From eb6e49698965c23d12d094759538fb4aa833db6a Mon Sep 17 00:00:00 2001
From: eclipse <eclipse@unterdemradar.de>
Date: Sun, 23 Mar 2025 15:03:58 +0100
Subject: [PATCH] added some more tests to block bots calling the script
 directly

---
 content/misc/contact.php | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/content/misc/contact.php b/content/misc/contact.php
index 3ee60ed..c7e1751 100644
--- a/content/misc/contact.php
+++ b/content/misc/contact.php
@@ -1,6 +1,19 @@
 <?php
 // inspired by: https://www.unixdude.net/posts/2017/Nov/29/pelican-contact-form/
 
+// make sure method is POST
+if ( $_SERVER['REQUEST_METHOD'] != 'POST' ) {
+  header('Location: /');
+  exit;
+}
+
+// make sure all required fields are set
+// HTML already validates this, but bots sometimes call the script directly 
+if ( $_POST['name'] == '' or $_POST['email'] == '' or $_POST['nachricht'] == '') {
+  header('Location: /');
+  exit;
+}
+
 // The 'address' form field is in the code but doesn't get rendered on the page. The message will only get sent if the field is empty, thus weeding out bots that will just fill out any form field 
 if ( $_POST['address'] != '' ) {
   header('Location: /');