Can you post an edited version of FormProcessor then with your suggestion?
I’ve put CAPTCHA on all my form and still the SPAMMERS are getting passed it.
vbrilon, can you post the code for your suggestion for stopping the SPAMERS?
What exactly are the spammers sending to who?
I don’t know who because they are injecting bcc but the from address is wrong,
[email protected] which is the server default instead of
[email protected] so they are stripping out the from address.
The subject in normally correct although I have had a few with the subject changed, I know these ones are sent from the website because I checked the source code.
An example below of a SPAM which had the correct subject line and the from address had been stripped out so it read "Vitalized <
[email protected]>"
Name: cheap airfares
email: [email protected]
Message: cheap airfares [url=http://cheap2airfares.blogspot.com]cheap airfares[/url] http://cheap2airfares.blogspot.com
How did they find the website?: Search
-
MODX Staff
- 12,272 Posts
Post the code and call you’re using for your mail snippet.
Ryan Thrash, MODX Co-Founder
Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
The Call
[!eForm? &formid=`MyForm` &tpl=`QuickEmailForm` &to=`****@********.co.uk` &bcc=`***@***.com` &replyto=`youremail` &format=`yourname:Your name:string:1,message:Message:string:1,youremail:Your email:email:1,hear:How did you hear about us:string:1` &report=`contactsendemail` &subject=`Email from the website`&vericode=`1`!]
The Chuck
<p><b><span style="color:#FF0000;">[+validationmessage+]</span></b></p>
<form name="contact" action="[~[*id*]~]" method="post">
<input type="hidden" name="formid" value="MyForm" />
<fieldset>
<ol>
<li>
<label for="yourname">Your name:<em>*</em></label><br />
<input type="text" id="yourname" size="27" class="" name="yourname" value="[+yourname+]" />
</li>
<li>
<label for="youremail">Your eMail:<em>*</em></label><br />
<input type="text" id="youremail" size="27" class="" name="youremail" value="[+youremail+]" />
</li>
<li>
<label for="message">Message:<em>*</em></label><br />
<textarea cols="25" rows="5" id="message" class="" name="message">[+message+]</textarea>
</li>
<li>
<label for="hear">How did you find us?:<em>*</em></label><br />
<select name="hear" id="activity">
<option value="Search Engine">Search Engine</option>
<option value="Another website">Another website</option>
<option value="Other">Other</option>
</select>
</li>
</ol>
<div style="margin:10px 0px 10px 0px;">
<strong>Please enter the verification code below: (to prevent spam)</strong><br />
<img align="top" src="manager/includes/veriword.php?rand=[+vericode+]" width="148" height="60" alt="If you have trouble reading the code, click on the code itself to generate a new random code." style="margin:5px 0px 5px 0px; border: 1px solid #003399" /><br />
<input type="text" name="vericode" size="20" />
</div>
<div class="send">
<input type="submit" class="submit" value="Send email" alt="Click here to send an email" />
</div>
</form>
Is there anything else you need?
I have edited the spam post so that it is in a code block, rather than giving the spammers the oxygen of this site’s pagerank with two working links.
I read in Wired that sploggers (spam bloggers) are paying actual humans to fill in forms and "crack" captcha codes - whilst we can program to stop robots, we can’t distinguish low-paid human form fillers from genuine customers.
I wonder if the presence of the captcha code (or the words "to prevent spam") possibly makes these people think there’s some benefit in filling the form in.
Actually, lets refocus. There are 2 issues:
1) Users/Robots filling in form to submit links to website / admin
2) Users/Robots abusing form to send emails to someone on another server.
This thread was originally about issue 2. Web_designer, you’ve given evidence of issue 1, although you also say that the from address has been changed in some cases. Have you any evidence that your form is being exploited to send mail to others?
Thanks for the quick responce.
Would this suggestion work?
A more sane approach would be to allow through only known good text. I.E., don’t bother looking for bad code in your input. Only allow [A-Za-z0-9\.\@\-] or something similar to prevent bad stuff from getting through.
If you think it would can you post the code to make it work?
I also read somewhere that a way to stop all SPAM is to convert @ to [at] instead (of course excluding the to: in the form)
That approach, applied here, would basically have stripped the bbcode from the message, but you would still have gotten the message. And on your work site, you want people to pass through web addresses because they may have a legcay site that they wish to upgrade to a CMS.
I still don’t know what the extent of your spam problem is, and you don’t seem to have taken on board what I have said.
If it is just that you get people filling your inbox with promotional messages, you can’t avoid it. If people are abusing your server to send out messages to lots of people as if it is from you, then you have a problem that can be tackled and stopped. But it is the "sending messages to unauthorised people" that is the bit that can be stopped, not the "sending promotional messages". If you invite input on your site, you are going to get people shoving links at you. It is quicker for them to fill in the form than it is for them to decide whether it is remotely appropriate.
The @ to [at] is to stop your email address being harvested from your site by a robot, but I would imagine they’ve smartened up to this. The only solution is to use mail forms instead, or to display your email address in an image not unlike a Captcha image.
