PDA

View Full Version : Please can you see if you can spot my error


DougieMcN
10-07-2008, 09:29 PM
Hi, I am trying to get a simple form with two fields to work on my site but the info is not being mailed back to me.

I have check permissions once the FormMail.pl is uploaded and double checked website and email address but am no further forward.

Please can anyone help.

HTML CODE


<form class="webform" action="http://www.mywebsite.co.uk/cgi-bin/formmail/FormMail.pl" method="post">
<input type="hidden" name="recipient" value="info@mywebsite.co.uk" />
<input type="hidden" name="subject" value="***Information Request***" />
<input type="hidden" name="redirect" value="http://www.mywebsite.co.uk/index.html" />
<label>Name please:</label>
<br />
<input name="name" class="formname" type="text" size="31" maxlength="50" />
<div id="spacer">&nbsp;</div>
<label>Telephone number please:</label><br />
<input name="telnumber" class="formnumber" type="text" size="31" maxlength="50" />
<div id="spacer">&nbsp;</div>
<input name="enter" type="button" value="enter" />
</form>



PERL SCRIPT

#!/usr/bin/perl
##############################################################################
# FormMail Version 1.92 #
# Copyright 1995-2002 Matt Wright mattw@scriptarchive.com #
# Created 06/09/95 Last Modified 04/21/02 #
# Matt's Script Archive, Inc.: http://www.scriptarchive.com/ #
##############################################################################
# COPYRIGHT NOTICE #
# Copyright 1995-2002 Matthew M. Wright All Rights Reserved. #
# #
# FormMail may be used and modified free of charge by anyone so long as this #
# copyright notice and the comments above remain intact. By using this #
# code you agree to indemnify Matthew M. Wright from any liability that #
# might arise from its use. #
# #
# Selling the code for this program without prior written consent is #
# expressly forbidden. In other words, please ask first before you try and #
# make money off of my program. #
# #
# Obtain permission before redistributing this software over the Internet or #
# in any other medium. In all cases copyright and header must remain intact. #
##############################################################################
# ACCESS CONTROL FIX: Peter D. Thompson Yezek #
# http://www.securityfocus.com/archive/1/62033 #
##############################################################################
# Define Variables #
# Detailed Information Found In README File. #

# $mailprog defines the location of your sendmail program on your unix #
# system. The flags -i and -t should be passed to sendmail in order to #
# have it ignore single dots on a line and to read message for recipients #

$mailprog = '/usr/lib/sendmail -i -t';

# @referers allows forms to be located only on servers which are defined #
# in this field. This security fix from the last version which allowed #
# anyone on any server to use your FormMail script on their web site. #

@referers = ('mywebsite.co.uk','www.mywebsite.co.uk');

# @recipients defines the e-mail addresses or domain names that e-mail can #
# be sent to. This must be filled in correctly to prevent SPAM and allow #
# valid addresses to receive e-mail. Read the documentation to find out how #
# this variable works!!! It is EXTREMELY IMPORTANT. #
@recipients = &fill_recipients('mywebsite.co.uk');

# ACCESS CONTROL FIX: Peter D. Thompson Yezek #
# @valid_ENV allows the sysadmin to define what environment variables can #
# be reported via the env_report directive. This was implemented to fix #
# the problem reported at http://www.securityfocus.com/bid/1187 #

@valid_ENV = ('REMOTE_HOST','REMOTE_ADDR','REMOTE_USER','HTTP_USER_AGENT');

# Done #

FishMonger
10-07-2008, 11:12 PM
Matt's script is very poorly written and insecure. You should start by getting the well written drop-in replacement formmail script from the nms project.

http://nms-cgi.sourceforge.net/scripts.shtml