Do this work with Plone 6 Volto?

[mactrash]

I am trying to find a anti-spam solution for Volto Contact form. Will this work?

[mauritsvanrees]

A few days ago @sneridagh created issue #29 where he used it in Volto.

Victor, can you confirm that it works? (Well, ignoring your issue with the large log when uploading an image.)

[sneridagh]

@mauritsvanrees @mactrash yes, it does, provided that the endpoint used is wired with it.
We don't have enpoints unsecured in p.restapi, but in case of need one, you could use this add-on to add a honeypot validation to it.

[sneridagh]

Now I realised that we are tapping in every POST request, so I guess the endpoint does not really need to be wired to that. In case that you have an unsecured form, it should comply with c.honeypot way of doing things.

[mactrash]

@sneridagh If I install the plone 6 with cookiephone and which file should I use to store the

[instance]
environment-vars =
    HONEYPOT_FIELD pooh
    EXTRA_PROTECTED_ACTIONS discussion_reply join_form sendto_form
    ALLOWLISTED_ACTIONS jq_reveal_email
    ALLOWLISTED_START jq_*
    IGNORED_FORM_FIELDS secret_field
    ACCEPTED_LOG_LEVEL info
    SPAMMER_LOG_LEVEL error
    DISALLOW_ALL_POSTS no

[mauritsvanrees]

If the default values are fine for you, you don't need to add anything. Otherwise you need to set this in the OS environment.

I just ran Cookieplone and am not sure. I think you can add a file backend/.env and add environment variables in there, probably like this:

HONEYPOT_FIELD=pooh
EXTRA_PROTECTED_ACTIONS=discussion_reply join_form sendto_form

[mactrash]

@mauritsvanrees strange I add the add-on add .env

and make install, but there is no pooh field show up.

can you give my the full path of backend/.env

[mauritsvanrees]

Okay, I tried the .env and it does not work, sorry.

You say you used cookieplone, so you have a backend folder, right?
Within that folder, there should be an instance.yaml file. You can add an environment key in there. See the environment option in the readme of cookiecutter-zope-instance.

End result would be similar to this (you may have more options in there, they should stay):

default_context:
    initial_user_password: 'admin'
    zcml_package_includes: 'project.title'
    environment: {
        "HONEYPOT_FIELD": "pooh"
    }

Then in the backend directory run make start and the instance configuration in instance/etc/zope.conf should be updated, and at startup you should see something like this being printed:

2025-05-27 17:13:02,218 INFO    [collective.honeypot:29][MainThread] Honey pot field: 'pooh'

[mactrash]

@mauritsvanrees

Yes I see
2025-05-27 16:02:54,695 INFO [collective.honeypot:18][MainThread] Extra protected actions: {'send_feedback_site', 'sendto_form', 'register', 'sendto', 'contact-info'}

but there is no pooh added to contact-form

[mauritsvanrees]

It works fine for me, but I only tried in ClassicUI. Which makes me wonder again if it really works in Volto.