ALTCHA Spam Protection: Storefront

Storefront integration of the ALTCHA Spam Protection module for OXID 7: protected forms, template overrides for the Apex theme, widget, honeypot, ViewConfig methods and integration into other themes.

Deutsche Version

Back to overview

ALTCHA Spam Protection: Storefront

Live Demo: Try this and other plugins live — no installation, no risk: demo.markus-michalski.net

Protected forms

The module extends four OXID classes: the three form classes ContactController, NewsletterController and UserComponent, plus ViewConfig as the fourth for the template methods. Only these three submissions are checked:

Form	Extended method	Action (rate limit)	Fields evaluated
Contact form	`ContactController::send`	`contact_form`	`editval[oxuser__oxfname]`, `editval[oxuser__oxlname]`, `editval[oxuser__oxusername]`
Newsletter subscription	`NewsletterController::send`	`newsletter_subscribe`	`editval[oxuser__oxfname]`, `editval[oxuser__oxlname]`, `editval[oxuser__oxusername]`
Registration	`UserComponent::createUser`, only for `cl=register`	`registration`	`lgn_usr`, `invadr[oxuser__oxfname]`, `invadr[oxuser__oxlname]`, `invadr[oxuser__oxstreet]`, `invadr[oxuser__oxcity]`

Registration is only checked on the page cl=register (case does not matter). Registration during checkout (cl=user) and all other forms, such as login or password reset, are not protected.

Page URLs do not matter, controller and method are what counts. The submission must carry the solution in the POST field altcha, which the widget adds automatically.

Template overrides

The module ships template extensions for the Apex theme only. They live under views/twig/extensions/themes/apex/:

File	Effect
`form/contact.html.twig`	Extends `form/contact.html.twig` and inserts the widget in the block `captcha_form`
`form/newsletter.html.twig`	Extends `form/newsletter.html.twig` and inserts the widget in the block `newsletter_form_captcha`
`form/register.html.twig`	Fully replaces the Apex registration form and places the widget between the account data and the billing address
`layout/base.html.twig`	Adds the widget script in the block `base_js` when `getAltchaEnabled()` is true. No CSS is included

The widget itself is in views/twig/widget/altcha_widget.html.twig and is registered under the name @mmd_altcha/widget/altcha_widget.

Because form/register.html.twig is a copy of the Apex form, it does not pick up later changes the theme makes to that file. Review it after a theme update.

The widget template renders something only when ALTCHA or the honeypot is active. It has two parts:

Honeypot field: a container with aria-hidden="true", positioned outside the visible area by an inline style. It holds a label (text from the key MMD_ALTCHA_HONEYPOT_LABEL) and a text input whose name and id are the configured field name (default website), with an empty value, autocomplete="off" and tabindex="-1".
ALTCHA widget: the altcha-widget element with challengeurl, hidefooter, hidelogo and auto="onsubmit". The challenge is therefore only solved when the form is submitted.

The widget labels come from the frontend translations:

Key	German	English
`MMD_ALTCHA_LABEL`	Ich bin kein Roboter	I am not a robot
`MMD_ALTCHA_VERIFYING`	Verifiziere...	Verifying...
`MMD_ALTCHA_VERIFIED`	Verifiziert	Verified
`MMD_ALTCHA_ERROR`	Fehler bei der Verifizierung	Verification error
`MMD_ALTCHA_EXPIRED`	Verifizierung abgelaufen	Verification expired
`MMD_ALTCHA_HONEYPOT_LABEL`	Bitte leer lassen	Leave this empty

The error messages shown after a rejected submission are listed on the Troubleshooting page.

ViewConfig methods

The module extends ViewConfig with these methods, available in templates through oViewConf:

Method	Returns
`getAltchaEnabled()`	True when "Enable spam protection" and "Enable ALTCHA" are on
`getHoneypotEnabled()`	True when "Enable spam protection" and "Enable honeypot" are on
`getHoneypotFieldName()`	The configured honeypot field name
`getAltchaChallengeUrl()`	URL of the challenge endpoint, built from the self link plus `cl=mmd_altcha_challenge&fnc=getChallenge`
`isSpamProtectionEnabled()`	True when "Enable spam protection" is on

Other themes

The module ships no templates for themes other than Apex. The server still checks submissions, and without the widget the ALTCHA solution is always missing, so contact, newsletter and registration submissions are rejected. You therefore have to build the integration yourself:

{# in the form, where the widget should appear #}
{% include "@mmd_altcha/widget/altcha_widget.html.twig" %}

{# in the base_js block of the layout, once per page #}
{% if oViewConf.getAltchaEnabled() %}
    <script type="module" src="https://cdn.jsdelivr.net/npm/altcha@latest/dist/altcha.min.js"></script>
{% endif %}

If "Enable ALTCHA" is switched off, no widget is shown and the server does not require a solution either. Honeypot, content validation and rate limiting keep running.