From b5835c85f50dbd8aef5053694151d00501d3b619 Mon Sep 17 00:00:00 2001 From: Fabrizio Balliano Date: Wed, 5 Apr 2023 11:23:31 +0100 Subject: [PATCH 1/2] Added form key validation to Contacts form --- .../Contacts/controllers/IndexController.php | 28 ++++++++++--------- .../base/default/template/contacts/form.phtml | 1 + .../rwd/default/template/contacts/form.phtml | 1 + app/locale/en_US/Mage_Contacts.csv | 3 +- 4 files changed, 19 insertions(+), 14 deletions(-) diff --git a/app/code/core/Mage/Contacts/controllers/IndexController.php b/app/code/core/Mage/Contacts/controllers/IndexController.php index 4401b88bdec..61488eb3408 100644 --- a/app/code/core/Mage/Contacts/controllers/IndexController.php +++ b/app/code/core/Mage/Contacts/controllers/IndexController.php @@ -59,25 +59,24 @@ public function postAction() /** @var Mage_Core_Model_Translate $translate */ $translate->setTranslateInline(false); try { + if (!$this->_validateFormKey()) { + Mage::throwException($this->__('Invalid Form Key. Please submit your request again.')); + } + $postObject = new Varien_Object(); $postObject->setData($post); $error = false; - if (!Zend_Validate::is(trim($post['name']), 'NotEmpty')) { $error = true; - } - - if (!Zend_Validate::is(trim($post['comment']), 'NotEmpty')) { + } elseif (!Zend_Validate::is(trim($post['comment']), 'NotEmpty')) { $error = true; - } - - if (!Zend_Validate::is(trim($post['email']), 'EmailAddress')) { + } elseif (!Zend_Validate::is(trim($post['email']), 'EmailAddress')) { $error = true; } if ($error) { - throw new Exception(); + Mage::throwException($this->__('Unable to submit your request. Please, try again later')); } $mailTemplate = Mage::getModel('core/email_template'); /** @var Mage_Core_Model_Email_Template $mailTemplate */ @@ -92,19 +91,22 @@ public function postAction() ); if (!$mailTemplate->getSentSuccess()) { - throw new Exception(); + Mage::throwException($this->__('Unable to submit your request. Please, try again later')); } $translate->setTranslateInline(true); - Mage::getSingleton('customer/session')->addSuccess(Mage::helper('contacts')->__('Your inquiry was submitted and will be responded to as soon as possible. Thank you for contacting us.')); + Mage::getSingleton('customer/session')->addSuccess($this->__('Your inquiry was submitted and will be responded to as soon as possible. Thank you for contacting us.')); $this->_redirect('*/*/'); return; - } catch (Exception $e) { + } catch (Mage_Core_Exception $e) { $translate->setTranslateInline(true); - - Mage::getSingleton('customer/session')->addError(Mage::helper('contacts')->__('Unable to submit your request. Please, try again later')); + Mage::logException($e); + Mage::getSingleton('customer/session')->addError($e->getMessage()); + } catch (Throwable $e) { + Mage::logException($e); + Mage::getSingleton('customer/session')->addError($this->__('Unable to submit your request. Please, try again later')); $this->_redirect('*/*/'); return; } diff --git a/app/design/frontend/base/default/template/contacts/form.phtml b/app/design/frontend/base/default/template/contacts/form.phtml index 3c98afb1a34..25e37672274 100644 --- a/app/design/frontend/base/default/template/contacts/form.phtml +++ b/app/design/frontend/base/default/template/contacts/form.phtml @@ -18,6 +18,7 @@

__('Contact Us') ?>

+ getBlockHtml('formkey') ?>

__('Contact Information') ?>

    diff --git a/app/design/frontend/rwd/default/template/contacts/form.phtml b/app/design/frontend/rwd/default/template/contacts/form.phtml index 95499047a70..0b1c94b0ddb 100644 --- a/app/design/frontend/rwd/default/template/contacts/form.phtml +++ b/app/design/frontend/rwd/default/template/contacts/form.phtml @@ -18,6 +18,7 @@

    __('Contact Us') ?>

+ getBlockHtml('formkey') ?>

__('Contact Information') ?>

__('* Required Fields') ?>

diff --git a/app/locale/en_US/Mage_Contacts.csv b/app/locale/en_US/Mage_Contacts.csv index 277333d7e51..0bcf27bc679 100644 --- a/app/locale/en_US/Mage_Contacts.csv +++ b/app/locale/en_US/Mage_Contacts.csv @@ -10,9 +10,10 @@ "Email Sender","Email Sender" "Email Template","Email Template" "Enable Contact Us","Enable Contact Us" +"Invalid Form Key. Please submit your request again.","Invalid Form Key. Please submit your request again." "Name","Name" "Send Emails To","Send Emails To" "Submit","Submit" "Telephone","Telephone" -"Unable to submit your request. Please, try again later","Unable to submit your request. Please, try again later" +"Unable to submit your request. Please, try again later","Unable to submit your request. Please, try again later." "Your inquiry was submitted and will be responded to as soon as possible. Thank you for contacting us.","Your inquiry was submitted and will be responded to as soon as possible. Thank you for contacting us." From e47047226e7f3a4818cf04d38d5d4c2a3edc85fc Mon Sep 17 00:00:00 2001 From: Fabrizio Balliano Date: Mon, 10 Apr 2023 17:01:38 +0200 Subject: [PATCH 2/2] Suggestions by @addison74 --- app/code/core/Mage/Contacts/controllers/IndexController.php | 6 +++--- app/locale/en_US/Mage_Contacts.csv | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/app/code/core/Mage/Contacts/controllers/IndexController.php b/app/code/core/Mage/Contacts/controllers/IndexController.php index 61488eb3408..5877d442220 100644 --- a/app/code/core/Mage/Contacts/controllers/IndexController.php +++ b/app/code/core/Mage/Contacts/controllers/IndexController.php @@ -76,7 +76,7 @@ public function postAction() } if ($error) { - Mage::throwException($this->__('Unable to submit your request. Please, try again later')); + Mage::throwException($this->__('Unable to submit your request. Please try again later')); } $mailTemplate = Mage::getModel('core/email_template'); /** @var Mage_Core_Model_Email_Template $mailTemplate */ @@ -91,7 +91,7 @@ public function postAction() ); if (!$mailTemplate->getSentSuccess()) { - Mage::throwException($this->__('Unable to submit your request. Please, try again later')); + Mage::throwException($this->__('Unable to submit your request. Please try again later')); } $translate->setTranslateInline(true); @@ -106,7 +106,7 @@ public function postAction() Mage::getSingleton('customer/session')->addError($e->getMessage()); } catch (Throwable $e) { Mage::logException($e); - Mage::getSingleton('customer/session')->addError($this->__('Unable to submit your request. Please, try again later')); + Mage::getSingleton('customer/session')->addError($this->__('Unable to submit your request. Please try again later')); $this->_redirect('*/*/'); return; } diff --git a/app/locale/en_US/Mage_Contacts.csv b/app/locale/en_US/Mage_Contacts.csv index 0bcf27bc679..f49f24da895 100644 --- a/app/locale/en_US/Mage_Contacts.csv +++ b/app/locale/en_US/Mage_Contacts.csv @@ -15,5 +15,5 @@ "Send Emails To","Send Emails To" "Submit","Submit" "Telephone","Telephone" -"Unable to submit your request. Please, try again later","Unable to submit your request. Please, try again later." +"Unable to submit your request. Please try again later","Unable to submit your request. Please try again later." "Your inquiry was submitted and will be responded to as soon as possible. Thank you for contacting us.","Your inquiry was submitted and will be responded to as soon as possible. Thank you for contacting us."