fix(contact-form): make captcha validate cross-origin and fix thank-you redirect

source/_partials/contact_form.blade.php

@@ -129,7 +129,7 @@ function loadImage(token) {
 
                     if (this.readyState == 4) {
                       if (this.status == 200) {
-                        window.top.location.href = 'thank-you-contact'
+                        window.top.location.href = '{{ locale_url($page, 'thank-you-contact') }}'
                       } else {
                         let message = document.getElementById('message')
                         message.textContent = '{{ $page->t( 'Invalid Captcha') }}'

suitecrm-form-middleware/audio_captcha.php

@@ -5,6 +5,7 @@
 use Gregwar\Captcha\CaptchaBuilder;
 use Libresign\Espeak\Espeak;
 
+\App\Support\Http\SessionCookie::configureCrossSite();
 session_start();
 
 header("Access-Control-Allow-Origin: {$_ENV['URL_SITE']}");

suitecrm-form-middleware/captcha.php

@@ -7,6 +7,7 @@
 $builder = new CaptchaBuilder();
 $builder->build();
 
+\App\Support\Http\SessionCookie::configureCrossSite();
 session_start();
 
 header("Access-Control-Allow-Origin: {$_ENV['URL_SITE']}");

suitecrm-form-middleware/validate.php

@@ -2,14 +2,17 @@
 
 include "../vendor/autoload.php";
 use Gregwar\Captcha\CaptchaBuilder;
+\App\Support\Http\SessionCookie::configureCrossSite();
 session_start();
 
 header("Access-Control-Allow-Origin: {$_ENV['URL_SITE']}");
 header("Access-Control-Allow-Credentials: true");
 
-$builder = new CaptchaBuilder($_SESSION['code']);
+$builder = new CaptchaBuilder($_SESSION['code'] ?? null);
 $codeImg = filter_input(INPUT_POST, 'codeImg');
 
+session_write_close();
+
 if( !$builder->testPhrase($codeImg)){
     http_response_code(404);
     return;
@@ -29,6 +32,8 @@
 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
 curl_setopt($ch, CURLOPT_POST, 1);
 curl_setopt($ch, CURLOPT_POSTFIELDS, $formulario_data);
+curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
+curl_setopt($ch, CURLOPT_TIMEOUT, 15);
 
 $resposta = curl_exec($ch);
 

support/Http/SessionCookie.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Support\Http;
+
+class SessionCookie
+{
+    public static function configureCrossSite(): void
+    {
+        $isHttps = (!empty($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) !== 'off')
+            || (($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https');
+
+        session_set_cookie_params([
+            'lifetime' => 0,
+            'path' => '/',
+            'secure' => $isHttps,
+            'httponly' => true,
+            'samesite' => $isHttps ? 'None' : 'Lax',
+        ]);
+    }
+}