Contact Us page needs group permissions

[mrgtb]

The "Contact Us" link you can display in forum footer. Do you not think it needs group permissions who can use it? I have it activated on my forum and quite a number of times now I've received spam emails via it from guests. Just watched a Russian spammer using it "spotted listed in who's online", seconds later email from them. I think group permissions are needed so you can rule out guests being able to use it sending you email junk from board.

I would hate to think how much it would get used by guests spammers if having a big board, going off how many spam emails I've got via it so far running a very small inactive forum with next to nothing going on. Or at least have that page so it uses anti-spam validation like forums do for guests.

[Nicofuma]

https://area51.phpbb.com/phpBB/viewtopi ... 41#p265941

Now I can see Contact page here in area51. It seems it's merged thanks. This system use captcha?

No, the page is linked on registration if the user is unable to solve the captcha.

[RMcGirr83]

So then what is to stop spam bots from posting to the contact page once 3.1 goes gold?

[Louis7777]

So then what is to stop spam bots from posting to the contact page once 3.1 goes gold?

Your "Contact Board Administration" extension? xD

[Dragosvr92]

So then what is to stop spam bots from posting to the contact page once 3.1 goes gold?

"No, the page is linked on registration if the user is unable to solve the captcha."
Im guessing the Captcha that appears to guests that try to message the admin.

[mrgtb]

I don't get this because I use Q/A and not Captcha for registration. So anyone sending email from board using Contact us doesn't need solve any Captcha image on my forum. Whether or not that then is linked to fact I use Q/A and not Image Captcha at registration, no idea?

But reading what you're saying here is as though you mean, if you use Captcha and not Q/A at registration, then that Captcha will be used for Contact Us page also, while Q/A doesn't get used on both if using that for registration - is that correct?

Further more... what I've spotted in Google Search is that it indexes Contact Us page as it's own page to hit, so if there's no anti-spam validation used on it, or permissions to exclude guests from using it. Then you're going to get a lot of spam over time because spam bots can easy search (target) that page out listed in google across lots of phphBB sites.

If honest, I'm a little bemused why you'd even add Contact Us page and not include anti-spam validation or group permissions with it. It's asking for spam to happen sent out by spam bots, you might as well just never use the feature, don't think using a mod to (add anti-spam) validation is the answer either. It should be their on that page stock, along with groups permissons also to decide if guests can even use contact us.

[Nicofuma]

I said before, one purpose of this form is to able to contact the board admin if you can't solve the captcha. So it can't be disabled for the guest and it can't be protected by a captcha.

Before the admin address email was exposed in this case so it was worse...

[Arty]

So then what is to stop spam bots from posting to the contact page once 3.1 goes gold?

Absolutely nothing. I'm using other forum software that has contact form, had to modify contact form code a bit because of huge amount of spam I was getting.

Contact form will be heavily spammed. Spammers don't care if they get to send their message to 1 user or whole forum, 1 user without catpcha is better than 0 because of captcha so they will spam contact form.

[Senky]

Contact form will be heavily spammed. Spammers don't care if they get to send their message to 1 user or whole forum, 1 user without catpcha is better than 0 because of captcha so they will spam contact form.

That! One solution that works for my sites is, that part of the form DOM (<form>, <input type="submit"> or the best is hidden field) is generated by JS. The best solution is to generate hidden field which makes form submission pass the php validation, or to generate action attribute of form tag by JS. I know, that this makes form unsubmittable to users with JS turned off, but I can imagine 99% webmasters be more happy with that, than inbox full of spam.

[nachtelb]

Started RFC to this: https://area51.phpbb.com/phpBB/viewtopi ... 59#p271629