Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.I've tried to manually add honeypot timing protection to a views exposed form that's being abused, but because the exposed form is 'submitted' on page load, the timing information is processed, and validation fails immediately.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | honeypot-2845272-views-exposed-form-support.patch | 585 bytes | steven jones |
| #4 | honeypot-2845272-views-exposed-form-support-4.patch | 586 bytes | chris matthews |
Issue fork honeypot-2845272
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #2
steven jones commentedHere's a patch that I think detects if there's submitted exposed input and skips if there's not.
Comment #3
geerlingguy commentedComment #4
chris matthews commentedPlease correct me if this is the wrong thing to do....I used the 2 year old patch in #2 and it did apply cleanly to the most recent 7.x-1.x-dev snapshot. However, I noticed that "Hunk #1" now succeeds at line 305 whereas the previous patch in #2 succeeded at line 267. I've attached an updated patch against the most recent -dev branch that shows this, but I'm not 100% sure it's necessary. Any help/advise would be appreciated.
Comment #5
chris matthews commentedComment #6
tr commentedNew features and bug fixes need to go into the most current branch first. Needs re-roll for 2.0.x-dev and a confirmation that the problem still exists in Drupal 9.
Comment #7
tr commentedHoneypot is deliberately disabled on Views exposed forms. See #1498940: Views exposed auto submit filter doesn't work with Honeypot and #2049563: Honeypot protection on Exposed Views Filters.
Changing that is a feature request.
If someone wants to research those issues and submit a patch (and test) that works without re-introducing the problems solved by those issues, then I'm happy to review and commit a fix to add this functionality.
Comment #8
tr commentedComment #9
tr commentedComment #12
jsutta commentedI've tried to manually add honeypot timing protection to a views exposed form that's being abused, but because the exposed form is 'submitted' on page load, the timing information is processed, and validation fails immediately.
Comment #13
jsutta commented