fs
e7801ca6ee
Mehrschichtiger Formular-Schutz ohne externe Dienste, ergänzend zu Honeypot und HMAC-Time-Trap: - rate_limit_ok(): pro IP+Route (5/10 min), Tages-Cap (100/Tag), Token-Replay - client_ip() / log_spam() (abgewiesene Versuche -> storage/logs/spam.log) - Honeypot-Feld website -> company_url umbenannt (contact-/membership-form) - Ratelimit-Hinweis in form.js - storage/ratelimit/ (gitignored bis auf .gitkeep) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HGzc6GhWhmLJt1jC2q1SRZ
123 lines
3.8 KiB
PHP
123 lines
3.8 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
/**
|
|
* POST /kontakt-senden — Kontaktformular validieren und via Brevo SMTP versenden.
|
|
* Antwort: PRG-Redirect zu /#kontakt (?sent=1 | ?error=…) oder JSON bei fetch (form.js).
|
|
*/
|
|
|
|
use PHPMailer\PHPMailer\PHPMailer;
|
|
|
|
$wantsJson = str_contains($_SERVER['HTTP_ACCEPT'] ?? '', 'application/json');
|
|
|
|
$respond = static function (bool $ok, string $error = '') use ($wantsJson): never {
|
|
if ($wantsJson) {
|
|
header('Content-Type: application/json; charset=utf-8');
|
|
echo json_encode(['ok' => $ok, 'error' => $error ?: null]);
|
|
} else {
|
|
header('Location: ' . url('') . ($ok ? '?sent=1' : '?error=' . $error) . '#kontakt', true, 303);
|
|
}
|
|
exit;
|
|
};
|
|
|
|
$field = static fn (string $key): string => trim((string) ($_POST[$key] ?? ''));
|
|
|
|
$route = 'kontakt';
|
|
$token = $field('ft');
|
|
|
|
// --- Spam-Checks: Bots bekommen ein stilles "OK" (kein Feedback-Kanal) ---
|
|
if ($field('company_url') !== '') {
|
|
log_spam($route, 'honeypot');
|
|
$respond(true);
|
|
}
|
|
if (!form_token_valid($token)) {
|
|
log_spam($route, 'token');
|
|
$respond(true);
|
|
}
|
|
|
|
// Rate-Limit pro IP (sichtbarer Hinweis statt still — legitime NAT-Nutzer nicht im Dunkeln lassen).
|
|
if (!rate_limit_ok('submit|' . $route . '|' . client_ip(), 5, 600)) {
|
|
log_spam($route, 'ratelimit');
|
|
$respond(false, 'ratelimit');
|
|
}
|
|
|
|
// --- Validierung ---
|
|
$name = $field('name');
|
|
$email = $field('email');
|
|
$phone = $field('phone');
|
|
$interest = $field('interest');
|
|
$subject = $field('subject');
|
|
$message = $field('message');
|
|
|
|
$interests = ['', 'Herrenfußball', 'Damenfußball', 'Jugendfußball', 'Turnen', 'Sonstiges'];
|
|
|
|
$valid = $name !== '' && mb_strlen($name) <= 200
|
|
&& filter_var($email, FILTER_VALIDATE_EMAIL) !== false
|
|
&& mb_strlen($phone) <= 50
|
|
&& in_array($interest, $interests, true)
|
|
&& $subject !== '' && mb_strlen($subject) <= 200
|
|
&& $message !== '' && mb_strlen($message) <= 5000
|
|
&& ($_POST['privacy'] ?? '') === '1'
|
|
&& !preg_match('/[\r\n]/', $name . $subject);
|
|
|
|
if (!$valid) {
|
|
$respond(false, 'validation');
|
|
}
|
|
|
|
// --- Inhalts-/Aufkommens-Heuristiken (still abweisen, Bot-typisch) ---
|
|
if (preg_match_all('~https?://~i', $subject . ' ' . $message) > 2) {
|
|
log_spam($route, 'links');
|
|
$respond(true);
|
|
}
|
|
// Globaler Tages-Cap als Brevo-Kosten-Backstop — die Flut soll ihn nicht bemerken.
|
|
if (!rate_limit_ok('daily', 100, 86400)) {
|
|
log_spam($route, 'daily-cap');
|
|
$respond(true);
|
|
}
|
|
// Token-Mehrfachnutzung begrenzen (Replay-Schutz, großzügig für menschliches Mehrfach-Senden).
|
|
if (!rate_limit_ok('token|' . $token, 3, 86400)) {
|
|
log_spam($route, 'replay');
|
|
$respond(true);
|
|
}
|
|
|
|
// --- Versand ---
|
|
$smtp = config('smtp');
|
|
|
|
$body = "Kontaktanfrage über tsv08kulmbach.de\n"
|
|
. str_repeat('-', 40) . "\n"
|
|
. "Name: {$name}\n"
|
|
. "E-Mail: {$email}\n"
|
|
. ($phone !== '' ? "Telefon: {$phone}\n" : '')
|
|
. ($interest !== '' ? "Interesse: {$interest}\n" : '')
|
|
. "Betreff: {$subject}\n"
|
|
. str_repeat('-', 40) . "\n\n"
|
|
. $message . "\n\n"
|
|
. str_repeat('-', 40) . "\n"
|
|
. 'Datenschutz zugestimmt: ja (' . date('d.m.Y H:i') . ")\n";
|
|
|
|
try {
|
|
$mail = new PHPMailer(true);
|
|
$mail->isSMTP();
|
|
$mail->Host = $smtp['host'];
|
|
$mail->Port = (int) $smtp['port'];
|
|
$mail->SMTPAuth = true;
|
|
$mail->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS;
|
|
$mail->Username = $smtp['username'];
|
|
$mail->Password = $smtp['password'];
|
|
$mail->CharSet = PHPMailer::CHARSET_UTF8;
|
|
|
|
$mail->setFrom($smtp['from'], $smtp['from_name']);
|
|
$mail->addAddress($smtp['to']);
|
|
$mail->addReplyTo($email, $name);
|
|
$mail->Subject = 'Kontaktanfrage: ' . $subject;
|
|
$mail->Body = $body;
|
|
|
|
$mail->send();
|
|
} catch (Throwable $e) {
|
|
error_log('[' . date('c') . '] Mailversand fehlgeschlagen: ' . $e->getMessage() . "\n", 3, STORAGE_PATH . '/logs/mail.log');
|
|
$respond(false, 'mail');
|
|
}
|
|
|
|
$respond(true);
|