare/7be1c5c2c4...d8903e738b