Problem/Motivation

The 'send me a copy' checkbox is hidden from anonymous users for spam prevention.
There are some cases where sites may wish to override this.

Proposed resolution

Allow default values to be set for the 'send me a copy'.
Allow per-form option to show the field to anonymous users.

Remaining tasks

All

User interface changes

?

API changes

?

Data model changes

New third party fields.

Comments

larowlan created an issue. See original summary.

larowlan’s picture

Assigned: Unassigned » larowlan
Issue summary: View changes

Updates

larowlan’s picture

Title: Add option to toggle off the 'send me a copy' restriction for anonymous users » Add option to set the default value for 'send me a copy' restriction for anonymous users
Status: Active » Needs review
StatusFileSize
new4.55 KB
jibran’s picture

Do we need an upgrade path for this?

benjy’s picture

RTBC for me, @jibran, wouldn't it be OK since we have a default value on the call? Although maybe an upgrade path is more reliable...

berdir’s picture

Doesn't this restriction exist for security reasons? As anonymous user, you can otherwise send out spam to arbitrary e-mail addresses through that form?

jibran’s picture

Well it is OK but imo every module should clean up after itself and set defaults on module uninstall and install. I agree the feature is complete and this will be just icing on the cake.

jibran’s picture

#7 is in Re: #5

benjy’s picture

@Berdir, sure but the comment on the setting tells you that and it isn't the default, an administrator would have to enable it?

larowlan’s picture

@Berdir, yes but it would be limited by flood settings too

A client requested this feature - maybe we should add a note 'Adding an additional spam prevention measure is recommended' to the comment?

andypost’s picture

Status: Needs review » Reviewed & tested by the community

We have protection to hide "copy" field in \Drupal\contact\MessageForm::form()

    $form['copy'] = array(
      '#type' => 'checkbox',
      '#title' => $this->t('Send yourself a copy'),
      // Do not allow anonymous users to send themselves a copy, because it can
      // be abused to spam people.
      '#access' => $user->isAuthenticated(),
    );
andypost’s picture

Status: Reviewed & tested by the community » Needs work

oh... field description should be removed

andypost’s picture

I mean that comment

+++ b/contact_storage.module
@@ -44,6 +44,12 @@ function contact_storage_form_contact_form_form_alter(&$form, FormStateInterface
+    '#description' => t('Note that this may present a way for anonymous users to spam other users.'),

this nothing about anonymous users

andypost’s picture

Status: Needs work » Needs review
StatusFileSize
new4.45 KB
new759 bytes

suppose that

larowlan’s picture

this nothing about anonymous users

Well if the default is to send a copy, even anonymous users get sent a copy.

So I think we should have a comment and expand it to mention a second-level spam prevention layer.

Thoughts?

andypost’s picture

I'd better add a some check to make sure that anonymous users will never get a copy message
Because you can get you site blacklisted...

larowlan’s picture

Well this issue arose out of a client requirement to always send anonymous users a copy.
Yes I advised of the risks.
Maybe we split the checkbox in two.

'Default send a copy'
'Default anonymous send a copy'

With the second checkbox having a big warning about a second-level spam protection control etc?

larowlan’s picture

StatusFileSize
new4.61 KB

Re-rolling 1 for a client project

Status: Needs review » Needs work

The last submitted patch, 18: anonymous-2716993.18.patch, failed testing.

The last submitted patch, 18: anonymous-2716993.18.patch, failed testing.

welly’s picture

StatusFileSize
new5.21 KB

Rerolled patch

welly’s picture

Status: Needs work » Needs review
StatusFileSize
new5.21 KB

Status: Needs review » Needs work

The last submitted patch, 22: anonymous-2716993.21.patch, failed testing.

welly’s picture

Status: Needs work » Needs review
StatusFileSize
new5.68 KB

Status: Needs review » Needs work

The last submitted patch, 24: anonymous-2716993.22.patch, failed testing.

welly’s picture

StatusFileSize
new5 KB

Fixed paths in patch

welly’s picture

StatusFileSize
new5 KB
welly’s picture

Status: Needs work » Needs review
StatusFileSize
new4.93 KB

Let's try again.. ಠ_ಠ

Status: Needs review » Needs work

The last submitted patch, 28: anonymous-2716993.28.patch, failed testing.

larowlan’s picture

Status: Needs work » Closed (won't fix)