Deutsche Version

Back to overview

ALTCHA Spam Protection: Installation

This documentation always refers to the latest published release.

Live demo: Try this and other plugins live, no installation, no risk: demo.markus-michalski.net

Prerequisites

Shopware ~6.7.0, PHP >=8.2 and a set APP_SECRET environment variable. The plugin ships the ALTCHA PHP library as source code, so no vendor/ directory is needed for it.

Installation

Via Shopware Store (recommended)

1. Purchase the plugin in the Shopware Store
2. Install and activate it in the Shopware Admin under Extensions > My Extensions
3. Clear the cache

Via Composer

1. Add the private repository to your shop's composer.json:

{
    "repositories": [
        {
            "type": "composer",
            "url": "https://packeton.markus-michalski.net"
        }
    ]
}

You receive the repository credentials after purchasing the license. The repository is managed through Packeton.

2. Install the plugin

composer require mmd/sw67-altcha-integration

When prompted for authentication, enter the credentials provided with your license.

3. Activate the plugin

bin/console plugin:refresh
bin/console plugin:install --activate MmdAltchaIntegration
bin/console cache:clear

After activation

• On activation the plugin switches off all captchas that are active in Shopware's native configuration (system key core.basicInformation.activeCaptchasV2) and backs up their state. On deactivation it restores that state.
• On install and on every update the plugin writes the default values of the switches to the system configuration, as long as they are not set yet. This keeps "not set" and "off" distinguishable.
• The settings are under Extensions > My Extensions > ALTCHA Spam Protection, see Configuration.

Update

composer update mmd/sw67-altcha-integration
bin/console plugin:update MmdAltchaIntegration
bin/console cache:clear

For a Store installation, update the extension under Extensions > My Extensions.

When updating from an older release

When updating from an older release, the following applies:

• Clear the cache after the update, including HTTP cache, Varnish and any CDN. Cached pages otherwise still contain the old widget markup, and there is no fallback to the old protocol.
• Reload form pages that were open before the update once.
• The "Max Number" setting no longer exists. The update deletes the stored value (altchaMaxNumber); it is not converted.
• Challenge Cost and Challenge Difficulty both start at 2000. Solving takes noticeable CPU time in the visitor's browser and grows with the cost setting. Raise the values yourself for more protection.
• The widget markup is <altcha-widget challenge="...">. Widget texts come from the bundled language pack; a custom strings attribute is not evaluated.
• Content validation is deprecated and skipped as soon as gibberish detection or the disposable e-mail check is on, see Configuration.
• If your theme overrides one of the three form templates or their captcha block, the override must use the current widget markup and call {{ parent() }}. If the widget is missing, the shop rejects the submission as long as ALTCHA is active. See Storefront Integration.
• Review themes that style the widget with CSS after the update.

Scheduled tasks

Both tasks run through the Shopware message queue:

bin/console messenger:consume scheduled_task

Run a task manually:

bin/console scheduled-task:run mmd_altcha.rate_limit_cleanup

You can also refresh the list by hand, for example when the check is on for a single sales channel only:

bin/console mmd:altcha:update-disposable-domains

Uninstall

When uninstalling without the "keep data" option, the plugin removes:

• the tables mmd_altcha_used_challenge and mmd_altcha_rate_limit_log
• all configuration values (MmdAltchaIntegration.config.*)
• both scheduled task entries

With "keep data", configuration and tables are retained. The refreshed domain list under var/mmd_altcha/ is not removed by the plugin.