• Hello, thank you for the plugin and the Germanized extension. I’m currently testing it on a staging site. As far as I can see there are no limits and no restrictions on most of the input fields in the form. Looks like heaven for form spammers. Could you give store administrators the possibility to put some limits and restrictions to the form fields?

    Order Number: I would like to limit this input field to 8 characters and restrict it to numerical content. There could be an error message like: “Order number must be a number. If you can’t find your order number use 0 and we will try to match your order by name and email address.” My order numbers currently have 4 digits and I won’t live long enough to need more than 6 digits.

    Email Address: should be checked to be a formally correct email address. Looks like this check is already there.

    First Name and Last Name: I would like to limit these fields to something between 20 and 30 characters. It may not be long enough for every possible existing name but it is certainly long enough to identify the customers. In addition to that it would be nice to have a configurable list of character combinations that are not allowed in these fields (for http://, https://, www. and things like that).

    Additional fields: I would not like to have a captcha here but there could be an input field for country, where people can choose their country. That’s easier to solve than a captcha and I could silently ignore every withdrawal request coming from a country I never delivered to.

    Having an open form on a website where everybody can send emails to any email address without being logged in is a nightmare for every system administrator. The mentioned restrictions would make it less attractive for form spam. Thanks for considering this.

    Andreas

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Contributor Dennis

    (@vdwoocommercesupport)

    Hi Andreas,

    no, there are currently no restrictions as there is still a lot of legal uncertainty about what restrictions are actually allowed, e.g. there is consensus that even an invalid order id must lead to a valid withdrawal request.

    I’ll add some filters to the next version to apply custom restrictions to the input fields. You may of course use your own custom validation logic via hooks, see: https://github.com/vendidero/eu-order-withdrawal-button-for-woocommerce/blob/main/src/Ajax.php#L470

    You may as well register additional fields (such as captchas although these are still highly controversial; see my explanation above) via hooks too and use the above hook to validate those fields.

    Best,
    Dennis

    Thread Starter Andreas Stiasny

    (@andreas2050)

    Hello Dennis,

    thanks for the answer and the links. I will have a look at this.

    As a first step I didn’t mean to reject form submissions (I agree that this could be a legal problem) but just to limit the length of the input with the maxlength attribute. This would also prevent the misuse of the form as a contact form.

    Best regards, Andreas

    Plugin Contributor Dennis

    (@vdwoocommercesupport)

    Hi Andreas,

    yes, you are right. I’ll add some sane default maxlengths to the next update.

    Best,
    Dennis

Viewing 3 replies - 1 through 3 (of 3 total)

You must be logged in to reply to this topic.