Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Restrict contact form to signed in users #9353

Closed
eloquence opened this issue Jun 6, 2023 · 10 comments
Closed

Restrict contact form to signed in users #9353

eloquence opened this issue Jun 6, 2023 · 10 comments
Assignees
Labels
documentation Improvements or additions to the documentation.
Milestone

Comments

@eloquence
Copy link

Describe the problem

The "contact your admin" form on our Weblate instance is starting to attract spam from crawlers.

Describe the solution you'd like

It would be good to restrict it to signed in users to mitigate spam.

Describe alternatives you've considered

CAPTCHA is already enabled but CAPTCHAs are increasingly useless.

Screenshots

No response

Additional context

No response

@nijel
Copy link
Member

nijel commented Jun 7, 2023

If you are using LOGIN_REQUIRED, you can remove the contact URL from LOGIN_REQUIRED_URLS_EXCEPTIONS.

@eloquence
Copy link
Author

We're not using REQUIRE_LOGIN currently as we prefer the process overall to be transparent and visible - but allowing anonymous users to send email is just a recipe for spam. It would be great to be able to lock down that feature selectively. I suppose we could allow-list every other path manually, but that seems a bit cumbersome in comparison.

@nijel
Copy link
Member

nijel commented Jun 8, 2023

The contact form is open intentionally – it is linked from the page in case the user has trouble registering. There should be some way such user can get in touch...

@github-actions
Copy link

This issue has been automatically marked as stale because there wasn’t any recent activity.

It will be closed soon if no further action occurs.

Thank you for your contributions!

@github-actions github-actions bot added the wontfix Nobody will work on this. label Jun 23, 2023
@github-actions github-actions bot closed this as not planned Won't fix, can't repro, duplicate, stale Jun 28, 2023
@nijel nijel mentioned this issue Jun 30, 2023
2 tasks
@perrfect
Copy link

perrfect commented Jun 30, 2023

Hello.
How correctly disable contact form in docker-compose file?
I added WEBLATE_LOGIN_REQUIRED_URLS_EXCEPTIONS=/contact/(.*)$ but getting not working Weblate at all.

@nijel
Copy link
Member

nijel commented Jul 3, 2023

You need to include other URLs from the default settings, so that at least login page works.

@perrfect
Copy link

perrfect commented Jul 4, 2023

You need to include other URLs from the default settings, so that at least login page works.

I want to disable Weblate contact form in general.
I'm using WEBLATE_REQUIRE_LOGIN=1 and don't have any other options.
I don't understand which other URLs from default settings I should include.
Could you please write some examples?

@nijel nijel self-assigned this Jul 5, 2023
@nijel nijel added documentation Improvements or additions to the documentation. and removed wontfix Nobody will work on this. labels Jul 5, 2023
@nijel nijel added this to the 5.0 milestone Jul 5, 2023
@nijel
Copy link
Member

nijel commented Jul 5, 2023

I've added example to the documentation: b5ca320

@nijel nijel closed this as completed Jul 5, 2023
@github-actions
Copy link

github-actions bot commented Jul 5, 2023

Thank you for your report; the issue you have reported has just been fixed.

  • In case you see a problem with the fix, please comment on this issue.
  • In case you see a similar problem, please open a separate issue.
  • If you are happy with the outcome, don’t hesitate to support Weblate by making a donation.

@perrfect
Copy link

perrfect commented Jul 5, 2023

I've added example to the documentation: b5ca320

Thank you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
documentation Improvements or additions to the documentation.
Projects
None yet
Development

No branches or pull requests

3 participants