Contact Form Spam

[pinbrook]

you can use v8 as 30 day trial whilst you wait 28 days for your key

[PaulGrimshaw]

I've now created a new PHP 'Join our mailing page' with some very secure PHP CAPTCHA code from the net. Have a look here.....

Les, could you let us know where you got this from?

Thanks,
Paul.

[Timmo]

you can use v8 as 30 day trial whilst you wait 28 days for your key

some reason when i run the upgrade it says the trial version has expired...

but thanks anyway.

Timmo.

[pinbrook]

Les, could you let us know where you got this from?

post 24 in this thread offers one

[lessharma]

Les, could you let us know where you got this from?

Thanks,
Paul.

Hi Paul,

The php Captcha script I'm using came from here....
http://www.digitalmidget.com/php_noob/captcha.php

Your server needs GD2 library installed and I did an edit on the PHP script so the form results is sent to my email address using 'sendmail'. I downloaded loads of Captcha scripts and found this one the best.

If you what the my edited script I can email it to you.

[feemish]

I've read through this thread,

and am a little confused as it seems to split into 3 or 4 topics.

Let me summarise the question.

Can the contact form on my Actinic version 7.0.3 site be exploited by spammers to send emails ?
If so, how do i stop it?

Thanks
Mark
http://www.arka-shop.co.uk

[mj2003]

Message number #17 in this thread holds the instant solution to the problem, and will protect Actinic 7 from being used for spam. Actinic 8 users can get the latest release to fix it also.

Matthew

[Nadeem]

Hi there

Open 'Mailform.pl'

Find the following and delete it

#
# Send the same message to the sender
# Withe a "thank you" prefix
#
$sTextMailBody = ACTINIC::GetPhrase(-1, 2379) . "\r\n\r\n" . 
$sTextMailBody;
my @Response = ACTINIC::SendMail($::g_sSmtpServer, $sEmailRecpt, 
$sSubject, $sTextMailBody, $$::g_pSetupBlob{EMAIL});
if ($Response[0] != $::SUCCESS)
        {
        ACTINIC::RecordErrors($Response[1], ACTINIC::GetPath());
        $sError = $Response[1];
        }

Kind Regards

[feemish]

Thanks Matthew and Nadeem for clearing that up for me.
Mark

http://www.arka-shop.co.uk

[pinbrook]

Can the contact form on my Actinic version 7.0.3 site be exploited by spammers to send emails ?
If so, how do i stop it?

Did any one even comprehensively answer this? ie can the actinic form be used to send spam to 3rd parties

Message number #17 in this thread holds the instant solution to the problem, and will protect Actinic 7 from being used for spam

is this solution simply stopping the contact form sending an acknowledgement to the sender and disclosing the email address.

[pinbrook]

On re-readig the thread several times I have established that yes the form can beused to send to 3rd parties.

Did this get fixed in any later version of 7 ie is it fixed in 7.06?

[Bruce]

Jo,

This was not fixed for v7.0.6 or for 7.0.7. You will still have to delete the bit from mailform.pl

Kind regards,

[siwalker]

This was not fixed for v7.0.6 or for 7.0.7. You will still have to delete the bit from mailform.pl

I'd love to know why this hasn't been considered worthy of fixing, but in the meantime I've had to delete this code section. We've been accused of sending unsolicited mail despite the fact that we don't operate any mailing lists whatosever, so I can only assume abuse of our contact form.
However this now means that enquiries don't get an automated acknowledgment. I'd like to direct these enquiries to an address other than our main sales address, so I can set up an auto-reponse and then forward to sales. Presumably if I change the email address in View | Business Settings | Company/Contact it will change all over the site, which I don't want. Can I hardcode it into mailform.pl? If so where do I change it?
Can I hide the address using another variable somewhere?

Thanks,
simon

[pinbrook]

To be honest Simon I'd use my own form. (I plugged my own form in when v6 was only a mailto link and kept with it ever since)

We always advise people to use the form that can be found here

http://nms-cgi.sourceforge.net/

you can use the download file on our support desk for additional notes how to configure it. Then you can use a separate address (es) to send the resultant email to, keeping it separate from your main address

We've always used a separate email address for forms (and ensured the email address doesn't get disclosed) we separate out alot of addresses and use alot of addresses behind the scenes, this allows us to close addresses as and when they get too riddled with spam.

we still keep one main address that is publicised etc and have to best deal with spam on that address, but at least we can throw away others.

[jxm28788]

Message number #17 in this thread holds the instant solution to the problem, and will protect Actinic 7 from being used for spam. Actinic 8 users can get the latest release to fix it also.

Sorry to join the party a bit late, but can I just clarify something? Does this vunerability occur only if I'm actually using the actinic contact form (to be honest I didn't even know there was one) or can the system be abused on a v7 site just because the file exists on the server?

In other words, I'm not using the contact form so do I still need to start deleting stuff out of the mailform.pl or not?