diff options
| author | alyx <alyx@aleteoryx.me> | 2024-06-01 11:38:12 -0400 |
|---|---|---|
| committer | alyx <alyx@aleteoryx.me> | 2024-06-01 11:38:12 -0400 |
| commit | b5f931b9c9344e9db07abfe9de1e1ca5e64342bb (patch) | |
| tree | c4559229f6b35b173de91699c40787e29d573ab3 /visitors.php | |
| parent | 27a98f32de4ff4972ca08b046c0ff3df3f10fdd5 (diff) | |
| download | visitors_dot_php-b5f931b9c9344e9db07abfe9de1e1ca5e64342bb.tar.gz visitors_dot_php-b5f931b9c9344e9db07abfe9de1e1ca5e64342bb.tar.bz2 visitors_dot_php-b5f931b9c9344e9db07abfe9de1e1ca5e64342bb.zip | |
Fix POST validation bugs
Diffstat (limited to 'visitors.php')
| -rw-r--r-- | visitors.php | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/visitors.php b/visitors.php index a841d3a..850cefb 100644 --- a/visitors.php +++ b/visitors.php @@ -103,7 +103,7 @@ $config['captcha'] = true; // // Any entries in one mode will display fine in any other. -$config['form_mode'] = 1; +$config['form_mode'] = 2; // E-Mail display mode: choice @@ -497,6 +497,7 @@ session_start(['cookie_lifetime' => 1440]); function cleanup_post() { global $config; + error_log(var_dump($_POST, false)); if ($config['captcha'] && (@$_SESSION['captcha'] !== htmlentities($_POST['captcha']??''))) { return "Invalid captcha!"; } @@ -509,15 +510,15 @@ function cleanup_post() { else return "Invalid Website URL or E-Mail!"; } else { - if (isset($_POST['website'])) { + if (isset($_POST['website']) && $_POST['website'] !== '') { $_POST['website'] = trim($_POST['website']); if (!preg_match('/^(?:https?|gopher|gemini):\/\/(?:www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b(?:[-a-zA-Z0-9()@:%_\+.~#?&\/=]*)$/', $_POST['website'])) return "Invalid Website URL!"; $_POST['website'] = htmlentities($_POST['website']); } - if (isset($_POST['email'])) { + if (isset($_POST['email']) && $_POST['email'] !== '') { $_POST['email'] = trim($_POST['email']); - if (!preg_match('/^[a-zA-Z0-9.!#$%&’*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$/', $_POST['email'])) + if (!preg_match('/^[a-zA-Z0-9.!#$%&’*+\/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$/', $_POST['email'])) return "Invalid E-Mail!"; $_POST['email'] = htmlentities($_POST['email']); } |