Merge pull request #1501 from MTES-MCT/feature/antispam-forms

smdsgn · web-flow · commit fbb355175896 · 2026-03-19T14:42:42.000+01:00
Améliorer antispam des formulaires
diff --git a/frontend/scripts/components/pages/Synthese/components/TerritoryIdentityCard.tsx b/frontend/scripts/components/pages/Synthese/components/TerritoryIdentityCard.tsx
@@ -123,7 +123,7 @@ export const TerritoryIdentityCard = ({ landData, className }: TerritoryIdentity
 
   const population = populationData?.[0]?.population || null;
   const hasCompetenceUrba = landData.competence_planification;
-console.log(landData.competence_planification)
+
   const identityItems = [
     {
       icon: "bi bi-geo-alt-fill",
diff --git a/frontend/scripts/components/ui/Feedback.tsx b/frontend/scripts/components/ui/Feedback.tsx
@@ -4,7 +4,7 @@ import Lottie, { LottieRefCurrentProps } from 'lottie-react';
 import { theme } from '@theme';
 import Button from '@components/ui/Button';
 import BaseCard from '@components/ui/BaseCard';
-import { useSubmitFeedbackMutation } from '@services/api';
+import { useSubmitFeedbackMutation, useGetAntispamTokenQuery } from '@services/api';
 
 import animation from '@animations/cup.json';
 
@@ -200,6 +200,7 @@ const Feedback: React.FC<FeedbackProps> = ({ context }) => {
   const [animatedStar, setAnimatedStar] = useState<number | null>(null);
   const [submitted, setSubmitted] = useState(false);
   const [submitFeedback, { isLoading }] = useSubmitFeedbackMutation();
+  const { data: tokenData, refetch: refetchToken } = useGetAntispamTokenQuery();
   const lottieRef = useRef<LottieRefCurrentProps>(null);
 
   useEffect(() => {
@@ -219,7 +220,7 @@ const Feedback: React.FC<FeedbackProps> = ({ context }) => {
   };
 
   const handleSubmit = async () => {
-    if (rating === 0 || isLoading) return;
+    if (rating === 0 || isLoading || !tokenData?.token) return;
 
     try {
       const payload = {
@@ -231,15 +232,17 @@ const Feedback: React.FC<FeedbackProps> = ({ context }) => {
         land_name: context?.landName ?? '',
         page_name: context?.pageName ?? '',
         crisp_session_id: getCrispSessionId(),
+        _token: tokenData.token,
       };
 
-      await submitFeedback(payload as any).unwrap();
+      await submitFeedback(payload).unwrap();
 
       lottieRef.current?.goToAndPlay(0);
       setSubmitted(true);
     } catch {
       setSubmitted(true);
     }
+    refetchToken();
   };
 
   const displayRating = hoveredRating || rating;
diff --git a/frontend/scripts/components/ui/SearchBar.tsx b/frontend/scripts/components/ui/SearchBar.tsx
@@ -1,4 +1,4 @@
-import React, { useEffect, ChangeEvent, useState, useRef } from 'react';
+import React, { useEffect, ChangeEvent, useState, useRef, useMemo } from 'react';
 import styled from 'styled-components';
 import { useSearchTerritoryQuery } from '@services/api';
 
@@ -144,11 +144,16 @@ const SearchBar: React.FC<SearchBarProps> = ({
         skip: shouldQueryBeSkipped,
     });
 
+    const stableExcludeTerritories = useMemo(() => excludeTerritories, 
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+        [JSON.stringify(excludeTerritories)]
+    );
+
     const shouldExcludeTerritoryFromResults = (territory: LandDetailResultType): boolean => {
-        if (excludeTerritories.length === 0) {
+        if (stableExcludeTerritories.length === 0) {
             return false;
         }
-        return excludeTerritories.some(
+        return stableExcludeTerritories.some(
             (excludedTerritory: LandDetailResultType) =>
                 territory.land_id === excludedTerritory.land_id &&
                 territory.land_type === excludedTerritory.land_type
@@ -159,14 +164,12 @@ const SearchBar: React.FC<SearchBarProps> = ({
         if (shouldQueryBeSkipped || isFetching) {
             setData(undefined);
         } else {
-            // Filter out excluded territories
-            let filteredData = queryData;
-            if (queryData) {
-                filteredData = queryData.filter((territory: LandDetailResultType) => !shouldExcludeTerritoryFromResults(territory));
-            }
+            const filteredData = queryData
+                ? queryData.filter((territory: LandDetailResultType) => !shouldExcludeTerritoryFromResults(territory))
+                : undefined;
             setData(filteredData);
         }
-    }, [isFetching, queryData, query, shouldQueryBeSkipped, excludeTerritories]);
+    }, [isFetching, queryData, query, shouldQueryBeSkipped, stableExcludeTerritories]);
 
     useEffect(() => {
         const handleClickOutside = (event: MouseEvent) => {
diff --git a/frontend/scripts/index.js b/frontend/scripts/index.js
@@ -6,5 +6,8 @@ import '../styles/index.css'
 // Import dsfr
 import '@gouvfr/dsfr/dist/dsfr.module.min.js'
 
+// HTMX
+import 'htmx.org'
+
 // React
 import './react-roots.tsx'
diff --git a/frontend/scripts/services/api.ts b/frontend/scripts/services/api.ts
@@ -334,6 +334,9 @@ export const djangoApi = createApi({
 		getCurrentUser: builder.query<CurrentUserResponse, void>({
 			query: () => '/api/me/',
 		}),
+		getAntispamToken: builder.query<{ token: string }, void>({
+			query: () => '/api/token/',
+		}),
 		submitFeedback: builder.mutation<void, {
 			rating: number;
 			comment: string;
@@ -343,6 +346,7 @@ export const djangoApi = createApi({
 			land_name: string;
 			page_name: string;
 			crisp_session_id?: string;
+			_token: string;
 		}>({
 			query: (body) => {
 				const csrfToken = getCsrfToken();
@@ -383,6 +387,7 @@ const useStartExportPdfMutation = djangoApi.useStartExportPdfMutation;
 const useLazyGetExportStatusQuery = djangoApi.useLazyGetExportStatusQuery;
 
 const useSubmitFeedbackMutation = djangoApi.useSubmitFeedbackMutation;
+const useGetAntispamTokenQuery = djangoApi.useGetAntispamTokenQuery;
 
 const {
 	useGetDepartementListQuery,
@@ -448,4 +453,5 @@ export {
 	useDeleteReportDraftMutation,
 	useGetCurrentUserQuery,
 	useSubmitFeedbackMutation,
+	useGetAntispamTokenQuery,
 };
diff --git a/home/api.py b/home/api.py
@@ -9,6 +9,7 @@
 from crisp.services import send_feedback_to_crisp
 from home.models import PageFeedback
 from public_data.models.administration import AdminRef, LandModel
+from utils.antispam import AntispamSerializerMixin
 from utils.mattermost import Mattermost
 
 logger = logging.getLogger(__name__)
@@ -18,7 +19,7 @@ class FeedbackThrottle(AnonRateThrottle):
     rate = "5/minute"
 
 
-class PageFeedbackSerializer(serializers.ModelSerializer):
+class PageFeedbackSerializer(AntispamSerializerMixin, serializers.ModelSerializer):
     crisp_session_id = serializers.CharField(required=False, allow_blank=True, write_only=True)
 
     class Meta:
@@ -46,6 +47,7 @@ def validate_page_url(self, value):
         return value
 
     def validate(self, data):
+        data = super().validate(data)
         land_type = data.get("land_type")
         land_id = data.get("land_id")
 
diff --git a/home/forms.py b/home/forms.py
@@ -1,10 +1,12 @@
 from django import forms
 from django.templatetags.static import static
 
+from utils.antispam import HoneypotFormMixin
+
 from .models import Newsletter, SatisfactionFormEntry
 
 
-class NewsletterForm(forms.ModelForm):
+class NewsletterForm(HoneypotFormMixin, forms.ModelForm):
     class Meta:
         model = Newsletter
         fields = ("email",)
diff --git a/home/templates/home/partials/newsletter_confirm_subscription.html b/home/templates/home/partials/newsletter_confirm_subscription.html
@@ -1,4 +1,4 @@
 <div class="fade-in fr-alert fr-alert--success fr-alert--sm" role="alert">
     <h3 class="fr-alert__title">Votre inscription a été prise en compte.</h3>
-    <p>Vous allez recevoir un e-mail vous demandant de confirmer votre souhait.</p>
+    <p>Vous allez recevoir un e-mail vous demandant de confirmer votre inscription.</p>
 </div>
diff --git a/home/templates/home/partials/newsletter_form.html b/home/templates/home/partials/newsletter_form.html
@@ -8,8 +8,11 @@ <h2 class="fr-h5">Abonnez-vous à notre lettre d'information</h2>
             <p class="fr-text--sm">Ne ratez rien de notre actualité.</p>
           </div>
           <div>
-            <form hx-post="{% url 'home:nwl-confirmation' %}">
+            <form hx-post="{% url 'home:nwl-confirmation' %}" hx-target="this" hx-swap="outerHTML">
               {% csrf_token %}
+              <div style="position:absolute;left:-9999px" aria-hidden="true">
+                <input type="text" name="website" autocomplete="off" tabindex="-1">
+              </div>
               <div class="fr-input-group">
                 <label class="fr-label" for="newsletter-email">
                   Votre adresse électronique (ex. : nom@domaine.fr)
diff --git a/project/api_urls.py b/project/api_urls.py
@@ -186,6 +186,7 @@
     NearestTerritoriesViewset,
 )
 from public_data.models.urbanisme import LogementVacantAutorisationStatsViewset
+from utils.antispam import generate_token
 
 app_name = "api"
 
@@ -194,6 +195,11 @@
 router.register(r"feedback", PageFeedbackViewSet, basename="feedback")
 
 
+@api_view(["GET"])
+def antispam_token_view(request):
+    return Response({"token": generate_token()})
+
+
 @api_view(["GET"])
 def me_view(request):
     """Retourne les informations de l'utilisateur connecté."""
@@ -396,6 +402,7 @@ def chart_view(request, id, land_type, land_id):
 urlpatterns = [
     path("", include(router.urls)),
     path("me/", me_view, name="me"),
+    path("token/", antispam_token_view, name="antispam-token"),
     path(
         "preference/<str:land_type>/<str:land_id>/",
         UserLandPreferenceAPIView.as_view(),
diff --git a/users/forms.py b/users/forms.py
@@ -8,6 +8,8 @@
 from django.urls import reverse
 from django.utils.safestring import mark_safe
 
+from utils.antispam import AntispamFormMixin
+
 from .models import User
 
 
@@ -23,7 +25,7 @@ class Meta:
         fields = ("email",)
 
 
-class SignupForm(forms.ModelForm):
+class SignupForm(AntispamFormMixin, forms.ModelForm):
     accept_privacy = forms.BooleanField(label="", required=True)
     password1 = forms.CharField(
         label="Mot de passe", widget=forms.PasswordInput(), validators=[validate_password], max_length=50
diff --git a/users/middleware.py b/users/middleware.py
@@ -19,6 +19,9 @@ def __call__(self, request):
             "/admin/",
             "/public/",
             "/api/",
+            "/webpack-dev/",
+            "/static/",
+            "/media/",
         ]
 
         # Vérifier si l'utilisateur est connecté et si son profil est incomplet
diff --git a/users/templates/users/signup.html b/users/templates/users/signup.html
@@ -65,6 +65,7 @@ <h2>S'inscrire avec ProConnect</h2>
               	</div>
               	<p class="fr-hr-or">ou</p>
                 <div>
+                    <style>#div_id_website{position:absolute;left:-9999px}</style>
                     <form {% if next %}action="?next={{ next }}"{% endif %} method="post">
                         {% csrf_token %}
                         {{ form|crispy }}
diff --git a/users/tests/test_signup.py b/users/tests/test_signup.py
@@ -1,6 +1,7 @@
 from django.test import TestCase
 
 from users.models import User
+from utils.antispam import generate_past_token
 from utils.validators import MISSING_SPECIAL_CHAR_ERROR
 
 valid_payload = {
@@ -10,6 +11,8 @@
     "password1": "ycvqB:U7aj%umbG3H<f8@D",
     "password2": "ycvqB:U7aj%umbG3H<f8@D",
     "accept_privacy": True,
+    "website": "",
+    "_token": generate_past_token(),
 }
 
 form_url = "/users/signup/"
diff --git a/utils/antispam.py b/utils/antispam.py
@@ -0,0 +1,62 @@
+import time
+
+from django import forms
+from django.core.signing import BadSignature, Signer
+from rest_framework import serializers
+
+
+def generate_token() -> str:
+    return Signer().sign(str(int(time.time())))
+
+
+def generate_past_token() -> str:
+    return Signer().sign(str(int(time.time()) - 10))
+
+
+def validate_token(token: str) -> bool:
+    try:
+        ts = int(Signer().unsign(token))
+        elapsed = time.time() - ts
+        return 3 <= elapsed <= 3600
+    except (BadSignature, ValueError):
+        return False
+
+
+class HoneypotFormMixin:
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields["website"] = forms.CharField(
+            required=False,
+            label="Ne pas remplir",
+            widget=forms.TextInput(attrs={"autocomplete": "off", "tabindex": "-1", "class": "fr-hidden"}),
+        )
+
+    def clean(self):
+        cleaned_data = super().clean()
+        if cleaned_data.get("website"):
+            raise forms.ValidationError("Erreur de validation")
+        return cleaned_data
+
+
+class AntispamFormMixin(HoneypotFormMixin):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields["_token"] = forms.CharField(widget=forms.HiddenInput(), initial=generate_token())
+
+    def clean(self):
+        cleaned_data = super().clean()
+        if not validate_token(cleaned_data.get("_token", "")):
+            raise forms.ValidationError("Erreur de validation")
+        return cleaned_data
+
+
+class AntispamSerializerMixin:
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields["_token"] = serializers.CharField(write_only=True)
+
+    def validate(self, data):
+        data = super().validate(data)
+        if not validate_token(data.pop("_token", "")):
+            raise serializers.ValidationError("Erreur de validation")
+        return data
diff --git a/utils/templatetags/utils_tags.py b/utils/templatetags/utils_tags.py
@@ -1,9 +1,16 @@
 from django import template
 from django.conf import settings
 
+from utils.antispam import generate_token
+
 register = template.Library()
 
 
+@register.simple_tag
+def antispam_token():
+    return generate_token()
+
+
 @register.inclusion_tag("utils/matomo_code.html", takes_context=True)
 def tracking_code(context):
     return {

Original file line number	Diff line number	Diff line change
`@@ -123,7 +123,7 @@ export const TerritoryIdentityCard = ({ landData, className }: TerritoryIdentity`
`123`	`123`
`124`	`124`	`const population = populationData?.[0]?.population \|\| null;`
`125`	`125`	`const hasCompetenceUrba = landData.competence_planification;`
`126`		`-console.log(landData.competence_planification)`
	`126`	`+`
`127`	`127`	`const identityItems = [`
`128`	`128`	`{`
`129`	`129`	`icon: "bi bi-geo-alt-fill",`