So, by default, the Webform module allows users to submit webforms (the same form), an unlimited number of times. Although Webform has the ability to limit submissions, it is not configured by default.

Example problem:

  1. An admin creates a webform that is publicly available to anonymous users, and contains a file upload field.
  2. A hacker is able to create a script that submits the form and file contents an unlimited number of times, thereby flooding their system, possibly making the site unavailable and unstable as all disk, memory, and database resources are eaten up. Example script could be created with PHP, Behat, Selenium, etc.
  3. Flooding the system through the web browser is as easy as holding the ENTER key on the submit button and releasing after 10+ seconds (hundreds of submissions will be created).

Possible solution:

Set default webform submission limits such that each user can only submit 10 requests per minute (very reasonable).

See webform.pages.inc:131.

Comments

donutdan4114 created an issue. See original summary.

tzt20’s picture

tzt20 commented

It would actually be great to have the optional submission limit default setting included in the main Webform configuration (admin/config/content/webform) so that it can be deployed with Features. Currently, this form setting is only at the individual node level (ie /node/123/webform/configure). That way, the developer can choose the default option.

Thanks for the consideration.

liam morland’s picture

liam morland
Primary language English
Location Ontario, CA 🇨🇦
commented
Version: 7.x-4.x-dev » 8.x-5.x-dev

These are both great suggestions. A rate limiter and a default limit are different things so they should have their tickets. As well, these should be implemented in Drupal 8 and then backported.

jrockowitz’s picture

jrockowitz commented

Webform 8.x-5.x does not currently support interval submission limits. This would need a dedicated feature request ticket.

jrockowitz’s picture

jrockowitz commented

I know of no form builder on the market that by default has any submission limits enabled. It is very easy to write a custom hook that sets the default submission limit for all forms. This code can be contributed back to the Drupal community as a recipe.

Still, I agree with you that it is extremely important to protect websites from malicious form submissions and all sites should use a SPAM protection module like CAPTCHA, Antibot, or Honeypot.

For D8, I am going to add a warning, which can be disabled, to the Status Report that tells administrators that "No SPAM protection module was found. Please try one of these modules: CAPTCHA, Honeypot, or Antibot. This warning can be [disabled](/admin/structure/webform/settings/advanced)."

jrockowitz’s picture

jrockowitz commented

BTW, I will create a new ticket for the SPAM module warning instead of hijacking this issue.

jrockowitz’s picture

jrockowitz commented

I added a check for a SPAM protection module to the Status Report.

@see #2909723: Improve hook requirements

I would to close this and mark it as won't fix.

Moving back to 7.x to see how @Liam Morland wants to address this.

jrockowitz’s picture

jrockowitz commented
Version: 8.x-5.x-dev » 7.x-4.x-dev
liam morland’s picture

liam morland
Primary language English
Location Ontario, CA 🇨🇦
commented
Status: Active » Closed (outdated)

Drupal 7 is no longer supported. If this applies to a supported version, please re-open.

Now that this issue is closed, please review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, please credit people who helped resolve this issue.