Email Contact Form --〉HELP

[ertok]

I have developed a plugin whose main function is a pop-up message board. The verification code is received via a valid email address and then filled in to confirm the validity of the email.
The plugin is located in the right sidebar, beneath the "About" plugin, and primarily supports Chinese and English languages.
During local testing, the first issue is that the backend management plugin interface does not display the name and introduction of the plugin. Secondly, the settings page is not translated. Lastly, the email verification code function has not been debugged.
I am uploading the original code of the plugin now. Please help improve the functionality of this plugin by a programming expert.
Thank you!

email-contact-form.zip

(6.19 KiB) Downloaded 13 times

If you have a similar plugin that you could kindly send me, I would be extremely grateful! (Applicable to BLUDIT CMS 3.16.2)

[lastpictures]

The plugin, as described in the download, is rather problematic. It lacks CSRF protection.

The

Code: Select all

`form_token`

is generated but not validated anywhere.

There is no rate limiting.

Code: Select all

`send_code`

can be called an unlimited number of times, leading to potential email spam.

SMTP is only pseudo-SMTP.

Code: Select all

`sendSMTPEmail()`

doesn't use true SMTP but instead uses

Code: Select all

`mail()`.

The SMTP configuration is practically misleading.

Session handling is required. No

Code: Select all

`session_start()`

is visible, posing a risk depending on the CMS.

There are XSS risks due to output like

• Code: Select all

  `$this->getValue('title')`

not being consistently escaped.

I wouldn't use this in a production environment!

[LRAM]

Hello
I'm no expert, but I took a look out of curiosity.
Indeed, the plugin name and description did not appear, just the word ‘activate’.
As this is managed by language files, I assumed that the file was incorrectly encoded. I copied and pasted your English text into Notepad and re-uploaded it to my test site, and everything worked fine.
As for the translation, I don't speak Chinese, but I assume it's the same problem: the file is not encoded correctly.