\n"; 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /feedback/vendor/phpmailer/phpmailer/language/phpmailer.lang-zh_cn.php: -------------------------------------------------------------------------------- 1 | 7 | * @author young
5 |
|
39 |
40 |
41 |
42 | ```
43 | When you click on the button `.form-success__btn:`
44 | ```js
45 | document.querySelector('.form-success__btn').addEventListener('click', (e) => {
46 | form.reset();
47 | e.target.closest('.form-container').querySelector('.form-success').classList.add('form-success_hide');
48 | });
49 | ```
50 | The `reset()` method resets the form.
51 |
52 | ### 3. Initialize form as `ItcSubmitForm`
53 | ```js
54 | // 'form' - selector
55 | const form = new ItcSubmitForm('form');
56 | ```
57 | Additional parameters are passed in the 2nd argument:
58 | ```js
59 | const form = new ItcSubmitForm('form', {
60 | isCheckValidationOnClient: true, // проверять форму перед отправкой на сервер
61 | attachMaxItems: 5, // максимальное количество файлов, которые можно добавить к форме
62 | attachMaxFileSize: 512, // 512 Кбайт - максимальный размер файла
63 | attachExt: ['jpg', 'jpeg', 'bmp', 'gif', 'png'] // допустимые расширения файлов
64 | });
65 | ```
66 | Here are the values of the keys that they have by default.
67 |
68 | ### 4. Set values to constants in php script
69 |
70 | 4.1. Checking the captcha:
71 | ```php
72 | define('HAS_CHECK_CAPTCHA', true);
73 | ```
74 | 4.2. Attached files:
75 | ```php
76 | // не пропускать форму, если к ней не прикреплён хотя бы один файл
77 | define('HAS_ATTACH_REQUIRED', true);
78 | // разрешённые mime типы файлов
79 | define('ALLOWED_MIME_TYPES', ['image/jpeg', 'image/gif', 'image/png']);
80 | // максимальный размер файла
81 | define('MAX_FILE_SIZE', 512 * 1024);
82 | ```
83 |
84 | 4.3. Mail settings:
85 | ```php
86 | // отправлять письмо на указанный адрес email
87 | define('HAS_SEND_EMAIL', true);
88 | // добавить файлы в тело письма в виде ссылок (В противном случае прикрепить)
89 | define('HAS_ATTACH_IN_BODY', false);
90 | // базовый URL-адрес (используется, если составления полного URL для ссылок, добавляемых в тело письма)
91 | define('BASE_URL', 'https://domain.com');
92 | // настройка почты (отправка осуществляется через SMTP)
93 | define('EMAIL_SETTINGS', [
94 | 'addresses' => ['manager@domain.com'], // кому необходимо отправить письмо
95 | 'from' => ['no-reply@domain.com', 'Имя сайта'], // от какого email и имени необходимо отправить письмо
96 | 'subject' => 'Сообщение с формы обратной связи', // тема письма
97 | 'host' => 'ssl://smtp.yandex.ru', // SMTP-хост
98 | 'username' => 'name@yandex.ru', // // SMTP-пользователь
99 | 'password' => '*********', // SMTP-пароль
100 | 'port' => '465' // SMTP-порт
101 | ]);
102 | ```
103 |
104 | 4.4. Notifications to user:
105 | ```php
106 | // необходимо ли отправлять уведомление пользователю на почту
107 | define('HAS_SEND_NOTIFICATION', false);
108 | // тема письма
109 | define('SUBJECT_FOR_CLIENT', 'Ваше сообщение доставлено');
110 | ```
111 |
112 | 4.5. Logs:
113 | ```php
114 | // писать предупреждения и ошибки в лог
115 | define('HAS_WRITE_LOG', true);
116 | ```
117 |
118 | 4.6. Saving form in txt:
119 | ```php
120 | // записывать успешные формы в файл forms.log
121 | define('HAS_WRITE_TXT', true);
122 | ```
123 |
124 | ### 5. Copy "feedback" folder to the root directory of site
125 |
126 | By default, the "feedback" folder contains the file "index.html". It can be used to test the form.
127 | On a website with a domain name "domain.com " this form will be available at the following URL: `http://domain.com/feedback/` (or `https://domain.com/feedback/`).
128 |
--------------------------------------------------------------------------------
/feedback/vendor/phpmailer/phpmailer/get_oauth_token.php:
--------------------------------------------------------------------------------
1 |
9 | * @author Jim Jagielski (jimjag) 52 | Google
53 | Yahoo
54 | Microsoft/Outlook/Hotmail/Live/Office365
55 | 56 | 57 | $clientId, 88 | 'clientSecret' => $clientSecret, 89 | 'redirectUri' => $redirectUri, 90 | 'accessType' => 'offline' 91 | ]; 92 | 93 | $options = []; 94 | $provider = null; 95 | 96 | switch ($providerName) { 97 | case 'Google': 98 | $provider = new Google($params); 99 | $options = [ 100 | 'scope' => [ 101 | 'https://mail.google.com/' 102 | ] 103 | ]; 104 | break; 105 | case 'Yahoo': 106 | $provider = new Yahoo($params); 107 | break; 108 | case 'Microsoft': 109 | $provider = new Microsoft($params); 110 | $options = [ 111 | 'scope' => [ 112 | 'wl.imap', 113 | 'wl.offline_access' 114 | ] 115 | ]; 116 | break; 117 | } 118 | 119 | if (null === $provider) { 120 | exit('Provider missing'); 121 | } 122 | 123 | if (!isset($_GET['code'])) { 124 | //If we don't have an authorization code then get one 125 | $authUrl = $provider->getAuthorizationUrl($options); 126 | $_SESSION['oauth2state'] = $provider->getState(); 127 | header('Location: ' . $authUrl); 128 | exit; 129 | //Check given state against previously stored one to mitigate CSRF attack 130 | } elseif (empty($_GET['state']) || ($_GET['state'] !== $_SESSION['oauth2state'])) { 131 | unset($_SESSION['oauth2state']); 132 | unset($_SESSION['provider']); 133 | exit('Invalid state'); 134 | } else { 135 | unset($_SESSION['provider']); 136 | //Try to get an access token (using the authorization code grant) 137 | $token = $provider->getAccessToken( 138 | 'authorization_code', 139 | [ 140 | 'code' => $_GET['code'] 141 | ] 142 | ); 143 | //Use this to interact with an API on the users behalf 144 | //Use this to get a new access token if the old one expires 145 | echo 'Refresh Token: ', $token->getRefreshToken(); 146 | } 147 | -------------------------------------------------------------------------------- /feedback/index.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 |
13 |
103 |
104 |
105 |
128 |
129 |
130 |
131 |
132 |
--------------------------------------------------------------------------------
/feedback/vendor/phpmailer/phpmailer/SECURITY.md:
--------------------------------------------------------------------------------
1 | # Security notices relating to PHPMailer
2 |
3 | Please disclose any security issues or vulnerabilities found through [Tidelift's coordinated disclosure system](https://tidelift.com/security) or to the maintainers privately.
4 |
5 | PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the `$patternselect` parameter to `validateAddress()` is set to `'php'` (the default, defined by `PHPMailer::$validator`), and the global namespace contains a function called `php`, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names. Recorded as [CVE-2021-3603](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3603). Reported by [Vikrant Singh Chauhan](mailto:vi@hackberry.xyz) via [huntr.dev](https://www.huntr.dev/).
6 |
7 | PHPMailer versions 6.4.1 and earlier contain a possible remote code execution vulnerability through the `$lang_path` parameter of the `setLanguage()` method. If the `$lang_path` parameter is passed unfiltered from user input, it can be set to [a UNC path](https://docs.microsoft.com/en-us/dotnet/standard/io/file-path-formats#unc-paths), and if an attacker is also able to persuade the server to load a file from that UNC path, a script file under their control may be executed. This vulnerability only applies to systems that resolve UNC paths, typically only Microsoft Windows.
8 | PHPMailer 6.5.0 mitigates this by no longer treating translation files as PHP code, but by parsing their text content directly. This approach avoids the possibility of executing unknown code while retaining backward compatibility. This isn't ideal, so the current translation format is deprecated and will be replaced in the next major release. Recorded as [CVE-2021-34551](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34551). Reported by [Jilin Diting Information Technology Co., Ltd](https://listensec.com) via Tidelift.
9 |
10 | PHPMailer versions between 6.1.8 and 6.4.0 contain a regression of the earlier CVE-2018-19296 object injection vulnerability as a result of [a fix for Windows UNC paths in 6.1.8](https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9). Recorded as [CVE-2020-36326](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-36326). Reported by Fariskhi Vidyan via Tidelift. 6.4.1 fixes this issue, and also enforces stricter checks for URL schemes in local path contexts.
11 |
12 | PHPMailer versions 6.1.5 and earlier contain an output escaping bug that occurs in `Content-Type` and `Content-Disposition` when filenames passed into `addAttachment` and other methods that accept attachment names contain double quote characters, in contravention of RFC822 3.4.1. No specific vulnerability has been found relating to this, but it could allow file attachments to bypass attachment filters that are based on matching filename extensions. Recorded as [CVE-2020-13625](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13625). Reported by Elar Lang of Clarified Security.
13 |
14 | PHPMailer versions prior to 6.0.6 and 5.2.27 are vulnerable to an object injection attack by passing `phar://` paths into `addAttachment()` and other functions that may receive unfiltered local paths, possibly leading to RCE. Recorded as [CVE-2018-19296](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-19296). See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info on this type of vulnerability. Mitigated by blocking the use of paths containing URL-protocol style prefixes such as `phar://`. Reported by Sehun Oh of cyberone.kr.
15 |
16 | PHPMailer versions prior to 5.2.24 (released July 26th 2017) have an XSS vulnerability in one of the code examples, [CVE-2017-11503](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-11503). The `code_generator.phps` example did not filter user input prior to output. This file is distributed with a `.phps` extension, so it it not normally executable unless it is explicitly renamed, and the file is not included when PHPMailer is loaded through composer, so it is safe by default. There was also an undisclosed potential XSS vulnerability in the default exception handler (unused by default). Patches for both issues kindly provided by Patrick Monnerat of the Fedora Project.
17 |
18 | PHPMailer versions prior to 5.2.22 (released January 9th 2017) have a local file disclosure vulnerability, [CVE-2017-5223](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5223). If content passed into `msgHTML()` is sourced from unfiltered user input, relative paths can map to absolute local file paths and added as attachments. Also note that `addAttachment` (just like `file_get_contents`, `passthru`, `unlink`, etc) should not be passed user-sourced params either! Reported by Yongxiang Li of Asiasecurity.
19 |
20 | PHPMailer versions prior to 5.2.20 (released December 28th 2016) are vulnerable to [CVE-2016-10045](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10045) a remote code execution vulnerability, responsibly reported by [Dawid Golunski](https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html), and patched by Paul Buonopane (@Zenexer).
21 |
22 | PHPMailer versions prior to 5.2.18 (released December 2016) are vulnerable to [CVE-2016-10033](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10033) a remote code execution vulnerability, responsibly reported by [Dawid Golunski](http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html).
23 |
24 | PHPMailer versions prior to 5.2.14 (released November 2015) are vulnerable to [CVE-2015-8476](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8476) an SMTP CRLF injection bug permitting arbitrary message sending.
25 |
26 | PHPMailer versions prior to 5.2.10 (released May 2015) are vulnerable to [CVE-2008-5619](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5619), a remote code execution vulnerability in the bundled html2text library. This file was removed in 5.2.10, so if you are using a version prior to that and make use of the html2text function, it's vitally important that you upgrade and remove this file.
27 |
28 | PHPMailer versions prior to 2.0.7 and 2.2.1 are vulnerable to [CVE-2012-0796](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0796), an email header injection attack.
29 |
30 | Joomla 1.6.0 uses PHPMailer in an unsafe way, allowing it to reveal local file paths, reported in [CVE-2011-3747](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3747).
31 |
32 | PHPMailer didn't sanitise the `$lang_path` parameter in `SetLanguage`. This wasn't a problem in itself, but some apps (PHPClassifieds, ATutor) also failed to sanitise user-provided parameters passed to it, permitting semi-arbitrary local file inclusion, reported in [CVE-2010-4914](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4914), [CVE-2007-2021](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-2021) and [CVE-2006-5734](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-5734).
33 |
34 | PHPMailer 1.7.2 and earlier contained a possible DDoS vulnerability reported in [CVE-2005-1807](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-1807).
35 |
36 | PHPMailer 1.7 and earlier (June 2003) have a possible vulnerability in the `SendmailSend` method where shell commands may not be sanitised. Reported in [CVE-2007-3215](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-3215).
37 |
38 |
--------------------------------------------------------------------------------
/feedback/examples/form-processing-1.php:
--------------------------------------------------------------------------------
1 | ['manager@domain.com'], // кому необходимо отправить письмо
42 | 'from' => ['no-reply@domain.com', 'Имя сайта'], // от какого email и имени необходимо отправить письмо
43 | 'subject' => 'Сообщение с формы обратной связи', // тема письма
44 | 'host' => 'ssl://smtp.yandex.ru', // SMTP-хост
45 | 'username' => 'name@yandex.ru', // // SMTP-пользователь
46 | 'password' => '*********', // SMTP-пароль
47 | 'port' => '465' // SMTP-порт
48 | ];
49 | const HAS_SEND_NOTIFICATION = false;
50 | const BASE_URL = 'https://domain.com';
51 | const SUBJECT_FOR_CLIENT = 'Ваше сообщение доставлено';
52 | //
53 | const HAS_WRITE_TXT = true;
54 |
55 | function itc_log($message)
56 | {
57 | if (HAS_WRITE_LOG) {
58 | error_log('Date: ' . date('d.m.Y h:i:s') . ' | ' . $message . PHP_EOL, 3, LOG_FILE);
59 | }
60 | }
61 |
62 | $data = [
63 | 'errors' => [],
64 | 'form' => [],
65 | 'logs' => [],
66 | 'result' => 'success'
67 | ];
68 |
69 | $attachs = [];
70 |
71 | /* 4 ЭТАП - ВАЛИДАЦИЯ ДАННЫХ (ЗНАЧЕНИЙ ПОЛЕЙ ФОРМЫ) */
72 |
73 | // валидация name
74 | if (!empty($_POST['name'])) {
75 | $data['form']['name'] = htmlspecialchars($_POST['name']);
76 | } else {
77 | $data['result'] = 'error';
78 | $data['errors']['name'] = 'Заполните это поле.';
79 | itc_log('Не заполнено поле name.');
80 | }
81 |
82 | // валидация email
83 | if (!empty($_POST['email'])) {
84 | $data['form']['email'] = $_POST['email'];
85 | if (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
86 | $data['result'] = 'error';
87 | $data['errors']['email'] = 'Email не корректный.';
88 | itc_log('Email не корректный.');
89 | }
90 | } else {
91 | $data['result'] = 'error';
92 | $data['errors']['email'] = 'Заполните это поле.';
93 | itc_log('Не заполнено поле email.');
94 | }
95 |
96 | // валидация message
97 | if (!empty($_POST['message'])) {
98 | $data['form']['message'] = htmlspecialchars($_POST['message']);
99 | if (mb_strlen($data['form']['message'], 'UTF-8') < 20) {
100 | $data['result'] = 'error';
101 | $data['errors']['message'] = 'Это поле должно быть не меньше 20 cимволов.';
102 | itc_log('Поле message должно быть не меньше 20 cимволов.');
103 | }
104 | } else {
105 | $data['result'] = 'error';
106 | $data['errors']['message'] = 'Заполните это поле.';
107 | itc_log('Не заполнено поле message.');
108 | }
109 |
110 | // проверка капчи
111 | if (HAS_CHECK_CAPTCHA) {
112 | session_start();
113 | if ($_POST['captcha'] === $_SESSION['captcha-1']) {
114 | $data['form']['captcha'] = $_POST['captcha'];
115 | } else {
116 | $data['result'] = 'error';
117 | $data['errors']['captcha'] = 'Код не соответствует изображению.';
118 | itc_log('Не пройдена капча. Указанный код ' . $_POST['captcha'] . ' не соответствует ' . $_SESSION['captcha']);
119 | }
120 | }
121 |
122 | // валидация agree
123 | if ($_POST['agree'] == 'true') {
124 | $data['form']['agree'] = true;
125 | } else {
126 | $data['result'] = 'error';
127 | $data['errors']['agree'] = 'Необходимо установить этот флажок.';
128 | itc_log('Не установлен флажок для поля agree.');
129 | }
130 |
131 | // валидация прикреплённых файлов
132 | if (empty($_FILES['attach'])) {
133 | if (HAS_ATTACH_REQUIRED) {
134 | $data['result'] = 'error';
135 | $data['errors']['attach'] = 'Заполните это поле.';
136 | itc_log('Не прикреплены файлы к форме.');
137 | }
138 | } else {
139 | foreach ($_FILES['attach']['error'] as $key => $error) {
140 | if ($error == UPLOAD_ERR_OK) {
141 | $name = basename($_FILES['attach']['name'][$key]);
142 | $size = $_FILES['attach']['size'][$key];
143 | $mtype = mime_content_type($_FILES['attach']['tmp_name'][$key]);
144 | if (!in_array($mtype, ALLOWED_MIME_TYPES)) {
145 | $data['result'] = 'error';
146 | $data['errors']['attach'][$key] = 'Файл имеет не разрешённый тип.';
147 | itc_log('Прикреплённый файл ' . $name . ' имеет не разрешённый тип.');
148 | } else if ($size > MAX_FILE_SIZE) {
149 | $data['result'] = 'error';
150 | $data['errors']['attach'][$key] = 'Размер файла превышает допустимый.';
151 | itc_log('Размер файла ' . $name . ' превышает допустимый.');
152 | }
153 | }
154 | }
155 | if ($data['result'] === 'success') {
156 | // перемещаем файлы в папку UPLOAD_PATH
157 | foreach ($_FILES['attach']['name'] as $key => $attach) {
158 | $ext = mb_strtolower(pathinfo($_FILES['attach']['name'][$key], PATHINFO_EXTENSION));
159 | $name = basename($_FILES['attach']['name'][$key], $ext);
160 | $tmp = $_FILES['attach']['tmp_name'][$key];
161 | $newName = rtrim($name, '.') . '_' . uniqid() . '.' . $ext;
162 | if (!move_uploaded_file($tmp, UPLOAD_PATH . $newName)) {
163 | $data['result'] = 'error';
164 | $data['errors']['attach'][$key] = 'Ошибка при загрузке файла.';
165 | itc_log('Ошибка при перемещении файла ' . $name . '.');
166 | } else {
167 | $attachs[] = UPLOAD_PATH . $newName;
168 | }
169 | }
170 | }
171 | }
172 |
173 | use PHPMailer\PHPMailer\PHPMailer;
174 | //use PHPMailer\PHPMailer\SMTP;
175 | use PHPMailer\PHPMailer\Exception;
176 |
177 | require '../vendor/phpmailer/phpmailer/src/Exception.php';
178 | require '../vendor/phpmailer/phpmailer/src/PHPMailer.php';
179 | require '../vendor/phpmailer/phpmailer/src/SMTP.php';
180 |
181 | if ($data['result'] == 'success' && HAS_SEND_EMAIL) {
182 | // получаем содержимое email шаблона и заменяем в нём
183 | $template = file_get_contents('../template/email.tpl');
184 | $search = ['%subject%', '%name%', '%email%', '%message%', '%date%'];
185 | $replace = [EMAIL_SETTINGS['subject'], $data['form']['name'], $data['form']['email'], $data['form']['message'], date('d.m.Y H:i')];
186 | $body = str_replace($search, $replace, $template);
187 | // добавление файлов в виде ссылок
188 | if (HAS_ATTACH_IN_BODY && count($attachs)) {
189 | $ul = 'Файлы, прикреплённые к форме:Форма обратной связи
14 | 15 |
16 |
17 |
93 |
94 |
95 |
101 |
102 |
96 |
98 |
99 |
100 | - ';
190 | foreach ($attachs as $attach) {
191 | $href = str_replace($_SERVER['DOCUMENT_ROOT'], '', $attach);
192 | $name = basename($href);
193 | $ul .= '
- ' . $name . ' '; 194 | 195 | $data['href'][] = BASE_URL . $href; 196 | } 197 | $ul .= '
- ';
190 | foreach ($attachs as $attach) {
191 | $href = str_replace($_SERVER['DOCUMENT_ROOT'], '', $attach);
192 | $name = basename($href);
193 | $ul .= '
- ' . $name . ' '; 194 | 195 | $data['href'][] = BASE_URL . $href; 196 | } 197 | $ul .= '
13 |
191 |
192 |
193 |
221 |
222 |
223 |
224 |
225 |
--------------------------------------------------------------------------------
/feedback/form-processing.php:
--------------------------------------------------------------------------------
1 | ['manager@domain.com'], // кому необходимо отправить письмо
53 | 'from' => ['no-reply@domain.com', 'Имя сайта'], // от какого email и имени необходимо отправить письмо
54 | 'subject' => 'Сообщение с формы обратной связи', // тема письма
55 | 'host' => 'ssl://smtp.yandex.ru', // SMTP-хост
56 | 'username' => 'name@yandex.ru', // // SMTP-пользователь
57 | 'password' => '*********', // SMTP-пароль
58 | 'port' => '465' // SMTP-порт
59 | ];
60 | const HAS_SEND_NOTIFICATION = false;
61 | const BASE_URL = 'https://domain.com';
62 | const SUBJECT_FOR_CLIENT = 'Ваше сообщение доставлено';
63 | //
64 | const HAS_WRITE_TXT = true;
65 |
66 | function itc_log($message)
67 | {
68 | if (HAS_WRITE_LOG) {
69 | error_log('Date: ' . date('d.m.Y h:i:s') . ' | ' . $message . PHP_EOL, 3, LOG_FILE);
70 | }
71 | }
72 |
73 | $data = [
74 | 'errors' => [],
75 | 'form' => [],
76 | 'logs' => [],
77 | 'result' => 'success'
78 | ];
79 |
80 | $attachs = [];
81 |
82 | /* 4 ЭТАП - ВАЛИДАЦИЯ ДАННЫХ (ЗНАЧЕНИЙ ПОЛЕЙ ФОРМЫ) */
83 |
84 | // валидация name
85 | if (!empty($_POST['name'])) {
86 | $data['form']['name'] = htmlspecialchars($_POST['name']);
87 | } else {
88 | $data['result'] = 'error';
89 | $data['errors']['name'] = 'Заполните это поле.';
90 | itc_log('Не заполнено поле name.');
91 | }
92 |
93 | // валидация email
94 | if (!empty($_POST['email'])) {
95 | $data['form']['email'] = $_POST['email'];
96 | if (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
97 | $data['result'] = 'error';
98 | $data['errors']['email'] = 'Email не корректный.';
99 | itc_log('Email не корректный.');
100 | }
101 | } else {
102 | $data['result'] = 'error';
103 | $data['errors']['email'] = 'Заполните это поле.';
104 | itc_log('Не заполнено поле email.');
105 | }
106 |
107 | // валидация message
108 | if (!empty($_POST['message'])) {
109 | $data['form']['message'] = htmlspecialchars($_POST['message']);
110 | if (mb_strlen($data['form']['message'], 'UTF-8') < 20) {
111 | $data['result'] = 'error';
112 | $data['errors']['message'] = 'Это поле должно быть не меньше 20 cимволов.';
113 | itc_log('Поле message должно быть не меньше 20 cимволов.');
114 | }
115 | } else {
116 | $data['result'] = 'error';
117 | $data['errors']['message'] = 'Заполните это поле.';
118 | itc_log('Не заполнено поле message.');
119 | }
120 |
121 | // проверка капчи
122 | if (HAS_CHECK_CAPTCHA) {
123 | session_start();
124 | if ($_POST['captcha'] === $_SESSION['captcha']) {
125 | $data['form']['captcha'] = $_POST['captcha'];
126 | } else {
127 | $data['result'] = 'error';
128 | $data['errors']['captcha'] = 'Код не соответствует изображению.';
129 | itc_log('Не пройдена капча. Указанный код ' . $_POST['captcha'] . ' не соответствует ' . $_SESSION['captcha']);
130 | }
131 | }
132 |
133 | // валидация agree
134 | if ($_POST['agree'] == 'true') {
135 | $data['form']['agree'] = true;
136 | } else {
137 | $data['result'] = 'error';
138 | $data['errors']['agree'] = 'Необходимо установить этот флажок.';
139 | itc_log('Не установлен флажок для поля agree.');
140 | }
141 |
142 | // валидация прикреплённых файлов
143 | if (empty($_FILES['attach'])) {
144 | if (HAS_ATTACH_REQUIRED) {
145 | $data['result'] = 'error';
146 | $data['errors']['attach'] = 'Заполните это поле.';
147 | itc_log('Не прикреплены файлы к форме.');
148 | }
149 | } else {
150 | foreach ($_FILES['attach']['error'] as $key => $error) {
151 | if ($error == UPLOAD_ERR_OK) {
152 | $name = basename($_FILES['attach']['name'][$key]);
153 | $size = $_FILES['attach']['size'][$key];
154 | $tmpPath = $_FILES['attach']['tmp_name'][$key];
155 |
156 | // Определяем MIME-тип файла через finfo
157 | $finfo = finfo_open(FILEINFO_MIME_TYPE);
158 | $mtype = finfo_file($finfo, $tmpPath);
159 | finfo_close($finfo);
160 |
161 | if (!in_array($mtype, ALLOWED_MIME_TYPES, true)) {
162 | $data['result'] = 'error';
163 | $data['errors']['attach'][$key] = 'Файл имеет не разрешённый тип.';
164 | itc_log('Прикреплённый файл ' . $name . ' имеет не разрешённый тип (' . $mtype . ').');
165 | } else if ($size > MAX_FILE_SIZE) {
166 | $data['result'] = 'error';
167 | $data['errors']['attach'][$key] = 'Размер файла превышает допустимый.';
168 | itc_log('Размер файла ' . $name . ' превышает допустимый.');
169 | }
170 | }
171 | }
172 | if ($data['result'] === 'success') {
173 | // перемещаем файлы в папку UPLOAD_PATH
174 | foreach ($_FILES['attach']['name'] as $key => $attach) {
175 | $ext = mb_strtolower(pathinfo($_FILES['attach']['name'][$key], PATHINFO_EXTENSION));
176 | $name = basename($_FILES['attach']['name'][$key], $ext);
177 | $tmp = $_FILES['attach']['tmp_name'][$key];
178 | $newName = rtrim($name, '.') . '_' . uniqid() . '.' . $ext;
179 |
180 | if (!move_uploaded_file($tmp, UPLOAD_PATH . $newName)) {
181 | $data['result'] = 'error';
182 | $data['errors']['attach'][$key] = 'Ошибка при загрузке файла.';
183 | itc_log('Ошибка при перемещении файла ' . $name . '.');
184 | } else {
185 | $attachs[] = UPLOAD_PATH . $newName;
186 | }
187 | }
188 | }
189 | }
190 |
191 | use PHPMailer\PHPMailer\PHPMailer;
192 | use PHPMailer\PHPMailer\SMTP;
193 | use PHPMailer\PHPMailer\Exception;
194 |
195 | require 'vendor/phpmailer/phpmailer/src/Exception.php';
196 | require 'vendor/phpmailer/phpmailer/src/PHPMailer.php';
197 | require 'vendor/phpmailer/phpmailer/src/SMTP.php';
198 |
199 | if ($data['result'] == 'success' && HAS_SEND_EMAIL == true) {
200 | // получаем содержимое email шаблона и заменяем в нём
201 | $template = file_get_contents(dirname(__FILE__) . '/template/email.tpl');
202 | $search = ['%subject%', '%name%', '%email%', '%message%', '%date%'];
203 | $replace = [EMAIL_SETTINGS['subject'], $data['form']['name'], $data['form']['email'], $data['form']['message'], date('d.m.Y H:i')];
204 | $body = str_replace($search, $replace, $template);
205 | // добавление файлов в виде ссылок
206 | if (HAS_ATTACH_IN_BODY && count($attachs)) {
207 | $ul = 'Файлы, прикреплённые к форме:Форма обратной связи
14 | 15 |
16 |
17 |
92 |
93 |
94 |
101 |
102 |
95 |
99 |
100 |
103 |
104 |
179 |
180 |
181 |
188 |
189 |
190 |
182 |
186 |
187 | - ';
208 | foreach ($attachs as $attach) {
209 | $href = str_replace($_SERVER['DOCUMENT_ROOT'], '', $attach);
210 | $name = basename($href);
211 | $ul .= '
- ' . $name . ' '; 212 | 213 | $data['href'][] = BASE_URL . $href; 214 | } 215 | $ul .= '
48 | ${itemImg}
49 |
`;
53 | }
54 |
55 | // получение новой капчи
56 | _reloadСaptcha() {
57 | var captchaImg = this._elForm.querySelector('.form-captcha__image');
58 | var captchaSrc = captchaImg.getAttribute('data-src');
59 | var captchaPrefix = captchaSrc.indexOf('?id') !== -1 ? '&rnd=' : '?rnd=';
60 | var captchaNewSrc = captchaSrc + captchaPrefix + new Date().getTime();
61 | captchaImg.setAttribute('src', captchaNewSrc);
62 | }
63 |
64 | // установка статуса валидации
65 | _setStateValidaion(input, state, message) {
66 | const className = state === 'success' ? 'is-valid' : 'is-invalid';
67 | const text = state === 'success' ? '' : message;
68 | if (input.classList.contains('form-attach__item')) {
69 | input.setAttribute('title', text);
70 | input.classList.add(className);
71 | return;
72 | }
73 | input.classList.remove('is-valid');
74 | input.classList.remove('is-invalid');
75 | input.closest('.form-group').querySelector('.invalid-feedback').textContent = '';
76 | if (state === 'error' || state === 'success') {
77 | input.classList.add(className);
78 | input.closest('.form-group').querySelector('.invalid-feedback').textContent = text;
79 | }
80 | }
81 |
82 | // валидация формы
83 | _checkValidity() {
84 | let valid = true;
85 | // input, textarea
86 | this._elForm.querySelectorAll('input, textarea').forEach(el => {
87 | if (el.type === 'file') {
88 | return;
89 | }
90 | if (el.checkValidity()) {
91 | this._setStateValidaion(el, 'success');
92 | } else {
93 | this._setStateValidaion(el, 'error', el.validationMessage);
94 | valid = false;
95 | }
96 | })
97 | // attach
98 | const elAttach = this._elForm.querySelector('.form-attach');
99 | if (elAttach) {
100 | elAttach.classList.remove('is-invalid');
101 | elAttach.querySelector('.invalid-feedback').textContent = '';
102 | const isRequired = elAttach.querySelector('[type="file"]').required;
103 | if (isRequired && this._attach.items.length === 0) {
104 | elAttach.classList.add('is-invalid');
105 | elAttach.querySelector('.invalid-feedback').textContent = 'Заполните это поле.';
106 | }
107 | }
108 | this._attach.items.forEach((item) => {
109 | const elAttach = this._elForm.querySelector('.form-attach__item[data-index="' + item.index + '"]');
110 | if (item.file.size > this._attach.maxFileSize * 1024) {
111 | this._setStateValidaion(elAttach, 'error', `Размер файла больше ${this._attach.maxFileSize}Кб`);
112 | valid = false;
113 | } else if (!this.constructor._checkExt(item.file.name, this._attach.ext)) {
114 | this._setStateValidaion(elAttach, 'error', 'Тип не является допустимым');
115 | valid = false;
116 | } else {
117 | this._setStateValidaion(elAttach, 'success', '');
118 | }
119 | })
120 | return valid;
121 | }
122 |
123 | // собираем данные для отправки на сервер
124 | _getFormData() {
125 | const formData = new FormData(this._elForm);
126 | formData.delete('attach[]');
127 | this._attach.items.forEach(item => {
128 | formData.append('attach[]', item.file);
129 | });
130 | return formData;
131 | };
132 |
133 | // при получении успешного ответа от сервера
134 | _successXHR(data) {
135 | const elAttach = this._elForm.querySelector('.form-attach');
136 | if (elAttach) {
137 | elAttach.classList.remove('is-invalid');
138 | elAttach.querySelector('.invalid-feedback').textContent = '';
139 | }
140 | this._elForm.querySelectorAll('input, textarea').forEach(el => {
141 | this._setStateValidaion(el);
142 | });
143 |
144 | // при успешной отправки формы
145 | if (data['result'] === 'success') {
146 | this._elForm.dispatchEvent(new Event('itc.successSendForm', {bubbles: true}));
147 | return;
148 | }
149 |
150 | this._elForm.querySelector('.form-error').classList.add('form-error_hide');
151 | // this._elForm.querySelector('.form-error').classList.remove('form-error_hidden');
152 |
153 | if (!Object.keys(data['errors']).length) {
154 | this._elForm.querySelector('.form-error').textContent = 'При отправке сообщения произошла ошибка. Пожалуйста, попробуйте ещё раз позже.';
155 | } else {
156 | this._elForm.querySelector('.form-error').textContent = 'В форме содержатся ошибки!';
157 | }
158 |
159 | this._elForm.querySelector('.form-error').classList.remove('form-error_hide');
160 |
161 | // выводим ошибки
162 | for (let key in data['errors']) {
163 | if (key === 'attach') {
164 | const attachs = data['errors'][key];
165 | if (typeof attachs === 'string') {
166 | if (elAttach.querySelector('[type="file"]').required) {
167 | elAttach.classList.add('is-invalid');
168 | elAttach.querySelector('.invalid-feedback').textContent = attachs;
169 | }
170 | } else {
171 | for (let attach in attachs) {
172 | const index = this._attach.items[attach].index;
173 | const elAttach = this._elForm.querySelector('.form-attach__item[data-index="' + index + '"]');
174 | this._setStateValidaion(elAttach, 'error', attachs[attach]);
175 | }
176 | }
177 | } else {
178 | key === 'captcha' ? this._reloadСaptcha() : null;
179 | const el = this._elForm.querySelector('[name="' + key + '"]');
180 | el ? this._setStateValidaion(el, 'error', data['errors'][key]) : null;
181 | }
182 | }
183 | // к полям, отвечающим требованиям, добавляем класс is-valid
184 | this._elForm.querySelectorAll('.form-attach__item:not(.is-invalid), input:not(.is-invalid), textarea:not(.is-invalid)').forEach(el => {
185 | this._setStateValidaion(el, 'success', '');
186 | })
187 |
188 | data['logs'].forEach((message) => {
189 | console.log(message);
190 | });
191 |
192 | // устанавливаем фокус на не валидный элемент
193 | const elInvalid = this._elForm.querySelector('.is-invalid');
194 | if (elInvalid) {
195 | if (elInvalid.classList.contains('form-attach')) {
196 | elInvalid.querySelector('input[type="file"]').focus();
197 | } else {
198 | elInvalid.focus();
199 | }
200 | }
201 | }
202 |
203 | _errorXHR() {
204 | this._elForm.querySelector('.form-error').classList.remove('d-none');
205 | }
206 |
207 | // отправка формы
208 | _onSubmit() {
209 | this._elForm.dispatchEvent(new Event('before-send'));
210 | if (this._isCheckValidationOnClient) {
211 | if (!this._checkValidity()) {
212 | const elInvalid = this._elForm.querySelector('.is-invalid');
213 | if (elInvalid) {
214 | if (elInvalid.classList.contains('form-attach')) {
215 | elInvalid.querySelector('input[type="file"]').focus();
216 | } else {
217 | elInvalid.focus();
218 | }
219 | }
220 | return;
221 | }
222 | }
223 |
224 | const submitWidth = this._elForm.querySelector('[type="submit"]').getBoundingClientRect().width;
225 | const submitHeight = this._elForm.querySelector('[type="submit"]').getBoundingClientRect().height;
226 | this._elForm.querySelector('[type="submit"]').textContent = '';
227 | this._elForm.querySelector('[type="submit"]').disabled = true;
228 | this._elForm.querySelector('[type="submit"]').style.width = `${submitWidth}px`;
229 | this._elForm.querySelector('[type="submit"]').style.height = `${submitHeight}px`;
230 |
231 | this._elForm.querySelector('.form-error').classList.add('form-error_hide');
232 |
233 | var xhr = new XMLHttpRequest();
234 | xhr.open('POST', this._elForm.action);
235 | xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
236 | xhr.responseType = 'json';
237 | xhr.onload = () => {
238 | this._elForm.querySelector('[type="submit"]').textContent = this._submitText;
239 | this._elForm.querySelector('[type="submit"]').disabled = false;
240 | this._elForm.querySelector('[type="submit"]').style.width = '';
241 | this._elForm.querySelector('[type="submit"]').style.height = '';
242 | if (xhr.status == 200) {
243 | this._successXHR(xhr.response);
244 | } else {
245 | this._errorXHR();
246 | }
247 | }
248 | xhr.send(this._getFormData());
249 | };
250 |
251 | // функция для инициализации
252 | _init() {
253 | const elFormAttachCount = this._elForm.querySelector('.form-attach__count');
254 | elFormAttachCount ? elFormAttachCount.textContent = this._attach.maxItems : null;
255 | this._submitText = this._elForm.querySelector('[type="submit"]').textContent;
256 | this._addEventListener();
257 | }
258 |
259 | // добавляем обработчики для событий
260 | _addEventListener() {
261 | // обработка события submit
262 | this._elForm.addEventListener('submit', (e) => {
263 | e.preventDefault();
264 | this._onSubmit();
265 | });
266 | // обработка события click
267 | this._elForm.addEventListener('click', (e) => {
268 | const target = e.target;
269 | if (target.closest('.form-captcha__refresh')) {
270 | e.preventDefault();
271 | this._reloadСaptcha();
272 | } else if (target.closest('.form-attach__link')) {
273 | const el = target.closest('.form-attach__item');
274 | const index = +el.dataset.index;
275 | this._attach.items.forEach((item, i) => {
276 | if (item['index'] === index) {
277 | this._attach.items.splice(i, 1);
278 | el.remove();
279 | return;
280 | }
281 | });
282 | }
283 | })
284 | // обработка события change
285 | this._elForm.addEventListener('change', (e) => {
286 | const target = e.target;
287 | if (target.name !== 'attach[]') {
288 | return;
289 | }
290 | for (let i = 0, length = target.files.length; i < length; i++) {
291 | if (this._attach.items.length >= this._attach.maxItems) {
292 | target.value = '';
293 | break;
294 | }
295 | const index = this._attach.index++;
296 | const file = target.files[i];
297 | this._attach.items.push({
298 | index,
299 | file
300 | });
301 | if (file.type.match(/image.*/)) {
302 | const reader = new FileReader();
303 | reader.readAsDataURL(file);
304 | reader.addEventListener('load', (e) => {
305 | this._elForm.querySelector('.form-attach__items').innerHTML += this.constructor._getAttachTemplate(index, file, e.target);
306 | });
307 | } else {
308 | this._elForm.querySelector('.form-attach__items').innerHTML += this.constructor._getAttachTemplate(index, file);
309 | }
310 | }
311 | target.value = '';
312 | });
313 | }
314 | // сброс формы
315 | reset() {
316 | if (this._elForm.querySelector('.form-error')) {
317 | this._elForm.querySelector('.form-error').classList.add('form-error_hide');
318 | }
319 | this._elForm.reset();
320 | this._elForm.querySelectorAll('input, textarea').forEach(el => {
321 | this._setStateValidaion(el);
322 | });
323 | document.querySelector('[name="captcha"]') ? this._reloadСaptcha() : null;
324 | if (this._elForm.querySelector('.form-attach')) {
325 | this._attach['index'] = 0;
326 | this._attach['items'] = [];
327 | this._elForm.querySelector('.form-attach__items').textContent = '';
328 | if (this._elForm.querySelector('.is-invalid')) {
329 | this._elForm.querySelector('.is-invalid').classList.remove('is-invalid');
330 | }
331 | }
332 | }
333 | }
334 |
--------------------------------------------------------------------------------
/feedback/vendor/phpmailer/phpmailer/src/POP3.php:
--------------------------------------------------------------------------------
1 |
10 | * @author Jim Jagielski (jimjag) ${file.name}
50 | ${(file.size / 1024).toFixed(1)}Кб
51 | ×
52 | ';
430 | foreach ($this->errors as $e) {
431 | print_r($e);
432 | }
433 | echo '';
434 | }
435 | }
436 |
437 | /**
438 | * Get an array of error messages, if any.
439 | *
440 | * @return array
441 | */
442 | public function getErrors()
443 | {
444 | return $this->errors;
445 | }
446 |
447 | /**
448 | * POP3 connection error handler.
449 | *
450 | * @param int $errno
451 | * @param string $errstr
452 | * @param string $errfile
453 | * @param int $errline
454 | */
455 | protected function catchWarning($errno, $errstr, $errfile, $errline)
456 | {
457 | $this->setError(
458 | 'Connecting to the POP3 server raised a PHP warning:' .
459 | "errno: $errno errstr: $errstr; errfile: $errfile; errline: $errline"
460 | );
461 | }
462 | }
463 |
--------------------------------------------------------------------------------