2

I recently faced a problem where, I am receiving emails from an unknown source. Somehow they bypass the validation for email and sending me SQL statement in email fields for example: (SELECT CHAR(113)+CHAR(113)+CHAR(118)+CHAR(98)+CHAR(113)+(SELECT (CASE WHEN (8513=8513) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(98)+CHAR(113))

That's what I am receiving on my email that, I set on Magento contacts configuration. When I tried to find out the exact issue, I found out that If I save the HTML of contact page and remove all the validation from there, then I can able to submit the form from my local system. I am receiving email even if I submit the form, that I saved on my local system.

I also tried other forms to check for the same, but other forms have validation on the server side too, but only contact form having this issue.

How can we solve this issue?

  • have you did customize form page? – Sunil Patel Mar 21 '18 at 13:01
  • I only added a ReCaptcha on the contact page. – Sachin Nagpal Mar 21 '18 at 13:06
  • did you use an extension to add recaptcha, or is this default magento captcha? – Ricky Odin Matthews Mar 21 '18 at 13:41
  • I used an extension to implement the recaptcha. – Sachin Nagpal Mar 21 '18 at 18:31
  • Which one, because the problem is likely in there. It does client-side validation which is inherently useless. – Willem Mar 22 '18 at 4:19
0

You have to add a captcha check on the server side. On the contact page, at the bottom of the form, you should already have something like:

<div class="g-recaptcha" data-callback="myrecaptchaCallback" data-sitekey="MYDATASITEKEY"></div>

Now if you want to prevent a hacker to save you contact page as HTML and modify it to bypass Javascript validation, you must add a server side validation on the file which is the value of the action field in your form. You should already have something like:

<form name="contact" onsubmit="return validateForm()" method="post" 
action="processcontact.php">

All you have to do is add a captcha verification in processcontact.php. The minimum is to check the presence of the captcha:

<?php
captcha;
if(isset($_POST['g-recaptcha-response'])){
$captcha=$_POST['g-recaptcha-response'];
}
if(!$captcha){
echo '<h2>Please check the captcha.</h2>';
exit;
}
?>

Source: https://codeforgeek.com/2014/12/google-recaptcha-tutorial/

Hope this helps,

Alexandre

| improve this answer | |
-3

I think you have to Setup Google Recaptcha Developed by Magecomp, It is free Extension you can try it. https://magecomp.com/magento-new-recaptcha.html

| improve this answer | |
  • The issue is not about implementing recaptcha. Please see my question above. – Sachin Nagpal Mar 21 '18 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.