For full details of how CFFormProtect works, see the project page at
http://cfformprotect.riaforge.org/
Installation
-
Copy the cfformprotect folder into your web root.
-
Put <cfinclude template="/cfformprotect/cffp.cfm"> somewhere between
your form tags.
-
On your processing page include the following code:
<cfset Cffp =
CreateObject("component","cfformprotect.cffpVerify").init() />
<!--- now we can test the form submission --->
<cfif Cffp.testSubmission(form)>
<!--- The submission has passed
the form test. Place processing here --->
<cfelse>
<!--- The test failed. Take
appropriate failure action here. --->
</cfif>
-
Setup your email settings and Akismet in cffp.ini.cfm, if you want to use
those features (if you leave the email settings blank, you won't receive
an email when spammer tries to attack your forms)
Customization
-
You can change the values in cffp.ini.cfm if you want to tweak how
CFFormProtect operates. Descriptions of the values are below.
-
You'll probably want to change what happens when a spam message is found.
I have it set to display an error, send you an email (if you configured
this feature) and then cfabort. You can change this at the bottom of
cffpVerify.cfm. You can use two variables for information on why the
message was flagged as spam, testsThatFailed and totalPoints. This will
help you tweak the settings to your liking (to allow more or less messages
through)
-
If you use the Akismet feature, modify your site's "send email" code that
sends you good emails, so that it contains the Akismet link to notify
Akismet of spam that got through their filters. This step is optional but
very recommended, because Akismet is free, and all they ask is that you
feed data back into the system when necessary to help them improve it.
Here is the code I have in my sites for this:
<cfif Cffp.getConfig().akismet>
<!--- The following few lines build the URL to allow the user to submit a missed spam notification to Akismet if this is not spam --->
<cfset missedSpamURL = replace("#Cffp.getConfig().akismetBlogURL##cffpPath#/akismetFailure.cfm?type=spam","://","^^","all")>
<cfset missedSpamURL = replace(missedSpamURL,"//","/","all")>
<cfset missedSpamURL = replace(missedSpamURL,"^^","://","all")>
<cfset missedSpamURL = missedSpamURL&"&user_ip=#urlEncodedFormat(cgi.remote_addr,'utf-8')#">
<cfset missedSpamURL = missedSpamURL&"&referrer=#urlEncodedFormat(cgi.http_referer,'utf-8')#">
<cfset missedSpamURL = missedSpamURL&"&comment_author=#urlEncodedFormat(form[Cffp.getConfig().akismetFormNameField],'utf-8')#">
<cfif Cffp.getConfig().akismetFormEmailField neq "">
<cfset missedSpamURL = missedSpamURL&"&comment_author_email=#urlEncodedFormat(form[Cffp.getConfig().akismetFormEmailField],'utf-8')#">
</cfif>
<cfif cffpConfig.akismetFormURLField neq "">
<cfset missedSpamURL = missedSpamURL&"&comment_author_url=#urlEncodedFormat(form[cffpConfig.akismetFormURLField],'utf-8')#">
</cfif>
<cfset missedSpamURL = missedSpamURL&"&comment_content=#urlEncodedFormat(form[cffpConfig.akismetFormBodyField],'utf-8')#">
<p>Akisment thinks this is not spam, if it is please mark this as
missed spam by <cfoutput><a href="#missedSpamURL#">clicking here</a></cfoutput>.</p>
</cfif>
Tip: You can enter "viagra-test-123" as your Name when
testing your form, and Akismet will automatically mark the form submission as
spam
INI File settings (cffp.ini.cfm)
Most of the values can be left as default, if you want, but you'll need to
provide values for Akismet if you want to use that test.
The first section of the ini allows you to set which tests to run. 1 is
enabled and 0 is disabled :
-
mouseMovement
-
enable/disable the mouse test. This test makes sure the user moved
thier mouse
-
usedKeyboard
-
enable/disable the keyboard test. this test makes sure the user used
their keyboard
-
timedFormSubmission
-
enable/disable the test to check how long the form entry and
submission took
-
hiddenFormField
-
enable/disable hidden form field test. this test makes sure a CSS
hidden form field is empty
-
akismet
-
enable/disable the akismet test. uses the public Akismet service to
test if form contents are spam. This is off by default, because you
have to provide the details in the second section for Akistmet to
work.
-
tooManyUrls
-
enable/disable the tooManyUrls test. this test will add up the number
of URLs that are found in all of the submitted form fields, and
mark the submission as spam if the total exceeds the limit configured
by the tooManyUrlsMaxUrls variable in the ini file. This test was
created by Dave Shuck.
-
teststrings
-
enable/disable the teststrings test. this test will compare the words
in the form submission to a list of configurable "spammy" words, and
mark the submission as spam if one of these words is found. you can
modify the list by editing the spamstrings variable in the ini file.
This test was created by Mary Jo Sminkey.
The 2nd section has settings for individual tests. All of the Akisment
settings are left blank on purpose. If you want to use Akismet (highly
recommended), please fill in these variables to match your environment
-
timedFormMinSeconds
-
the minimum seconds allowed for a user to fill out the form
-
timedFormMaxSeconds
-
the maximum seconds allowed for a user to fill out the form
-
encryptionKey
-
used in the timedForm test, to encrypt the time so it can be stored in
a hidden form field (to help fool the spammers)
-
akismetAPIKey
-
this is the api key that you recieved from Akismet. it's blank by
default, because you have to get your own! ;)
-
akismetBlogURL
-
put the URL for your site here, it's a required value for the Akismet
service
-
akismetFormNameField
-
the name of your "Name" form field
-
akismetFormEmailField
-
the name of your "Email address" form field (optional)
-
akismetFormURLField
-
the name of your "URL" form field (optional)
-
akismetFormBodyField
-
the name of your "Comment" form field
-
tooManyUrlsMaxUrls
-
the maximum amount of URLs that can be passed in the form contents
-
spamstrings
-
a list of strings that form contents will be compared to
The 3rd section allows you to modify how many penalty points each test
failure will receive
failureLimit, is the total amount of points you will allow before
flagging a message as spam. Each test that fails will assign 'failure
points' to the form submission (see 3rd section of ini file). If the total
points exceeds the failureLimit, the message will not be sent.
The 4th section allows you to setup your email settings if you
want to have spam reports sent to you as they occur. Set
emailFailedTests to '1' if you want this feature enabled
The final section allows you to setup logging. By default, any failed
spam submissions will be logged to your server's default cflog location.
logFailedTests, enable/disable logging of spam submissions
logFile, if you don't want to use the default cflog log file, you can
specify a different log file name here
CFFormProtect is governed by the mozilla public license version 1.1.
See the included License.txt or
http://www.mozilla.org/MPL/
for details