[RFC] Hide captcha field for users and add honeypot field

[ausi]

With these changes we would achieve the following:

1. Normal users won’t see the captcha field and can just submit the form.
2. If a user is detected as a spam bot, they can still send the form by answering the captcha question.
3. Bots that don’t support JS, or that can’t resist the honeypot cannot send the form.

[leofeyer]

Awesome, thank you @ausi.

[Toflar]

In English should be fill in this field and I wonder if we should translate it anyway for screenreaders? Also I wonder if there's some WAI-ARIA directive to improve usability for handicapped people.

[ausi]

Yes, the PR wasn’t completely finished, thats why I added [RFC], not [RTM] :)
Because there is a display:none div directly around it, no user and no screenreader user will see that in 99.9999% of cases.
But yes, we should change it to Do not fill in this field and translate it.

[leofeyer]

With display:none, the message will never be read out by screen readers. We do not need to translate it therefore.

[leofeyer]

Fixed in 820ea42.

[ausi]

@leofeyer should we restructure getQuestion() and getSum() so that the it works independend of the order and how often you call these methods? Calling getQuestion() twice, would overwrite the session, and calling getSum() before getQuestion() doesn’t work.

[ausi]

Followup: #835

[fenepedia]

@ausi Does this new function replace your anti-spam-extension? In other words, is it the same?

[ausi]

It works with the same principles: time check, JS check and a honeypot field. So I think it should offer the same protection.

The biggest difference to the anti-spam extension is the naming of the honeypot field I think. The extension tries to use very attractive names, but this can have conflict problems with other fields in the form.

[leofeyer]

We could improve the new feature like "if there is no field named email, name the CAPTCHA field email; if there is no field named name, name the CAPTCHA field name; and use the CAPTCHA field name with a suffix in all other cases". (Then the form would have to set the CAPTCHA field name I guess, because the widget does not know about the other widgets.)

Does this make sense? And is it worth the effort?

[Toflar]

The "if there is no email" does not work reliably. You could determine that in the loadFormField hook in case of the form generator but the captcha is used elsewhere too. Like comments form or whatever the developers did directly with that widget. I think the honeypot field is going to work anyway.