adrian/contact-mailer
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

tested timer field

Browse Source
This commit is contained in:
Adrian Amaglio 2020-09-17 16:19:39 +02:00
parent e66ac2e8bd
commit 8f88cd6d2c
2 changed files with 22 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
main.py
View File

@ -134,22 +134,22 @@ def submission ():
response.status = 500 response.status = 500
return resp('error', 'La base de donnée n’est pas accessible.') return resp('error', 'La base de donnée n’est pas accessible.')
# Did the bot filled the honeypot field?
if 'honeypotfield' in form and form['honeypotfield'] in request.forms and request.forms.get(form['honeypotfield']) != '':
response.status = 400
return resp('error', 'We identified you as a bot. If this is an error, try to contact us via another way.')
# Is the js timer enabled?
if 'timerdelay' in form:
# Did it work?
if 'timerfield' not in request.forms or request.forms.get('timerfield') < form['timerdelay']:
response.status = 400
return resp('error', 'We identified you as a bot. If this is an error, try to contact us via another way.')
try: try:
subject_fields = fill_fields(request, get_fields(form['subject'])) subject_fields = fill_fields(request, get_fields(form['subject']))
content_fields = fill_fields(request, get_fields(form['content'])) content_fields = fill_fields(request, get_fields(form['content']))
# Did the bot filled the honeypot field?
if 'honeypotfield' in form and form['honeypotfield'] in request.forms and request.forms.get(form['honeypotfield']) != '':
response.status = 400
return resp('error', 'We identified you as a bot. If this is an error, try to contact us via another way.')
# Is the js timer enabled?
if 'timerdelay' in form:
# Did it work?
if 'timerfield' not in request.forms or request.forms.get('timerfield') < form['timerdelay']:
response.status = 400
return resp('error', 'We identified you as a bot. If this is an error, try to contact us via another way.')
except MissingParameterException as e: except MissingParameterException as e:
response.status = 404 response.status = 400
return resp('error', str(e)) return resp('error', str(e))
subject = re.sub(form_regex, r'{\1}', form['subject']).format(**subject_fields) subject = re.sub(form_regex, r'{\1}', form['subject']).format(**subject_fields)
@ -270,10 +270,6 @@ def create_form ():
response.status = 400 response.status = 400
return resp('error', 'Le champs « contenu » est requis') return resp('error', 'Le champs « contenu » est requis')
if 'honeypotfield' in request.forms:
honeypotfield = request.forms.getunicode('honeypotfield')
else:
honeypotfield = None
# Getting from address # Getting from address
if 'mail' in request.forms: if 'mail' in request.forms:
@ -290,14 +286,19 @@ def create_form ():
# TODO limit the insertion rate # TODO limit the insertion rate
token = ''.join(random.sample(token_chars, token_len)) token = ''.join(random.sample(token_chars, token_len))
try: try:
inserted = mongodb_database['forms'].insert_one({ newEntry = {
'mail': mail, 'mail': mail,
'content': content, 'content': content,
'subject': subject, 'subject': subject,
'user_id': user['_id'], 'user_id': user['_id'],
'token': token, 'token': token,
'honeypotfield': honeypotfield, }
}) if 'honeypotfield' in request.forms:
newEntry['honeypotfield'] = request.forms.getunicode('honeypotfield')
if 'timerdelay' in request.forms:
newEntry['timerdelay'] = request.forms.getunicode('timerdelay')
inserted = mongodb_database['forms'].insert_one(newEntry)
except pymongo.errors.ServerSelectionTimeoutError as e: except pymongo.errors.ServerSelectionTimeoutError as e:
response.status = 500 response.status = 500
return resp('error', 'La base de donnée n’est pas accessible') return resp('error', 'La base de donnée n’est pas accessible')

3
test.html
View File

@ -7,7 +7,8 @@
<body> <body>
<div id="contact-mailer-message"></div> <div id="contact-mailer-message"></div>
<form action="http://localhost:8080/submit" method="POST" id="contact-mailer-form"> <form action="http://localhost:8080/submit" method="POST" id="contact-mailer-form">
<input type="hidden" name="token" value="sYMXDz5UKuRF38LbQl20ikrmp7nhHcxTCgGZodqAaBtSvPOV4f" /> <noscript>Les protections anti-spam, nécéssitent l’utilisation de javascript. Rien d’intrusif normalement.</noscript>
<input type="hidden" name="token" value="PK8gQHDx9VoJ7yuEhbj5iCZkcUOAqTYlRSN14XFtdfr3LBs0zn" />
<div> <div>
<label for="nom">Votre nom&nbsp;:</label> <label for="nom">Votre nom&nbsp;:</label>
<input type="text" name="nom" required="required"/> <input type="text" name="nom" required="required"/>