Add a captcha system to our public form system

Descriptive title for this enhancement

Add a captcha system to our public form system

Actual behavior

no captcha system on ou public form system, so people can spam and use it to create lots of unwanted accounts

Expected behavior

have a catcha system to prevent bots creating accounts

Step by step description of n

ew behaviour

1. create a public form
2. select captcha functionality
3. be forced to answer the question to be ale to send the form

Benefits

more security and reduce the possibility of bots mass accounts creation

Possible Drawbacks

• choose the right implementation
• leave an option to use google captcha ???

Applicable Issues

each time people use public forms

example implementation

captcha used in our wordpress instance

https://wordpress.org/plugins/contact-form-7-image-captcha/

changed due date to October 02, 2019

changed milestone to %FusionDirectory 1.4

Captcha systems is a complicated subject, see https://www.w3.org/TR/turingtest/

It seems https://www.phpcaptcha.org/try-securimage/ at least has an audio alternative and does not use flash. It also seems to work when javascript is off. Other alternatives I’ve seen so far are either non-free, non-accessible, or based on flash or a javascript framework.

added 1h of time spent at 2019-10-02

hello @MCMic,

yes captcha can be difficult, the phpcaptcha seems nice we can look whats need to be done to ha ve a nice optional captcha on the forms

Cheers

added 5m of time spent at 2019-10-02

added PJ1802-0188 plugin-public-forms labels

@bmortier securimage does not seem packaged for Debian. https://github.com/dapphp/securimage -> I’m also a bit worried by the license of some of the sounds which does not seem free (last license in the README). It may block inclusion in Debian.

There is also https://captcheck.netsyms.com/ but it needs to be hosted as a separate service, and the service needs a database so that seems a bit overkill (we may use this and ask the user for an URL to the API, and let him worry about using official instance or hosting his own?) They say the text accessible part is from http://textcaptcha.com/ so it’s not clear if that part can be self-hosted as well as this one does not seem open source.

added 1h of time spent at 2019-10-09

hello @MCMic,

we could make other sound if needed its seems no so problematic to me, maybe look for replacement if needed. I think its still rhe best viable option

Cheers

added 5m of time spent at 2019-10-09

mentioned in commit 2220541a

added 1h of time spent at 2019-10-16

mentioned in commit 8981a635

added 2h of time spent at 2019-10-17

added To Be Tested label

assigned to @jswaelens and unassigned @MCMic

added packaging label