smueller/HexaHost-Web-Prod
1
0
Fork 0
mirror of https://git.hexahost.dev/smueller/HexaHost-Frontend.git synced 2026-06-02 06:58:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Implement CSRF protection in contact form: Added session management and CSRF token validation to enhance security. Updated AJAX response handling in JavaScript to reset button state after submission.

Browse Source
This commit is contained in:
TheOnlyMace
2026-01-06 21:49:24 +01:00
parent a6aab5208d
commit 385baf2db7
3 changed files with 29 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
public/assets/js/contact.js
View File

@@ -77,6 +77,10 @@
}) })
.then(response => response.json()) .then(response => response.json())
.then(data => { .then(data => {
// Reset button state
submitBtn.textContent = originalText;
submitBtn.disabled = false;
if (data.success) { if (data.success) {
// Reset form // Reset form
form.reset(); form.reset();

20
public/contact-handler.php
View File

@@ -4,12 +4,22 @@
* E-Mail-Verarbeitung mit SMTP-Integration und Spam-Schutz * E-Mail-Verarbeitung mit SMTP-Integration und Spam-Schutz
*/ */
// Session starten für CSRF-Validierung
if (session_status() === PHP_SESSION_NONE) {
session_start();
}
// Konfiguration laden // Konfiguration laden
require_once 'config.php'; require_once 'config.php';
// Konfiguration verwenden // Konfiguration verwenden
$config = getHexaHostConfig(); $config = getHexaHostConfig();
// CSRF-Token validieren
function validateCSRFToken($token) {
return isset($_SESSION['csrf_token']) && hash_equals($_SESSION['csrf_token'], $token);
}
// CORS Headers für AJAX-Requests // CORS Headers für AJAX-Requests
header('Access-Control-Allow-Origin: *'); header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: POST'); header('Access-Control-Allow-Methods: POST');
@@ -329,6 +339,16 @@ function generateEmailText($data) {
// Hauptverarbeitung // Hauptverarbeitung
try { try {
// CSRF-Token validieren
if (empty($_POST['csrf_token']) || !validateCSRFToken($_POST['csrf_token'])) {
http_response_code(403);
echo json_encode([
'success' => false,
'message' => 'Ungültige Sitzung. Bitte laden Sie die Seite neu und versuchen Sie es erneut.'
]);
exit;
}
// Rate Limiting Check // Rate Limiting Check
$client_ip = $_SERVER['REMOTE_ADDR']; $client_ip = $_SERVER['REMOTE_ADDR'];
if (!checkRateLimit($client_ip)) { if (!checkRateLimit($client_ip)) {

5
public/includes/functions.php
View File

@@ -3,6 +3,11 @@
* Helper functions for HexaHost.de * Helper functions for HexaHost.de
*/ */
// Start session for CSRF token
if (session_status() === PHP_SESSION_NONE) {
session_start();
}
/** /**
* Set page configuration and include header * Set page configuration and include header
* *