getgrav / getgrav/grav-plugin-form
Nonce verification
- Dominant language
- PHP
- Stars
- 64
- Forks
- 80
- Avg merge
- 10h 13m
- Merged PRs (30d)
- 9
Description
Our Grav contact form page shows our message in green with Chrome (status='success'). Firefox, Edge and IE11 showed the standard 'Oops' message in red (status='error').
I found only Chrome returns the same nonce string (in Grav form utils.php)
Results of successive submissions in each browser were:
Firefox: 5ad9398a6edd563a549a0edc72f499d3
Firefox: 282da8f78d6f46f1df8e0fab6b85c639
IE11: 91ad57f892f6ec1c816ab310090823f0
IE11: cf86831399fc5d223c7c139251384687
EDGE: b28e725fe38dcc3c5a81a691072f889d
EDGE: 0dddab4fd0f9ccc27b391f3ef2afb1d0
Chrome: 7849d7e1e5ce91af970890dc8b73ed71
Chrome: 7849d7e1e5ce91af970890dc8b73ed71
As a workround I have changed the verifyNonce function in Grav/Common/Utils.php to return true in all cases (so form data is processed) and set status='success' (so the message is in green not red)
Is this a problem with the Form plugin or is there something I should set?
The contact form is included in CustomHTML in the the Base Outline (Supra theme):
{% include "forms/form.html.twig" with {form: forms('contact')} %}
Thank you
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.