getgrav / getgrav/grav-plugin-form

Nonce verification

Open
#299 11 comments 0 reactions 2 assignees Claimed by @mahagr View on GitHub
bug
Dominant language
PHP
Stars
64
Forks
80
Avg merge
10h 13m
Merged PRs (30d)
9

Description

Our Grav contact form page shows our message in green with Chrome (status='success'). Firefox, Edge and IE11 showed the standard 'Oops' message in red (status='error').

I found only Chrome returns the same nonce string (in Grav form utils.php)

Results of successive submissions in each browser were:
Firefox: 5ad9398a6edd563a549a0edc72f499d3
Firefox: 282da8f78d6f46f1df8e0fab6b85c639
IE11: 91ad57f892f6ec1c816ab310090823f0
IE11: cf86831399fc5d223c7c139251384687
EDGE: b28e725fe38dcc3c5a81a691072f889d
EDGE: 0dddab4fd0f9ccc27b391f3ef2afb1d0
Chrome: 7849d7e1e5ce91af970890dc8b73ed71
Chrome: 7849d7e1e5ce91af970890dc8b73ed71

As a workround I have changed the verifyNonce function in Grav/Common/Utils.php to return true in all cases (so form data is processed) and set status='success' (so the message is in green not red)

Is this a problem with the Form plugin or is there something I should set?

The contact form is included in CustomHTML in the the Base Outline (Supra theme):
{% include "forms/form.html.twig" with {form: forms('contact')} %}

Thank you

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.