CMS Made Simple Forums

blackrain wrote:I am using captcha and a trick Rolf posted using regular expression and a website address. still spam gets through.

This leads me to conclude that the Formbuilder is getting hit and processing without using the front end anti spam tools.

blackrain wrote:The messages are formatted correctly as per my settings in Formbuilder but the messages are not saved to the database as are valid messages from the website.

blackrain wrote:Thanks guys, I have looked through the access logs but nothing jumps out as odd, lots of 404 requests for php scripts but nothing getting through there.

I have tried all the captcha modules ReCaptcha included and they all work fine for the form submission.

@JoMorg - The emails I receive are formatted as per the html I have put in the formbuilder module the setting are correct and even the form fields are all correct. when I submit a message via the frontend the message is stored in formbrowser and I can access it. the spam messages are not stored I am thinking there may be a vulnerability in the formbuilder somewhere that allows a bot to POST without using the frontend.

thanks

• - create a UDT, name it gen_sec_token:

$token = bin2hex( openssl_random_pseudo_bytes(16) );
$_SESSION['fb_token'] = $token;
return $token; 

• - create a new UDT, name it val_sec_token:

if($params['token'] != $_SESSION['fb_token'])
{
  audit(0, 'Form submission error: security token missing or invalid!');
  return array(false, 'Security token missing or invalid');
}

# make sure no reuse is possible
unset($_SESSION['fb_token']);
return array(true,'');

• - in FormBuilder open the affected form and create a new field of type Text Input and name it token;
• - create yet another field of type User Defined Tag Call and select the gen_sec_token UDT, name it st;
• (note: keep these fields validation at their default settings....)
• - in FormBuilder form page on the tab Form Submission, under Form Submission Behavior set User defined tag to call during form validation to val_sec_token;
• - on the form template and assuming that you use some variation of one the original templates that handle rendering the fields automatically you'll need to trap and prevent the new fields from displaying (that bit is up to you as it will depend on how the form template is set);
• - add the following right after the {$fb_hidden} tag in the template:

<input type="hidden" name="{$actionid}{$token->input_id}" value="{$st->input}"> 

• - update/save the form.