[TASK] Require __hp field in arguments when honeypot spamcheck enabled

[derhansen]

When the honeypot spamcheck is enabled, the __hp field is automatically rendered as invisible field in the frontend. The spamcheck currently only checks, if the content of the field is not empty. The field can however be completely omitted in the POST request, so spambots may more easily find out, that the __hp field should not be sent in the POST request at all.

This change hardens the honeypot spamcheck by requiring the __hp field to be present in the POST request. If the field is omitted, the spamcheck will fail.

[mschwemer]

Unfortunately I had to revert your code for now. All automated tests, that have spam shield enabled, failed with a percentage higher than 80%.

I really like the idea. I need to check, whether the tests fail.

[derhansen]

Just an idea: Maybe the __hp field is missing on those tests and by the new requirement from the PR, the spam score increases?

[derhansen]

Just found the reason, why the tests may fail. If powermail is configured to show a confirmation page, the __hp field als possible values entered by spambots are not included in the HiddenFields section in the Confirmation.html template. This basically disables the honeypot check, since the field is never evaluated.

My patch added a requirement for the __hp field, so the honeypot check will now always fail, because when coming from the confirmationAction, the field value is not given in the POST request to createAction.

I suggest to add a new partial to Confirmation.html, where the __hp field is rendered as hidden input and the given value from POST data is used as value.