Support

Admin Tools

#14301 general question about contact forms

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by nicholas on Friday, 07 December 2012 15:46 CST

user8011

Hi Nick.  I didn't fill in the stuff at the top, because this is a more general question -- about contact forms, and other input fields.  One of the biggest problems I've faced is that it seems like everytime you provide any kind of input field to the general public, some jerk comes along and uses it in some nefarious fashion -- the last time I had a public contact form on a site, someone used it to start sending out tons of spam with my email address on it!  As you might imagine, chaos ensued, which I didn't discover until the next time I tried to send out an email of my own --  of course it bounced, and all my sites were down, until I got the contact form off my site and my host off my back about it.

This sort of behavior is why I got Admin Tools in the first place, and why I deemed it a reasonable expense to subscribe to the Pro version.  What I'm wondering is, will Admin Tools protect me from this kind of thing?  Whether spamming me, or using my address to spam others, or any other kind of hijacking of input fields?  I'd really like to provide a contact form on a couple of my sites, but after what I've endured because of them, I'm terrified of what will happen if I put them out there, even though I do have Admin Tools pro on all my sites now.

Also -- on one of the sites I want to provide with a contact form, I'm looking at a couple different ones, hoping I can find one that will let me make the subject field a dropdown select box, but more importantly by far -- do you know of any that are particularly good or particularly bad, as regards security?  I really Really REALLY don't want anymore hijacking!

Thx much,

Andria

nicholas
Akeeba Staff
Manager

Hi Andria,

The answer is "it depends". If you use Admin Tools with its Project Honeypot integration it will block most such jerks. It can't block them all.

I would suggest using a contact component with a CAPTCHA. I don't have any favourites. At some point, when I decide to get off my ass, I will write a small one for my personal use*. Still, it's not 100% accurate. There are actually companies where you can hire human spammers or human CAPTCHA solvers for a low cost. They work in a similar fashion to Amazon's Mechanical Turk, albeit for nefarious purposes.

The best approach is to have a contact form which doesn't send emails back to the user's email address. This will confuse a very small minority of users but will prevent such idiots from abusing your contact page.

Oh, for what is worth, very old versions of Joomla! (IIRC, before 1.5.10) did have a bug which allowed abusing your site as a spam gateway. This is long fixed. I have a strong suspicion you were bitten by one of these issues in the past ;)

* Actually, I am following the very long road to do this. I am writing the second version of my FOF framework so that I can easily write such an ad-hoc contact component. My goal is to implement it with four XML files and a small snippet of PHP code. Yes, I know, it's like building a lathe from raw materials in order to create a doorknob, but I have a serious flair for overkill :D

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

user8011

Ok, I definitely use Honeypot; I discovered it years ago when I first started fighting this losing battle, and I was really glad to see the integration in ATP.

I definitely use reCaptcha on my site; had those keys for years now also.  The contact form I'm currently looking at is Fox Contact, which lets you define your own fields, and I found a post in their forum describing how to make a field into a dropdown select box, so this may be the one I end up using.  I note that it has its own captcha, so I don't know if my default reCaptcha will be used in this or not; I would guess not, so I should probably use theirs.

I kinda know what you mean about over-complicating; when I first wanted to find out about having a website, it seemed only logical to me to actually learn the language that creates websites, HTML and CSS, and ever since then, I simply cannot leave any kind of web thing in a "default" state, I have to customize it to suit my own aesthetic sensibility.  I've dabbled with php for quite a while now, never have really learned it, but I'm going to have to buckle down to it at some point.  The fact that it's interpretive instead of compiled, and also can be visualized immediately like HTML, could make it easier for me I guess.  Anyway, if/when you get it done, I'll be very interested; all your programs are truly excellent.  Make the subject line able to be a dropdown field!  :)

Thx!

Andria

nicholas
Akeeba Staff
Manager

Ok, I definitely use Honeypot; I discovered it years ago when I first started fighting this losing battle, and I was really glad to see the integration in ATP.

It was the first feature I implemented, for obvious reasons ;)

I definitely use reCaptcha on my site; had those keys for years now also.  The contact form I'm currently looking at is Fox Contact, which lets you define your own fields, and I found a post in their forum describing how to make a field into a dropdown select box, so this may be the one I end up using.  I note that it has its own captcha, so I don't know if my default reCaptcha will be used in this or not; I would guess not, so I should probably use theirs.

Just remember that CAPTCHAs deter, they don't prevent, spam.

I kinda know what you mean about over-complicating; when I first wanted to find out about having a website, it seemed only logical to me to actually learn the language that creates websites, HTML and CSS, and ever since then, I simply cannot leave any kind of web thing in a "default" state, I have to customize it to suit my own aesthetic sensibility.  I've dabbled with php for quite a while now, never have really learned it, but I'm going to have to buckle down to it at some point.  The fact that it's interpretive instead of compiled, and also can be visualized immediately like HTML, could make it easier for me I guess.  Anyway, if/when you get it done, I'll be very interested; all your programs are truly excellent.  Make the subject line able to be a dropdown field!  :)

My intention is to make it possible for people with little PHP skills to develop their own (basic) components in a standardised way. This will allow them to later bring in a more skilled developer and continue the component from they point they got it, without losing time. If I can do that, I will be perfectly satisfied with my life... for at least 5 minutes :D

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!