Sikkerhed i formmail-script
Jeg oplever i disse dage at blive spammet via et formmail-script på mit eget website. Det ligner noget injection-noget. Er der én, der vil kigge på mit script og se om der er noget, der kan gøres mere sikkert?<?php
// Recipant's e-mail adress:
$mailto = "email@email.dk";
# Maximum size of attachment in bytes:
$max_attach_size = 500000;
//Collect sender's details
$ips = $_SERVER['REMOTE_ADDR'];
/* Set locale to Danish */
setlocale(LC_ALL, 'da_DK');
$dato = ucfirst(strftime("%A, %d.%m.%Y"));
$tid = strftime("%H:%M:%S");
$info ="\n\n\n\n\n***********************************\n" .
"Sendt fra IP: $ips" . "\n" .
"Browser: $browser_agent $browser_version" . "\n" .
"Sprog: $lang" . "\n" .
"Dato: $dato" . "\n" .
"Kl: $tid" . "\n***********************************";
?>
<?php
if (isset($_POST["form_submitted"]))
{
$name = $_POST['name'];
$email = $_POST['email'];
$subject = $_POST['subject'];
$text = $_POST['text'];
unset($errors);
if ($email != "" and !preg_match("/^[^@]+@.+\.\D{2,5}$/", $email)) $errors[] = "Angiv venligst en gyldig e-mailadresse";
if ($text == "") $errors[] = "Skriv venligst en besked";
if ($_FILES['probe']['size'] > $max_attach_size) $errors[] = "Den vedhæftede fil er for stor - (".number_format($_FILES['probe']['size']/1000,0,",","")." KB) - maximum størrelse er: ".number_format($max_attach_size/1000,0,",","")." kb";
if (empty($errors))
{
$text = stripslashes($text);
$subject = stripslashes($subject);
if ($name != "") $mail_name=$name; else $mail_name="Anonym";
if ($subject != "") $mail_subject = $subject; else $mail_subject = "Fra website - No subject";
if ($email != "") $mail_email = $email; else $mail_email = "email@unknown.xyz";
$ip = $_SERVER["REMOTE_ADDR"];
// if attachment, MIME-Mail:
if (isset($_FILES['probe']['name']) && trim($_FILES['probe']['name']) != "")
{
// read and encode file:
$datei_content = fread(fopen($_FILES['probe']['tmp_name'],"r"),filesize($_FILES['probe']['tmp_name']));
$datei_content = chunk_split(base64_encode($datei_content),76,"\n");
// Boundary:
$boundary = md5(uniqid(rand()));
// Mail-Header:
$mail_header = "From: ".$mail_name." <".$mail_email.">\n";
$mail_header .= "X-Sender-IP: ".$ip."\n";
$mail_header .= "MIME-Version: 1.0\n";
$mail_header .= "Content-Type: multipart/mixed; boundary=\"".$boundary."\"\n";
$mail_header .= "This is a multi-part message in MIME format.\n";
// Mail-Text:
$mail_header .= "--".$boundary;
$mail_header .= "\nContent-Type: text/plain";
$mail_header .= "\nContent-Transfer-Encoding: 8bit";
$mail_header .= "\n\n".$text;
// Attachment:
$mail_header .= "\n--".$boundary;
$mail_header .= "\nContent-Type: ".$_FILES['probe']['type']."; name=\"".$_FILES['probe']['name']."\"";
$mail_header .= "\nContent-Transfer-Encoding: base64";
$mail_header .= "\nContent-Disposition: attachment; filename=\"".$_FILES['probe']['name']."\"";
$mail_header .= "\n\n".$datei_content;
// End:
$mail_header .= "\n--".$boundary."--";
// Sende E-Mail und gebe Fehler bzw. Bestaetigung aus
if (@mail($mailto,$mail_subject,"",$mail_header)) $sent = true; else $errors[] = "no connection to the mailserver - please try again later";
}
// no attachment, normal E-mail:
else
{
$mail_header = "From: ".$mail_name." <".$mail_email.">\n";
$mail_header .= "X-Sender-IP: $ip\n";
$mail_header .= "Content-Type: text/plain";
if (@mail($mailto,$mail_subject,$text."$info",$mail_header)) $sent = true; else $errors[] = "Ingen forbindelse til mailserveren - prøv igen senere!";
}
// copy to sender:
if (isset($sent) && isset($email) && $email != "" && isset($_POST['copy']))
{
if (isset($_FILES['probe']['name']) && trim($_FILES['probe']['name']) != "") $copy_mail_text = "Copy of the e-mail:\n\n".$text."\n\nAttachment: ".$_FILES['probe']['name']; else $copy_mail_text = "Copy of the e-mail:\n\n".$text;
$header= "From: ".$mailto."\n";
$header .= "X-Sender-IP: ".$ip."\n";
$header .= "Content-Type: text/plain";
@mail($email, $mail_subject, $copy_mail_text, $header);
}
}
}
if (empty($sent))
{
if(isset($errors))
{
?><p class="caution">Error:</p><ul><?php foreach($errors as $f) { ?><li><?php echo $f; ?></li><?php } ?></ul><br /><?php
}
?><form name="formnavn" method="post" action="<?php echo basename($_SERVER["PHP_SELF"]); ?>" enctype="multipart/form-data"><div>
Navn:<br />
<input type="text" name="name" style="border:1px solid #999;" value="<?php if (isset($name)) echo htmlentities(stripslashes($name)); else echo ""; ?>" size="35" /><br><br>
E-mail:<br /><input type="text" name="email" style="border:1px solid #999;" value="<?php if (isset($email)) echo htmlentities(stripslashes($email)); else echo ""; ?>" size="35" />
<br>
<br>
Emne:<br /><input type="text" name="subject" style="border:1px solid #999;" value="<?php if (isset($subject)) echo htmlentities(stripslashes($subject)); else echo ""; ?>" size="35" />
<br>
<br>
Besked:<br />
<textarea name="text" cols="55" rows="8" style="border:1px solid #999; overflow:auto;"><?php if (isset($text)) echo htmlentities(stripslashes($text)); else echo ""; ?>
</textarea>
<br>
<br>
Attachment:<br /><input type="file" name="probe" style="border: 1px solid #999;cursor:pointer;" value="<?php if (isset($_POST['probe'])) echo htmlentities(stripslashes($_POST['probe'])); else echo ""; ?>" size="20"/>
<br />
<br />
<input type="checkbox" name="copy" value="true" /> Send kopi til dig selv
<p><input type="submit" name="form_submitted" class="submit_knap" value="OK - Send" />
<input type="reset" value="Clear" name="reset" class="submit_knap" style="width:70px;">
</p>
</div>
</form><?php
}
else
{
if (empty($email)) { ?>
<p style="padding-left:10px;"><br /><b>Tak!</b><input type="hidden" name="name"><br />
Beskeden er sendt, men da du ikke angav en e-mailadresse, kan vi ikke besvare din henvendelse.<br />
<br />
</p>
<?php }
else { ?><p style="padding-left:10px;"><b>Tak!</b><input type="hidden" name="name"><br />
Din besked er sendt. Vi vender tilbage hurtigst muligt. <br />
<br />
</p>
<?php }
}
?>
Mvh.
