invisible_captcha 2.2.0 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b054e8cc12c7c543111eabaa13c46e4ec94d99200bf8fb189d6d1284568f9b3a
-  data.tar.gz: 11c94f7e36b4c2892c9def7ab86b5fcb560005fdc0c68b5beef3971eb065950c
+  metadata.gz: 8421f23e2c4ca4f1512efe6f0ac5b7d538c21fae25c94dae1eb12080bcc7bff2
+  data.tar.gz: d80bbba59b964e84f677620a2c24a5047744a95733805981583034e3629034a4
 SHA512:
-  metadata.gz: eea98bc58a674b4daa961a5fc3bb5edafbfef74034ed06364684993d96802a7bd8c169507f208b635ba24b09fc0e0b69039f964babd874e1104ae9a29c1dc2ee
-  data.tar.gz: 710d6bf3c780d91525dca60566db5f20f564f784e27223af0ab9342fb95d1bc507e4bdafe687cdacd60b7496f547a5f81653b6a7ebfcca0425fd2de53a13adba
+  metadata.gz: 94f28d33d89e5dcfa741d97c34c4a42645a5d3f668238653341cd402c1e1e3bfbf8d2c42f5bc6d9d8bda3815d3e7036c0dae13965691e7409ce5df1ff5763bee
+  data.tar.gz: 2a187357840766a3eae1c40f032015c38f07a2b12955c9bfc82f95251b81138a6eab8e69ccd0adbfb9e5f13c095a541e869f2b3d5672e29a75b893253702965e

data/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to this project will be documented in this file.
 
+## [2.3.0]
+
+- Run honeypot + spinner checks and their callback also if timestamp triggers but passes through (#132)
+- Mark as spam requests with no spinner value (#134)
+
 ## [2.2.0]
 
 - Official support for Rails 7.1
@@ -136,6 +141,7 @@ All notable changes to this project will be documented in this file.
 
 - First version of controller filters
 
+[2.3.0]: https://github.com/markets/invisible_captcha/compare/v2.2.0...v2.3.0
 [2.2.0]: https://github.com/markets/invisible_captcha/compare/v2.1.0...v2.2.0
 [2.1.0]: https://github.com/markets/invisible_captcha/compare/v2.0.0...v2.1.0
 [2.0.0]: https://github.com/markets/invisible_captcha/compare/v1.1.0...v2.0.0

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright 2012-2021 Marc Anguera Insa
+Copyright 2012-2024 Marc Anguera Insa
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.md

@@ -287,7 +287,7 @@ end
 Another option is to wait for the timestamp check to be valid:
 
 ```ruby
-# Maybe in a before block
+# Maybe inside a before block
 InvisibleCaptcha.init!
 InvisibleCaptcha.timestamp_threshold = 1
 
@@ -295,6 +295,26 @@ InvisibleCaptcha.timestamp_threshold = 1
 sleep InvisibleCaptcha.timestamp_threshold
 ```
 
+If you're using the "random honeypot" approach, you may want to set a known honeypot:
+
+```ruby
+config.honeypots = ['my_honeypot_field'] if Rails.env.test?
+```
+
+And for the "spinner validation" check, you may want to disable it:
+
+```ruby
+config.spinner_enabled = !Rails.env.test?
+```
+
+Or alternativelly, you should send a valid spinner value along your requests:
+
+```ruby
+# RSpec example
+session[:invisible_captcha_spinner] = '32ab649161f9f6faeeb323746de1a25d'
+post :create,  params: { topic: { title: 'foo' }, spinner: '32ab649161f9f6faeeb323746de1a25d' }
+```
+
 ## Contribute
 
 Any kind of idea, feedback or bug report are welcome! Open an [issue](https://github.com/markets/invisible_captcha/issues) or send a [pull request](https://github.com/markets/invisible_captcha/pulls).

data/lib/invisible_captcha/controller_ext.rb

@@ -21,7 +21,10 @@ module InvisibleCaptcha
     def detect_spam(options = {})
       if timestamp_spam?(options)
         on_timestamp_spam(options)
-      elsif honeypot_spam?(options) || spinner_spam?
+        return if performed?
+      end
+
+      if honeypot_spam?(options) || spinner_spam?
         on_spam(options)
       end
     end
@@ -73,7 +76,7 @@ module InvisibleCaptcha
     end
 
     def spinner_spam?
-      if InvisibleCaptcha.spinner_enabled && params[:spinner] != session[:invisible_captcha_spinner]
+      if InvisibleCaptcha.spinner_enabled && (params[:spinner].blank? || params[:spinner] != session[:invisible_captcha_spinner])
         warn_spam("Spinner value mismatch")
         return true
       end

data/lib/invisible_captcha/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module InvisibleCaptcha
-  VERSION = "2.2.0"
+  VERSION = "2.3.0"
 end

data/spec/controllers_spec.rb

@@ -71,6 +71,12 @@ RSpec.describe InvisibleCaptcha::ControllerExt, type: :controller do
         .to be_present
     end
 
+    it 'runs on_spam callback if on_timestamp_spam callback is defined but passes' do
+      put :test_passthrough, params: { id: 1, topic: { title: 'bar', subtitle: 'foo' } }
+
+      expect(response.status).to eq(204)
+    end
+
     context 'successful submissions' do
       it 'passes if submission on or after timestamp_threshold' do
         sleep InvisibleCaptcha.timestamp_threshold
@@ -98,6 +104,12 @@ RSpec.describe InvisibleCaptcha::ControllerExt, type: :controller do
         expect(flash[:error]).not_to be_present
         expect(response.body).to redirect_to(new_topic_path)
       end
+
+      it 'passes if on_timestamp_spam doesn\'t perform' do
+        put :test_passthrough, params: { id: 1, topic: { title: 'bar' } }
+
+        expect(response.body).to redirect_to(new_topic_path)
+      end
     end
   end
 

data/spec/dummy/app/controllers/topics_controller.rb

@@ -13,6 +13,10 @@ class TopicsController < ApplicationController
 
   invisible_captcha only: :categorize
 
+  invisible_captcha honeypot: :subtitle, only: :test_passthrough,
+    on_spam: :catching_on_spam_callback,
+    on_timestamp_spam: :on_timestamp_spam_callback_with_passthrough
+
   def index
     redirect_to new_topic_path
   end
@@ -56,6 +60,10 @@ class TopicsController < ApplicationController
     end
   end
 
+  def test_passthrough
+    redirect_to new_topic_path
+  end
+
   private
 
   def custom_callback
@@ -65,4 +73,12 @@ class TopicsController < ApplicationController
   def custom_timestamp_callback
     head(204)
   end
+
+  def on_timestamp_spam_callback_with_passthrough
+  end
+
+  def catching_on_spam_callback
+    head(204)
+  end
+
 end

data/spec/dummy/config/routes.rb

@@ -4,6 +4,7 @@ Rails.application.routes.draw do
     post :rename, on: :collection
     post :categorize, on: :collection
     post :copy, on: :collection
+    post :test_passthrough, on: :collection
   end
 
   root to: 'topics#new'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: invisible_captcha
 version: !ruby/object:Gem::Version
-  version: 2.2.0
+  version: 2.3.0
 platform: ruby
 authors:
 - Marc Anguera Insa
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-02-04 00:00:00.000000000 Z
+date: 2024-03-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails