greggy/landingpage-haus-schleusingen
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Fix #42: CSRF-Schutz für Kontaktformular #50

Merged
greggy merged 1 commits from feature/issue-42-csrf-protection into main 2026-05-22 08:33:41 +02:00
Conversation 0 Commits 1 Files Changed 2 +14
2 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
app/controllers/HomeController.php
View File

@@ -41,7 +41,20 @@ class HomeController extends Controller
$formData = ['fname' => '', 'lname' => '', 'email' => '', 'phone' => '', 'interest' => 'Besichtigung anfragen', 'message' => '']; $formData = ['fname' => '', 'lname' => '', 'email' => '', 'phone' => '', 'interest' => 'Besichtigung anfragen', 'message' => ''];
} }
// CSRF-Token generieren (nach Session-Start)
if (empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
if ($_SERVER['REQUEST_METHOD'] === 'POST') { if ($_SERVER['REQUEST_METHOD'] === 'POST') {
// CSRF-Token validieren
$csrfToken = $_POST['csrf_token'] ?? '';
if (!hash_equals($_SESSION['csrf_token'] ?? '', $csrfToken)) {
header('Location: /#form-result');
$_SESSION['form_errors'] = ['Sicherheitsüberprüfung fehlgeschlagen. Bitte versuchen Sie es erneut.'];
exit;
}
$formData['fname'] = $normalizeContactValue((string) ($_POST['fname'] ?? '')); $formData['fname'] = $normalizeContactValue((string) ($_POST['fname'] ?? ''));
$formData['lname'] = $normalizeContactValue((string) ($_POST['lname'] ?? '')); $formData['lname'] = $normalizeContactValue((string) ($_POST['lname'] ?? ''));
$formData['email'] = $normalizeContactValue((string) ($_POST['email'] ?? '')); $formData['email'] = $normalizeContactValue((string) ($_POST['email'] ?? ''));

1
app/views/home/index.php
View File

@@ -434,6 +434,7 @@
</div> </div>
<?php endif; ?> <?php endif; ?>
<form id="contactForm" method="post"> <form id="contactForm" method="post">
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token'] ?? '') ?>" />
<div class="form-row"> <div class="form-row">
<div class="form-field"> <div class="form-field">
<label for="fname">Vorname</label> <label for="fname">Vorname</label>