From 0bca1226457d2b4704a90fd0c9a022fd60e56f63 Mon Sep 17 00:00:00 2001 From: YvesCesar Date: Tue, 14 Jul 2026 16:44:32 -0400 Subject: [PATCH 1/2] fix(contact-form): make captcha validate cross-origin and fix thank-you redirect Signed-off-by: YvesCesar --- source/_partials/contact_form.blade.php | 2 +- suitecrm-form-middleware/audio_captcha.php | 1 + suitecrm-form-middleware/captcha.php | 1 + suitecrm-form-middleware/session_bootstrap.php | 12 ++++++++++++ suitecrm-form-middleware/validate.php | 7 ++++++- 5 files changed, 21 insertions(+), 2 deletions(-) create mode 100644 suitecrm-form-middleware/session_bootstrap.php diff --git a/source/_partials/contact_form.blade.php b/source/_partials/contact_form.blade.php index 45224328..d8810fae 100644 --- a/source/_partials/contact_form.blade.php +++ b/source/_partials/contact_form.blade.php @@ -129,7 +129,7 @@ function loadImage(token) { if (this.readyState == 4) { if (this.status == 200) { - window.top.location.href = 'thank-you-contact' + window.top.location.href = '{{ locale_url($page, 'thank-you-contact') }}' } else { let message = document.getElementById('message') message.textContent = '{{ $page->t( 'Invalid Captcha') }}' diff --git a/suitecrm-form-middleware/audio_captcha.php b/suitecrm-form-middleware/audio_captcha.php index be6787a2..533fc322 100644 --- a/suitecrm-form-middleware/audio_captcha.php +++ b/suitecrm-form-middleware/audio_captcha.php @@ -5,6 +5,7 @@ use Gregwar\Captcha\CaptchaBuilder; use Libresign\Espeak\Espeak; +require __DIR__ . '/session_bootstrap.php'; session_start(); header("Access-Control-Allow-Origin: {$_ENV['URL_SITE']}"); diff --git a/suitecrm-form-middleware/captcha.php b/suitecrm-form-middleware/captcha.php index 8a96d9d0..5ee0007a 100644 --- a/suitecrm-form-middleware/captcha.php +++ b/suitecrm-form-middleware/captcha.php @@ -7,6 +7,7 @@ $builder = new CaptchaBuilder(); $builder->build(); +require __DIR__ . '/session_bootstrap.php'; session_start(); header("Access-Control-Allow-Origin: {$_ENV['URL_SITE']}"); diff --git a/suitecrm-form-middleware/session_bootstrap.php b/suitecrm-form-middleware/session_bootstrap.php new file mode 100644 index 00000000..d4512ae2 --- /dev/null +++ b/suitecrm-form-middleware/session_bootstrap.php @@ -0,0 +1,12 @@ + 0, + 'path' => '/', + 'secure' => $isHttps, + 'httponly' => true, + 'samesite' => $isHttps ? 'None' : 'Lax', +]); diff --git a/suitecrm-form-middleware/validate.php b/suitecrm-form-middleware/validate.php index 263e5453..9bb1593b 100644 --- a/suitecrm-form-middleware/validate.php +++ b/suitecrm-form-middleware/validate.php @@ -2,14 +2,17 @@ include "../vendor/autoload.php"; use Gregwar\Captcha\CaptchaBuilder; +require __DIR__ . '/session_bootstrap.php'; session_start(); header("Access-Control-Allow-Origin: {$_ENV['URL_SITE']}"); header("Access-Control-Allow-Credentials: true"); -$builder = new CaptchaBuilder($_SESSION['code']); +$builder = new CaptchaBuilder($_SESSION['code'] ?? null); $codeImg = filter_input(INPUT_POST, 'codeImg'); +session_write_close(); + if( !$builder->testPhrase($codeImg)){ http_response_code(404); return; @@ -29,6 +32,8 @@ curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, $formulario_data); +curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5); +curl_setopt($ch, CURLOPT_TIMEOUT, 15); $resposta = curl_exec($ch); From cdcf392880e5c6c6afffe1a422b6ee7aafc6e1cb Mon Sep 17 00:00:00 2001 From: YvesCesar Date: Tue, 14 Jul 2026 17:13:57 -0400 Subject: [PATCH 2/2] refactor(contact-form): extract session cookie config into App\Support\Http\SessionCookie Signed-off-by: YvesCesar --- suitecrm-form-middleware/audio_captcha.php | 2 +- suitecrm-form-middleware/captcha.php | 2 +- .../session_bootstrap.php | 12 ---------- suitecrm-form-middleware/validate.php | 2 +- support/Http/SessionCookie.php | 22 +++++++++++++++++++ 5 files changed, 25 insertions(+), 15 deletions(-) delete mode 100644 suitecrm-form-middleware/session_bootstrap.php create mode 100644 support/Http/SessionCookie.php diff --git a/suitecrm-form-middleware/audio_captcha.php b/suitecrm-form-middleware/audio_captcha.php index 533fc322..fae85c56 100644 --- a/suitecrm-form-middleware/audio_captcha.php +++ b/suitecrm-form-middleware/audio_captcha.php @@ -5,7 +5,7 @@ use Gregwar\Captcha\CaptchaBuilder; use Libresign\Espeak\Espeak; -require __DIR__ . '/session_bootstrap.php'; +\App\Support\Http\SessionCookie::configureCrossSite(); session_start(); header("Access-Control-Allow-Origin: {$_ENV['URL_SITE']}"); diff --git a/suitecrm-form-middleware/captcha.php b/suitecrm-form-middleware/captcha.php index 5ee0007a..98f78103 100644 --- a/suitecrm-form-middleware/captcha.php +++ b/suitecrm-form-middleware/captcha.php @@ -7,7 +7,7 @@ $builder = new CaptchaBuilder(); $builder->build(); -require __DIR__ . '/session_bootstrap.php'; +\App\Support\Http\SessionCookie::configureCrossSite(); session_start(); header("Access-Control-Allow-Origin: {$_ENV['URL_SITE']}"); diff --git a/suitecrm-form-middleware/session_bootstrap.php b/suitecrm-form-middleware/session_bootstrap.php deleted file mode 100644 index d4512ae2..00000000 --- a/suitecrm-form-middleware/session_bootstrap.php +++ /dev/null @@ -1,12 +0,0 @@ - 0, - 'path' => '/', - 'secure' => $isHttps, - 'httponly' => true, - 'samesite' => $isHttps ? 'None' : 'Lax', -]); diff --git a/suitecrm-form-middleware/validate.php b/suitecrm-form-middleware/validate.php index 9bb1593b..ad44acf3 100644 --- a/suitecrm-form-middleware/validate.php +++ b/suitecrm-form-middleware/validate.php @@ -2,7 +2,7 @@ include "../vendor/autoload.php"; use Gregwar\Captcha\CaptchaBuilder; -require __DIR__ . '/session_bootstrap.php'; +\App\Support\Http\SessionCookie::configureCrossSite(); session_start(); header("Access-Control-Allow-Origin: {$_ENV['URL_SITE']}"); diff --git a/support/Http/SessionCookie.php b/support/Http/SessionCookie.php new file mode 100644 index 00000000..8995dc98 --- /dev/null +++ b/support/Http/SessionCookie.php @@ -0,0 +1,22 @@ + 0, + 'path' => '/', + 'secure' => $isHttps, + 'httponly' => true, + 'samesite' => $isHttps ? 'None' : 'Lax', + ]); + } +}