Add a honeypot field to collections.add form to catch spammy bots (bug 1211012).

apps/bandwagon/forms.py

@@ -6,6 +6,7 @@
 
 import commonware.log
 from tower import ugettext as _, ugettext_lazy as _lazy
+from django_statsd.clients import statsd
 
 import amo
 from amo.utils import clean_nl, has_links, slug_validator, slugify
@@ -48,7 +49,6 @@ class AddonsForm(Form):
                                     required=False)
 
     def clean_addon(self):
-
         addons = []
         for a in self.data.getlist('addon'):
             try:
@@ -136,13 +136,30 @@ class CollectionForm(ModelForm):
     icon = forms.FileField(label=_lazy(u'Icon'),
                            required=False)
 
+    # This is just a honeypot field for bots to get caught
+    # L10n: bots is short for robots
+    your_name = forms.CharField(
+        label=_lazy(
+            u"Please don't fill out this field, it's used to catch bots"),
+        required=False)
+
     def __init__(self, *args, **kw):
         super(CollectionForm, self).__init__(*args, **kw)
         # You can't edit the slugs for the special types.
         if (self.instance and
                 self.instance.type in amo.COLLECTION_SPECIAL_SLUGS):
             del self.fields['slug']
 
+    def clean(self):
+        # Check the honeypot here instead of 'clean_your_name' so the
+        # error message appears at the top of the form in the __all__ section
+        if self.cleaned_data['your_name']:
+            statsd.incr('collections.honeypotted')
+            log.info('Bot trapped in honeypot at collections.create')
+            raise forms.ValidationError(
+                "You've been flagged as spam, sorry about that.")
+        return super(CollectionForm, self).clean()
+
     def clean_name(self):
         name = self.cleaned_data['name']
         if BlacklistedName.blocked(name):

apps/bandwagon/templates/bandwagon/includes/addedit.html

@@ -1,6 +1,9 @@
 {{ csrf() }}
 
 <fieldset>
+  {# Honeypot field for bots to get caught #}
+  {{ form.your_name }}
+
   {{ field(form.name, _('Name:'), class='long') }}
   {% if form.slug %}
     <p id="collection-form-slug">

apps/bandwagon/tests/test_views.py

@@ -386,6 +386,11 @@ def create_collection(self, **kw):
         eq_(r.status_code, 200)
         return r
 
+    @patch('bandwagon.views.statsd.incr')
+    def test_create_collection_statsd(self, mock_incr):
+        self.client.post(self.add_url, self.data, follow=True)
+        mock_incr.assert_any_call('collections.created')
+
     def test_restricted(self, **kw):
         g, created = Group.objects.get_or_create(rules='Restricted:UGC')
         self.client.login(username='clouserw@gmail.com',
@@ -1272,3 +1277,51 @@ def test_clean_description(self):
             'description': '<a href="http://example.com">example.com</a>'}
         with self.assertRaisesRegexp(ValidationError, 'No links are allowed'):
             form.clean_description()
+
+    def test_honeypot_not_required(self):
+        author = UserProfile.objects.get(pk=9945)
+
+        form = forms.CollectionForm(
+            initial={'author': author},
+            data={
+                'name': 'test collection',
+                'slug': 'test-collection',
+                'listed': False,
+            }
+        )
+
+        assert form.is_valid()
+
+    def test_honeypot_fails_on_entry(self):
+        author = UserProfile.objects.get(pk=9945)
+
+        form = forms.CollectionForm(
+            initial={'author': author},
+            data={
+                'name': 'test collection',
+                'slug': 'test-collection',
+                'listed': False,
+                'your_name': "I'm a super dumb bot",
+            }
+        )
+
+        assert not form.is_valid()
+        assert 'spam' in form.errors['__all__'][0]
+
+    @patch('bandwagon.forms.statsd.incr')
+    def test_honeypot_statsd_incr(self, mock_incr):
+        author = UserProfile.objects.get(pk=9945)
+
+        form = forms.CollectionForm(
+            initial={'author': author},
+            data={
+                'name': 'test collection',
+                'slug': 'test-collection',
+                'listed': False,
+                'your_name': "I'm a super dumb bot",
+            }
+        )
+
+        assert not form.is_valid()
+
+        mock_incr.assert_any_call('collections.honeypotted')

apps/bandwagon/views.py

@@ -13,6 +13,7 @@
 import caching.base as caching
 import commonware.log
 from tower import ugettext_lazy as _lazy, ugettext as _
+from django_statsd.clients import statsd
 
 import amo
 from amo import messages
@@ -330,6 +331,7 @@ def add(request):
             if aform.is_valid():
                 aform.save(collection)
             collection_message(request, collection, 'add')
+            statsd.incr('collections.created')
             log.info('Created collection %s' % collection.id)
             return http.HttpResponseRedirect(collection.get_url_path())
         else:

static/css/zamboni/zamboni.css

@@ -3396,6 +3396,11 @@ td.input {
     padding: 1em;
 }
 
+/* Hide this honeypot field for our users */
+.collection-create input[name="your_name"] {
+    display: none;
+}
+
 .contributor span {
     position: relative;
 }