[Security] Bundled snippet ContactForm

Could be used to send spam. Better check $_POST[’name’] (and also $_POST[’to’] if $receipient_type != "static):
What I mean is something like that:
Otherwise additional headers could be inserted by bad guys to send spam.

Thanks for pointing that out, I also notice that if we are not using static subject, the intruder/spammer can hijack the email form as well.



I have been dealing with it last week, when a spammer hijack into our company’s email form. Man, they are smart, I mean they know what they are doing, while we don’t know what we are doing by installing those crappy oder form system. Hehehee... I got it transfered to eForm snipept created by Raymond I believe. If you have time, would mind checcking that snippet out as well Netnoise

Thanks for sharing NetNoise. Brilliant findings!

Do you have a fix ready for the ContactForm?

Will have a fix until Monday

Should work now safely:

Doesn’t work at all. Replaced stock 0.9.1 version with this, and got a general failure "Sorry...Try again later" message. Replace it with the original and it works fine.

Could you please send me your php_errorlog-message or something else that helps me to catch the error?

(I tested it again and again and it works without any errors on my MODx-Standard-Install.)

I’ll give it another try and see what happens.

I just dropped it in the snippet code as it came from the txt file. It gives me a "Sorry, there was an error! Please try again later." message. I don’t see any other error messages.

Ok, I put an echo statement to echo the variables just before calling the mail() function. With the new one, the $to variable is still the unparsed [(emailsender)] tag, while in the old one it’s parsed to the actual email address.

I set the sendTo argument in the snippet call using [(emailsender)] and it works fine. For some reason it’s not parsing the tag when used as the default.

I also jazzed it up a bit by adding From: and X-Mailer: to the $headers field, taken directly from the php manual.