Commit 88f34357 authored by Chris Graham's avatar Chris Graham
Browse files

Fixed MANTIS-4295 (Spambots may target newsletter form)

parent f8e9592b

lang/EN/newsletter.ini

+1 −1
Original line number Diff line number Diff line
@@ -71,7 +71,7 @@ MODULE_TRANS_NAME_admin_newsletter=Newsletters 
MODULE_TRANS_NAME_newsletter=Newsletters

BLOCK_TRANS_NAME_main_newsletter_signup=Newsletter signup form

BLOCK_main_newsletter_signup_DESCRIPTION=Provide a very lightweight newsletter signup-form.

BLOCK_main_newsletter_signup_USE=If you want a quick-signup form on your panel.

BLOCK_main_newsletter_signup_USE=If you want a quick-signup form. Note that CAPTCHA is not supported, spambots may target this form; the full newsletter interface does support CAPTCHA.

BLOCK_main_newsletter_signup_PARAM_param_TITLE=Newsletter

BLOCK_main_newsletter_signup_PARAM_subject_TITLE=Subject

BLOCK_main_newsletter_signup_PARAM_path_TITLE=Introduction e-mail path

site/pages/modules/newsletter.php

+17 −1
Original line number Diff line number Diff line
@@ -318,7 +318,7 @@ class Module_newsletter 


        // Build up the join form

        $fields = new Tempcode();

        $fields->attach(form_input_line(do_lang_tempcode('EMAIL_ADDRESS'), do_lang_tempcode('DESCRIPTION_SUBSCRIBE_ADDRESS'), 'email', $their_email, true));

        $fields->attach(form_input_email(do_lang_tempcode('EMAIL_ADDRESS'), do_lang_tempcode('DESCRIPTION_SUBSCRIBE_ADDRESS'), 'email', $their_email, true));

        $fields->attach(form_input_line(do_lang_tempcode('FORENAME'), '', 'forename', $forename, false));

        $fields->attach(form_input_line(do_lang_tempcode('SURNAME'), '', 'surname', $surname, false));

        $fields->attach(form_input_password(do_lang_tempcode('YOUR_PASSWORD'), do_lang_tempcode('DESCRIPTION_MAINTENANCE_PASSWORD'), 'password', false));
@@ -347,6 +347,15 @@ class Module_newsletter 
            }

        }



        if (addon_installed('captcha')) {

            require_code('captcha');

            if (use_captcha()) {

                $fields->attach(form_input_captcha());

                $text->attach(' ');

                $text->attach(do_lang_tempcode('FORM_TIME_SECURITY'));

            }

        }



        url_default_parameters__disable();



        $text->attach(paragraph(do_lang_tempcode('CHANGE_SETTINGS_BY_RESUBSCRIBING')));
@@ -365,6 +374,8 @@ class Module_newsletter 
            };

        ";



        $javascript .= (function_exists('captcha_ajax_check') ? captcha_ajax_check() : '');



        return do_template('FORM_SCREEN', array('_GUID' => '24d7575465152f450c5a8e62650bf6c8', 'JAVASCRIPT' => $javascript, 'HIDDEN' => '', 'FIELDS' => $fields, 'SUBMIT_ICON' => 'buttons__proceed', 'SUBMIT_NAME' => $submit_name, 'URL' => $post_url, 'TITLE' => $this->title, 'TEXT' => $text));

    }
@@ -378,6 +389,11 @@ class Module_newsletter 
        require_code('type_sanitisation');

        require_code('crypt');



        if (addon_installed('captcha')) {

            require_code('captcha');

            enforce_captcha();

        }



        // Add

        $email = trim(post_param_string('email'));

        $password = trim(post_param_string('password', ''));