#!/usr/local/bin/perl ## Mail Form Handler (mail_form.pl) Copyright 1998-2003 ## by Tim Stevenson, tstevens at employees.org ## Generic HTML form-processing CGI script ## Version 4.1 -- Modified September 2003 ## Version 4.0 -- Modified August 2003 ## Version 3.2 -- Modified April 2002 ## Version 3.1 -- Modified July 2000 ## Version 3.0 -- Modified July 1999 ## Version 2.0 -- Modified January 1998 ## Version 1.0 -- Modified March 1997 ## ReadParse subroutine by Steven E. Brenner $version = "4.1"; ####################################################################### ## HTTP Referer Control Block: ## ## Here is the "HTTP Referer" control block, which consists of: ## - Ignore Flag: if set to 1, the allowed list is ignored; otherwise, ## we compare $ENV(HTTP_REFERER) to the HTTP Allowed List ## - Allowed List: if Ignore Flag is not 1, then a regexp comparison is ## performed against this list ## Modify this block only if you want to limit the use of the script to ## certain referring domains. ## ## **Ignore Flag** ## The next line sets the Ignore Flag. Set to 0 to enable HTTP Referer ## Allowed List checking, set to 1 to disable checking: $ignoreHttpAllowedList = 1; ## **Allowed List** ## The next line defines the HTTP Referer Allowed List (a quoted, comma- ## separated list) containing the list of domains, IP addresses, and/or ## URLs you want to be able to submit forms to the script. Be sure to ## include all possible representations of the domain name (perhaps ## "example.com" as well as "www.example.com"): @httpAllowedList = ("www.example.com", "http://example.com", "10.99.113.4"); ## end of HTTP Referer control block ####################################################################### # Define the "special" form fields &specialFields; # Get misc script & server info &getScriptandServerInfo; # Set the defaults &setDefaults; # Print the HTTP header &httpHeader; # Gather the form input &ReadParse; # Make sure they use "POST" &checkForPOST; # Check for input &checkForInput; # Print the help file if need be if ( $errorState == 1 ) { &printHelpFile; } # Check whether we can find the sendmail executable $sendmail_found = &locateSendmail; # Abort if we cannot find sendmail if ($sendmail_found != "1") { &noSendmailError; } # Check the HTTP_REFERER $referer_allowed = &checkHttpReferer; # Abort if referer is not in allowed list if ($referer_allowed != "1") { &httpRefererError; } # Check which fields are flagged as required &idRequiredFields; # Replace defaults based on form input &replaceDefaults; # Make sure required fields are populated &checkRequiredFields; # Check for title centered requirement &isTitleCentered; # If some required fields aren't filled in, complain if ($errormsg ne "") { &requiredFieldsMissingError; } # ...Otherwise, generate the final output... else { &generateFinalOutput; } # ...and then exit gracefully exit (0); ########################################################################################### # Subroutines follow sub specialFields { # Supported "special" form fields and their "required" versions are contained # in the array \@specials (except the special case for "Full Name", which sometimes # should be displayed) @special_fields = ("Recipient Address", "Cc Address", "Auto Cc", "Email Subject Line", "Email HTML", "Background Color", "Link Color", "ActiveLink Color", "VisitedLink Color", "Text Color", "Toggle Graphics", "Required Graphic", "Graphic", "Magic Word", "Response Page Title", "Greeting", "Return URL", "Return Link Text", "Show Blanks", "Show Results", "Debug Flag"); foreach (@special_fields) { push (@specials, $_); $_ =~ s/$/*/; push (@specials, $_); } } sub getScriptandServerInfo { # Get info about the script and server $script_filename = $script_path = $ENV{SCRIPT_NAME}; $script_filename =~ s#.*/([^/]+)$#\1#; $script_path =~ s#^//#/#; $server = $ENV{SERVER_NAME}; $server =~ s#/##g; $referer = $ENV{HTTP_REFERER}; } sub setDefaults { # Set default values for all the variables $ADDRESS = $DEF_ADDRESS = "nobody\@example.com"; $EMAIL_ADDRESS = $DEF_EMAIL_ADDRESS = $RETURN_ADDRESS = "nobody"; $COPY_ADDRESS = $DEF_COPY_ADDRESS = ""; $AUTO_COPY = $DEF_AUTO_COPY = "No"; $FULL_NAME = $DEF_FULL_NAME = "exclude;Mail Form Handler"; $SUBJECT = $DEF_SUBJECT = "Form Submission"; $EMAIL_HTML = $DEF_EMAIL_HTML = "No"; $BKGD_COLOR = $DEF_BKGD_COLOR = "white"; $LINK_COLOR = $DEF_LINK_COLOR = ""; #unspecified $ALINK_COLOR = $DEF_ALINK_COLOR = ""; #unspecified $VLINK_COLOR = $DEF_VLINK_COLOR = ""; #unspecified $TEXT_COLOR = $DEF_TEXT_COLOR = "black"; $REQUIRED_URL = $DEF_REQUIRED_URL = "http://www.example.com/imglib/some.gif"; $TOGGLE_GRAPHICS = $DEF_TOGGLE_GRAPHICS = "On"; $GRAPHIC_URL = $DEF_GRAPHIC_URL = "http://www.example.com/imglib/some_other.gif"; $MAGIC = $DEF_MAGIC = ""; $TITLE = $DEF_TITLE = "Mail Form Handler Response"; $GREETING = $DEF_GREETING = "Thank you for your form submission."; $RETURN_URL = $DEF_RETURN_URL = ""; $RETURN_LINK_TEXT = $DEF_RETURN_LINK_TEXT = ""; $SHOW_BLANKS = $DEF_SHOW_BLANKS = "No"; $SHOW_RESULTS = $DEF_SHOW_RESULTS = "No"; $DEBUG_FLAG = $DEF_DEBUG_FLAG = "No"; $errorState = 0; } sub httpHeader { # Print the HTTP header print "Content-type: text/html", "\n\n"; } sub ReadParse { # ReadParse subroutine # Courtesy of Steven E. Brenner's cgi-lib.pl # If the code in this subroutine isn't working well with your server, # visit the cgi-lib.pl home page on the web to find a version that works better. local (*in) = @_ if @_; local ($i, $loc, $key, $val); # Read in text if ($ENV{'REQUEST_METHOD'} eq "GET") { $in = $ENV{'QUERY_STRING'}; } elsif ($ENV{'REQUEST_METHOD'} eq "POST") { read(STDIN,$in,$ENV{'CONTENT_LENGTH'}); } @in = split(/&/,$in); foreach $i (0 .. $#in) { # Convert plus's to spaces $in[$i] =~ s/\+/ /g; # Convert %XX from hex numbers to alphanumeric $in[$i] =~ s/%(..)/pack("c",hex($1))/ge; # Split into key and value. ($key, $val) = split(/=/,$in[$i],2); # splits on the first =. $in{$key} .= '\0' if (defined($in{$key})); # \0 is the multiple separator $in{$key} .= $val; } return 1;# just for fun } sub checkForPOST { # If they don't use "POST", return the help file if ($ENV{'REQUEST_METHOD'} eq "GET") { $errorState = 1; $TITLE = "Mail Form Handler Help"; } } sub checkForInput { # If there is no input to the script, return the help file if ($ENV{'CONTENT_LENGTH'} == 0) { $errorState = 1; $TITLE = "Mail Form Handler Help"; } } sub printHelpFile { # Look for the sendmail executable, then print the Help File &locateSendmail; &helpFile; exit (0); } sub idRequiredFields { # Check input names to see which fields are required, which are optional for ($x=0; $x<=$#in; $x++) { @form_input = split (/=/ , $in[$x] , 2); if ($form_input[0] =~ /\*$/) { push (@required_fields, $form_input[0]); } } } sub checkRequiredFields { # Make sure required fields have values assigned to them foreach $item (@required_fields) { $value = $item; chop ($item); if ($in{$value} eq "" || $in{$value} eq $MAGIC) { $TITLE = "Required Fields"; $errormsg .= "
The following field(s) have to be completed before this form can be processed.
Use your browser's Back button to return to the form and complete the field(s) as required. error_message &footerCode; print "