From 1d5596db5f5b2ae826a469344518d627b3c95e3f Mon Sep 17 00:00:00 2001
From: Artemii Peretiachenko <artemium@MacBook-Pro-Artemii.local>
Date: Sun, 26 Jul 2026 19:16:36 +0200
Subject: [PATCH] Fix contact honeypot so browser autofill does not swallow
 submissions.

Rename the trap field away from "website" and keep legacy detection so real messages still reach Telegram.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 api/README.md          |  2 +-
 api/contact_server.py  |  8 +++++---
 en/index.html          |  4 ++--
 en/terminal/index.html |  4 ++--
 index.html             |  4 ++--
 src/index.html         |  4 ++--
 src/terminal.html      |  4 ++--
 styles.css             | 14 ++++++++++++--
 terminal/index.html    |  4 ++--
 ua/index.html          |  4 ++--
 ua/terminal/index.html |  4 ++--
 11 files changed, 34 insertions(+), 22 deletions(-)

diff --git a/api/README.md b/api/README.md
index 5d7ba4f..98a675c 100644
--- a/api/README.md
+++ b/api/README.md
@@ -104,6 +104,6 @@ Backup is written even if Telegram fails (`telegram_ok: false`), so you still ha
 
 ## Behaviour notes
 
-- Honeypot field `website`: if filled, returns `200` without notifying Telegram or writing a backup.
+- Honeypot field `hp_company` (legacy `website` still checked): if filled, returns `200` without notifying Telegram or writing a backup.
 - In-memory rate limit: 5 POSTs per IP per 60 seconds → `429`.
 - Field limits: name/contact ≤ 200 chars, message ≤ 4000.
diff --git a/api/contact_server.py b/api/contact_server.py
index b61c10f..80fbf80 100644
--- a/api/contact_server.py
+++ b/api/contact_server.py
@@ -114,9 +114,11 @@ def validate_fields(data: dict) -> tuple[str, str, str] | str:
         return "invalid"
 
     # Honeypot — treat as success upstream; caller checks separately.
-    website = data.get("website", "")
-    if isinstance(website, str) and website.strip():
-        return "honeypot"
+    # Accept legacy "website" (autofill magnets) and current "hp_company".
+    for pot in ("hp_company", "website"):
+        raw_pot = data.get(pot, "")
+        if isinstance(raw_pot, str) and raw_pot.strip():
+            return "honeypot"
 
     def field(key: str, max_len: int) -> str | None:
         raw = data.get(key, "")
diff --git a/en/index.html b/en/index.html
index cbdddb3..900161b 100644
--- a/en/index.html
+++ b/en/index.html
@@ -429,8 +429,8 @@
 
     <form id="contactForm" data-status-loading="..." data-status-success="Sent ✓" data-status-error="Could not send. Please try again.">
       <label class="hp-field" aria-hidden="true">
-        <span>Website</span>
-        <input type="text" name="website" tabindex="-1" autocomplete="off">
+        <span>Company fax</span>
+        <input type="text" name="hp_company" value="" tabindex="-1" autocomplete="off">
       </label>
 
       <label>
diff --git a/en/terminal/index.html b/en/terminal/index.html
index 6ca6651..32c7cab 100644
--- a/en/terminal/index.html
+++ b/en/terminal/index.html
@@ -278,8 +278,8 @@
 
     <form id="contactForm" data-status-loading="..." data-status-success="Sent ✓" data-status-error="Could not send. Please try again.">
       <label class="hp-field" aria-hidden="true">
-        <span>Website</span>
-        <input type="text" name="website" tabindex="-1" autocomplete="off">
+        <span>Company fax</span>
+        <input type="text" name="hp_company" value="" tabindex="-1" autocomplete="off">
       </label>
 
       <label>
diff --git a/index.html b/index.html
index 96fdead..f070bda 100644
--- a/index.html
+++ b/index.html
@@ -429,8 +429,8 @@
 
     <form id="contactForm" data-status-loading="..." data-status-success="Отправлено ✓" data-status-error="Не удалось отправить. Попробуйте ещё раз.">
       <label class="hp-field" aria-hidden="true">
-        <span>Website</span>
-        <input type="text" name="website" tabindex="-1" autocomplete="off">
+        <span>Company fax</span>
+        <input type="text" name="hp_company" value="" tabindex="-1" autocomplete="off">
       </label>
 
       <label>
diff --git a/src/index.html b/src/index.html
index f0ee100..a1dae8c 100644
--- a/src/index.html
+++ b/src/index.html
@@ -334,8 +334,8 @@
 
     <form id="contactForm" data-status-loading="{{FORM_STATUS_LOADING}}" data-status-success="{{FORM_STATUS_SUCCESS}}" data-status-error="{{FORM_STATUS_ERROR}}">
       <label class="hp-field" aria-hidden="true">
-        <span>Website</span>
-        <input type="text" name="website" tabindex="-1" autocomplete="off">
+        <span>Company fax</span>
+        <input type="text" name="hp_company" value="" tabindex="-1" autocomplete="off">
       </label>
 
       <label>
diff --git a/src/terminal.html b/src/terminal.html
index e295b00..ca66bdb 100644
--- a/src/terminal.html
+++ b/src/terminal.html
@@ -183,8 +183,8 @@
 
     <form id="contactForm" data-status-loading="{{FORM_STATUS_LOADING}}" data-status-success="{{FORM_STATUS_SUCCESS}}" data-status-error="{{FORM_STATUS_ERROR}}">
       <label class="hp-field" aria-hidden="true">
-        <span>Website</span>
-        <input type="text" name="website" tabindex="-1" autocomplete="off">
+        <span>Company fax</span>
+        <input type="text" name="hp_company" value="" tabindex="-1" autocomplete="off">
       </label>
 
       <label>
diff --git a/styles.css b/styles.css
index 356f4a6..88101e7 100644
--- a/styles.css
+++ b/styles.css
@@ -441,8 +441,18 @@ a:hover{opacity:0.7;}
 }
 #contactForm label{display:block; margin-bottom:20px; font-size:13px; color:var(--text);}
 #contactForm .hp-field{
-  position:absolute; left:-10000px; top:auto; width:1px; height:1px;
-  overflow:hidden; opacity:0; pointer-events:none;
+  position:absolute !important;
+  left:-10000px !important;
+  top:auto !important;
+  width:1px !important;
+  height:1px !important;
+  margin:0 !important;
+  padding:0 !important;
+  overflow:hidden !important;
+  clip:rect(0,0,0,0) !important;
+  border:0 !important;
+  opacity:0 !important;
+  pointer-events:none !important;
 }
 #contactForm input, #contactForm textarea{
   width:100%; margin-top:6px; padding:10px; border:1px solid var(--border);
diff --git a/terminal/index.html b/terminal/index.html
index 43b9f8d..8b96426 100644
--- a/terminal/index.html
+++ b/terminal/index.html
@@ -278,8 +278,8 @@
 
     <form id="contactForm" data-status-loading="..." data-status-success="Отправлено ✓" data-status-error="Не удалось отправить. Попробуйте ещё раз.">
       <label class="hp-field" aria-hidden="true">
-        <span>Website</span>
-        <input type="text" name="website" tabindex="-1" autocomplete="off">
+        <span>Company fax</span>
+        <input type="text" name="hp_company" value="" tabindex="-1" autocomplete="off">
       </label>
 
       <label>
diff --git a/ua/index.html b/ua/index.html
index 9b7a4e7..6023a55 100644
--- a/ua/index.html
+++ b/ua/index.html
@@ -429,8 +429,8 @@
 
     <form id="contactForm" data-status-loading="..." data-status-success="Надіслано ✓" data-status-error="Не вдалося надіслати. Спробуйте ще раз.">
       <label class="hp-field" aria-hidden="true">
-        <span>Website</span>
-        <input type="text" name="website" tabindex="-1" autocomplete="off">
+        <span>Company fax</span>
+        <input type="text" name="hp_company" value="" tabindex="-1" autocomplete="off">
       </label>
 
       <label>
diff --git a/ua/terminal/index.html b/ua/terminal/index.html
index d72fcdc..6a0a97b 100644
--- a/ua/terminal/index.html
+++ b/ua/terminal/index.html
@@ -278,8 +278,8 @@
 
     <form id="contactForm" data-status-loading="..." data-status-success="Надіслано ✓" data-status-error="Не вдалося надіслати. Спробуйте ще раз.">
       <label class="hp-field" aria-hidden="true">
-        <span>Website</span>
-        <input type="text" name="website" tabindex="-1" autocomplete="off">
+        <span>Company fax</span>
+        <input type="text" name="hp_company" value="" tabindex="-1" autocomplete="off">
       </label>
 
       <label>