Live Demo: Try this and other plugins live — no installation, no risk: demo.markus-michalski.net
The module extends four OXID classes: the three form classes ContactController, NewsletterController and UserComponent, plus ViewConfig as the fourth for the template methods. Only these three submissions are checked:
| Form | Extended method | Action (rate limit) | Fields evaluated |
|---|---|---|---|
| Contact form | ContactController::send |
contact_form |
editval[oxuser__oxfname], editval[oxuser__oxlname], editval[oxuser__oxusername] |
| Newsletter subscription | NewsletterController::send |
newsletter_subscribe |
editval[oxuser__oxfname], editval[oxuser__oxlname], editval[oxuser__oxusername] |
| Registration | UserComponent::createUser, only for cl=register |
registration |
lgn_usr, invadr[oxuser__oxfname], invadr[oxuser__oxlname], invadr[oxuser__oxstreet], invadr[oxuser__oxcity] |
Registration is only checked on the page
cl=register(case does not matter). Registration during checkout (cl=user) and all other forms, such as login or password reset, are not protected.
Page URLs do not matter, controller and method are what counts. The submission must carry the solution in the POST field altcha, which the widget adds automatically.
The module ships template extensions for the Apex theme only. They live under views/twig/extensions/themes/apex/:
| File | Effect |
|---|---|
form/contact.html.twig |
Extends form/contact.html.twig and inserts the widget in the block captcha_form |
form/newsletter.html.twig |
Extends form/newsletter.html.twig and inserts the widget in the block newsletter_form_captcha |
form/register.html.twig |
Fully replaces the Apex registration form and places the widget between the account data and the billing address |
layout/base.html.twig |
Adds the widget script in the block base_js when getAltchaEnabled() is true. No CSS is included |
The widget itself is in views/twig/widget/altcha_widget.html.twig and is registered under the name @mmd_altcha/widget/altcha_widget.
Because
form/register.html.twigis a copy of the Apex form, it does not pick up later changes the theme makes to that file. Review it after a theme update.
The widget template renders something only when ALTCHA or the honeypot is active. It has two parts:
aria-hidden="true", positioned outside the visible area by an inline style. It holds a label (text from the key MMD_ALTCHA_HONEYPOT_LABEL) and a text input whose name and id are the configured field name (default website), with an empty value, autocomplete="off" and tabindex="-1".altcha-widget element with challengeurl, hidefooter, hidelogo and auto="onsubmit". The challenge is therefore only solved when the form is submitted.The widget labels come from the frontend translations:
| Key | German | English |
|---|---|---|
MMD_ALTCHA_LABEL |
Ich bin kein Roboter | I am not a robot |
MMD_ALTCHA_VERIFYING |
Verifiziere... | Verifying... |
MMD_ALTCHA_VERIFIED |
Verifiziert | Verified |
MMD_ALTCHA_ERROR |
Fehler bei der Verifizierung | Verification error |
MMD_ALTCHA_EXPIRED |
Verifizierung abgelaufen | Verification expired |
MMD_ALTCHA_HONEYPOT_LABEL |
Bitte leer lassen | Leave this empty |
The error messages shown after a rejected submission are listed on the Troubleshooting page.
The module extends ViewConfig with these methods, available in templates through oViewConf:
| Method | Returns |
|---|---|
getAltchaEnabled() |
True when "Enable spam protection" and "Enable ALTCHA" are on |
getHoneypotEnabled() |
True when "Enable spam protection" and "Enable honeypot" are on |
getHoneypotFieldName() |
The configured honeypot field name |
getAltchaChallengeUrl() |
URL of the challenge endpoint, built from the self link plus cl=mmd_altcha_challenge&fnc=getChallenge |
isSpamProtectionEnabled() |
True when "Enable spam protection" is on |
The module ships no templates for themes other than Apex. The server still checks submissions, and without the widget the ALTCHA solution is always missing, so contact, newsletter and registration submissions are rejected. You therefore have to build the integration yourself:
{# in the form, where the widget should appear #}
{% include "@mmd_altcha/widget/altcha_widget.html.twig" %}
{# in the base_js block of the layout, once per page #}
{% if oViewConf.getAltchaEnabled() %}
<script type="module" src="https://cdn.jsdelivr.net/npm/altcha@latest/dist/altcha.min.js"></script>
{% endif %}
If "Enable ALTCHA" is switched off, no widget is shown and the server does not require a solution either. Honeypot, content validation and rate limiting keep running.