Honeypot update#832
Open
alexander-b-clean wants to merge 6 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the honeypot implementation (primarily around WordPress search forms), including aligning the honeypot field naming convention and expanding coverage to Gutenberg’s core/search block rendering.
Changes:
- Added support for injecting honeypot fields into the block search form via the
render_block_core/searchhook. - Updated honeypot field detection to use the
apbct__email_id__*naming pattern across PHP and JS. - Changed search-form honeypot transport in bundled JS to a short-lived native cookie (30s TTL), and added the value key to AltSessions allowlist.
Reviewed changes
Copilot reviewed 12 out of 22 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| lib/Cleantalk/ApbctWP/Variables/AltSessions.php | Allowlists apbct_search_form__honeypot_value for alt-sessions storage. |
| lib/Cleantalk/ApbctWP/Honeypot.php | Updates POST honeypot key detection to apbct__email_id and removes unused AltSessions usage. |
| lib/Cleantalk/Antispam/IntegrationsByClass/WPSearchForm.php | Injects honeypot into block search output and adds search honeypot evaluation in testSpam(). |
| js/src/public-1-main.js | Updates search-form honeypot field selector to the new apbct__email_id__ naming. |
| js/prebuild/apbct-public-bundle.js | Updates selector and changes honeypot transport to a short-lived native cookie. |
| js/prebuild/apbct-public-bundle_int-protection.js | Same as above for the int-protection build. |
| js/prebuild/apbct-public-bundle_int-protection_gathering.js | Same as above for the int-protection+gathering build. |
| js/prebuild/apbct-public-bundle_gathering.js | Same as above for the gathering build. |
| js/prebuild/apbct-public-bundle_full-protection.js | Same as above for the full-protection build. |
| js/prebuild/apbct-public-bundle_full-protection_gathering.js | Same as above for the full-protection+gathering build. |
| js/prebuild/apbct-public-bundle_ext-protection.js | Same as above for the ext-protection build. |
| js/prebuild/apbct-public-bundle_ext-protection_gathering.js | Same as above for the ext-protection+gathering build. |
| js/cleantalk-admin-settings-page.min.js.map | Rebuilt artifact update (source map content changed). |
| js/cleantalk-admin-settings-page.min.js | Rebuilt artifact update (minified output changed). |
| js/apbct-public-bundle.min.js | Rebuilt public bundle reflecting the updated search-form honeypot behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
AntonV1211
approved these changes
Jul 21, 2026
alexandergull
requested changes
Jul 22, 2026
| // stripped from the GET URL); without JS the field stays in the GET request. | ||
| if ( $apbct->settings['data__honeypot_field'] ) { | ||
| $cookie_name = apbct__get_cookie_prefix() . 'apbct_search_form__honeypot_value'; | ||
| $honeypot_value = $_GET['apbct__email_id__search_form'] |
| if ( $apbct->settings['data__honeypot_field'] ) { | ||
| $cookie_name = apbct__get_cookie_prefix() . 'apbct_search_form__honeypot_value'; | ||
| $honeypot_value = $_GET['apbct__email_id__search_form'] | ||
| ?? ( $_COOKIE[$cookie_name] ?? null ) |
alexandergull
requested changes
Jul 23, 2026
| add_filter('get_search_form', array($this, 'apbctFormSearchAddFields'), 999); | ||
| // The block search form (core/search) is rendered by render_block_core_search() | ||
| // and does not fire get_search_form, so it is handled on its dedicated render hook. | ||
| add_filter('render_block_core/search', array($this, 'apbctFormSearchAddFields'), 999); |
Member
There was a problem hiding this comment.
We must skip all the "GET" forms excepting the "get_search_form" hook.
This filter "render_block_core/search" may cause unexpected requests.
Discuss this change among the team due daily scrum , but be prepared to explain what exactly you wanted to do.
Contributor
Author
There was a problem hiding this comment.
https://developer.wordpress.org/reference/hooks/render_block_this-name/
If we just drop render_block_core/search, search protection will stop working on modern Gutenberg and FSE themes. The block form doesn't trigger get_search_form, so without this filter, our Honeypot won't be added to the form HTML at all.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://app.doboard.com/1/task/36324