Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix/discount code spam #3203

Closed
wants to merge 2 commits into from
Closed

Fix/discount code spam #3203

wants to merge 2 commits into from

Conversation

ideadude
Copy link
Member

All Submissions:

Changes proposed in this Pull Request:

Folks are testing sites for discount codes. We've seen over 2000-8000 attempts in a single day on our site. We'd like to track repeated failed checks as spam and so trigger spam protection after 10 failed attempts within 15 minutes (or whatever your site is set to track).

This PR only tracks checks that result in "no code found" errors as spam. It tracks every time a discount code is checked. On default setups, this is once per page load if a bad code is passed in as a parameter and once per page load when clicking on the "Apply" button from the checkout page.

If you have custom code checking the discount code numerous times, it will track numerous spam attempts.

In the future, we could perhaps update our pmpro_track_spam_activity() function avoid duplicate tracks per page load in some cases, but I think for now tracking every failed check is okay.

How to test the changes in this Pull Request:

  1. Enable spam protection from the Settings > Security tab.
  2. Visit the checkout page.
  3. Enter a non existent discount code into the discount code box and click "Apply".
  4. Repeat about 10-15 times. You should see the message "Suspicious activity detected. Try again in a few minutes." once spam protection is triggered.
  5. After about 15 minutes, you should be able to try codes again or checkout.

Other information:

  • Have you added an explanation of what your changes do and why you'd like us to include them?
  • Have you successfully run tests with your changes locally?

Changelog entry

ENHANCEMENT: Now tracking failed discount code checks as spam activity and blocking checks if spam protection is enabled and triggered.

@dparker1005
Copy link
Member

Closed in favor of #3208

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants