FormKey validation in Custom Form for Contacts

Question

I have a custom form setup for my contacts module. I would like to implement a form key to prevent spam. Usually, the spammer directly uses the form post without having a session before. So form key seems to be a solution. But. I am having some problems implementing this.

This is my custom form in index.phtml where I have already added the hidden input "FormKey" before closing the form-tag:

            <form action="<?php echo $this->getFormAction(); ?>" id="contactForm" method="post">
            <div class="fieldset">
                <h2 class="legend"><?php echo Mage::helper('contacts')->__('Contact Information') ?></h2>
                <ul class="form-list">
                    <li class="fields">
                        <div class="field">
                            <label for="name" class="required"><em>*</em><?php echo Mage::helper('contacts')->__('Name') ?></label>
                            <div class="input-box">
                                <input name="name" id="name" title="<?php echo Mage::helper('core')->quoteEscape(Mage::helper('contacts')->__('Name')) ?>" value="<?php echo $this->escapeHtml($this->helper('contacts')->getUserName()) ?>" class="input-text required-entry" type="text" />
                            </div>
                        </div>
                        <div class="field">
                            <label for="email" class="required"><em>*</em><?php echo Mage::helper('contacts')->__('Email') ?></label>
                            <div class="input-box">
                                <input name="email" id="email" title="<?php echo Mage::helper('core')->quoteEscape(Mage::helper('contacts')->__('Email')) ?>" value="<?php echo $this->escapeHtml($this->helper('contacts')->getUserEmail()) ?>" class="input-text required-entry validate-email" type="text" />
                            </div>
                        </div>
                    </li>
                    <li>
                        <label for="telephone"><?php echo Mage::helper('contacts')->__('Telephone') ?></label>
                        <div class="input-box">
                            <input name="telephone" id="telephone" title="<?php echo Mage::helper('core')->quoteEscape(Mage::helper('contacts')->__('Telephone')) ?>" value="" class="input-text" type="text" />

                        </div>
                    </li>
                    <li class="wide">
                        <label for="comment" class="required"><em>*</em><?php echo Mage::helper('contacts')->__('Comment') ?></label>

                        <div class="input-box">
                            <textarea name="comment" id="comment" title="<?php echo Mage::helper('core')->quoteEscape(Mage::helper('contacts')->__('Comment')) ?>" class="required-entry input-text" cols="5" rows="3"></textarea>
                        </div>
                    </li>
                </ul>
            </div>
            <?php echo $this->getLayout()->createBlock('cms/block')->setBlockId('dsgvo')->toHtml(); ?> 
            <div>
                <input type="text" name="hideit" id="hideit" value="" style="display:none !important;" />
                <button type="submit" title="<?php echo Mage::helper('core')->quoteEscape(Mage::helper('contacts')->__('Submit')) ?>" class="button"><span><span><?php echo Mage::helper('contacts')->__('Submit') ?></span></span></button>
            </div>
            <input name="form_key" type="hidden" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" />
        </form>

This is my Controller in IndexController.php

 <?php
require_once "Mage/Contacts/controllers/IndexController.php";  

class Centerfy_Contacts_IndexController extends Mage_Contacts_IndexController{
    const XML_PATH_EMAIL_RECIPIENT  = 'contacts/email/recipient_email';
    const XML_PATH_EMAIL_SENDER     = 'contacts/email/sender_email_identity';
    const XML_PATH_EMAIL_TEMPLATE   = 'contacts/email/email_template';
    const XML_PATH_ENABLED          = 'contacts/contacts/enabled';

    public function preDispatch()
    {
        parent::preDispatch();

        if( !Mage::getStoreConfigFlag(self::XML_PATH_ENABLED) ) {
            $this->norouteAction();
        }
    }

    public function indexAction()
    {
        $this->loadLayout();
        $this->getLayout()->getBlock('contactForm')
        ->setFormAction( Mage::getUrl('*/*/post', array('_secure' => $this->getRequest()->isSecure())) );

        $this->_initLayoutMessages('customer/session');
        $this->_initLayoutMessages('catalog/session');
        $this->renderLayout();
    }

    public function postAction()
    {
        $post = $this->getRequest()->getPost();
        if ( $post ) {
            $translate = Mage::getSingleton('core/translate');
            /* @var $translate Mage_Core_Model_Translate */
            $translate->setTranslateInline(false);
            try {
                $postObject = new Varien_Object();
                $postObject->setData($post);

                $error = false;

                if (!Zend_Validate::is(trim($post['name']) , 'NotEmpty')) {
                    $error = true;
                }

                if (!Zend_Validate::is(trim($post['comment']) , 'NotEmpty')) {
                    $error = true;
                }

                if (!Zend_Validate::is(trim($post['email']), 'EmailAddress')) {
                    $error = true;
                }

                if (Zend_Validate::is(trim($post['hideit']), 'NotEmpty')) {
                    $error = true;
                }
                    <?php echo $this->getBlockHtml('formkey')?>             


                if ($error) {
                    throw new Exception();
                }
                $mailTemplate = Mage::getModel('core/email_template');
                /* @var $mailTemplate Mage_Core_Model_Email_Template */
                $mailTemplate->setDesignConfig(array('area' => 'frontend'))
                ->setReplyTo($post['email'])
                ->setTemplateSubject(Mage::helper('contacts')->__('Contact Form'))
                ->sendTransactional(
                        Mage::getStoreConfig(self::XML_PATH_EMAIL_TEMPLATE),
                        Mage::getStoreConfig(self::XML_PATH_EMAIL_SENDER),
                        Mage::getStoreConfig(self::XML_PATH_EMAIL_RECIPIENT),
                        null,
                        array('data' => $postObject)
                );

                if (!$mailTemplate->getSentSuccess()) {
                    throw new Exception();
                }

                $translate->setTranslateInline(true);

                Mage::getSingleton('core/session')->addSuccess(Mage::helper('contacts')->__('Your inquiry was submitted and will be responded to as soon as possible. Thank you for contacting us.'));
                $this->_redirect('*/*/');

                return;
            } catch (Exception $e) {
                $translate->setTranslateInline(true);

                Mage::getSingleton('core/session')->addError(Mage::helper('contacts')->__('Unable to submit your request. Please, try again later'));
                $this->_redirect('*/*/');
                return;
            }

        } else {
            $this->_redirect('*/*/');
        }
    }

}

How do I setup my controller to check the formkey against the session?

Answer 1

You can Pass encrypted string in your .phtml file like this

<input name="form_key_hidden" type="hidden" value="<?php echo Mage::getSingleton('core/session')->getFormKey().'259a8240fba23e82626efdc9eaa0c483';?>" />

Add condition in the start of code in postAction()

$customformKey = $this->getRequest()->getParam('form_key_hidden');
// $customformKey = $this->getRequest()->getPost('form_key');// try this if getParam() is null
if ($customformKey == Mage::getSingleton('core/session')->getFormKey().'259a8240fba23e82626efdc9eaa0c483') {
   // Your code
}

As an alternate Solution, You can add

1. Google CAPTCHA

2. Block the IP address

Answer 2

You have to add below code at postAction() method before running of rest of code f this method/function.

public function postAction()
{
        if (!$this->_validateFormKey()) {
            $this->_redirect('*/*/index');
            return;
        }
    //Rest of code of  postAction()

}