grav-plugin-form icon indicating copy to clipboard operation
grav-plugin-form copied to clipboard

Added safe_email filter for email field

Open NicoHood opened this issue 4 years ago • 9 comments

Note: This requires grav 1.7.0-rc.18, as safe_email got fixed there: https://github.com/getgrav/grav/commit/068de42e833af8baeb96fe31c170964fa2df0d4b

Please have a look at https://github.com/getgrav/grav-plugin-form/pull/477 first. I will rebase afterwards.

NicoHood avatar Jan 13 '21 18:01 NicoHood

Interesting... Hide emails in the forms...

mahagr avatar Jan 15 '21 11:01 mahagr

It only hides the default emails.

Example: I have a website that lists multiple businesses. I am hiding their email with safe_email filter. Now I add a /edit page where you can correct the data. The emails are prefilled. Of course this page can be grabbed by bots too, so to should also have this filter applied.

I also wanted to add this for the telephone field afterwards.

NicoHood avatar Jan 15 '21 12:01 NicoHood

Since the other PR got rejected: What about this one? I've simply copied the general field template, so everything should be still compatible. I know that emails are not iterable, maybe we can remove it in this field. What do you think?

NicoHood avatar Jan 20 '21 12:01 NicoHood

I'm not sure how this will save after it has rendered with the safe_email filter applied?

w00fz avatar Feb 09 '21 23:02 w00fz

I dont understand your comment, sorry...

The filter will just obfuscate the email. I am using this for every email on my webpage and I noticed, that prefilled forms are lacking this filter. It does not hurt to have it there I think.

NicoHood avatar Feb 10 '21 11:02 NicoHood

When it’s prefilled obfuscated and you submit again, it will submit obfuscated right?

Imagine you have a user profile with email field. When the profile loads and the raw value gets manipulated to show the safe version of it, it means that if I save the profile again it will now be storing the value obfuscated (in yaml or wherever it’s going to be used). This is hardly a wanted behavior, most likely now sending an email to that obfuscated email will result in an invalid address error and so on.

That’s the issue I’m taking about. Am I missing something?

w00fz avatar Feb 10 '21 17:02 w00fz

It does not submit any obfuscated text. You can encode every html character like this. Did you try this? I guess you assumption was just wrong.

NicoHood avatar Feb 10 '21 23:02 NicoHood

I'm going to test this one after the next release.

rhukster avatar Feb 16 '21 21:02 rhukster

Any updates?

NicoHood avatar Apr 02 '21 09:04 NicoHood