From ac71b5880727a274e1d9ee7abc4080678e04df43 Mon Sep 17 00:00:00 2001 From: Wytze van der Raay Date: Thu, 17 Jan 2013 15:08:07 +0000 Subject: [PATCH] Fix for https://bugs.cacert.org/view.php?id=795 "contact form does not signal whether filed request is senstive or open" --- pages/account/40.php | 41 +++++++++++++++++++--------------------- pages/index/11.php | 39 ++++++++++++++++++-------------------- www/account.php | 43 +++++++++++++++++++++--------------------- www/index.php | 40 +++++++++++++++++++++------------------ www/styles/default.css | 4 ++++ 5 files changed, 85 insertions(+), 82 deletions(-) diff --git a/pages/account/40.php b/pages/account/40.php index 4877d79..a809595 100644 --- a/pages/account/40.php +++ b/pages/account/40.php @@ -29,15 +29,26 @@ if(!array_key_exists('secrethash',$_SESSION['_config'])) $_SESSION['_config']['s

- + - - - - - - - +

+ + +

+
: 
:
:
">
+ + + + + + + + + + + + +
:
:
:
:
">">
@@ -50,20 +61,6 @@ if(!array_key_exists('secrethash',$_SESSION['_config'])) $_SESSION['_config']['s

-

-

-
- - - - - - - - -
:
:
:
">
-
-

- + +

+ + +

- - - - - - + + + + + + + + + + + + +
: 
:
:
">
:
:
:
:
">">
@@ -50,20 +61,6 @@ if(!array_key_exists('secrethash',$_SESSION['_config'])) $_SESSION['_config']['s

-

-

-
- - - - - - - - -
:
:
:
">
-
-

bugs.cacert.org")?>

diff --git a/www/account.php b/www/account.php index 0b32c2c..c7f34a3 100644 --- a/www/account.php +++ b/www/account.php @@ -25,34 +25,35 @@ } else if($id == 19) { include_once("../pages/account/19.php"); exit; - } else if($oldid == 40 && $_REQUEST['process'] != "" && $_POST['support'] != "yes") { - $who = stripslashes($_REQUEST['who']); - $email = stripslashes($_REQUEST['email']); - $subject = stripslashes($_REQUEST['subject']); - $message = stripslashes($_REQUEST['message']); - - $message = "From: $who\nEmail: $email\nSubject: $subject\n\nMessage:\n".$message; - - sendmail("support@cacert.org", "[CAcert.org] ".$subject, $message, $email, $email, "", "CAcert Website"); - showheader(_("Welcome to CAcert.org")); - echo _("Your message has been sent."); - showfooter(); - exit; - } else if($oldid == 40 && $_REQUEST['process'] != "" && $_POST['support'] == "yes") { + } else if($oldid == 40 && $_REQUEST['process'] != "") { $who = stripslashes($_REQUEST['who']); $email = stripslashes($_REQUEST['email']); $subject = stripslashes($_REQUEST['subject']); $message = stripslashes($_REQUEST['message']); + //check for spam via honeypot + if(!isset($_REQUEST['robotest']) || !empty($_REQUEST['robotest'])){ + echo _("Form could not be sent."); + showfooter(); + exit; + } - $message = "From: $who\nEmail: $email\nSubject: $subject\n\nMessage:\n".$message; + $message = "From: $who\nEmail: $email\nSubject: $subject\n\nMessage:\n".$message; + if (isset($process[0])){ + sendmail("cacert-support@lists.cacert.org", "[website form email]: ".$subject, $message, "website-form@cacert.org", "cacert-support@lists.cacert.org, $email", "", "CAcert-Website"); + showheader(_("Welcome to CAcert.org")); + echo _("Your message has been sent to the general support list."); + showfooter(); + exit; + } + if (isset($process[1])){ + sendmail("support@cacert.org", "[CAcert.org] ".$subject, $message, $email, "", "", "CAcert Support"); + showheader(_("Welcome to CAcert.org")); + echo _("Your message has been sent."); + showfooter(); + exit; + } - sendmail("cacert-support@lists.cacert.org", "[website form email]: ".$subject, $message, "website-form@cacert.org", "cacert-support@lists.cacert.org, $email", "", "CAcert Website"); - - showheader(_("Welcome to CAcert.org")); - echo _("Your message has been sent to the general support list."); - showfooter(); - exit; } else if($id == 51 && $_GET['img'] == "show") { $query = "select * from `tverify` where `id`='".intval($_GET['photoid'])."' and `modified`=0"; $res = mysql_query($query); diff --git a/www/index.php b/www/index.php index 41b6d7a..35d22d7 100644 --- a/www/index.php +++ b/www/index.php @@ -563,6 +563,13 @@ require_once('../includes/lib/l10n.php'); $subject = stripslashes($_REQUEST['subject']); $message = stripslashes($_REQUEST['message']); $secrethash = $_REQUEST['secrethash2']; + + //check for spam via honeypot + if(!isset($_REQUEST['robotest']) || !empty($_REQUEST['robotest'])){ + echo _("Form could not be sent."); + showfooter(); + exit; + } if($_SESSION['_config']['secrethash'] != $secrethash || $secrethash == "" || $_SESSION['_config']['secrethash'] == "") { @@ -603,26 +610,23 @@ require_once('../includes/lib/l10n.php'); } } - if($oldid == 11 && $process != "" && $_REQUEST['support'] != "yes") - { - $message = "From: $who\nEmail: $email\nSubject: $subject\n\nMessage:\n".$message; - - sendmail("support@cacert.org", "[CAcert.org] ".$subject, $message, $email, "", "", "CAcert Support"); - showheader(_("Welcome to CAcert.org")); - echo _("Your message has been sent."); - showfooter(); - exit; - } - - if($oldid == 11 && $process != "" && $_REQUEST['support'] == "yes") + if($oldid == 11 && $process != "") { $message = "From: $who\nEmail: $email\nSubject: $subject\n\nMessage:\n".$message; - - sendmail("cacert-support@lists.cacert.org", "[website form email]: ".$subject, $message, "website-form@cacert.org", "cacert-support@lists.cacert.org, $email", "", "CAcert-Website"); - showheader(_("Welcome to CAcert.org")); - echo _("Your message has been sent to the general support list."); - showfooter(); - exit; + if (isset($process[0])){ + sendmail("cacert-support@lists.cacert.org", "[website form email]: ".$subject, $message, "website-form@cacert.org", "cacert-support@lists.cacert.org, $email", "", "CAcert-Website"); + showheader(_("Welcome to CAcert.org")); + echo _("Your message has been sent to the general support list."); + showfooter(); + exit; + } + if (isset($process[1])){ + sendmail("support@cacert.org", "[CAcert.org] ".$subject, $message, $email, "", "", "CAcert Support"); + showheader(_("Welcome to CAcert.org")); + echo _("Your message has been sent."); + showfooter(); + exit; + } } if(!array_key_exists('signup',$_SESSION) || $_SESSION['signup']['year'] < 1900) diff --git a/www/styles/default.css b/www/styles/default.css index 9fdd85c..c97e429 100644 --- a/www/styles/default.css +++ b/www/styles/default.css @@ -651,3 +651,7 @@ div.footerbar { padding: 10px 10px 10px 10px; } +/************ Honeypot ***********/ + +.robotic { display: none; } +