Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: "J.O. Aho" <user@example.net>
Newsgroups: comp.lang.php
Subject: Re: reCAPTCHA question
Date: Sun, 6 Sep 2015 10:10:29 +0200
Lines: 107
Message-ID: <d52annF9avU1@mid.individual.net>
References: <msdj39$333$1@ns2.nl2k.ab.ca>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Trace: individual.net mDms6+LE2MSK8Kswn28oqwK/LNl8ojdpuWOBVlHv4/8f6vFg3j
Cancel-Lock: sha1:Vtzv3h+jnjxYADny3DzUeb+hD/c=
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0
In-Reply-To: <msdj39$333$1@ns2.nl2k.ab.ca>
Xref: csiph.com comp.lang.php:15658

On 09/05/2015 04:12 AM, The Doctor wrote:
> All right I have a php mail script as follows:
> Anything wrong with this?

I will not look at the captcha but other things

> <?php
> 	$owner_email='email';
> 	//SMTP server settings	
> 	$host = 'mail.nk.ca';
>      $port = '465';//"587";
>      $username = 'user';
>      $password = 'pw';

I would not include the configuration in this script, include those from 
a file which ain't accessible for the web server, keep it outside the 
documentroot, this way you don't have to fear that the username/password 
will be as easily accessed by someone out on the internet if there would 
be something wrong with the php and it would suddenly send the source 
code than the processed result.

>      $subject='A message from your site visitor ';
>      $user_email='';
> 	$message_body='';
> 	$message_type='html';
>
> 	$max_file_size=50;//MB
> 	$file_types='/(doc|docx|txt|pdf|zip|rar)$/';
> 	$error_text='something goes wrong';
> 	$error_text_filesize='File size must be less than';
> 	$error_text_filetype='Failed to upload file. This file type is not allowed. Accepted files types: doc, docx, txt, pdf, zip, rar.';
>
> 	$private_recaptcha_key='6LeZwukSAAAAACmqrbLmdpvdhC68NLB1c9EA5vzU'; //localhost
> 	
> 	
> 	$use_recaptcha=isset( $_POST["recaptcha_challenge_field"]) and isset($_POST["recaptcha_response_field"]);
> 	$use_smtp=($host=='' or $username=='' or $password=='');
> 	$max_file_size*=1048576;
>
> 	if($owner_email==''){
> 		die('Attention, recipient e-mail is not set! Please define "owner_email" variable in the MailHanlder.php file.');
> 	}
>
> 	if(preg_match('/^(127\.|192\.168\.)/',$_SERVER['REMOTE_ADDR'])){
> 		die('Attention, contact form will not work locally! Please upload your template to a live hosting server.');
> 	}
>
> 	if($use_recaptcha){
> 		require_once('recaptchalib.php');
> 		$resp = recaptcha_check_answer ($private_recaptcha_key,$_SERVER["REMOTE_ADDR"],$_POST["recaptcha_challenge_field"],$_POST["recaptcha_response_field"]);
> 		if (!$resp->is_valid){
> 			die ('wrong captcha');
> 		}
> 	}
> 	
> 	if(isset($_POST['name']) and $_POST['name'] != ''){$message_body .= '<p>Visitor: ' . $_POST['name'] . '</p>' . "\n" . '<br>' . "\n"; $subject.=$_POST['name'];}
> 	if(isset($_POST['email']) and $_POST['email'] != ''){$message_body .= '<p>Email Address: ' . $_POST['email'] . '</p>' . "\n" . '<br>' . "\n"; $user_email=$_POST['email'];}
> 	if(isset($_POST['state']) and $_POST['state'] != ''){$message_body .= '<p>State: ' . $_POST['state'] . '</p>' . "\n" . '<br>' . "\n";}
> 	if(isset($_POST['phone']) and $_POST['phone'] != ''){$message_body .= '<p>Phone Number: ' . $_POST['phone'] . '</p>' . "\n" . '<br>' . "\n";}	
> 	if(isset($_POST['fax']) and $_POST['fax'] != ''){$message_body .= '<p>Fax Number: ' . $_POST['fax'] . '</p>' . "\n" . '<br>' . "\n";}
> 	if(isset($_POST['message']) and $_POST['message'] != ''){$message_body .= '<p>Message: ' . $_POST['message'] . '</p>' . "\n";}	
> 	if(isset($_POST['stripHTML']) and $_POST['stripHTML']=='true'){$message_body = strip_tags($message_body);$message_type='text';}
>
> try{
> 	include "libmail.php";
> 	$m= new Mail("utf-8");
> 	$m->From($user_email);
> 	$m->To($owner_email);
> 	$m->Subject($subject);
> 	$m->Body($message_body,$message_type);

There is no check against header injections, this form will most likely 
be used for spamming if accessible from the internet as the libmail.php 
will not do any checks for you, so you have to do it yourself.

> 	//$m->log_on(true);
>
> 	if(isset($_FILES['attachment'])){
> 		if($_FILES['attachment']['size']>$max_file_size){
> 			$error_text=$error_text_filesize . ' ' . $max_file_size . 'bytes';
> 			die($error_text);			
> 		}else{			
> 			if(preg_match($file_types,$_FILES['attachment']['name'])){
> 				$m->Attach($_FILES['attachment']['tmp_name'],$_FILES['attachment']['name'],'','attachment');
> 			}else{
> 				$error_text=$error_text_filetype;
> 				die($error_text);				
> 			}
> 		}		
> 	}
> 	if(!$use_smtp){
> 		$m->smtp_on( $host, $username, $password, $port);
> 	}
>
> 	if($m->Send()){
> 		die('success');
> 	}	
> 	
> }catch(Exception $mail){
> 	die($mail);
> }	
> ?>

-- 

  //Aho