- Kontaktformular: keine Mail mehr an die eingegebene Adresse (wurde als Spam-Versender missbraucht); Anfrage nur an Kontakt-Adresse + Berater (BCC), Reply-To = Absender; Eingaben in der Mail escaped - Kontakt + Registrierung: Cloudflare Turnstile statt reCAPTCHA (Schluessel aus dem Code in die .env), Rate-Limits, Honeypot + Mindest-Ausfuellzeit, Namensregel (lateinische Schrift, max. 50 Zeichen), Form Requests - Registrierung: Partner-Nummer nur fuer aktive Berater (vorher ungeprueft) - CRM: POST /register abgeschaltet (legte ohne Captcha Benutzer an) - Passwort-Mindestlaenge systemweit 8 Zeichen ueber Password::defaults() - Log abgefangener Anfragen: storage/logs/form-spam-*.log - Doku und Protokoll: dev/2026-10-09-spam/README.md Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
66 lines
2.2 KiB
PHP
66 lines
2.2 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers\Web;
|
|
|
|
use App\Http\Controllers\Controller;
|
|
use App\Http\Requests\Contact\ContactStoreRequest;
|
|
use App\Mail\MailContact;
|
|
use App\Services\FormSpamGuard;
|
|
use App\Services\Shop;
|
|
use App\Services\Util;
|
|
use Illuminate\Contracts\View\View;
|
|
use Illuminate\Support\Facades\Mail;
|
|
|
|
class ContactController extends Controller
|
|
{
|
|
public function __construct(private FormSpamGuard $spamGuard) {}
|
|
|
|
public function create(): View
|
|
{
|
|
$data = [
|
|
'turnstile_site_key' => config('services.turnstile.site_key'),
|
|
'form_token' => old(FormSpamGuard::TIMESTAMP_FIELD, $this->spamGuard->makeFormToken()),
|
|
'user_shop' => Util::getUserShop(),
|
|
'mylangs' => Shop::getLangChange('webshop'),
|
|
'yard_instance' => 'webshop',
|
|
];
|
|
|
|
return view('web.templates.kontakt', $data);
|
|
}
|
|
|
|
/**
|
|
* Die Anfrage geht nur an mivita und ggf. den Berater des Shops, nie an die eingegebene Adresse.
|
|
*/
|
|
public function store(ContactStoreRequest $request): View
|
|
{
|
|
$blockReason = $this->spamGuard->blockReason($request);
|
|
|
|
if ($blockReason !== null) {
|
|
FormSpamGuard::log($request, 'contact', $blockReason);
|
|
} else {
|
|
$this->sendMail($request);
|
|
}
|
|
|
|
return view('web.templates.contact-final', [
|
|
'user_shop' => Util::getUserShop(),
|
|
'mylangs' => Shop::getLangChange('webshop'),
|
|
'yard_instance' => 'webshop',
|
|
]);
|
|
}
|
|
|
|
private function sendMail(ContactStoreRequest $request): void
|
|
{
|
|
$contact = $request->safe()->only(['salutation', 'first_name', 'last_name', 'email', 'phone', 'message']);
|
|
if ($request->asksForSalesPartnership()) {
|
|
$contact['sales_partnership'] = $request->input('sales_partnership');
|
|
$contact['sales_partnership_message'] = $request->input('sales_partnership_message');
|
|
}
|
|
|
|
$mail = Mail::to(config('app.contact_mail'));
|
|
if ($consultantEmail = Util::getUserShop()?->user?->email) {
|
|
$mail->bcc($consultantEmail);
|
|
}
|
|
|
|
$mail->locale(app()->getLocale())->send(new MailContact($contact));
|
|
}
|
|
}
|