Plug-in: zem_contact_reborn

alannie · 2006-02-09 19:26:45

> neptho wrote:

alannie: There’s something wrong with your form, or your template logic. Make sure you make this template as a “Sticky.”, Mine is just an unlinked static page My thanks template

Are you using the <code>redirect</code> attribute instead of the <code>thanks_form</code> attribute?

els · 2006-02-09 20:02:06

neptho wrote:

Here’s a quick little patch I made (note that I’ve only slightly tested it right now – I haven’t had the time to audit the whole plugin):

<pre> foreach ($zem_contact_form as $k => $v) { // ssh_mime_patch_for_zem_contact_reborn

if (strpos($v, ‘multipart/mixed’) != FALSE))

die(“No, I do not think so.”);

$msg[] = $k.’: ‘.htmlspecialchars($v);

}
</pre>

Where should this go? I started recieving those mails as well.

-P- · 2006-02-09 20:23:49

<blockquote>> neptho wrote:

> Just parsed the thread. Was going to note that my site has always been a bit of a target – but two days after integrating zem_contact_reborn, spammers have been using it to use mime types to circument security.

Here’s a quick little patch I made (note that I’ve only slightly tested it right now – I haven’t had the time to audit the whole plugin):

foreach ($zem_contact_form as $k => $v) { // ssh_mime_patch_for_zem_contact_reborn

if (strpos($v, ‘multipart/mixed’) != FALSE)) die(“No, I do not think so.”);

$msg[] = $k.’: ‘.htmlspecialchars($v);

}

This tests for MIME injection. It should probably be a better, global scope, but, as I said, this is just a quick ‘one off’ patch.

</blockquote>

Okay, could i get exact definition and explanation about mime types, where they rely on my server, what they are and how I know they are secure enough. Bit off topic and blondie question, sorry.

I posted about these spam attacts to WP Support forum too since the first spam emails that I got to know about were sent from one of the sites I host and which is running on Wordpress. So surely this thing is not just TXP releated.

Last edited by -P- (2006-02-09 20:27:22)

thebombsite · 2006-02-09 20:26:12

@Els – the top and bottom lines are already in the code. It’s in the “zem_contact” function and appears just above the <code>if ($send_article == ‘yes’)</code> line.

Shall I put this out as a temporary fix until my more knowledgable partners sort something out? I have also fixed the validation problem I mentioned earlier with the “select” output so it might be a useful update.

I feel all left out now that you are all getting this problem. :(

Mind you, just recently I’ve been getting spammed on my GuestBlock. Brain-dead jerk-offs is what I call them. Directly when I can. ;)

@neptho – thanks for the code. Now if you could just explain to me exactly what it is doing please.

thebombsite · 2006-02-09 20:31:57

@alannie – how are you calling the contact form to your page template. Do you have it set up as a form then call it with the <code><txp:output_form /></code> tag?

You will have to explain to me why you have 4 “article” tags on a page. Could you not replace 3 of them with the “article_custom” tag? It isn’t generally recommended to use more than 1 “article” tag though, depending on how your site is set up, it can be done.

alannie · 2006-02-09 20:36:42

> neptho wrote:

There’s something wrong with your form, or your template logic. Make sure you make this template as a “Sticky.”, Mine is just an unlinked static page My thanks template – here’s the section logic:
<br />Section name: thanks
Sectino title: thanks
Uses page: static_page
Uses Style: default

Neptho, your suggestion gave me another idea – to simply create a separate page template that gets rid of all the extra <code>txp:article</code> tags, and specify that all pages containing a contact form use this template. That resolved the issue. Thanks so much!

thebombsite · 2006-02-09 20:37:36

@ P I don’t think this is either WP/TXP related or plug-in related. It sounds like someone has developed a bot to specifically hit contact forms. How many hits did you get on the TXP site?

Are you using a Captcha plug-in? Did I spot that Sencer had released something somewhere though I think that may have been for comments?

els · 2006-02-09 20:38:40

@Els – the top and bottom lines are already in the code. It’s in the “zem_contact” function and appears just above the <code>if ($send_article == ‘yes’)</code> line.

If I do that:

Parse error: parse error, unexpected ‘)’ in /home/virtual/site87/fst/var/www/html/textpattern/lib/txplib_misc.php(459) : eval()’d code on line 98
The above errors were caused by the plugin:zem_contact_reborn

thebombsite · 2006-02-09 20:48:23

@Els – That says you have too many “)” in there. Let me work it into my test site then I’ll update the template and put a new version out. Give me 30 minutes.

alannie · 2006-02-09 20:48:54

> thebombsite wrote:

@alannie – how are you calling the contact form to your page template. Do you have it set up as a form then call it with the <code><txp:output_form /></code> tag?

The contact form is inside an article.

You will have to explain to me why you have 4 “article” tags on a page. Could you not replace 3 of them with the “article_custom” tag? It isn’t generally recommended to use more than 1 “article” tag though, depending on how your site is set up, it can be done.

Two of them are for this reason. (Note the newly added “edit” that mentions the dangers of having more than one “article” tag!) The third one is because I needed an unique id for each page, so I was inserting the article’s id into the body tag. The last one is for the article content.

As for why I could not use <code>article_custom</code> – I needed something that was context-sensitive to the current article being displayed. I tried <code>article_custom</code> but it displayed data from all articles instead of the current one. Limiting it to “1” would have just displayed the most recently added article, instead of the current one.

For the contact form pages, those first three “article” tags weren’t absolutely essential, so I just created a separate page template that does away with them.

els · 2006-02-09 20:52:32

@Els – That says you have too many “)” in there. Let me work it into my test site then I’ll update the template and put a new version out. Give me 30 minutes.

I understood as much ;) But I counted and there are just as many opening brackets as closing brackets…

30 minutes would be great! but take your time and don’t forget supper ;)

Edit: hmm… so much for my counting abilities… I’m going to try again.

Edit again: the second one after FALSE should go.

Last edited by doggiez (2006-02-09 20:58:03)

-P- · 2006-02-09 21:01:33

<blockquote> > thebombsite wrote:

> @ P I don’t think this is either WP/TXP related or plug-in related. It sounds like someone has developed a bot to specifically hit contact forms. How many hits did you get on the TXP site?

Are you using a Captcha plug-in? Did I spot that Sencer had released something somewhere though I think that may have been for comments? </blockquote>

After first five spam emails received sent thru princessdom contact form I disabled all the contact forms from all the my own sites and sites I host. So can´t say what it could have been. Thru that other sites contact form, domain owner received a huge amount of this spam. Haven´t had reports from my other sites.

I don´t receive system mail neither (email delivery error and notifications) at the moment any more so can´t say how serious it could be.

What I hate most now is the though and knowledge about that there are zillion spam emails around the net now with personalized contact form subject fields from my domains and with sender address also pointing to my domains.

For especially business sites this could be very bad thing to happen.

I don´t use captcha since haven´t had much comment spam, thanks to forced preview on commet forms. Could it be implemented to contact form too? I it´s only for comments at the mo.

Last edited by -P- (2006-02-09 21:09:57)

Textpattern CMS

Textpattern CMS support forum

#217 2006-02-09 19:26:45

Re: Plug-in: zem_contact_reborn

#218 2006-02-09 20:02:06

Re: Plug-in: zem_contact_reborn

#219 2006-02-09 20:23:49

Re: Plug-in: zem_contact_reborn

#220 2006-02-09 20:26:12

Re: Plug-in: zem_contact_reborn

#221 2006-02-09 20:31:57

Re: Plug-in: zem_contact_reborn

#222 2006-02-09 20:36:42

Re: Plug-in: zem_contact_reborn

#223 2006-02-09 20:37:36

Re: Plug-in: zem_contact_reborn

#224 2006-02-09 20:38:40

Re: Plug-in: zem_contact_reborn

#225 2006-02-09 20:48:23

Re: Plug-in: zem_contact_reborn

#226 2006-02-09 20:48:54

Re: Plug-in: zem_contact_reborn

#227 2006-02-09 20:52:32

Re: Plug-in: zem_contact_reborn

#228 2006-02-09 21:01:33

Re: Plug-in: zem_contact_reborn

Board footer