Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Issues

Go to all issues
Select view

Select search mode

 
1 of 1

Unsecured contact forms are susceptible to spam

Description

Unsecured contact forms on the website are allowing spam bots and other agents to abuse the forms and send unsolicited emails.

In particular this page seems to be susceptible.

Environment

None

Details

Assignee

Reporter

Time tracking

4h 30m logged

Priority

Created April 5, 2019 at 10:48 AM
Updated April 5, 2019 at 11:09 AM

Activity

Jonathan HungApril 5, 2019 at 11:01 AM
Edited

Adding Recaptcha to vulnerable forms should reduce the amount of unsolicited emails on these forms. In adding Recaptcha to these forms, a number of issues came up:

  1. Privacy - Contact Form 7 5.1 and later uses Recaptcha V3 exclusively which monitors user activity across all served pages on the site, not just the contact forms, and send data back to Google. This will invalidate any statements of privacy on the BIG IDeA website.

  2. Recaptcha V2 Plugin - In order to use the older Recaptcha V2 (the traditional "I'm not a Robot" and select the matching images), a separate 3rd party plugin needed to be downloaded and activated on the site to add this functionality.

  3. Formatting issues caused by Easy Lazy Loader plugin - A plugin called "Easy Lazy Loader" was causing the form submit button to render outside of its Form element after a Recaptcha is added to the form. This also caused an invisible Recaptcha text field to be rendered visibly causing confusin. To avoid this issue, the Easy Lazy Loader plugin was disabled.

So far only this form is secured: https://bigidea.one/submit-a-design-challenge/

Other forms should be secured with Recaptcha. is there any reason we wouldn't want to add Recaptcha to all open, public forms?

Flag notifications