Add basic anti-spam measures to registration form

member_database/forms.py

@@ -63,6 +63,14 @@ class MembershipForm(FlaskForm):
             " Für alle anderen besteht die Möglichkeit einer außerordentlichen Mitgliedschaft."
         ),
     )
+    captcha = StringField(
+        _l("Captcha"),
+        validators=[DataRequired()],
+        render_kw={
+            "autocomplete": "off",
+            "placeholder": "Bitte den Code aus dem Bild eingeben",
+        },
+    )
     submit = SubmitField(_l("Mitgliedsantrag abschicken"))
 
 

member_database/main.py

@@ -1,14 +1,19 @@
+import random
 from datetime import date
+from io import BytesIO
 
+from captcha.image import ImageCaptcha
 from flask import (
     Blueprint,
+    Response,
     abort,
     current_app,
     flash,
     jsonify,
     redirect,
     render_template,
     request,
+    session,
     url_for,
 )
 from flask_babel import _
@@ -23,6 +28,19 @@
 
 main = Blueprint("main", __name__)
 
+_CAPTCHA_CHARS = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"
+_captcha_image = ImageCaptcha()
+
+
+@main.route("/register/captcha.png")
+def captcha_image():
+    text = "".join(random.choices(_CAPTCHA_CHARS, k=5))
+    session["captcha_text"] = text.lower()
+    buf = BytesIO()
+    _captcha_image.generate_image(text).save(buf, format="PNG")
+    buf.seek(0)
+    return Response(buf, mimetype="image/png")
+
 
 def init_main_database():
     if not table_exists(MembershipStatus):
@@ -113,6 +131,16 @@ def register():
     form = MembershipForm()
 
     if form.validate_on_submit():
+        if request.form.get("website"):
+            return redirect(url_for("main.index"))
+
+        expected = session.pop("captcha_text", "")
+        if form.captcha.data.lower() != expected:
+            form.captcha.errors.append("Falscher Sicherheitscode")
+            return render_template("member_registration.html", form=form)
+
+        session.pop("register_ts", None)
+
         p, _new = get_or_create(
             Person,
             email=form.email.data,

member_database/templates/member_registration.html

@@ -9,7 +9,25 @@ <h1>Mitgliedsantrag</h1>
 
 <p>Um Mitglied zu werden, melden Sie sich hier an. Nachdem Sie Ihre E-Mail Adresse über einen Bestätigungs-Link verifiziert haben, können Sie freigeschaltet werden:</p>
 
-{% from 'bootstrap4/form.html' import render_form %}
-{{ render_form(form, method='POST', action=action) }}
+{% from 'bootstrap4/form.html' import render_field %}
+<form method="POST" action="{{ action }}">
+  {{ form.hidden_tag() }}
+  {{ render_field(form.name) }}
+  {{ render_field(form.email) }}
+  {{ render_field(form.membership_type) }}
+  <div style="position:absolute;opacity:0;top:0;left:0;height:0;width:0;z-index:-1;" aria-hidden="true">
+    <label for="website">Website</label>
+    <input type="text" name="website" id="website" tabindex="-1" autocomplete="off">
+  </div>
+  <div class="mb-3">
+    <label class="form-label" for="{{ form.captcha.id }}">{{ form.captcha.label.text }}</label>
+    <img src="{{ url_for('main.captcha_image') }}" alt="CAPTCHA" class="d-block mb-1 border rounded">
+    {{ form.captcha(class="form-control" + (" is-invalid" if form.captcha.errors else "")) }}
+    {% for error in form.captcha.errors %}
+      <div class="invalid-feedback">{{ error }}</div>
+    {% endfor %}
+  </div>
+  {{ render_field(form.submit) }}
+</form>
 
 {% endblock %}

pyproject.toml

@@ -24,6 +24,7 @@ gunicorn = {version = "^22.0", optional = true}
 psycopg2-binary = {version = "^2.9", optional = true}
 email-validator = "^1.1"
 flask-cors = "^5.0.0"
+captcha = ">=0.7.1"
 
 [tool.poetry.extras]
 deploy = ["gunicorn", "psycopg2-binary"]

tests/test_member_registration.py

@@ -8,10 +8,13 @@ def test_member_registration(app, client, admin_user):
     name = "Enrico Fermi"
     email = "fermi@example.org"
 
+    with client.session_transaction() as sess:
+        sess["captcha_text"] = "abcde"
+
     with mail.record_messages() as outbox:
         ret = client.post(
             "/register/",
-            data=dict(name=name, email=email),
+            data=dict(name=name, email=email, captcha="abcde"),
             follow_redirects=True,
         )
 
@@ -61,3 +64,20 @@ def test_member_registration(app, client, admin_user):
 
     person = Person.query.filter_by(email=email).one()
     assert person.membership_status_id == "confirmed"
+
+
+def test_register_wrong_captcha(client):
+    from member_database.models import Person
+
+    with client.session_transaction() as sess:
+        sess["captcha_text"] = "abcde"
+
+    ret = client.post(
+        "/register/",
+        data=dict(name="Ada Lovelace", email="ada@example.org", captcha="wrong"),
+        follow_redirects=True,
+    )
+
+    assert ret.status_code == 200
+    assert "Falscher Sicherheitscode" in ret.data.decode("utf-8")
+    assert Person.query.filter_by(email="ada@example.org").one_or_none() is None