Timeline for Basic contact form
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 29, 2015 at 23:42 | comment | added | Sumurai8 | Partly. You would still allow people to execute the script, even though it is not directly visible anymore. See this question for more details. You could transfer your mail php page into a function that takes 4 parameters and call that function. That would get rid of the session variables completely. | |
| Dec 29, 2015 at 21:41 | comment | added | user273072545345 |
so you're suggesting that instead of using header, I do <?php include 'contact9SessionsCRSF2.php'?>
|
|
| Dec 29, 2015 at 20:25 | comment | added | Sumurai8 | Merging the two files. Only allowing it as include. | |
| Dec 29, 2015 at 20:10 | comment | added | user273072545345 |
not sure about what you meant by the comment of "image" on a forum ... but you do have a point that anyone who knows the name of contact9SessionsCRSF.php which is the phpMailer file as one can see from my post above ... but since I'm not using 'POST OR GET, but rather header this is the only way I knew how to get the sessions variables over to the phpMailer form. Any ideas how to make it more secure?1
|
|
| Dec 29, 2015 at 20:06 | history | edited | Sumurai8 | CC BY-SA 3.0 |
added 602 characters in body
|
| Dec 29, 2015 at 20:02 | comment | added | Sumurai8 |
I was partly wrong about the guards. When you inspect the requests in your browser, it will show the mailing page as a seperate request. Refreshing should indeed just reload the error or the result rather than resending the email. Going back in the browser will I guess go back to the last non-redirect. It still partly stands, because the script itself should verify that it is using the correct content, not some arbitrary other script. This setup is still exploitable, because I can, for example, put an "image" on a forum, which will actually redirect to yoursite.com/contact9SessionsCRSF2.php.
|
|
| Dec 29, 2015 at 19:31 | comment | added | user273072545345 |
just realized that I do guard against the reloading of the page sort of ... when the page is submitted, the user is redirected to either contactError.html or contactResult2.html ... so ... it does guard against the sessions being reloaded?
|
|
| Dec 29, 2015 at 19:23 | comment | added | user273072545345 |
3) didn't realize that the test_input function doesn't do what it's supposed to do ... oh ... unless you're looking at the name of the function, and the fact that it's a misnomer of its function? 4) will remove the second token generated in the else at the bottom
|
|
| Dec 29, 2015 at 19:23 | comment | added | user273072545345 |
ok, please forgive me in advance if I misunderstood anything you said here ... 1) both the forms contactError.html and contactResult2.html do have proper html-boilerplate around them ... 2) I thought that my first script checked that the session variables are there before it was directed to the contactResult1.html ... not sure how to guard against reloading of the page though ...
|
|
| Dec 29, 2015 at 10:17 | history | edited | Sumurai8 | CC BY-SA 3.0 |
+more
|
| Dec 29, 2015 at 10:02 | history | answered | Sumurai8 | CC BY-SA 3.0 |