Skip to content

Avoid inserting honey pot field within price fields

brienne requested to merge brienne/formprotection:candidate_parts into main

Overview Inserting a honey pot field before a price set field can cause a conflict with how the dynamically added field is displayed; mainly that it displays the field to front end users when it should be hidden. This styling problem was noted on Issue 21, but rather than style the field differently, this PR proposed changing what elements are eligible to have a honey pot field inserted before it.

Before

Previously, $insertBefore was set by a somewhat complicated call to rand() that wrapped several different form scenarios into one line of code. But mainly, the randomization only concerned itself with not placing the honey pot field before the first element or the last, unless there was only one element on the form.*

After

With this PR, $insertBefore is set by determining how many elements are on the form, and if there is more than one, it avoids selecting an element that coordinates with a price set/recurring button field so as not to encounter the display issue.

Testing *In my testing, I was not able to replicate a scenario in which $inputElementCount === 1 was one. Even on a standalone Profile with only one field, $inputElementCount evaluated to 6.

Merge request reports