5
\$\begingroup\$

I have created a script which presents a popup on every 5th pageview.

I would like to try to use just PHP cookies. However, due to the requirement of setting them before any content is output, it has made it tricky.

I would also like to just include this script and have it run. At the moment I believe the breaks are stopping the rest of the page/content underneath rendering. Standalone, however, works great.

Anyway, it's pretty ugly, and I was wondering if I could have some feedback.

<?php 


    if($_POST['noDelay'] === 'true'){
        $showPopups = '3';
    }else if (!isset($_POST['submit'])){
        popUp();
    }else if($_COOKIE['submitCv'] === '2'){
        $showPopups = '0';
    }else{
        $showPopups = '1';
    } 



    switch ($_SERVER['SERVER_NAME']) {
        case 'domain1.com':
            $border = '#FB7E12';
            $background = '-moz-linear-gradient(center top , #E25704, #FB7E12 100%) repeat scroll 0% 0% transparent';
            break;
        case 'domain2.com':
            $border = '#651727';
            $background = '-moz-linear-gradient(center top , #651727, #651727 100%) repeat scroll 0% 0% transparent';
            break;
        case 'domain3.com':
            $border = '#0099CA';
            $background = '-moz-linear-gradient(center top , #0099CA, #0099CA 100%) repeat scroll 0% 0% transparent';
            break;

?>


<style type="text/css">
    @media only screen and (min-width : 650px) {

        h4{color: #FB7E12;font-size: 2em;}
        #uploadCv{font-size: 20px;}
        #uploadCv input{ padding: 2.5px; display: block; height: 30px; margin: 20px 0;}
        #buttons{width: 264px; margin: 20px auto;}

        #popup form label{ display: inline;float: left;width: 150px;}
        #popupBlack{ height: 100%; width: 100%; position: fixed; background-color: rgba(0,0,0,0.7); z-index: 100; top: 0; left: 0;}
        #buttons input{height: auto;margin: 0 10px;}

       input[type="submit"]:hover, input[type="button"]:hover, button:hover, .button:hover {
            background: <?php echo $background; ?>;
            border: <?php echo $border; ?>;
        }
        input[type="submit"], input[type="button"], button, .button {
            border: 1px solid #FB7E12;
            background: #FB7E12;
            padding: 5px 10px;
            font-weight: bold;
            color: #FFF;
            cursor: pointer;
            height: 35px;
            font-size: 1em;
            float: left;
            min-width: 100px;
            margin: 0 16px;
        }



        #popupWrap{position: fixed; top: 50%; margin-top: -200px;/* half of #popup height*/
            left: 0;
            width: 100%;
            z-index: 101;
        }

        #popup{
            width: 500px;
            margin-left: auto;
            margin-right: auto;
            height: 400px;
            border:1px solid black; 
            padding:0 20px;
            background-color: white;
            z-index: 101;
        }
    }
</style>


<script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script>

<script type="text/javascript">


//update the function below, give the close button a different ID to the return.

$(document).ready(function(){

    $("#popupBlack, #closePopup").click(function(){
        $("#popupBlack, #popup").hide();
        document.cookie="submitCv=1;path=/";
    });

    $("#closePopupPerm").click(function(){
        $("#popupBlack, #popup").hide();
        document.cookie="submitCv=2;path=/";
    });

});


</script>
    <div id="popupBlack"></div>
    <div id="popupWrap">
        <div id="popup">
            <h4>Upload your cv now</h4>
            <form action="uploadCvContained.php?showPopup" method="post" enctype='multipart/form-data' id="uploadCv">
                <label for="firstName">First Name</label>
                    <input type="text" name="firstName" placeholder="First Name" value="<?php if(isset($_POST['firstName'])){echo $_POST['firstName'];} ?>" required autofocus/>
                <label>Last Name</label>
                    <input type="text" name="lastName" placeholder="Last Name" value="<?php if(isset($_POST['lastName'])){echo $_POST['lastName'];} ?>" required />
                <label>Email</label>
                    <input type="email" name="Email" placeholder="Email Address" value="<?php if(isset($_POST['Email'])){echo $_POST['Email'];} ?>" required />
                    <input type="hidden" name="noDelay" value="true" />
                    <input type="file" name="attachment"  required style="margin:0;height:auto;"/>
                    <p style="font-size:0.8em;padding:0;margin:0;">Accepted file types: pdf, doc, docx, rtf, txt and rtx</p>
                    <div id="buttons">
                        <input type="submit" name="submit" value="Submit" />
                        <input type="submit" name="cancel" value="Cancel" id="closePopup" />
                    </div>
            </form>
        </div>
    </div>
    <div id="popupBlack"></div>
    <div id="popupWrap">
        <div id="popup">
            <h4>Error</h4>
            <p>The file doesnt meet the upload criteria, please try again</p>
            <form action="uploadCvContained.php" method="post">
                <input type="submit" formnovalidate name="cancel" value="Return" id="returnPopup"/>
                <input type="hidden" name="firstName" value="<?php echo $_POST['firstName'];?>" /> 
                <input type="hidden" name="lastName" value="<?php echo $_POST['lastName'];?>" /> 
                <input type="hidden" name="Email" value="<?php echo $_POST['Email'];?>" />
                <input type="hidden" name="noDelay" value="true" />
            </form>
            <script>document.cookie = "submitCv=0;max-age=60000000;path=/"</script>
        </div>
    </div>

<?php
    header("Location:".$_SERVER[SCRIPT_NAME]);
    return; 
}?>


<?php

    $firstName = ucwords(preg_replace ( "/[^\.\,\-\_\'\"\@\?\!\:\$ a-zA-Z0-9()]/", "", $_POST['firstName'] ));
        $lastName = ucwords(preg_replace ( "/[^\.\,\-\_\'\"\@\?\!\:\$ a-zA-Z0-9()]/", "", $_POST['lastName'] ));
    $customerEmail = preg_replace ( "/[^\.\,\-\_\'\"\@\?\!\:\$ a-zA-Z0-9()]/", "", $_POST['Email'] );

    $customerDetails = $firstName." ".$lastName."\r\n".$customerEmail;


function mail_attachment($filename, $path, $mailto, $from_mail, $from_name, $replyto, $subject, $message) {

    $file  = $_FILES['attachment']['tmp_name'];

    $file_size = filesize($file);
    $handle = fopen($file, "r");
    $content = fread($handle, $file_size);
    fclose($handle);
    $content = chunk_split(base64_encode($content));
    $uid = md5(uniqid(time()));
    $name = basename($file);
    $header = "From: ".$from_name." <".$from_mail.">\r\n";
    $header .= "Reply-To: ".$replyto."\r\n";
    $header .= "Bcc: bcc@domain2.com" . "\r\n";
    $header .= "MIME-Version: 1.0\r\n";
    $header .= "Content-Type: multipart/mixed; boundary=\"".$uid."\"\r\n\r\n";
    $header .= "This is a multi-part message in MIME format.\r\n";
    $header .= "--".$uid."\r\n";
    $header .= "Content-type:text/plain; charset=iso-8859-1\r\n";
    $header .= "Content-Transfer-Encoding: 7bit\r\n\r\n";
    $header .= $message."\r\n\r\n";
    $header .= "--".$uid."\r\n";
    $header .= "Content-Type: application/octet-stream; name=\"".$filename."\"\r\n"; // use different content types here
    $header .= "Content-Transfer-Encoding: base64\r\n";
    $header .= "Content-Disposition: attachment; filename=\"".$filename."\"\r\n\r\n";
    $header .= $content."\r\n\r\n";
    $header .= "--".$uid."--";
    if (mail($mailto, $subject, "", $header)) {
        //echo "mail send ... OK"; // or use booleans here

        // show completed/sucess form
        ?> 
        <div id="popupBlack"></div>
        <div id="popupWrap">
            <div id="popup">
                <h4>Thank you for submitting your CV<?php echo $sendMailTo;?></h4>
                <p>We will add it to our DB. Next why not, sign up to alerts, or start a job search.</p>
                <input type="submit" formnovalidate name="cancel" value="Close" id="closePopupPerm"/>

                <script>document.cookie = "submitCv=2;max-age=60000000;path=/"</script>

            </div>
        </div>

        <?php

            } else {
                echo "mail send ... ERROR!";
            }
        }
    }

    $my_file = $fileName;
    $my_path = "$uploadedImagePath";
    $my_name = "Company Name";
    $my_mail = "info@domain1.com";
    $my_replyto = "info@domain1.com";
    $my_subject = "New CV attached";
    $my_message = "Hello,\r\nA new CV has been submitted.\r\n\r\nCandidate details:\r\n".$customerDetails."\r\n\r\n";
    mail_attachment($my_file, $my_path, $sendMailTo, $my_mail, $my_name, $my_replyto, $my_subject, $my_message);



 }


if($showPopups === '3'){ showPopup(); }

if($showPopups === '1'){ ?>

    <script>
    $(document).ready(function(){

        setTimeout(
          function() 
          {
                    $('#popupFrame').slideToggle();
          }, 1000);

});
    </script>


    <div id="popupFrame" style="display:none;">
        <?php showPopup(); ?>
    </div>

<?php } ?>
\$\endgroup\$
0
2
\$\begingroup\$

Reflected XSS via POST

Echoing user input unsanitized is a really bad idea. XSS is also possible via POST, and thus an attacker could steal your cookies, display phishing forms on your website, log all keystrokes, and so on.

So when echoing user data, always protect against XSS.

Misc

  • you mix HTML and PHP too much. For example mail_attachment should only mail the attachment. The success/error HTML should be somewhere else, along with all the other HTML.
  • along that note: a function should only do one thing. Your mail_attachment function reads from a file, sends a mail, echoes something to the user and displays HTML.
  • $showPopups isn't a good name, as it doesn't tell me what it does.
  • your indentation is off, which makes your code hard to read (eg it looks as if mail_attachment was called recursively).
  • naming consistency: sometimes, you use camelCase, sometimes snake_case and sometimes alllowercase (which is really hard to read). It's better to choose one and stick with it.
  • also, it's easier to read code if equal things have equal names. eg $my_file vs $fileName, $my_path vs $uploadedImagePath, etc.
  • in theory, it might be possible to inject into the body of an email (I didn't test this).
\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.