CGFeedback We have encountered a security related problem

[Gregor]

Hi,

How can I figure out what is causing the error when a CGFeedback form is submitted from the website?

The template I have in place is:

Code: Select all

{* comment form template *}
{cge_form_csrf}
{if isset($message)}
	<div class="pagemessage">{$message}</div>
{else}
	{* no message... display the form *}
	<div class="cgfeedback_addcomment">
	{if isset($error)}
		<div class="error">{$error}</div>
	{/if}

	{*<form>*}
	    <i class="now-ui-icons location_compass-05"></i>
		{form_start action=default inline=$inline extraparms=$extraparms}
		{*
		* A simple honeypot captcha field.  This field needs to be a text field, but hidden with CSS
		* deleting this field from the template will have no effect on form behavior, but if this
		* field exists, and is populated an error will be generated.
		*}
		<input type="text" name="{$actionid}feedback__data" value="" style="display: none;"/>
		<fieldset style="margin: 1em;">
		{*<legend>&nbsp;{$mod->Lang('prompt_add_comment')}&nbsp;</legend>*}
		<legend>&nbsp;Zijn benieuwd naar uw reactie&nbsp;</legend>
		<div class="form-group">
    		<label for="{$actionid}title">*{$mod->Lang('prompt_title')}</label>
    		<input type="text" class="form-control" id="{$actionid}title" name="{$actionid}title" value="{$comment_obj->title}" required/>
  		</div>

			<div class="form-group">
    			<label for="{$actionid}author_name">*{$mod->Lang('prompt_your_name')}</label>
    			<input type="text" class="form-control" id="{$actionid}author_name" name="{$actionid}author_name" value="{$comment_obj->author_name}" required/>
  			</div>
 
			<div class="form-group">
				<label for="{$actionid}author_email">{$mod->Lang('prompt_your_email')}:</label>
				<input type="email" class="form-control" id="{$actionid}author_email" name="{$actionid}author_email" value="{$comment_obj->author_email}"/>
			</div>
 			<div class="form-group">
				<label for="{$actionid}comment">{$mod->Lang('prompt_comment')}</label>
				{cge_textarea class="form-control" wysiwyg=$wysiwyg name="{$actionid}comment" id="{$actionid}comment" rows=3 value=$comment_obj->data}
			</div>
		  
		  {* <div class="row">
			<div class="col-md-4 text-right">
			 <label for="{$actionid}comment">{$mod->Lang('prompt_comment')}:</label>
			</div>
			<div class="col-md-8">
			{cge_textarea wysiwyg=$wysiwyg name="{$actionid}comment" id="{$actionid}comment" rows=3 value=$comment_obj->data}
			</div>
		  </div> *}

  {* custom fields *}
  {if isset($fields)}
	{foreach $fields as $fieldid => $field}
	{$_id="{$actionid}field_{$fieldid}"}
	<div class="row">
	  <div class="col-md-4 text-right">
		<label for="{$_id}">{$field.name}:</label>
	  </div>
	  <div class="col-md-8">
		{if $field.type == 0 or $field.type == 1 }
		<input type="text" name="{$actionid}field_{$fieldid}" value="{$field.value|default:''}" size="{$field.attrib.length}" maxlength="{$field.attrib.maxlength}"/>
		{elseif $field.type == 2}
		{cge_textarea wysiwyg=$field.attrib.usewysiwyg|default:0 rows=3 id="{$_id}" name="{$actionid}field_{$fieldid}" value=$field.value|default:''}
		{elseif $field.type == 3}
		<select name="{$actionid}field_{$fieldid}">
		  {html_options options=$field.attrib.options selected="{$field.value}"}
		</select>
		{elseif $field.type == 4}
		<select multiple="multiple" size="4" name="{$actionid}field_{$fieldid}[]">
		  {html_options options=$field.attrib.options selected="{$field.value}"}
		</select>
	{elseif isset($field.input)}
		{$field.input}
		{/if}
	  </div>
	</div>
	{/foreach}
  {/if}

  {if isset($captcha_img)}
	{* handle captcha image *}
	<div class="row">
	<div class="col-md-4 text-right"><label for="{$actionid}captchatext">{$mod->Lang('prompt_captcha')}:</label></div>
	<div class="col-md-8">
	  {if $captcha_needs_input}
	  <input type="text" class="form-control" id="{$actionid}captchatext" name="{$actionid}feedback_captcha" value="" size="20"/><br/>
	{/if}
	  {$captcha_img}
	</div>
	</div>
  {/if}

	<div class="row">
		<div class="col-md-4 text-left"></div>
		<div class="col-md-8">
			<button class="btn btn-primary" name="{$actionid}cgfb_submit">Verstuur</button>
		</div>
	</div>

  </fieldset>
  {form_end}
  </div>
 {* </form>*}
{/if}{* message *}

Thanks in advance!

[calguy1000]

{cge_form_csrf} must be inside the form.

[Gregor]

Thanks. I'll give it a go.