Crypting e-mail address

[Hypocrite]

I have tried to use several tags which encrypt an e-mail address.

The problem is that when I use a tag like this:
{mailto address="info@domain.com" encode="javascript"}

I get the following result:

Code: Select all

eval(unescape('%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%61%20%68%72%65%66%3d%22%6d%61%69%6c%74%6f%3a%65%74%75%6e%69%6d%69%2e%73%75%6b%75%6e%69%6d%69%40%72%61%61%68%65%6e%61%61%6b%6b%2e%66%69%22%20%3e%65%74%75%6e%69%6d%69%2e%73%75%6b%75%6e%69%6d%69%40%72%61%61%68%65%6e%61%61%6b%6b%2e%66%69%3c%2f%61%3e%27%29%3b'))info@domain.com

So it always adds a visible format of the e-mail address?

I have tried with mailto and email tags.

What's causing this? Does TinyMCE have something do to with it?

[planegoofy]

Try adding the text field to the mailto call like this:

Code: Select all

{mailto address="info@domain.com" text="Some Text" encode="javascript"}

It needs to display something for the user to click on and defaults to the email address without some text I believe. Let us know how this works.

Jeff

[Hypocrite]

Hi and thanks.

I tried that also. It works fine for the encode javascript.

Some Text

The problem is that, I would like to display the e-mail address on the page. This is because the e-mail address is usually added to notifications with the persons name, like User Name, user.name@domain.com.

When looking at the Smarty tag help for mailto, that should be possible:
http://www.smarty.net/manual/en/languag ... mailto.php

Javascript:

Code: Select all

{mailto address="me@example.com" encode="javascript"}
<__script__ type="text/javascript" language="javascript">
   eval(unescape('%64%6f% ... snipped ...%61%3e%27%29%3b'))
</__script>

Hex:

Code: Select all

{mailto address="me@example.com" encode="hex"}
<a href="mailto:%6d%65.. snipped..3%6f%6d">m&..snipped...#x6f;m</a>

So it should encode both the mailto address and the text address.

[The Wizl]

Hi everybody

Someone who has got a solution for this. I have the same problem.
It doesn´t encode the text address (and I need to publish the e-mail address - but encoded in the source code).

This is the source code for the generated page

E-post: info@xxxxxxx.se
eller besök oss:

So it should encode both the mailto address and the text address as smarty examples.


Hope that someone has the solution

/Wizl

[paulbaker]

Odd, this seems to work OK for me.

CMSMS V. 1.6.4.

In my page (TinyMCE editor):

Code: Select all

Email: {mailto address="wessex@example.com" encode="javascript"}

In the HTML source of the generated page:

Code: Select all

Email: <__script__ type="text/javascript">eval(unescape('%64%6f%63%75%6d%65 ...snip... %67%3c%2f%61%3e%27%29%3b'))</__script>

In the browser the email address wessex@example.com is shown as a clickable link - exactly what I need.

Hypocrite and The Wizl - what version of CMSMS are you running?

[The Wizl]

Hi there

My version is 1.6.3. And I´ve got smarty tags set to true.

I´ll try to upgrade and see what happens. I´ve never upgraded before so it might taka a while.


Thanks

The Wizl

[The Wizl]

I can´t upgrade at the moment. I´ve got dependent add-ons.

Thanks anyway

/Wizl

[jack4ya]

1.6.6 here and I have the same issue

[jack4ya]

Do NOT use FIREFOX/MOZILLA/FIREBUG to test this. 

It'll parse/de-encode it for your convenience..., hehe. And thus you can not test the encoding.

[tgnc.org.uk]

If your wanting to truly protect email addresses while sacrificing accessibility, then use an image of the email address.

The internet rules are simple, if you don't want it stolen or abuse, don't put it out their.

If you use a contact form for initial querys or point of contact, you remove the need to publish an email address.

Any web host of worth will have email filtering tools for you to configure spam filters too.

Trying to encrypt email addresses is stupid because your decreasing the accessibility to screen readers for people who are blind or partially sighted.

It is very common for people to simply use the following format... user.name_at_somedomain.tld and have people either edit out the _at_ or some people put a "Click function" in to the anchor to replace the _at_ and preappend mailto: to complete the mail address.

for example...

Code: Select all

<a href="my.email:mydomain.com" onclick="this.href='mailto:'+ (this.href.split(':')).join('@');">Email
Me</a>

or

Code: Select all

<a href="javascript:;" title="email:mydomain.com" onclick="this.href='mailto:'+ (this.title.split(':')).join('@');">Email
Me</a>

Of the several developer forums I frequent, this is a surprisingly common question on how to encode stuff to stop spam, fact is that you can not stop spam, a spammer will often employ a click agent to decode anything that you employ to obfuscate an email address which is why the first in frontline defence is a contact form and even then the form will be abused by bots and spam agents and hackers... It is a battle that you are never going to defeat no matter how convoluted your tactics, what you make can be broken.

So it is better that you be aware that this is never going to stop spammers and bots and it is best to employ some server side security such as salting and sessions in contact forms and mail filtering on the box that receives the contact form information.

So you want to be checking what kind of security tools you have access to with your web host. If you host from home, then you need to write your own filters in the mail client you use or write your own form handler to pick up on potential spam.

In all web forms you should have a dummy field, something that is like...

Code: Select all

<input name="loginid" type="hidden" value="" readonly>

Which means that when your form is submitted, the "readonly" setting means your expecting an empty field. If this field is not empty, it means that youe web form was most likely cloned by a bot and the "readonly" is being ignored, fact that a dummy field has data in it should instantly be discarded.

You would also be best to employ form salting, this is where you simply have a field that is a md5 hash, the way you calculate this hash is important.

eg

Code: Select all

$salt="a1b2c3d4e5f6";
$md5_salt = md5( $_SERVER['REMOTE_ADDR'] . $salt );
echo "<input type='crc' name='salt' value'{$md5_salt}' readonly>";

The purpose of adding a salt value to the IP address is to stop people using rainbow tables to guess your secret hash, it is important to add a secret salt to help your receiving script form handler to distinguish a genuine form from your site from some spam bot.

You can also empoy other methods of security which include the use of sessions and also AJAX too.

Your site security is only as good as your coding and this includes using the built in PHP functions like strip_tags and stripslashes and others that can be found on the php.net website.

What you shouldn't be afraid of is exposing your email address, how you do expose it is important and that it should be accessible, some screen readers for example understand javascript and can decode it, some can not.

I hope that info is of some use.

[The Wizl]

Every solution for improvment are of course positive. I´ll look into it when I got time.

My question are: Are there any CMSms module solution for this? Since this is a open source solution. I´m not a developer, more of a graphic designer with som technical knowlidge.


Thank you

/Wizl