mivita/app/Http/Controllers/Web/ContactController.php
Kevin Adametz 4c944aa15d Spamschutz Kontakt + Registrierung: Turnstile, Rate-Limit, Honeypot; Passwort min. 8
- Kontaktformular: keine Mail mehr an die eingegebene Adresse (wurde als
  Spam-Versender missbraucht); Anfrage nur an Kontakt-Adresse + Berater (BCC),
  Reply-To = Absender; Eingaben in der Mail escaped
- Kontakt + Registrierung: Cloudflare Turnstile statt reCAPTCHA (Schluessel
  aus dem Code in die .env), Rate-Limits, Honeypot + Mindest-Ausfuellzeit,
  Namensregel (lateinische Schrift, max. 50 Zeichen), Form Requests
- Registrierung: Partner-Nummer nur fuer aktive Berater (vorher ungeprueft)
- CRM: POST /register abgeschaltet (legte ohne Captcha Benutzer an)
- Passwort-Mindestlaenge systemweit 8 Zeichen ueber Password::defaults()
- Log abgefangener Anfragen: storage/logs/form-spam-*.log
- Doku und Protokoll: dev/2026-10-09-spam/README.md

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-09 08:22:02 +00:00

66 lines
2.2 KiB
PHP

<?php
namespace App\Http\Controllers\Web;
use App\Http\Controllers\Controller;
use App\Http\Requests\Contact\ContactStoreRequest;
use App\Mail\MailContact;
use App\Services\FormSpamGuard;
use App\Services\Shop;
use App\Services\Util;
use Illuminate\Contracts\View\View;
use Illuminate\Support\Facades\Mail;
class ContactController extends Controller
{
public function __construct(private FormSpamGuard $spamGuard) {}
public function create(): View
{
$data = [
'turnstile_site_key' => config('services.turnstile.site_key'),
'form_token' => old(FormSpamGuard::TIMESTAMP_FIELD, $this->spamGuard->makeFormToken()),
'user_shop' => Util::getUserShop(),
'mylangs' => Shop::getLangChange('webshop'),
'yard_instance' => 'webshop',
];
return view('web.templates.kontakt', $data);
}
/**
* Die Anfrage geht nur an mivita und ggf. den Berater des Shops, nie an die eingegebene Adresse.
*/
public function store(ContactStoreRequest $request): View
{
$blockReason = $this->spamGuard->blockReason($request);
if ($blockReason !== null) {
FormSpamGuard::log($request, 'contact', $blockReason);
} else {
$this->sendMail($request);
}
return view('web.templates.contact-final', [
'user_shop' => Util::getUserShop(),
'mylangs' => Shop::getLangChange('webshop'),
'yard_instance' => 'webshop',
]);
}
private function sendMail(ContactStoreRequest $request): void
{
$contact = $request->safe()->only(['salutation', 'first_name', 'last_name', 'email', 'phone', 'message']);
if ($request->asksForSalesPartnership()) {
$contact['sales_partnership'] = $request->input('sales_partnership');
$contact['sales_partnership_message'] = $request->input('sales_partnership_message');
}
$mail = Mail::to(config('app.contact_mail'));
if ($consultantEmail = Util::getUserShop()?->user?->email) {
$mail->bcc($consultantEmail);
}
$mail->locale(app()->getLocale())->send(new MailContact($contact));
}
}